Obion County, TennesseeLocal Government

Finding Number 2025-001 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2024 and 2025 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2024-002 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the two prior audits, Tennessee State University continued to have inadequate procedures to ensure Title IV credits were refunded in accordance with federal guidelines, and in the current year, did not properly provide disbursement notifications BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. These Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, a student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of the total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. As a condition of these programs, institutions must provide notifications of the amounts awarded and loans disbursed. In addition, institutions are required to refund credits to the student’s account within 14 days of posting the award to the student’s account. CONDITION AND CAUSE In response to the prior finding, which noted compliance issues during the 2024 academic year, management, in collaboration with outside consultants, had begun to refine financial aid procedures, including reactivating the automatic refund process for spring 2025 with enhanced automatic notifications for all students receiving loan disbursements. Management also emphasized the need to fill the vacant Account Manager position in the Bursar’s office. However, refining these procedures did not adequately address compliance issues for the 2025 academic year. We tested a sample of 40 Title IV recipients at Tennessee State University (the university) to determine whether the university met disbursement requirements, and we identified errors in 40 (100%) of the Title IV recipients. These requirements included refunding any credits to student accounts created by Title IV aid within 14 days of the disbursement; sending a general notification to Title IV recipients that included the expected disbursement date, amount, and type of aid awarded; and notifying Direct Loan borrowers when their loans were disbursed. The university had disbursement errors with all 40 students selected for testing, resulting in a total of 72 disbursement errors. Figure 1 details the number of students with multiple errors identified. See Schedule of Findings and Questioned Costs for figure. Refund Timeliness Of the 40 students tested, 23 had a credit balance resulting from the disbursed Title IV aid. We noted that 3 of the 23 students (13%) had Title IV credits that were not refunded within 14 days of the disbursement date. These 3 separate refunds were not refunded timely, ranging from 19 to 84 days late. · For 1 student, the university did initially provide a timely refund; however, the refund was insufficient. The university applied the complete refund 84 days late. · For 2 students, the university applied Title IV aid retroactively to the fall 2024 term, creating a credit balance. The university refunded these balances 19 and 57 days late. Award and Direct Loan Disbursement Notifications We also tested our sample to determine whether 2 required notifications were sent to students. The first required letter notifies students of the amount and type of Title IV funds they are expected to receive, as well as how and when the disbursements will be made. This notification must be sent prior to the university making any disbursements. The university uses an automated system to notify students of the Title IV aid they have been awarded. The template used for the general award notifications does not specify when students can expect to receive their aid. Because the university did not include expected disbursement dates in the general award notifications sent to students, and every Title IV recipient in our sample received at least 1 general award notification, this error was recorded for all 40 students (100%). In addition, we identified other general award notification errors for 25 of the 40 students (63%) tested. · For 22 of the students tested, the university did not provide notification of their Title IV aid to be applied for the spring 2025 term. · For 2 of the students tested, the university did not provide notification of their Title IV aid to be applied for the fall 2024 term. · For 1 of the students tested, the university did not provide notification of their Title IV aid until after the disbursement date. The student was notified 3 times, representing 1, 2, and 8 days late. The second required letter is specific only to those students receiving Direct Loans or Teacher Education Assistance for College and Higher Education (TEACH) Grants. The letter notifies students of 1) the date and amount of the disbursement, 2) the student’s or parent’s right to cancel, and 3) the procedure and time by which the student or parent must notify the institution that they wish to cancel. We noted that 30 students in our sample received Direct Loans and should have received a disbursement notification. However, 4 of these 30 students (13%) did not receive a disbursement notification for their Direct PLUS Loans. Management did not send these notifications because the notification system was not programmed to trigger when a student only received Direct PLUS Loans. Management acknowledged that a change in administration delayed system access, resulting in the failure to correct the system and properly notify students of fall 2024 disbursements in a timely manner. CRITERIA The 2024–2025 Federal Student Aid Handbook, Volume 4, Chapter 2, states, If FSA [federal student aid] disbursements to a student’s account at the school create a Title IV credit balance, the school must pay the credit balance directly to the student or parent as soon as possible but no later than 14 days after: [emphasis in original] • the first day of class of a payment period if the credit balance occurred on or before that day, or • the balance occurred if that was after the first day of class. In addition, Volume 4, Chapter 2, of the handbook states, A school must notify a student of the amount of funds the student and their parent can expect to receive from each FSA program, including FWS [Federal Work Study], and how and when those funds will be disbursed. This notification must be sent before any disbursements are made. Finally, Volume 4, Chapter 2, of the handbook also states,: Except in the case of loan funds made as part of a post-withdrawal disbursement (see Volume 5 for notification requirements in such cases), when Direct Loan or TEACH funds are being credited to a student’s ledger account, the school must also notify the borrower in writing (paper or electronically) of the: • anticipated date and amount of the disbursement; • student’s or parent’s right to cancel all or a portion of a Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement and have the loan proceeds or TEACH Grant proceeds returned to the Department; and • procedures and deadlines by which the student or parent must notify the school that they wish to cancel the Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. EFFECT Timely refunding credits to students is essential to fulfilling the goals of Title IV programs. Students may depend on these refunds to pay for non-institutional charges, such as off-campus housing, transportation, or meals. Furthermore, if the university does not notify students of expected aid, this could impact decision-making for students and their families when determining whether to attend the university. Without these funds, students may not have the resources to pay for these potentially significant costs, which can be a barrier to a successful college career. In addition, failure to notify students of important deadlines and information regarding their Direct Loans or TEACH Grants could cause students to incur loans they wished to cancel, resulting in unwanted debt. Finally, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate the university’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. RECOMMENDATION Management should revise and adequately document procedures to ensure that students receive the required disbursement notifications and to ensure that credits on student accounts are refunded within 14 days of Title IV aid being disbursed. In addition, leadership should take necessary steps to provide adequate staffing and training to ensure compliance. Finally, management should establish additional review procedures to meet disbursement requirements. MANAGEMENT’S COMMENT We concur. The Refund Timeliness and Disbursement Notification Accountabilities are owned by the Bursar’s Office and the Financial Aid Office, respectively, and as such have required separate remediation. While we have made significant improvements, including updating process documents, increasing external staffing support, and internal training, the University’s “last dollar” scholarship approach creates more complexity that we continue to address. Post fiscal-end June 30, 2025, we have updated the text scripts to ensure all required information is included, as well as activated non-term specific automated notifications. These updates were put into place for the Fall 2025 semester and are expected to provide additional safeguards from these errors going forward. Additionally, our comprehensive corrective action is to rebuild our application of payment sequencing, including creating new detail codes with accurate parameters for all awards. This will allow our Banner system to properly automate refunds without the manual initiation and interventions currently required. We expect this project to be completed by the Fall 2026 semester.

Finding Number 2025-002 Assistance Listing Number 84.063 and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2024 and 2025 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2024-003 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the two prior audits, for the federal Direct Loan and Pell Grant programs, Tennessee State University continued to not report timely and accurate information regarding students’ enrollment statuses BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For student recipients of Pell Grants or Direct Loans, ED requires institutions to report students’ enrollment statuses for each term to the National Student Loan Data System (NSLDS). The institution is also required to report changes to students’ enrollment, such as graduations, withdrawals, and transitions between full-time and part-time status. Tennessee State University’s (the university) Enrollment Reporting Office reports directly to the National Student Clearinghouse (NSC). The data entered into NSC is automatically uploaded to NSLDS. It is then the responsibility of the university’s management to maintain the data in NSLDS and make any necessary changes or updates. CONDITION AND CAUSE University management, in response to the prior finding, hired additional staff, reviewed and updated operational procedures, and communicated the withdrawal process in training and staff meetings; however, these corrections did not resolve the issues around enrollment reporting and withdrawal dates. We tested a sample of 60 Direct Loan borrowers and/or Pell Grant recipients at the university. During our testing, we found that the university did not correctly report status changes in NSLDS for 9 of the 60 students (15%). These 60 students had a total of 93 reportable status changes during the academic year, and management incorrectly reported 11 of those 93 (12%) status changes to NSLDS as of July 30, 2025 (the date of our testwork). As stated above, a status change includes changes to students’ enrollment, such as graduations, withdrawals, and transitions between full-time and part-time status. There were instances where management reported the proper enrollment information in NSC; however, we noted the information in NSLDS was incorrect. Despite management’s responsibility to ensure that enrollment information is correctly reported in NSLDS, management either did not properly update the enrollment information in NSLDS or did not review the information to ensure statuses were accurate. Management was unable to determine the cause of the discrepancies that led to improper reporting in NSLDS. The errors included instances of statuses not reported and reported incorrectly. Specifically, we found the following: Not Reported · For 1 student, the university did not report the student as attending three-quarters time for the fall 2024 term. There was no enrollment history in NSLDS for this student until the spring 2025 term. · For 1 student, the university did not report the student’s status, despite the student being enrolled in 9 credit hours. · For 1 student, the university had not reported the student’s full-time status to NSLDS, as of the date of our testwork, July 30, 2025. During the first week of the spring 2025 term, 1 student increased enrollment to half-time and then changed to full-time 9 days later. This error is likely due to the half-time status being reported 58 days late. · For 1 student, management could not provide any enrollment history in NSLDS. The student had 2 status changes that should have been reported for the 2024 fall term. According to management, the cause was likely due to the student being purged and then reinstated in the middle of the semester. · For 1 student who completed academic requirements in fall 2024 and graduated in May 2025, the university did not update the reporting roster to reflect the student’s graduation status. · For 1 student, the university did not report the student’s May 2025 graduation. As of July 30, 2025, the date of the testwork, NSLDS still showed the student as attending full-time. In addition to failing to report the student’s graduation status, because the student had federal loans, the university was required to report the status change within 60 days, but failed to do so. Reported Incorrectly · For 1 student, the university incorrectly reported the student as three-quarters time, despite the student being enrolled in 12 credit hours for the entire spring 2025 term. Management should not have reported a status change. · For 1 student, the university incorrectly reported the student as less than half-time despite the student being enrolled in 11 credit hours, which should have been three-quarters time. · For 1 student, management reported an incorrect effective date. The student began attending full-time on August 23, 2024. However, the university did not update the student’s enrollment status to full-time until the following spring semester and reported an effective date of January 3, 2025—133 days after the actual status date. CRITERIA The 2024–2025 Federal Student Aid Handbook, Volume 2, Chapter 3, states that institutions “must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that file.” In the introduction to Chapter 1, the NSLDS Enrollment Reporting Guide states, “Accurate and timely Enrollment Reporting to NSLDS is essential to the Department of Education’s successful delivery of Title IV aid.” The requirements are established in Title 34, Code of Federal Regulations, Part 685, Section 309(b). Chapter 4.4.2 of the NSLDS guide states, Enrollment Status Effective Date is the date that the current enrollment status reported for a student was first effective. . . . Effective Date, and its related enrollment status, must be reported for both the Campus-Level (Campus Enrollment Effective Date) and the Program-Level (Program Enrollment Effective Date), however the dates may not always match, depending on the student’s circumstance. In addition, Chapter 7.14.4 of the NSLDS guide states, “NSLDS records must be accurately matched with your enrollment records. You should review, update, or verify student enrollment statuses and other information with information that appears on the Enrollment Reporting Roster file.” EFFECT Timely and accurate enrollment reporting is critical for effective management of ED programs. The accurate administration of the Title IV programs depends heavily on the accuracy of the enrollment information reported by schools. Accurate, timely, and complete enrollment data is also important to the students, who can view their current campus enrollment information and their program enrollment history. Also, if an individual no longer attends the university but their lack of attendance is not reported, the individual’s loan repayment grace period could be improperly extended, resulting in the student’s loan repayments being improperly deferred. In addition, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate its participation in a Title IV program. These actions would negatively affect the university’s operations and the students impacted by the loss of Title IV aid. RECOMMENDATION Management should review and update its processes as necessary to ensure the Enrollment Services Office uploads and submits the correct information to NSLDS. In addition, the Assistant Vice President of Admissions and Records should ensure that staff know reporting deadlines and the importance of reporting enrollment status changes. The Assistant Vice President of Admissions and Records should also ensure that enrollment status changes are reported timely and the Financial Aid Office is promptly notified. Management should implement a review throughout each term to verify that accurate information is reported in NSLDS. MANAGEMENT’S COMMENT We concur. The management of and the compliance with Title IV programs accountability is jointly owned by the Admissions & Records Office and the Financial Aid Office, and as such require commingled remediation. While we have made significant improvements in the activities in the separate areas, including hiring additional staff, updating process documents, and re-emphasizing the process during staff meetings, these findings reflect there is more to do related to the connectivity activities and procedures of the Offices to ensure both accurate and timely reporting of students’ enrollment statuses. We have identified this is particularly critical in the compliance procedures that require sequential actions by different departments. Starting in the Fall 2025 semester, the Financial Aid Office receives an automated file of the students who have withdrawn that day. This report serves as a notice to review and update students’ enrollment statuses. The additional procedure helps to ensure accurate dates are being captured timely. In addition to the process improvements, we continue to create a higher standard of operating effectiveness to ensure all critical policies and procedures are being executed properly without exception.

Finding Number 2025-003 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2024 and 2025 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2024-004 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.063 Federal Award Identification Number P063P070381 Amount $10,757 Assistance Listing Number 84.268 Federal Award Identification Number P268K250381 Amount $743 FINDING As noted in the two prior audits, Tennessee State University continued not to return Title IV funds in compliance with federal regulations BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For Title IV recipients who did not complete at least 60% of the semester, the school is required to perform a calculation to determine the amount of unearned aid that it must return to ED. The university is responsible for the institution’s calculated return. The university has no role in returning any portion of the student’s calculated return when the only impacted aid is Direct Loans. CONDITION In response to the prior audit finding, management stated that the university would improve the communication process between the Registrar’s Office and the Financial Aid Office by sending a confirmation acknowledgement email upon receiving the daily withdrawal report. This update was insufficient in addressing the ongoing compliance issues. We tested two groups of students who officially or unofficially withdrew from classes at Tennessee State University (the university) during the 2024–2025 award year: those who completed less than 60% of the semester and those who completed more than 60% of the semester. Testwork on Students Who Completed Less Than 60% of the Semester First, we selected 38 student withdrawals from a population of 106 students who had an official or unofficial withdrawal before the 60% completion date. We tested these withdrawn students to ensure that their withdrawal dates were accurate, that staff performed return calculations correctly, and that the university returned the correct amounts to ED within the required timeframes. All 38 student withdrawals (100%) we reviewed contained errors, with a total of 55 distinct issues. The university did not properly identify 3 withdrawals (8%) as official, did not return unearned funds or disburse post-withdrawal earned funds within the required timeframe for 34 withdrawals (89%), and miscalculated the Title IV funds to be returned to ED for 16 withdrawals (42%). Additionally, university management could not support the last date of attendance for 2 withdrawals (5%). We tested these cases using the withdrawal dates recorded in the university’s system; however, we were unable to verify their accuracy. Errors related to timeliness and calculation are detailed below. Timeliness Of the 38 student withdrawals, the university did not return funds within the required timeframe for 34 student withdrawals (89%). For 3 of these students, the university had not returned any funds as of the testwork date, October 8, 2025 (making the university 306 to 373 days late). The remaining 31 withdrawals were returned more than 45 days after the date of determination, with delays ranging from 99 to 203 days. Calculation Errors Of the 38 student withdrawals, 16 involved miscalculations of return of funds, resulting in questioned costs of $9,042 and over-returns of $13,872. Specifically, we found the following: • For 2 students, the university incorrectly determined the withdrawal date to be before the 60% completion point. However, 1 student’s last date of attendance and another student’s manual withdrawal occurred after the 60% point. The university should not have returned Title IV aid because both students completed at least 60% of the semester, resulting in an over-return of $6,265. • For 2 students, the university incorrectly calculated that the students were eligible for an additional disbursement of funds; however, a return should have been calculated, resulting in questioned costs of $1,169. • For 1 student, the university calculated and returned the correct amount, but later reversed the return and re-credited the student’s account. These funds should have been returned, resulting in questioned costs of $843. • For 1 student, the university used an incorrect withdrawal date of October 3, 2024, instead of the official date of September 18, 2024. Additionally, management incorrectly identified funds as undisbursed. By using a later withdrawal date and overreporting undisbursed aid, the university reduced the calculated institutional return amount; however, the university returned both the institution’s and the student’s share. These errors resulted in an over-return of $3,269. • For 2 students, the university used incorrect withdrawal dates. For the first student, management recorded the withdrawal date as October 1, 2024, instead of the correct date of September 27, 2024. For the other student, management treated the withdrawal as unofficial with a date of October 10, 2024, although the student had submitted an official withdrawal form dated September 10, 2024. These errors resulted in questioned costs of $2,530. • For 4 students, the university used incorrect dates for the beginning and ending of the term in the return calculation. For the fall term, the university used August 26 to December 6 instead of August 19 to December 5. For the spring term, the university used January 3 to May 5 instead of January 14 to May 2. Additionally, for 2 of these students, the university returned funds that only affected Direct Loans and were not the institution’s responsibility. These errors resulted in questioned costs of $667 and an over-return of $3,568. • For 4 students, the university miscalculated the return of funds, but we could not identify why the errors occurred. These cases resulted in questioned costs of $3,833 and an over-return of $770. Testwork on Students Who Completed More Than 60% of the Semester We also reviewed all 14 student withdrawals where students had completed more than 60% of the semester in which they withdrew. We tested these withdrawn students to ensure that the university recorded the withdrawal date correctly, had adequate attendance records to support the withdrawal date, and did not remove Title IV funds from the account. Of the 14 student withdrawals, we identified 6 errors (43%). For 1 student withdrawal (7%), management was unable to support an official withdrawal. For 5 student withdrawals (36%), the university recorded inaccurate withdrawal dates, with discrepancies ranging from 1 to 40 days. Due to the withdrawal date errors, management misclassified 1 student, marking them as withdrawn after the 60% point when they actually withdrew before completing 60% of the term. In this case, the university should have calculated and returned Title IV aid, resulting in questioned costs of $2,458. CRITERIA The 2024–2025 Federal Student Aid Handbook, Volume 5, Chapter 1, states, A pro rata schedule is used to determine the amount of Title IV funds the student has earned at the time of withdrawal up through the 60% point in each payment period or period of enrollment. After the 60% point in the payment period or period of enrollment, a student has earned 100% of the Title IV funds the student received and was scheduled to receive during the period [emphasis in original]. The 2024–2025 Federal Student Aid Handbook, Volume 5, Chapter 2, Part 2, states, • [Student’s Withdrawal Date] Official Notification – The date the student begins the school’s withdrawal process, or the date that the student otherwise provides notification (If both circumstances occur, use the earlier withdrawal date) [emphasis in original]. • Official Notification Not Provided – The date that the school determines is related to the circumstance beyond the student’s control, or the midpoint of the payment period or period of enrollment, as applicable. . . • [Alternative approach] In place of the dates listed, a school may always use, as a student’s withdrawal date, the student’s last date of attendance at an academically related activity if the school documents that the activity is academically related and that the student attended the activity. The 2024–2025 Federal Student Aid Handbook, Volume 4, Chapter 3, states, Schools must return funds disbursed to a student who failed to begin attendance as soon as possible but no later than 30 days after the date they become aware that the student has not begun and will not begin attendance [emphasis in original]. The 2024–2025 Federal Student Aid Handbook, Volume 5, Chapter 2, Part 1, states, An institution is not required to return the inadvertent overpayment immediately but must return it within 45 days of the date of the institution’s determination that the student withdrew (the time frame for an institution’s return of Title IV funds under 34 CFR [Code of Federal Regulations] 668.22(j)(1)). An institution must return an inadvertent overpayment in accordance with the applicable regulations for returning overpayments. Please see Volume 4, Chapter 3 for more information on overpayment procedures [emphasis in original]. CAUSE Based on our review, it appears that management did not have proper oversight and review procedures over the return of Title IV funds, as we noted multiple issues regarding both the calculation itself as well as the timing. Specifically, the university performed the Title IV return calculation using cost of attendance instead of institutional charges and entered the withdrawal date as the date the withdrawal was processed instead of the last date the student attended or the date on the signed withdrawal forms. In addition, management did not have a system in place to ensure all withdrawals and returns were processed timely. The Director of Financial Aid also stated that the Financial Aid Office temporarily lost access to federal systems due to significant staff turnover. Additional delays occurred during the implementation of policy changes under the new federal administration. EFFECT For the 52 students tested, the university over-returned $13,872 and under-returned $11,500 to students. The $11,500 was identified as questioned costs. Violations of the federal requirement to timely return Title IV funds to ED could result in ED imposing a fine on the university and/or limiting, suspending, or terminating the university’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. In addition, incorrect return calculations and/or withdrawal dates can negatively impact students. If the university incorrectly calculates and returns the amount of unearned aid to ED, the errors could impact the amount of aid the student is eligible to receive in future terms or could result in a student having an incorrect account balance. RECOMMENDATION The Registrar’s Office and the Financial Aid Office should follow federal regulations. Management should ensure that the Financial Aid Office reperforms all return of Title IV funds calculations and makes necessary corrections to student and federal fund accounts for the 2024–2025 academic year. Finally, management should ensure that the Registrar’s Office communicates any withdrawals to the Financial Aid Office in a timely manner. MANAGEMENT’S COMMENT We concur. The management of and the compliance with Title IV programs accountability is jointly owned by the Registrar’s Office and the Financial Aid Office, and as such requires commingled remediation. We have made significant improvements by automating the potential return calculation for students with less than 60% of the semester complete and documenting the procedures for these instances. However, these findings reflect there is more to do related to the validation of the input data (i.e., dates) to ensure output accuracy (i.e., the calculation) as well as the coordination between the two offices to initiate action when a student withdrawal occurs. We have identified this step as particularly critical and pervasive to our compliance. As stated in the response to Finding 2025-002, the Financial Aid Office now receives an automated file of the students who have withdrawn that day. This report serves as a notice to review and update students’ enrollment statuses. The additional procedure helps to ensure accurate dates are being captured timely. Additionally, our comprehensive corrective action, referred to in Finding 2025-001, to rebuild our application of payment sequencing will allow the automation of the returns once calculated. In addition to the process improvements, we continue to create a higher standard of operating effectiveness to ensure all critical policies and procedures are being executed properly without exception.

Finding Number 2025-004 Assistance Listing Number 10.553, 10.555, 10.556, and 10.582 Program Name Child Nutrition Cluster Federal Agency Department of Agriculture State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2022 through 2025 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding 2024-005 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior audit, the Department of Education did not establish internal controls related to federal reporting requirements for the Child Nutrition Cluster and did not comply with the requirements BACKGROUND The Department of Education (the department) is the pass-through entity for the Child Nutrition Cluster (1), which is administered by the Food and Nutrition Service of the U.S. Department of Agriculture. The Child Nutrition Cluster is a cluster of federal programs to provide healthful, nutritious meals and snacks to eligible children in public schools and nonprofit private schools, residential childcare institutions, and summer recreation programs. See Schedule of Findings and Questioned Costs for footnote. For the School Breakfast Program, the National School Lunch Program, and the Special Milk Program for Children, the department enters into agreements with subrecipient organizations, known as school food authorities (SFAs), which operate the programs at the local level and deliver program services to eligible children. The department reimburses SFAs for each meal or snack served based on the rates established by the U.S. Department of Agriculture. Each month, the SFAs claim the number of meals or snacks served using the department’s Tennessee: Meals, Accounting, and Claiming (TMAC) system. For the Fresh Fruit and Vegetable Program, (2) the department enters into additional agreements with approved SFAs for eligible elementary schools within those SFAs to operate the program at the local level and deliver program services to eligible children. The department awards a grant amount for each elementary school based on a per-child rate set by the department. Each month, the SFAs claim procurement, operations, and administration costs using the department’s TMAC system. See Schedule of Findings and Questioned Costs for footnote. The Federal Funding and Accountability Transparency Act (FFATA) requires the department to report subrecipient subaward financial information for all subawards over $30,000. Before March 2025, FFATA information was reported in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The last month the department reported in FSRS was February 2025. In March 2025, FSRS was retired and fully transitioned to the System for Award Management (SAM).(3) According to federal regulations, reports are due “no later than the end of the month following the month in which the subaward was issued.”(4) The subaward information in SAM is then available to the public on the USA Spending website for transparency. See Schedule of Findings and Questioned Costs for footnote. CONDITIONS AND CAUSES Fresh Fruit and Vegetable Program Based on our discussion with management, staff did not complete any FFATA reporting for the Fresh Fruit and Vegetable Program for the entire fiscal year. Based on our review of the claim information, staff did not report 29 program subawards, totaling $4,740,455, as required. We discussed the noncompliance with management and determined that the department has not designed and implemented a supervisory review process to ensure the Data Processing and Reporting Specialist identifies and reports all required subawards. School Breakfast Program, National School Lunch Program, and Special Milk Program for Children Reporting in FSRS (Before March 2025) Based on our walkthrough and discussion with the department’s School Nutrition staff, each month, the Data Processing and Reporting Specialist downloaded the current month’s reports from the TMAC system (which contained totals from the prior month) and manually combined and formatted the data for each individual SFA. This process included identifying and reporting the applicable amounts for the breakfast, lunch, snack, and milk programs. Once the information was compiled, the Data Processing and Reporting Specialist transferred the SFA data into the reporting template and uploaded the file to FSRS. For the period of July 2024 through February 2025, we obtained a population of 1,386 subawards, totaling $366,066,740. We selected a nonstatistical, random sample of 60 subawards, totaling $18,321,655, to determine if the department followed FFATA reporting guidance. Based on our review of the subaward documentation, we found that for 46 out of 60 (77%) items tested, the department either did not report the subaward amount or reported the subaward amount incorrectly. See Figure 1. See Schedule of Findings and Questioned Costs for figure. Based on our discussions with management and the results of our testwork, we determined that the incorrect or unreported amounts occurred because management has not designed and implemented a supervisory review process to ensure the Data Processing and Reporting Specialist identifies and accurately reports all required subawards. Reporting in SAM (After March 2025) Based on our discussion with management, after FFATA reporting transitioned from FSRS to SAM, staff did not complete any required FFATA reporting for the School Breakfast Program, the National School Lunch Program, and the Special Milk Program for Children.(5) Based on our review of the claim information for March through June 2025, staff did not report 190 SFA’s Child Nutrition subawards totaling $161,571,716. See Schedule of Findings and Questioned Costs for footnote. Management stated they did not report FFATA information after the transition from FSRS to SAM because the department did not have an Application Programming Interface(6) connection to automate the submission process, and entering each SFA individually into SAM would have required a significant amount of staff time. See Schedule of Findings and Questioned Costs for footnote. Our review of the department’s 2025 Financial Integrity Act Risk Assessment revealed that management identified a risk that federally required reports may not be accurate or completed on time. Management identified a second-level review of reports as a control activity to mitigate these risks; however, management noted in the risk assessment that the control was not effective and has yet to establish an effective control and update the risk assessment. Based on our review, the control was not effective for FFATA reporting because it was not placed in operation during our audit period. CRITERIA FFATA Reporting Appendix A to “Reporting Subaward and Executive Compensation Information,” Title 2, Code of Federal Regulations (CFR), Part 170, states: a. Reporting of first-tier subawards. 1. Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. 2. Reporting Requirements. i. The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at http://www.fsrs.gov [SAM.gov] ii. For subaward information, report no later than the end of the month following the month in which the subaward was issued. Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Additionally, Green Book Principle 10.02, “Response to Objectives and Risks,” Management designs control activities in response to . . . risks to achieve an effective internal control system. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives to achieve the entity’s objectives and address related risks. EFFECT Not meeting the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Specific conditions may include the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance; (3) Requiring additional or more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the recipient or subrecipient to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner should implement the supervisory review process documented in the risk assessment to ensure all subawards are reported completely and accurately in SAM as required. MANAGEMENT’S COMMENT The department concurs with this finding. The department’s State Director of School Nutrition, Senior Compliance and Data Manager, and Data Processing and Reporting Specialist have been working with the Federal Funding and Accountability Transparency Act (FFATA) System for Award Management (SAM) administrators to submit the required reports. The department is pursuing both internal practice adjustments and external collaboration with the United States Department of Agriculture (USDA) to ensure proper reporting. Internally, the department is working to develop an application programming interface (API) between the department’s nutrition data system and the recently updated federal reporting system to promote seamless report submissions. Externally, the department is collaborating with the Office of the CFO for the United States Department of Agriculture (USDA), noting the lack of more robust bulk upload options in the federal reporting system compared to the prior system. The department, alongside other states, continues to work with USDA to determine more efficient bulk upload options to streamline federal data reporting. The department will continue to leverage both these efforts to ensure reporting requirements are met. The department has created and deployed a standard operating procedure (SOP) to inform staff of the responsibilities our office has in uploading the required reports. The department will also include a certification process in its standard operating procedures so that reports are reviewed prior to submission in the SAM platform.

Finding Number 2025-005 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2022 and 2025 Finding Type Material Weakness and Noncompliance Compliance Requirement Matching, Level of Effort, Earmarking Repeat Finding 2024-006 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the two prior audits, Department of Education management did not establish internal controls related to Maintenance of Effort (MOE) and matching requirements, and did not comply with state administrative MOE requirements BACKGROUND AND COMPLIANCE CRITERIA The U.S. Department of Education provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006 (Perkins Act). The Perkins Act was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act, which provides grants to states to develop the academic knowledge and technical and employability skills of secondary and post-secondary students. As a recipient of federal funding, the department is subject to federal Matching and Level of Effort – Maintenance of Effort (MOE) requirements. Section 112(b) of the Perkins Act requires the department to match federal funds reserved for State Administration with non-federal funds, such as state appropriations, on a dollar-for-dollar basis. Sections 211(b) and 223(a) of the Perkins Act specify the following MOE requirements: • Section 211(b) requires the department to maintain its fiscal effort from state appropriations for CTE at a level not less than that of the preceding fiscal year. For example, state resources allocated for fiscal year 2025 must be equal to or greater than the amount allocated for fiscal year 2024. • Section 223(a)(7) additionally requires the department to contribute, from non-federal sources, an amount for State Administration that is at least equal to the amount contributed in the previous fiscal year. See Schedule of Findings and Questioned Costs for footnote. Each year, the U.S. Department of Education requires Perkins recipients to submit financial and performance information through the Consolidated Annual Report (CAR). The CAR includes data used to verify compliance with MOE requirements, including both Section 211(b) and 223(a) of the Perkins Act. Department staff prepare the CAR in January using data from the most recently completed fiscal year. For example, the CAR submitted in January 2025 included fiscal data for fiscal year 2024, and the CAR submitted in January 2024 included fiscal data for fiscal year 2023. PRIOR AUDIT RESULTS In the two prior single audits, we reported a finding related to the Matching, Level of Effort – Maintenance of Effort, and Earmarking compliance requirement. Specifically, we noted that department management had not developed or implemented adequate policies and procedures to ensure compliance with the matching(8) or MOE(9) requirements. The absence of controls limited management’s ability to provide sufficient documentation demonstrating compliance. See Schedule of Findings and Questioned Costs for footnote. As a result of these internal control deficiencies, we reported the following compliance-related conditions: • department management was unable to provide documentary evidence supporting compliance with matching requirements; and • department management was unable to provide documentation supporting adjustments or final amounts reported in the CAR for compliance with MOE. Department management concurred with the prior audit finding and stated that they would take corrective action, including assigning clear responsibility for control activities and compliance related to these requirements, developing policies and procedures, and maintaining documentation of review activities. CONDITION AND CAUSE Repeated Conditions Based on our review of controls and testwork to determine compliance, we found that although the department met both matching and overall MOE requirements for the program, management had still not established controls for the matching and MOE process. Specifically, management has yet to develop policies and procedures and maintain documentation of management’s review activities. The following repeated conditions are described as follows. Matching Based on our discussions with department management, CTE program staff attend monthly budget meetings to review and discuss program expenditures, which include both federal and state expenditures, and determine if any adjustments are needed. Department management thought that matching requirements were a part of this review; however, based on discussion with CTE program staff, the monthly budget meetings consist of a review for program allowability and not matching requirements specifically. Maintenance of Effort According to the Fiscal Director, the department’s Budget Director provides the financial data for the CAR each year from Edison, the state’s accounting system. The Fiscal Director stated that she reviews the financial data and discusses any concerns or questions with CTE Program Managers. However, the Fiscal Director was unable to provide any documentation of her review or discussion with the program managers. New Condition Additionally, we noted one new condition in the current audit. According to the CARs for fiscal years 2023 and 2024, the department reported non-federal contributions of $1,784,950 in 2023 and $1,262,644 in 2024 for State Administration. As a result, the department’s non-federal contributions decreased by $522,306 from fiscal year 2023 to fiscal year 2024, and department management was unable to provide any additional documentation to demonstrate compliance with Section 223(a) of the Perkins Act. Department management stated that their normal process is to review administrative expenditures and make necessary adjustments each year to meet state administrative MOE requirements; however, this process did not occur during fiscal year 2024. Current Risk Assessment and Internal Control Criteria In the department’s December 2024 Financial Integrity Act Risk Assessment, management identified risks associated with determining and meeting matching requirements for external grants, as well as risks related to maintaining compliance with overall MOE requirements. Management identified scheduled reviews as a control activity intended to mitigate these risks. However, based on the results of our review, we determined that management’s review procedures were not effective in reducing the risks of noncompliance with matching and MOE requirements. CRITERIA According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303, a non-federal entity must (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. . . . (c) Evaluate and monitor the non-Federal entity’s compliance with statutes, regulations, and the terms and conditions of Federal awards. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 10.03, “Design of Appropriate Types of Control Activities,” states, Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. Also, Green Book Principle 12.03, “Documentation of Responsibilities Through Policies,” states, Management documents in policies for each unit its responsibility for an operational process’s objectives and related risks, and control activity design, implementation, and operating effectiveness. Green Book Principle 12.04, “Documentation of Responsibilities Through Policies,” states, Management communicates to personnel the policies and procedures so that personnel can implement the control activities for their assigned responsibilities. EFFECT Without appropriate internal controls over matching and MOE requirements, there is an increased risk that the department will not comply with applicable federal requirements and may miscalculate the state's required matching and MOE amounts. Such miscalculations could result in noncompliance, placing the department at risk of a reduction in federal funding for CTE activities in subsequent award years. A reduction in federal funding could, in turn, adversely affect the department's ability to provide essential services to students in Tennessee schools. Federal regulations outline the actions that federal agencies may take if a state entity fails to comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Department management should design and implement effective internal controls to ensure compliance with federal matching and MOE requirements. These controls should include developing and documenting key processes and procedures to promote consistent and ongoing compliance. Management should also ensure they maintain documentation of review activities to demonstrate compliance and support ongoing monitoring of matching and MOE requirements. In addition, management should periodically evaluate the effectiveness of these control activities in mitigating identified risks and update the department’s annual risk assessment to reflect any new or revised controls implemented as a result of this finding. MANAGEMENT’S COMMENT The department concurs with this finding. Matching On July 10, 2025, cross‑divisional staff members from the Tennessee Department of Education (TDOE) participated in a virtual training with Andrew Johnson from the U.S. Department of Education (ED), Office of Career, Technical, and Adult Education (OCTAE). The training agenda included an overview of matching requirements for the Perkins grant. Additionally, TDOE has procured training scheduled for April 1, 2026. Cross‑divisional staff members will engage in a full day of training focused on both programmatic and fiscal topics, including matching requirements, to further build team capacity. To support internal collaboration, CTE program staff currently attend monthly budget meetings to review and discuss program expenditures—including both federal and state funds—and determine whether adjustments are needed. Historically, these meetings focused primarily on program allowability; however, they were expanded to include a review of matching requirements specifically. Maintenance of Effort (MOE) On July 10, 2025, cross‑divisional staff members from the Tennessee Department of Education (TDOE) participated in a virtual training with Andrew Johnson from the U.S. Department of Education (ED), Office of Career, Technical, and Adult Education (OCTAE). The training agenda included an overview of Maintenance of Effort (MOE) requirements for the Perkins grant. Additionally, TDOE has procured training scheduled for April 1, 2026. Cross‑divisional staff members will engage in a full day of training focused on both programmatic and fiscal topics, including MOE requirements, to further build team capacity. The Fiscal Director reviews financial data and discusses any concerns or questions with CTE Program Managers. Processes have been updated to include documentation of these discussions. The team is implementing internal controls to ensure compliance with federal matching and MOE requirements. These controls include developing and documenting key processes and procedures to promote consistent and ongoing compliance. Documentation of review activities will be collected to demonstrate compliance and support ongoing monitoring of fiscal practices. In addition, leadership will evaluate the effectiveness of these control activities in mitigating identified risks and update the department’s annual risk assessment to reflect any new or revised controls implemented as a result of this finding.

Finding Number 2025-006 Assistance Listing Number 10.555 Program Name Child Nutrition Cluster Federal Agency Department of Agriculture State Agency Department of Agriculture Federal Award Identification Number N/A Federal Award Year 2024 and 2025 Finding Type Material Weakness and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Tennessee Department of Agriculture did not perform annual inventories at food storage locations resulting in noncompliance with federal inventory requirements for the Child Nutrition Cluster programs BACKGROUND The Department of Agriculture (the department) is a pass-through entity for the Child Nutrition Cluster,(10) which is administered by the Food and Nutrition Service of the U.S. Department of Agriculture (USDA). The Child Nutrition Cluster is a cluster of federal programs that provide nutritious meals and snacks to eligible children in public schools and nonprofit private schools, residential childcare institutions, and summer recreation programs. See Schedule of Findings and Questioned Costs for footnote. The department serves as a food distribution agency for one of the cluster’s five programs, the National School Lunch Program. Based on the food selections made by school food authorities (SFAs), who function as subrecipients, the department places orders with the USDA for donated foods.(11) USDA then ships the food directly to department-contracted warehouses for storage or sends it to processors for additional preparation.(12) As SFAs have the need and capacity, they coordinate the distribution of food from the warehouses to their participating schools. In fiscal year 2025, the department ordered $33,125,180 of USDA-donated foods on behalf of SFAs. Federal regulations(13) require the department to manage its food inventory in the warehouses by tracking receipts and distributions, performing at least one physical inventory count each year, and documenting adjustments to inventory records, such as losses due to spoilage. See Schedule of Findings and Questioned Costs for footnote. CONDITION AND CAUSE Based on our discussions with department management, we found that management did not conduct the required annual inventories at the food storage warehouses. Instead of performing physical inventories, management relied on reports from warehouses, processors, or SFAs of food inventory changes. When discussing inventory requirements with management, the Commodity Distribution Administrator stated that, since assuming the role in February 2024, he continued the processes established by prior program leadership and was not aware of the inventory and recordkeeping requirements applicable to the Child Nutrition Cluster. Although the department’s warehouse contracts require the contractor to provide inventory reports and specify “the State will require an annual physical inventory of USDA commodity foods and will reconcile physical and book inventories,” management acknowledged that they had not reconciled records with the actual inventory on hand. Management also stated that they do not have the staffing capacity to perform the annual physical inventories required for the food storage warehouses. Because the department did not perform and document physical inventories to reconcile to other records, the department could not determine the amount of USDA food losses for which USDA requires reporting and restitution. Management further noted that USDA conducted a federal program review of the department’s administration of the Child Nutrition Cluster in August 2025 and identified the lack of annual inventories for USDA foods stored in warehouse facilities as a compliance issue. Management explained they intended to wait for the final results of USDA’s review before initiating annual inventory procedures. In addition, our review of the department’s 2025 Financial Integrity Act Risk Assessment showed that, although the department identified certain controls related to USDA foods administered through other programs, management did not perform a similar risk assessment for food inventory associated with the Child Nutrition Cluster. CRITERIA Maintenance of Records and Inventory Management According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303(a), a non-federal agency must: Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, according to 7 CFR 250.12(b), The distributing agency must ensure that donated foods at all storage facilities used by the distributing agency (or by a subdistributing agency) are stored in a manner that permits them to be distinguished from other foods, and must ensure that a separate inventory record of donated foods is maintained. The distributing agency’s system of inventory management must ensure that donated foods are distributed in a timely manner and in optimal condition. On an annual basis, the distributing agency must conduct a physical review of donated food inventories at all storage facilities used by the distributing agency (or by a subdistributing agency), and must reconcile physical and book inventories of donated foods. The distributing agency must report donated food losses to [the Food and Nutrition Service], and ensure that restitution is made for such losses. Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Additionally, according to Green Book Principle 10.02, “Response to Objectives and Risks,” Management designs control activities in response to the entity’s objectives and risks to achieve an effective internal control system. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives to achieve the entity’s objectives and address related risks. EFFECT By failing to perform a sufficient inventory, management increases the risk of noncompliance with federal requirements and heightens the potential for fraud, waste, and abuse within this federal program. Without adequate internal controls over the receipt, distribution, and inventory of USDA-donated foods, management cannot reasonably ensure that subrecipients meet federal program requirements or achieve the intended program outcomes. Additionally, federal regulations outline actions that federal agencies may take if a state entity fails to comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” additional federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance; (3) Requiring additional or more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the recipient or subrecipient to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of the Department of Agriculture should ensure that management strengthens its oversight and internal controls over USDA-donated food inventory by establishing written procedures that comply with federal Child Nutrition Cluster requirements and clearly outline responsibilities for maintaining complete inventory records and performing required reconciliations. Management should ensure that staff perform and document annual physical inventories for each warehouse and reconcile the results to book inventories. To support these responsibilities, management should evaluate staffing levels and allocate sufficient resources or explore operational alternatives to ensure the department can meet federal requirements. In addition, management should provide training to program staff on federal inventory requirements and the department’s updated procedures. Finally, management should review and update the risk assessment for the deficiencies noted in the finding, design and implement controls to address these risks, continue to monitor these risks, and take appropriate action to address other deficiencies as they occur. MANAGEMENT’S COMMENT We concur. To ensure effective internal controls over inventory at storage locations for school food distribution, the department added the risk of not complying with inventory requirements for school food to our Financial Integrity Act risk assessment along with the following mitigating controls: • Monthly inventory reports are required to be sent by each of the three school food warehouses to the Commodities team. • Developed monitoring guides and have begun using those guides to assist with warehouse visits. The department has a plan to begin observing inventory annually. We completed our first warehouse visit in February 2026 and anticipate completing visits to the other two warehouses by September 30, 2026. In addition to the annual on-site inventory observation, internal monthly inventory monitoring has been added to the duties of the Commodities team. Warehouses are now required to submit monthly inventory reports by the 10th of each month which are then analyzed by the team. We have been looking at ways to add a permanent position to the Commodities team. We have tried getting an additional position approved in the budget and we are exploring the possibility of repurposing vacant positions within the department. Finally, the department’s special projects team has been looking at SOPs in place as well as the need for SOPs in areas without them. The Commodities team is next on the list for special projects to help with drafting and revising SOPs. We plan to use this opportunity to establish written procedures that outline responsibilities for the school food program to help us ensure compliance with federal requirements. The Commodity Distribution Administrator will be responsible for ensuring corrective actions are implemented by the anticipated completion date of December 31, 2026.

Finding Number 2025-007 Assistance Listing Number 93.069 Program Name Public Health Emergency Preparedness Federal Agency Department of Health and Human Services State Agency Department of Health Federal Award Identification Number N/A Federal Award Year 2025 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Health did not comply with subrecipient monitoring requirements for the Public Health Emergency Preparedness program BACKGROUND The Department of Health, as a pass-through entity, administers the Public Health Emergency Preparedness (PHEP) program. The department provides subawards to subrecipients with the aim of strengthening the capacity and capability of state and local public health systems to prepare for, respond to, and recover from public health threats and emergencies. The department uses eight subrecipients for this program. According to the schedule of expenditures of federal awards, subrecipient spending accounts for approximately 30% of the total program. Federal regulations require pass-through entities to establish and implement effective internal controls to monitor subrecipients’ activities to ensure they use federal funds in compliance with statutes, regulations, and grant terms and conditions. As a part of these responsibilities, management must evaluate each subrecipient’s risk of fraud and noncompliance, which includes reviewing the results of subrecipients’ Single Audits when applicable. Based on this risk assessment, management must perform appropriate monitoring to ensure subrecipients meet programmatic and financial requirements. This monitoring could include providing technical assistance, reviewing Single Audit reports, issuing management decisions related to PHEP funding, conducting site visits, or performing other monitoring procedures. CONDITION AND CAUSE Our audit identified deficiencies in the department’s monitoring of PHEP subrecipients, specifically related to tracking Single Audit Reports and performing monitoring reviews. Single Audit Report Tracking First, as of October 27, 2025, management had not ensured that any of the eight PHEP subrecipients obtained required Single Audits in accordance with Title 2, Code of Federal Regulations (CFR), Part 200, Subpart F, nor had management followed up when subrecipients did not submit Single Audit reports on time. No staff member was responsible for tracking which subrecipients were required to obtain a Single Audit, confirming whether subrecipients submitted audits, or following up when the department did not receive the required reports. After we brought it to their attention, management assigned a staff member to verify subrecipient Single Audit submissions on October 27, 2025. Monitoring Reviews Additionally, although the department’s documented risk assessment identified plans to conduct monitoring reviews of two subrecipients for the PHEP program during the audit period, the department did not perform these reviews. The staff member assigned to perform the reviews left the team on May 28, 2025, and management did not reassign the monitoring duties. CRITERIA Although revisions to 2 CFR 200 became effective during the audit period, the subrecipient monitoring requirements relevant to this finding—including evaluating subrecipient risk, performing appropriate monitoring activities, and verifying whether subrecipients were audited under Subpart F—remain substantively unchanged under both the prior and current versions of the Uniform Guidance. Federal regulations require pass-through entities to establish and maintain effective internal controls over federal awards and to monitor the activities of subrecipients to ensure compliance with applicable requirements. Under 2 CFR 200.332, the department, as a pass-through entity, must • evaluate each subrecipient’s risk of fraud and noncompliance to determine the appropriate level and type of monitoring; • consider factors such as the subrecipient’s o prior experience with similar awards; o results of previous audits, including whether the subrecipient undergoes a Single Audit; o changes in personnel or financial/management systems; and o results of other federal monitoring; • monitor subrecipient activities as necessary to ensure federal statutes, regulations, and award terms are met and that the goals and objectives of the subaward are achieved; • use appropriate monitoring tools based on assessed risk, including providing technical assistance, conducting site visits, or arranging for agreed-upon procedures engagements; and • verify that each subrecipient is audited as required under Subpart F of the Uniform Guidance. In addition, 2 CFR 200.501(a) requires any non-federal entity that meets the expenditure threshold established under Subpart F to obtain a Single Audit or program-specific audit for that fiscal year. Additionally, the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 3, states that management should assign and communicate responsibility for internal control activities. Collectively, these requirements obligate the department to ensure subrecipients obtain required audits, review and act on audit results, and perform the monitoring procedures identified through its risk assessments. EFFECT When management does not perform required subrecipient monitoring activities, it increases the risk of not timely detecting, documenting, or correcting subrecipient noncompliance, misuse of federal funds, or potential fraud. By failing to verify whether subrecipients obtained required Single Audits, management limits its ability to identify financial reporting deficiencies, internal control weaknesses, or questioned costs that could affect the PHEP program. RECOMMENDATION Management should ensure that responsibilities for subrecipient monitoring are clearly assigned, communicated, and carried out in accordance with federal requirements. These responsibilities include verifying required Single Audits, reviewing audit reports, issuing management decisions, and conducting risk-based monitoring activities. Management should also establish a process to ensure monitoring activities continue uninterrupted during staffing changes, including timely reassigning monitoring duties and documenting any modifications to the risk-based monitoring plan. Furthermore, management should periodically evaluate the effectiveness of its subrecipient monitoring system to confirm that staff are performing monitoring activities as planned and to promptly address any delays or impediments. MANAGEMENT’S COMMENT We concur. With regard to the monitoring of single audit findings within subrecipients, Emergency Preparedness will work with their column’s Business and Grant Management (BGM) Team to ensure grantees that require an annual single audit are identified and that single audits are reviewed within 60 days of the audit date. If relevant findings and corresponding corrective actions are identified, the BGM Team will confer with program management, and communicate with the subrecipient as to whether the corrective actions taken are believed to sufficiently mitigate the deficiencies noted in the finding. This communication will be filed for reference by program management and shared with the Compliance & Ethics Office, where a log will be kept to track this activity. This process will be put in place by January 31, 2026 and be the responsibility of the BGM Team Compliance Manager. With regard to staffing issues, the Compliance & Ethics Office was challenged with the untimely death of their monitoring manager, while at the same time losing an additional staff member due to attrition. The Compliance & Ethics Office will ensure that in the event of staffing shortages, a hierarchical management structure is in place to make needed changes in the subrecipient monitoring plan if needed. The Assistant Commissioner that leads the Compliance & Ethics Office will be responsible for this effort and has put this structure in place effective January 1, 2026. Finally, the evaluation of the effectiveness of the subrecipient monitoring system will be conducted as part of the annual Financial Integrity Act Risk Assessment, conducted by December 31 of each year, beginning December 31, 2026. Additionally, the Compliance & Ethics Office will conduct an enterprise-wide refresher course on single audit review and other subrecipient compliance responsibilities on or before June 30 each year, beginning June 30, 2026.

Finding Number 2025-008 Assistance Listing Number 93.568 Program Name Low-Income Home Energy Assistance Federal Agency Department of Health and Human Services State Agency Tennessee Housing Development Agency Federal Award Identification Number N/A Federal Award Year 2024 and 2025 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Reporting Repeat Finding 2024-012 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the two prior audits, Tennessee Housing Development Agency (THDA) management did not have effective internal controls over reporting for the Low-Income Home Energy Assistance Program BACKGROUND The U.S. Department of Health and Human Services (HHS) provides grant funding through the Low-Income Home Energy Assistance Program (LIHEAP) to the Tennessee Housing Development Agency (the agency). The objective of LIHEAP is to help low-income households meet the costs of home energy, increase their energy self-sufficiency, and reduce their vulnerability resulting from energy needs. As a condition of the grant, HHS requires the agency to report on the use of federal funds through financial, performance, and special reports. In addition to federal requirements in the Code of Federal Regulations, the HHS Office of Administration for Children and Families, Office of Community Services (OCS), provides guidance to LIHEAP recipients by issuing Action Transmittals. In response to the prior-year finding noting ineffective controls over reporting, management stated that positions were filled, including the Community Services Division Director and LIHEAP Manager, who were working to strengthen internal processes to ensure reports are completed timely and accurately. CONDITION, CRITERIA, AND CAUSE As noted in the two prior years, the agency did not have adequate internal controls to ensure it provided the federal grantor (HHS) with timely or accurate reports. The primary cause for the special and performance reporting deficiencies was inadequate training of the new staff. Management assigned a secondary reviewer, but this reviewer did not always review the report data before submission, which led to inaccurate reported information. Special Reporting Annual Report on Households Assisted by LIHEAP According to Title 45, Code of Federal Regulations (CFR), Part 96, Section 82(a), the agency is required to submit to HHS an annual report on households assisted by LIHEAP “for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance.” We reviewed the 2024 annual report on households assisted by LIHEAP to determine that management submitted the report timely and reported line items accurately. Management originally submitted a timely estimated report on September 18, 2024. However, we noted that the agency did not submit the final corrected report until January 14, 2025, 14 days after the due date of December 31, 2024. The Director of Community Services stated the late submission was due to new staff onboarding and miscommunication, as the director was new to program administration and did not realize a subsequent report needed to be submitted after the estimated version. After the January 14, 2025, submission, APPRISE Inc., whose data consultants work with HHS, made THDA aware of two errors on the report: • The “Sum of Assistance Types” (reported as 117,537 households) did not reconcile with the figures reported in Line 14 (Any Type of LIHEAP Assistance) and Line 18 (Bill Payment Assistance), both listed as 109,045. • The weatherization program total of 264 households assisted was omitted from the report. After management submitted an updated report including the missing weatherization data, APPRISE Inc. followed up again, noting that the total households assisted (Line 14) still did not reflect the correct total of households served by the bill payment assistance and weatherization program, 117,801. Quarterly Performance and Management Reports LIHEAP Action Transmittal 2025-01 Quarterly Report Instructions Attachment 1 requires grant recipients to submit data and information about LIHEAP through quarterly performance and management reports. The quarterly report “collects valuable statistics on the number of assisted households, the impact of LIHEAP in ensuring access to home energy service, the amount of awarded funds that have been obligated, and successes and challenges that grant recipients are experiencing.” We reviewed the quarterly performance and management report for the first and second quarters of federal fiscal year 2025. During this review, we noted that management did not adequately review the second-quarter report prior to submission, causing inaccurate information to be reported until an amendment was made after the deadline. Management submitted the report timely; however, management reported the incorrect obligated amounts on the original report. The amount of funds obligated was reported at $24,303,853 instead of the correct amount of $58,379,528, an understatement of $34,075,675. The Director of Community Services stated that immediately after submission of the report, management discovered that the reported obligated amounts were not calculated in accordance with the LIHEAP model plan. The Director of Community Services stated that a new program staff member had been assigned to complete the reports but used the incorrect methodology. Management subsequently submitted an amended report on May 27, 2025. EFFECT When staff do not proactively perform procedures to ensure the reports are generated timely and without errors, management increases the risk of providing incorrect or untimely data to HHS, which could affect program oversight and funding decisions. Inaccurate reporting also increases the likelihood of noncompliance with federal grant requirements, including the risk of obligating more funds than are available. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Specific conditions may include the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance; (3) Requiring additional or more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the recipient or subrecipient to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • withholding further awards for the project or program, or • pursuing other available legal remedies. RECOMMENDATION THDA management should continue to strengthen the reporting process by ensuring new employees are adequately trained, reports are reviewed for accuracy prior to submission, and that management and staff have an adequate tracking system to ensure timeliness. Management should also continue to monitor reporting procedures and revise internal controls as necessary to ensure full compliance with federal reporting requirements. MANAGEMENT’S COMMENT We partially concur. THDA has continued to refine its process to ensure timely and accurate reporting. In 2025, steps were taken to review reports prior to submission. The manager additionally consulted with APPRISE, Inc., the data management firm contracted to support HHS and LIHEAP grantees, prior to report submission. APPRISE acknowledges that the report templates do not properly identify errors and encourages THDA to submit reports even when errors are noted. Any instances where errors were substantiated following report submission have been corrected in consultation with APPRISE. HHS has accepted all reports submitted by THDA, and we have received no communication from HHS that THDA is in jeopardy of their consideration of any of the effects noted in your finding. We do acknowledge that there was an instance where numbers were not reported correctly or timely due to lags in getting LIHEAP Weatherization data, as well as improper grantee reporting. We are working to resolve this issue through implementation of new software that will join the LIHEAP utility assistance and LIHEAP weatherization data together, on a single platform. THDA launched the software for the utility assistance segment of LIHEAP on November 1, 2025, and we expect the LIHEAP weatherization data to be online by October 1, 2026. THDA’s work in 2025 to improve its reporting accuracy has been impacted considerably by inconsistent guidance at the federal level. Since January 2025, due to periods of non-communication by HHS and subsequent reductions and changes in staffing at HHS, we have received various interpretations of HHS guidance. For instance, HHS has provided differing definitions of “obligation”, creating some confusion with reporting. To date, HHS has not provided a final definition. THDA will continue to report obligations as is stated in our Model Plan, when funds are awarded and a contract is fully executed with the sub-grantee. We appreciate the comments of the State Comptroller’s Office as we actively take steps to improve our reporting processes. AUDITOR’S COMMENT We reviewed and considered management’s comments. Although they provide additional context, the response does not alter the underlying condition or conclusion of the finding.

Finding Number 2025-009 Assistance Listing Number 20.106 Program Name Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs Federal Agency Department of Transportation State Agency Department of Transportation Federal Award Identification Number N/A Federal Award Year 2020 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Transportation did not establish internal controls related to federal reporting requirements for the Airport Improvement Program and did not comply with the requirements BACKGROUND The Federal Aviation Administration’s (FAA) Airport Improvement Program supports the development of a nationwide system of airports by funding projects that increase airport capacity and safety. To be eligible for the program, an airport must be open to the public and be included in the National Plan of Integrated Airport Systems.(14) Applications for grants must be submitted to the appropriate FAA Airports Office. See Schedule of Findings and Questioned Costs for footnote. The Federal Funding and Transparency Act (FFATA) requires the Department of Transportation (the department) to report financial information on all subawards of $30,000 or more in federal funds(15) through the System for Award Management (SAM).(16) According to federal regulations, reports are due “no later than the end of the month following the month in which the subaward was issued.”(17) The subaward information in SAM is then available to the public through the USA Spending website for transparency. See Schedule of Findings and Questioned Costs for footnote. Based on our walkthrough and discussion with the department’s Aeronautics Division management, the division holds bi-monthly meetings to discuss funding, which comes from federal, state, and local funding streams, for potential Airport Improvement Program projects. In collaboration, the department’s division management and the state’s Tennessee Aeronautics Commission (18) document their decisions to approve or deny subawards in a Project Status Report (PSR) spreadsheet. Following the bi-monthly meeting, the Aeronautics Division Grants and Compliance Team Lead uses the PSR to update a shared spreadsheet known as the “All AERO” to maintain all approved Airport Improvement Program subaward projects. See Schedule of Findings and Questioned Costs for footnote. Each month, the department’s Transportation Program Supervisor, who is responsible for reporting Airport Improvement Program subawards that meet the $30,000 threshold, uses the All AERO spreadsheet to filter subawards issued in the prior month and identify the subawards by Federal Award Identification Number.(19) The Transportation Program Supervisor then enters the information from the spreadsheet into SAM.gov. See Schedule of Findings and Questioned Costs for footnote. CONDITION AND CAUSE We obtained a population of 82 subawards, totaling $7,479,559 in federal dollars obligated during the fiscal year ending June 30, 2025. After filtering out subawards below the $30,000 reporting threshold, this left 74 subawards, totaling $7,384,452, to be sampled from. We then selected a nonstatistical, random sample and a haphazard sample and reviewed 18 subawards totaling $1,725,163. Based on our review of the subaward documentation, we found that 4 of the 18 subawards did not meet the $30,000 federal funding threshold for FFATA reporting. For the remaining 14 subawards, we found the following: • Unreported and Late Subawards: We found that the department did not report 2 subawards, totaling $177,300, as required. Additionally, the department reported 10 subawards, totaling $1,471,679, after the required reporting deadline. Management stated that the transition from the Federal Funding Accountability and Transparency Act Subaward Reporting System to SAM.gov contributed to the late reporting for 6 of these 10 subawards. • Subaward Amendments Unreported: We found that for 1 subaward, management did not report a $13,904 amendment to the subaward. The department reported the original $150,000 subaward in the prior scope period; however, management did not report the $13,904 increase, as required by FFATA reporting requirements. • Subaward Amendments Reported Late: We found that for 1 subaward, management reported a $9,090 amendment after the required deadline. The department reported the original $43,200 subaward in the prior scope period but did not report the $9,090 amendment within the FFATA reporting timeframe. Based on our discussions with management regarding the noncompliance, we determined that the department has not designed and implemented a supervisory review process to ensure the Transportation Program Supervisor timely enters all required subaward reports in SAM. See Figure 1. See Schedule of Findings and Questioned Costs for figure. We also reviewed the department’s 2024 Financial Integrity Act Risk Assessment, which confirmed that the Aeronautics Division’s management did not assess the FFATA reporting process related to the Airport Improvement Program for the potential risk of errors and noncompliance with federal laws and regulations and did not establish controls to mitigate risks. CRITERIA FFATA Reporting Appendix A to “Reporting Subaward and Executive Compensation Information,” Title 2, Code of Federal Regulations (CFR), Part 170, states: a. Reporting of first-tier subawards. 1. Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. 2. Reporting Requirements. i. The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the subaward was issued. Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Additionally, Green Book Principle 10.02, “Response to Objectives and Risks,” Management designs control activities in response to risks to achieve an effective internal control system. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives to achieve the entity’s objectives and address related risks. EFFECT Not meeting the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding the department’s expenditures of federal awards. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” additional federal award conditions may include items such as the following: • Requiring payments as reimbursements rather than advance payments; • Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance; • Requiring additional, more detailed financial reports; • Requiring additional project monitoring; • Requiring the recipient or subrecipient to obtain technical or management assistance; or • Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of the Department of Transportation should design and implement a supervisory review process to ensure all subawards and related amendments are reported as required. Management should include the risks associated with FFATA reporting in the annual risk assessment and develop compensating controls to address the risks.   MANAGEMENT’S COMMENT We concur. The following processes have been created to correct the issues with FFATA reporting: • An internal submittal deadline has been created to ensure the timely submission of the FFATA report each month. This timeframe is 15 days from project approval. In the event something happens and the 15 days is missed, there is still time to correct the issue before becoming noncompliant with the FAA. • All the information is kept on a separate excel strictly for FFATA reporting and contains checks in the file stating if it has been entered into SAM.gov and to ensure it is also on the ALL Aero spreadsheet. • Ensure that the information that is entered, is transferred into the folder for that month. Via pdf or screenshot. • Created a folder dedicated to FY26 for all things FFATA. This will be the norm going forward per fiscal year. • Trained two senior staff members within the Grants and Compliance section on entering the information if the Statewide Technical Specialist is out or unable to get it in within the allotted timeframe. • Emailing the Team Lead after the FFATA report has been entered as well as storing it on the shared drive in the FY26 FFATA Reporting Folder (or future corresponding folder). • Created a section on our section’s OneNote (SOP) of how to enter the information and also put the information for the paths to the share drive FFATA files as well for anyone else in case something happened to any of the people who are trained it, continuity will be maintained. • A line item has been created on the weekly one-on-one agenda between the Team Lead and Statewide Tech Spec following up on FFATA reporting status and cross-referenced with project approval list.

Finding Number 2025-010 Assistance Listing Number 93.558 Program Name Temporary Assistance for Needy Families Federal Agency Department of Health and Human Services State Agency Department of Human Services Federal Award Identification Number N/A Federal Award Year 2025 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Reporting Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The department and STS did not jointly establish effective oversight and monitoring of IT systems managed by STS and third-party vendors, or provide adequate internal controls in three other areas related to the department’s information systems, increasing the risk of errors and disruptions in the Temporary Assistance for Needy Families financial assistance program BACKGROUND The Department of Human Services (the department) modernized its information systems by replacing legacy applications with cloud-based platforms designed to improve reliability, reduce maintenance needs, and expand access to services. The department now relies on both custom-developed and Software-as-a-Service systems, many of which are operated by third-party vendors. The department uses these systems to support the Temporary Assistance for Needy Families (TANF) program by providing a single, digital system that simplifies families’ experiences with applying for benefits, submitting necessary documents, and viewing case updates. Because these systems support key business processes, the department and the Department of Finance and Administration’s Strategic Technology Solutions (STS) share oversight responsibilities to ensure systems are secure, compliant, and functioning as intended. Under a 2017 memorandum of understanding, STS is responsible for certain operational and vendor‑management functions. At the time of the audit, statewide guidance specific to monitoring third-party vendor risk had not yet been fully developed. Since then, statewide guidance has been developed and is currently under review for approval and implementation. As of 2024, the U.S. Department of Health and Human Services awarded the Tennessee Department of Human Services $190,885,719 for the TANF program. CONDITION AND CAUSE Department management and STS management did not effectively design and monitor internal controls over the department’s information systems, including controls related to vendor-managed systems. We identified deficiencies in overseeing and monitoring the department’s third-party information technology vendors. Because STS and the department did not implement effective monitoring, they did not identify three other internal control weaknesses in the department’s systems, which are confidential and omitted from this report. The third-party information technology vendor lacked oversight and monitoring While the department relies on STS and external vendors, such as Deloitte, to manage and operate its systems, the department did not establish sufficient oversight and monitoring controls over its third-party information technology vendor, which manages one of its custom-developed systems. Specifically, the department and STS did not effectively monitor daily operations, verify that the vendor implemented appropriate technical safeguards, or ensure that the vendor complied with statewide security requirements and department policies. As a result, neither the department nor STS consistently monitored the vendor’s performance or the effectiveness of controls over department systems. One reason for this oversight gap is that the department did not clearly define its own responsibilities, or those of STS, in the memorandum of understanding. In addition, during the audit, the Information Systems Council had not developed statewide policies for monitoring third-party vendor risk. After we completed the audit, STS prepared draft statewide guidance on third-party management, which the council approved during its December 17, 2025, meeting. The department’s and STS’s annual risk assessment does not sufficiently mitigate risks The department and STS did not identify the risks noted in this audit finding during their annual risk assessment and, therefore, did not establish internal controls to mitigate those risks.(20) See Schedule of Findings and Questioned Costs for footnote. STS management did identify the risk that STS and the consolidated agencies(21) are responsible for ongoing monitoring of third-party IT vendors to safeguard an agency’s mission-critical information systems. However, STS management’s identified controls focused only on Software-as-a-Service providers and independent audit reports. They did not address internal controls pertaining to vendors maintaining and managing the department’s IT environment, such as those supporting custom-developed systems.(22) Even when STS or external vendors perform IT functions, the department remains responsible for ensuring risks are managed and controls are effective. See Schedule of Findings and Questioned Costs for footnote. The department’s systems contained confidential internal control weaknesses Due to the lack of monitoring, the department and STS were not aware of internal control weaknesses in three other areas related to the department’s information systems. Department and STS management acknowledged these confidential internal control weaknesses and have taken steps to correct them. These identified weaknesses increased the risk of unauthorized access or modification to critical systems and processes because the department and STS did not adhere to state policies and federal internal control standards. Under Standard 9.61 of the U.S. Government Accountability Office’s Government Auditing Standards, we omitted details from this finding because they are confidential under the provisions of Section 10-7-504(i), Tennessee Code Annotated. We provided department and STS management with detailed information regarding the specific conditions we identified, as well as the related criteria, causes, and our specific recommendations for improvement. CRITERIA According to Title 2, Code of Federal Regulations, Part 200, Section 303(a), the department must Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According” to Green Book Section OV4.03, “External Parties,” Management may engage external parties to perform certain business processes for the entity . . . [but] management retains responsibility for the effectiveness of controls over business processes assigned to service organizations. . . . [M]anagement needs to understand the controls that service organizations design, implement, and operate. Additionally, Green Book Principle 7.02, “Identify Risks,” states, Management identifies risks throughout the entity . . . to provide a basis for analyzing risks. Furthermore, Green Book Principle 7.14, “Respond to Risks,” states, When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT TANF eligibility determinations, benefit calculations, and case management activities rely on accurate, complete, and timely information in the department’s information systems. Ineffective implementation and operation of internal IT controls increase the likelihood of errors, data loss, and unauthorized access to departmental systems that support the TANF program. As a result of these control deficiencies, management lacks reasonable assurance that it can effectively identify, monitor, and respond to risks affecting the protection and dependability of its systems and data. Weak controls increase the risk of data breaches, service disruptions, and system failures that could affect the delivery of services to Tennesseans. Limited monitoring also reduces management’s ability to detect control breakdowns promptly and respond quickly when problems occur. Collectively, these control deficiencies elevate the risk of someone altering, exposing, or disrupting TANF data without detection. These deficiencies not only threaten service delivery to Tennesseans but may also lead to noncompliance with federal requirements, which could impact the department’s continued access to federal support or participation in programs. RECOMMENDATION The department and STS should strengthen oversight and monitoring of vendor maintenance and system management for the department’s programs, including the TANF program. This should include updating their memorandum of understanding to clearly define each party’s responsibilities for monitoring vendors and system controls. At the statewide level, STS should work with the Information Systems Council to continue developing and refining guidance for overseeing third-party vendor risk related to vendor-maintained and managed systems, including those supporting TANF. The department and STS should update their vendor-management practices as statewide guidance is finalized. The department and STS should continue to correct the confidential control weaknesses identified during our audit and assign staff to monitor these areas moving forward. Finally, department management and STS management should evaluate the risks noted in this finding and implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. MANAGEMENT’S COMMENT Department Management and STS We concur. STS has taken steps to address the issues identified, implemented new processes to enhance oversight and risk management, and will continue to refine these efforts in alignment with evolving state policies and guidance. STS is working with DHS to establish a new Interagency Agreement that explicitly outlines each party’s responsibilities in monitoring vendor performance, validating security controls, and responding to risks associated with vendor-managed systems. In an effort to establish consistent standards for monitoring vendors, assessing technical safeguards, and ensuring alignment with applicable state and federal control frameworks, including the GAO Green Book and NIST 800-53, STS has also developed and presented a new Information Systems Council (ISC) policy regarding statewide guidance on third-party vendor oversight. Additionally, STS reviewed and updated departmental risk assessment documents to reflect third-party IT vendor oversight controls.

Finding Number 2025-011 Assistance Listing Number 64.053 Program Name Payments to States for Programs to Promote the Hiring and Retention of Nurses at State Veterans Homes Federal Agency Department of Veterans Affairs State Agency State Veterans’ Homes Board Federal Award Identification Number N/A Federal Award Year 2025 Finding Type Noncompliance Compliance Requirement Activities Allowed or Unallowed Allowable Costs/Cost Principles Repeat Finding N/A Pass-Through Entity N/A Questioned Costs $94,375 FINDING Tennessee State Veterans’ Homes Board management improperly claimed reimbursement from the federal nurse retention grant BACKGROUND In 2022, the U.S. Department of Veterans Affairs (VA) established a nurse retention grant program to help state veterans’ homes hire or retain nurses who provide direct clinical care to residents. For federal fiscal year 2025, the VA approved the Tennessee State Veterans’ Home Board’s (the board’s) application for grants for the Clarksville, Humboldt, Knoxville, and Murfreesboro veterans’ homes, as these homes had struggled with nursing turnover. The board used the grant funds to implement financial incentives to encourage nurses to join their staff, including bonuses for new-hire retention, referrals, and mentoring.(23) Figure 1 summarizes each financial incentive program. See Schedule of Findings and Questioned Costs for footnote. See Schedule of Findings and Questioned Costs for figure. Based on our discussions with management and a review of the incentive programs management described to us, management pays employees quarterly for the retention bonus and mentor incentive programs if the employee remains employed for that time. The referral bonus is paid after 90 and 180 days of successful employment. Each quarter, the executive office staff submits a reimbursement invoice to VA to recover 50% of the incentives/bonuses paid to the employees. CONDITION AND CRITERIA As part of the veterans’ homes’ grant application process, the VA approved the veterans’ homes’ referral and mentor bonuses, as well as the tuition/student loan reimbursement, as these programs aligned with the federal grant’s purpose to improve the nursing shortage each home faced. Based on our review of the grant application and agreement, however, we found that VA had not specifically approved the new-hire retention bonus as an allowable program for federal reimbursement. Furthermore, the VA approval letter for each nursing home states, The funds are to be used solely for the purpose of the specific employee incentive programs. In the original VA grant application, management did not include a description of new-hire retention bonuses in its description of the planned incentive programs. As such, the VA was not aware of the new-hire retention bonus program when it approved the other incentive programs. Based on our review of grant reimbursement records, we found that, even though the program was not specifically approved, management invoiced $94,375 in new-hire retention bonus payments under the approved mentor program category. In addition, we noted instances of employees participating simultaneously in both the mentor program and the new-hire retention bonus program, and management sought reimbursement for both programs through the mentor program category. CAUSE Based on our discussion with management, the new-hire retention bonus program was not explicitly described in the grant application, but management asserts that the program was included as part of the mentor program. EFFECT When management improperly invoices the federal grantor for unapproved programs, there may be fewer funds available for the approved incentive programs. For example, as of March 2025, management had exhausted all its federal nurse retention grant funds for its Clarksville home because they included the new-hire retention bonuses. Furthermore, management has submitted false claims to the federal grantor and may be required to pay back the improperly used funds. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 208(c), “Specific conditions,” these conditions may include (1) Requiring payments as reimbursement rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance; (3) Requiring additional or more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the recipient or subrecipient to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should seek specific approval from VA to use the nurse retention grant funds to assist with the new-hire employee retention bonus program or use veterans’ homes funds to pay for the new-hire bonuses. Management should contact the federal grantor for guidance on how to remedy the improper billings. MANAGEMENT’S COMMENT We concur in part: While our grant application did not explicitly itemize retention bonuses, their use is consistent with the framework and intent of the grant, as defined in 38 CFR Part 53.11(b), which states the purpose is for an “employee incentive program to reduce the shortage of nurses at the TSVH.” We are also actively consulting with the VA to clarify the status of prior billings and determine the appropriate path forward if any are deemed improper. As of the date of this update, we have not received a response. AUDITOR’S COMMENT As of the date of this report, the Veterans’ Home Board's management has not received explicit approval from the VA to use the nurse retention grant funds to support the new-hire employee retention bonus program.

Finding Number 2025-001 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2024 and 2025 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2024-002 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the two prior audits, Tennessee State University continued to have inadequate procedures to ensure Title IV credits were refunded in accordance with federal guidelines, and in the current year, did not properly provide disbursement notifications BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. These Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, a student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of the total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. As a condition of these programs, institutions must provide notifications of the amounts awarded and loans disbursed. In addition, institutions are required to refund credits to the student’s account within 14 days of posting the award to the student’s account. CONDITION AND CAUSE In response to the prior finding, which noted compliance issues during the 2024 academic year, management, in collaboration with outside consultants, had begun to refine financial aid procedures, including reactivating the automatic refund process for spring 2025 with enhanced automatic notifications for all students receiving loan disbursements. Management also emphasized the need to fill the vacant Account Manager position in the Bursar’s office. However, refining these procedures did not adequately address compliance issues for the 2025 academic year. We tested a sample of 40 Title IV recipients at Tennessee State University (the university) to determine whether the university met disbursement requirements, and we identified errors in 40 (100%) of the Title IV recipients. These requirements included refunding any credits to student accounts created by Title IV aid within 14 days of the disbursement; sending a general notification to Title IV recipients that included the expected disbursement date, amount, and type of aid awarded; and notifying Direct Loan borrowers when their loans were disbursed. The university had disbursement errors with all 40 students selected for testing, resulting in a total of 72 disbursement errors. Figure 1 details the number of students with multiple errors identified. See Schedule of Findings and Questioned Costs for figure. Refund Timeliness Of the 40 students tested, 23 had a credit balance resulting from the disbursed Title IV aid. We noted that 3 of the 23 students (13%) had Title IV credits that were not refunded within 14 days of the disbursement date. These 3 separate refunds were not refunded timely, ranging from 19 to 84 days late. · For 1 student, the university did initially provide a timely refund; however, the refund was insufficient. The university applied the complete refund 84 days late. · For 2 students, the university applied Title IV aid retroactively to the fall 2024 term, creating a credit balance. The university refunded these balances 19 and 57 days late. Award and Direct Loan Disbursement Notifications We also tested our sample to determine whether 2 required notifications were sent to students. The first required letter notifies students of the amount and type of Title IV funds they are expected to receive, as well as how and when the disbursements will be made. This notification must be sent prior to the university making any disbursements. The university uses an automated system to notify students of the Title IV aid they have been awarded. The template used for the general award notifications does not specify when students can expect to receive their aid. Because the university did not include expected disbursement dates in the general award notifications sent to students, and every Title IV recipient in our sample received at least 1 general award notification, this error was recorded for all 40 students (100%). In addition, we identified other general award notification errors for 25 of the 40 students (63%) tested. · For 22 of the students tested, the university did not provide notification of their Title IV aid to be applied for the spring 2025 term. · For 2 of the students tested, the university did not provide notification of their Title IV aid to be applied for the fall 2024 term. · For 1 of the students tested, the university did not provide notification of their Title IV aid until after the disbursement date. The student was notified 3 times, representing 1, 2, and 8 days late. The second required letter is specific only to those students receiving Direct Loans or Teacher Education Assistance for College and Higher Education (TEACH) Grants. The letter notifies students of 1) the date and amount of the disbursement, 2) the student’s or parent’s right to cancel, and 3) the procedure and time by which the student or parent must notify the institution that they wish to cancel. We noted that 30 students in our sample received Direct Loans and should have received a disbursement notification. However, 4 of these 30 students (13%) did not receive a disbursement notification for their Direct PLUS Loans. Management did not send these notifications because the notification system was not programmed to trigger when a student only received Direct PLUS Loans. Management acknowledged that a change in administration delayed system access, resulting in the failure to correct the system and properly notify students of fall 2024 disbursements in a timely manner. CRITERIA The 2024–2025 Federal Student Aid Handbook, Volume 4, Chapter 2, states, If FSA [federal student aid] disbursements to a student’s account at the school create a Title IV credit balance, the school must pay the credit balance directly to the student or parent as soon as possible but no later than 14 days after: [emphasis in original] • the first day of class of a payment period if the credit balance occurred on or before that day, or • the balance occurred if that was after the first day of class. In addition, Volume 4, Chapter 2, of the handbook states, A school must notify a student of the amount of funds the student and their parent can expect to receive from each FSA program, including FWS [Federal Work Study], and how and when those funds will be disbursed. This notification must be sent before any disbursements are made. Finally, Volume 4, Chapter 2, of the handbook also states,: Except in the case of loan funds made as part of a post-withdrawal disbursement (see Volume 5 for notification requirements in such cases), when Direct Loan or TEACH funds are being credited to a student’s ledger account, the school must also notify the borrower in writing (paper or electronically) of the: • anticipated date and amount of the disbursement; • student’s or parent’s right to cancel all or a portion of a Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement and have the loan proceeds or TEACH Grant proceeds returned to the Department; and • procedures and deadlines by which the student or parent must notify the school that they wish to cancel the Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. EFFECT Timely refunding credits to students is essential to fulfilling the goals of Title IV programs. Students may depend on these refunds to pay for non-institutional charges, such as off-campus housing, transportation, or meals. Furthermore, if the university does not notify students of expected aid, this could impact decision-making for students and their families when determining whether to attend the university. Without these funds, students may not have the resources to pay for these potentially significant costs, which can be a barrier to a successful college career. In addition, failure to notify students of important deadlines and information regarding their Direct Loans or TEACH Grants could cause students to incur loans they wished to cancel, resulting in unwanted debt. Finally, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate the university’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. RECOMMENDATION Management should revise and adequately document procedures to ensure that students receive the required disbursement notifications and to ensure that credits on student accounts are refunded within 14 days of Title IV aid being disbursed. In addition, leadership should take necessary steps to provide adequate staffing and training to ensure compliance. Finally, management should establish additional review procedures to meet disbursement requirements. MANAGEMENT’S COMMENT We concur. The Refund Timeliness and Disbursement Notification Accountabilities are owned by the Bursar’s Office and the Financial Aid Office, respectively, and as such have required separate remediation. While we have made significant improvements, including updating process documents, increasing external staffing support, and internal training, the University’s “last dollar” scholarship approach creates more complexity that we continue to address. Post fiscal-end June 30, 2025, we have updated the text scripts to ensure all required information is included, as well as activated non-term specific automated notifications. These updates were put into place for the Fall 2025 semester and are expected to provide additional safeguards from these errors going forward. Additionally, our comprehensive corrective action is to rebuild our application of payment sequencing, including creating new detail codes with accurate parameters for all awards. This will allow our Banner system to properly automate refunds without the manual initiation and interventions currently required. We expect this project to be completed by the Fall 2026 semester.

Finding Number 2025-002 Assistance Listing Number 84.063 and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2024 and 2025 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2024-003 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the two prior audits, for the federal Direct Loan and Pell Grant programs, Tennessee State University continued to not report timely and accurate information regarding students’ enrollment statuses BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For student recipients of Pell Grants or Direct Loans, ED requires institutions to report students’ enrollment statuses for each term to the National Student Loan Data System (NSLDS). The institution is also required to report changes to students’ enrollment, such as graduations, withdrawals, and transitions between full-time and part-time status. Tennessee State University’s (the university) Enrollment Reporting Office reports directly to the National Student Clearinghouse (NSC). The data entered into NSC is automatically uploaded to NSLDS. It is then the responsibility of the university’s management to maintain the data in NSLDS and make any necessary changes or updates. CONDITION AND CAUSE University management, in response to the prior finding, hired additional staff, reviewed and updated operational procedures, and communicated the withdrawal process in training and staff meetings; however, these corrections did not resolve the issues around enrollment reporting and withdrawal dates. We tested a sample of 60 Direct Loan borrowers and/or Pell Grant recipients at the university. During our testing, we found that the university did not correctly report status changes in NSLDS for 9 of the 60 students (15%). These 60 students had a total of 93 reportable status changes during the academic year, and management incorrectly reported 11 of those 93 (12%) status changes to NSLDS as of July 30, 2025 (the date of our testwork). As stated above, a status change includes changes to students’ enrollment, such as graduations, withdrawals, and transitions between full-time and part-time status. There were instances where management reported the proper enrollment information in NSC; however, we noted the information in NSLDS was incorrect. Despite management’s responsibility to ensure that enrollment information is correctly reported in NSLDS, management either did not properly update the enrollment information in NSLDS or did not review the information to ensure statuses were accurate. Management was unable to determine the cause of the discrepancies that led to improper reporting in NSLDS. The errors included instances of statuses not reported and reported incorrectly. Specifically, we found the following: Not Reported · For 1 student, the university did not report the student as attending three-quarters time for the fall 2024 term. There was no enrollment history in NSLDS for this student until the spring 2025 term. · For 1 student, the university did not report the student’s status, despite the student being enrolled in 9 credit hours. · For 1 student, the university had not reported the student’s full-time status to NSLDS, as of the date of our testwork, July 30, 2025. During the first week of the spring 2025 term, 1 student increased enrollment to half-time and then changed to full-time 9 days later. This error is likely due to the half-time status being reported 58 days late. · For 1 student, management could not provide any enrollment history in NSLDS. The student had 2 status changes that should have been reported for the 2024 fall term. According to management, the cause was likely due to the student being purged and then reinstated in the middle of the semester. · For 1 student who completed academic requirements in fall 2024 and graduated in May 2025, the university did not update the reporting roster to reflect the student’s graduation status. · For 1 student, the university did not report the student’s May 2025 graduation. As of July 30, 2025, the date of the testwork, NSLDS still showed the student as attending full-time. In addition to failing to report the student’s graduation status, because the student had federal loans, the university was required to report the status change within 60 days, but failed to do so. Reported Incorrectly · For 1 student, the university incorrectly reported the student as three-quarters time, despite the student being enrolled in 12 credit hours for the entire spring 2025 term. Management should not have reported a status change. · For 1 student, the university incorrectly reported the student as less than half-time despite the student being enrolled in 11 credit hours, which should have been three-quarters time. · For 1 student, management reported an incorrect effective date. The student began attending full-time on August 23, 2024. However, the university did not update the student’s enrollment status to full-time until the following spring semester and reported an effective date of January 3, 2025—133 days after the actual status date. CRITERIA The 2024–2025 Federal Student Aid Handbook, Volume 2, Chapter 3, states that institutions “must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that file.” In the introduction to Chapter 1, the NSLDS Enrollment Reporting Guide states, “Accurate and timely Enrollment Reporting to NSLDS is essential to the Department of Education’s successful delivery of Title IV aid.” The requirements are established in Title 34, Code of Federal Regulations, Part 685, Section 309(b). Chapter 4.4.2 of the NSLDS guide states, Enrollment Status Effective Date is the date that the current enrollment status reported for a student was first effective. . . . Effective Date, and its related enrollment status, must be reported for both the Campus-Level (Campus Enrollment Effective Date) and the Program-Level (Program Enrollment Effective Date), however the dates may not always match, depending on the student’s circumstance. In addition, Chapter 7.14.4 of the NSLDS guide states, “NSLDS records must be accurately matched with your enrollment records. You should review, update, or verify student enrollment statuses and other information with information that appears on the Enrollment Reporting Roster file.” EFFECT Timely and accurate enrollment reporting is critical for effective management of ED programs. The accurate administration of the Title IV programs depends heavily on the accuracy of the enrollment information reported by schools. Accurate, timely, and complete enrollment data is also important to the students, who can view their current campus enrollment information and their program enrollment history. Also, if an individual no longer attends the university but their lack of attendance is not reported, the individual’s loan repayment grace period could be improperly extended, resulting in the student’s loan repayments being improperly deferred. In addition, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate its participation in a Title IV program. These actions would negatively affect the university’s operations and the students impacted by the loss of Title IV aid. RECOMMENDATION Management should review and update its processes as necessary to ensure the Enrollment Services Office uploads and submits the correct information to NSLDS. In addition, the Assistant Vice President of Admissions and Records should ensure that staff know reporting deadlines and the importance of reporting enrollment status changes. The Assistant Vice President of Admissions and Records should also ensure that enrollment status changes are reported timely and the Financial Aid Office is promptly notified. Management should implement a review throughout each term to verify that accurate information is reported in NSLDS. MANAGEMENT’S COMMENT We concur. The management of and the compliance with Title IV programs accountability is jointly owned by the Admissions & Records Office and the Financial Aid Office, and as such require commingled remediation. While we have made significant improvements in the activities in the separate areas, including hiring additional staff, updating process documents, and re-emphasizing the process during staff meetings, these findings reflect there is more to do related to the connectivity activities and procedures of the Offices to ensure both accurate and timely reporting of students’ enrollment statuses. We have identified this is particularly critical in the compliance procedures that require sequential actions by different departments. Starting in the Fall 2025 semester, the Financial Aid Office receives an automated file of the students who have withdrawn that day. This report serves as a notice to review and update students’ enrollment statuses. The additional procedure helps to ensure accurate dates are being captured timely. In addition to the process improvements, we continue to create a higher standard of operating effectiveness to ensure all critical policies and procedures are being executed properly without exception.

Finding Number 2025-003 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2024 and 2025 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2024-004 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.063 Federal Award Identification Number P063P070381 Amount $10,757 Assistance Listing Number 84.268 Federal Award Identification Number P268K250381 Amount $743 FINDING As noted in the two prior audits, Tennessee State University continued not to return Title IV funds in compliance with federal regulations BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For Title IV recipients who did not complete at least 60% of the semester, the school is required to perform a calculation to determine the amount of unearned aid that it must return to ED. The university is responsible for the institution’s calculated return. The university has no role in returning any portion of the student’s calculated return when the only impacted aid is Direct Loans. CONDITION In response to the prior audit finding, management stated that the university would improve the communication process between the Registrar’s Office and the Financial Aid Office by sending a confirmation acknowledgement email upon receiving the daily withdrawal report. This update was insufficient in addressing the ongoing compliance issues. We tested two groups of students who officially or unofficially withdrew from classes at Tennessee State University (the university) during the 2024–2025 award year: those who completed less than 60% of the semester and those who completed more than 60% of the semester. Testwork on Students Who Completed Less Than 60% of the Semester First, we selected 38 student withdrawals from a population of 106 students who had an official or unofficial withdrawal before the 60% completion date. We tested these withdrawn students to ensure that their withdrawal dates were accurate, that staff performed return calculations correctly, and that the university returned the correct amounts to ED within the required timeframes. All 38 student withdrawals (100%) we reviewed contained errors, with a total of 55 distinct issues. The university did not properly identify 3 withdrawals (8%) as official, did not return unearned funds or disburse post-withdrawal earned funds within the required timeframe for 34 withdrawals (89%), and miscalculated the Title IV funds to be returned to ED for 16 withdrawals (42%). Additionally, university management could not support the last date of attendance for 2 withdrawals (5%). We tested these cases using the withdrawal dates recorded in the university’s system; however, we were unable to verify their accuracy. Errors related to timeliness and calculation are detailed below. Timeliness Of the 38 student withdrawals, the university did not return funds within the required timeframe for 34 student withdrawals (89%). For 3 of these students, the university had not returned any funds as of the testwork date, October 8, 2025 (making the university 306 to 373 days late). The remaining 31 withdrawals were returned more than 45 days after the date of determination, with delays ranging from 99 to 203 days. Calculation Errors Of the 38 student withdrawals, 16 involved miscalculations of return of funds, resulting in questioned costs of $9,042 and over-returns of $13,872. Specifically, we found the following: • For 2 students, the university incorrectly determined the withdrawal date to be before the 60% completion point. However, 1 student’s last date of attendance and another student’s manual withdrawal occurred after the 60% point. The university should not have returned Title IV aid because both students completed at least 60% of the semester, resulting in an over-return of $6,265. • For 2 students, the university incorrectly calculated that the students were eligible for an additional disbursement of funds; however, a return should have been calculated, resulting in questioned costs of $1,169. • For 1 student, the university calculated and returned the correct amount, but later reversed the return and re-credited the student’s account. These funds should have been returned, resulting in questioned costs of $843. • For 1 student, the university used an incorrect withdrawal date of October 3, 2024, instead of the official date of September 18, 2024. Additionally, management incorrectly identified funds as undisbursed. By using a later withdrawal date and overreporting undisbursed aid, the university reduced the calculated institutional return amount; however, the university returned both the institution’s and the student’s share. These errors resulted in an over-return of $3,269. • For 2 students, the university used incorrect withdrawal dates. For the first student, management recorded the withdrawal date as October 1, 2024, instead of the correct date of September 27, 2024. For the other student, management treated the withdrawal as unofficial with a date of October 10, 2024, although the student had submitted an official withdrawal form dated September 10, 2024. These errors resulted in questioned costs of $2,530. • For 4 students, the university used incorrect dates for the beginning and ending of the term in the return calculation. For the fall term, the university used August 26 to December 6 instead of August 19 to December 5. For the spring term, the university used January 3 to May 5 instead of January 14 to May 2. Additionally, for 2 of these students, the university returned funds that only affected Direct Loans and were not the institution’s responsibility. These errors resulted in questioned costs of $667 and an over-return of $3,568. • For 4 students, the university miscalculated the return of funds, but we could not identify why the errors occurred. These cases resulted in questioned costs of $3,833 and an over-return of $770. Testwork on Students Who Completed More Than 60% of the Semester We also reviewed all 14 student withdrawals where students had completed more than 60% of the semester in which they withdrew. We tested these withdrawn students to ensure that the university recorded the withdrawal date correctly, had adequate attendance records to support the withdrawal date, and did not remove Title IV funds from the account. Of the 14 student withdrawals, we identified 6 errors (43%). For 1 student withdrawal (7%), management was unable to support an official withdrawal. For 5 student withdrawals (36%), the university recorded inaccurate withdrawal dates, with discrepancies ranging from 1 to 40 days. Due to the withdrawal date errors, management misclassified 1 student, marking them as withdrawn after the 60% point when they actually withdrew before completing 60% of the term. In this case, the university should have calculated and returned Title IV aid, resulting in questioned costs of $2,458. CRITERIA The 2024–2025 Federal Student Aid Handbook, Volume 5, Chapter 1, states, A pro rata schedule is used to determine the amount of Title IV funds the student has earned at the time of withdrawal up through the 60% point in each payment period or period of enrollment. After the 60% point in the payment period or period of enrollment, a student has earned 100% of the Title IV funds the student received and was scheduled to receive during the period [emphasis in original]. The 2024–2025 Federal Student Aid Handbook, Volume 5, Chapter 2, Part 2, states, • [Student’s Withdrawal Date] Official Notification – The date the student begins the school’s withdrawal process, or the date that the student otherwise provides notification (If both circumstances occur, use the earlier withdrawal date) [emphasis in original]. • Official Notification Not Provided – The date that the school determines is related to the circumstance beyond the student’s control, or the midpoint of the payment period or period of enrollment, as applicable. . . • [Alternative approach] In place of the dates listed, a school may always use, as a student’s withdrawal date, the student’s last date of attendance at an academically related activity if the school documents that the activity is academically related and that the student attended the activity. The 2024–2025 Federal Student Aid Handbook, Volume 4, Chapter 3, states, Schools must return funds disbursed to a student who failed to begin attendance as soon as possible but no later than 30 days after the date they become aware that the student has not begun and will not begin attendance [emphasis in original]. The 2024–2025 Federal Student Aid Handbook, Volume 5, Chapter 2, Part 1, states, An institution is not required to return the inadvertent overpayment immediately but must return it within 45 days of the date of the institution’s determination that the student withdrew (the time frame for an institution’s return of Title IV funds under 34 CFR [Code of Federal Regulations] 668.22(j)(1)). An institution must return an inadvertent overpayment in accordance with the applicable regulations for returning overpayments. Please see Volume 4, Chapter 3 for more information on overpayment procedures [emphasis in original]. CAUSE Based on our review, it appears that management did not have proper oversight and review procedures over the return of Title IV funds, as we noted multiple issues regarding both the calculation itself as well as the timing. Specifically, the university performed the Title IV return calculation using cost of attendance instead of institutional charges and entered the withdrawal date as the date the withdrawal was processed instead of the last date the student attended or the date on the signed withdrawal forms. In addition, management did not have a system in place to ensure all withdrawals and returns were processed timely. The Director of Financial Aid also stated that the Financial Aid Office temporarily lost access to federal systems due to significant staff turnover. Additional delays occurred during the implementation of policy changes under the new federal administration. EFFECT For the 52 students tested, the university over-returned $13,872 and under-returned $11,500 to students. The $11,500 was identified as questioned costs. Violations of the federal requirement to timely return Title IV funds to ED could result in ED imposing a fine on the university and/or limiting, suspending, or terminating the university’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. In addition, incorrect return calculations and/or withdrawal dates can negatively impact students. If the university incorrectly calculates and returns the amount of unearned aid to ED, the errors could impact the amount of aid the student is eligible to receive in future terms or could result in a student having an incorrect account balance. RECOMMENDATION The Registrar’s Office and the Financial Aid Office should follow federal regulations. Management should ensure that the Financial Aid Office reperforms all return of Title IV funds calculations and makes necessary corrections to student and federal fund accounts for the 2024–2025 academic year. Finally, management should ensure that the Registrar’s Office communicates any withdrawals to the Financial Aid Office in a timely manner. MANAGEMENT’S COMMENT We concur. The management of and the compliance with Title IV programs accountability is jointly owned by the Registrar’s Office and the Financial Aid Office, and as such requires commingled remediation. We have made significant improvements by automating the potential return calculation for students with less than 60% of the semester complete and documenting the procedures for these instances. However, these findings reflect there is more to do related to the validation of the input data (i.e., dates) to ensure output accuracy (i.e., the calculation) as well as the coordination between the two offices to initiate action when a student withdrawal occurs. We have identified this step as particularly critical and pervasive to our compliance. As stated in the response to Finding 2025-002, the Financial Aid Office now receives an automated file of the students who have withdrawn that day. This report serves as a notice to review and update students’ enrollment statuses. The additional procedure helps to ensure accurate dates are being captured timely. Additionally, our comprehensive corrective action, referred to in Finding 2025-001, to rebuild our application of payment sequencing will allow the automation of the returns once calculated. In addition to the process improvements, we continue to create a higher standard of operating effectiveness to ensure all critical policies and procedures are being executed properly without exception.

Finding Number 2025-004 Assistance Listing Number 10.553, 10.555, 10.556, and 10.582 Program Name Child Nutrition Cluster Federal Agency Department of Agriculture State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2022 through 2025 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding 2024-005 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior audit, the Department of Education did not establish internal controls related to federal reporting requirements for the Child Nutrition Cluster and did not comply with the requirements BACKGROUND The Department of Education (the department) is the pass-through entity for the Child Nutrition Cluster (1), which is administered by the Food and Nutrition Service of the U.S. Department of Agriculture. The Child Nutrition Cluster is a cluster of federal programs to provide healthful, nutritious meals and snacks to eligible children in public schools and nonprofit private schools, residential childcare institutions, and summer recreation programs. See Schedule of Findings and Questioned Costs for footnote. For the School Breakfast Program, the National School Lunch Program, and the Special Milk Program for Children, the department enters into agreements with subrecipient organizations, known as school food authorities (SFAs), which operate the programs at the local level and deliver program services to eligible children. The department reimburses SFAs for each meal or snack served based on the rates established by the U.S. Department of Agriculture. Each month, the SFAs claim the number of meals or snacks served using the department’s Tennessee: Meals, Accounting, and Claiming (TMAC) system. For the Fresh Fruit and Vegetable Program, (2) the department enters into additional agreements with approved SFAs for eligible elementary schools within those SFAs to operate the program at the local level and deliver program services to eligible children. The department awards a grant amount for each elementary school based on a per-child rate set by the department. Each month, the SFAs claim procurement, operations, and administration costs using the department’s TMAC system. See Schedule of Findings and Questioned Costs for footnote. The Federal Funding and Accountability Transparency Act (FFATA) requires the department to report subrecipient subaward financial information for all subawards over $30,000. Before March 2025, FFATA information was reported in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The last month the department reported in FSRS was February 2025. In March 2025, FSRS was retired and fully transitioned to the System for Award Management (SAM).(3) According to federal regulations, reports are due “no later than the end of the month following the month in which the subaward was issued.”(4) The subaward information in SAM is then available to the public on the USA Spending website for transparency. See Schedule of Findings and Questioned Costs for footnote. CONDITIONS AND CAUSES Fresh Fruit and Vegetable Program Based on our discussion with management, staff did not complete any FFATA reporting for the Fresh Fruit and Vegetable Program for the entire fiscal year. Based on our review of the claim information, staff did not report 29 program subawards, totaling $4,740,455, as required. We discussed the noncompliance with management and determined that the department has not designed and implemented a supervisory review process to ensure the Data Processing and Reporting Specialist identifies and reports all required subawards. School Breakfast Program, National School Lunch Program, and Special Milk Program for Children Reporting in FSRS (Before March 2025) Based on our walkthrough and discussion with the department’s School Nutrition staff, each month, the Data Processing and Reporting Specialist downloaded the current month’s reports from the TMAC system (which contained totals from the prior month) and manually combined and formatted the data for each individual SFA. This process included identifying and reporting the applicable amounts for the breakfast, lunch, snack, and milk programs. Once the information was compiled, the Data Processing and Reporting Specialist transferred the SFA data into the reporting template and uploaded the file to FSRS. For the period of July 2024 through February 2025, we obtained a population of 1,386 subawards, totaling $366,066,740. We selected a nonstatistical, random sample of 60 subawards, totaling $18,321,655, to determine if the department followed FFATA reporting guidance. Based on our review of the subaward documentation, we found that for 46 out of 60 (77%) items tested, the department either did not report the subaward amount or reported the subaward amount incorrectly. See Figure 1. See Schedule of Findings and Questioned Costs for figure. Based on our discussions with management and the results of our testwork, we determined that the incorrect or unreported amounts occurred because management has not designed and implemented a supervisory review process to ensure the Data Processing and Reporting Specialist identifies and accurately reports all required subawards. Reporting in SAM (After March 2025) Based on our discussion with management, after FFATA reporting transitioned from FSRS to SAM, staff did not complete any required FFATA reporting for the School Breakfast Program, the National School Lunch Program, and the Special Milk Program for Children.(5) Based on our review of the claim information for March through June 2025, staff did not report 190 SFA’s Child Nutrition subawards totaling $161,571,716. See Schedule of Findings and Questioned Costs for footnote. Management stated they did not report FFATA information after the transition from FSRS to SAM because the department did not have an Application Programming Interface(6) connection to automate the submission process, and entering each SFA individually into SAM would have required a significant amount of staff time. See Schedule of Findings and Questioned Costs for footnote. Our review of the department’s 2025 Financial Integrity Act Risk Assessment revealed that management identified a risk that federally required reports may not be accurate or completed on time. Management identified a second-level review of reports as a control activity to mitigate these risks; however, management noted in the risk assessment that the control was not effective and has yet to establish an effective control and update the risk assessment. Based on our review, the control was not effective for FFATA reporting because it was not placed in operation during our audit period. CRITERIA FFATA Reporting Appendix A to “Reporting Subaward and Executive Compensation Information,” Title 2, Code of Federal Regulations (CFR), Part 170, states: a. Reporting of first-tier subawards. 1. Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. 2. Reporting Requirements. i. The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at http://www.fsrs.gov [SAM.gov] ii. For subaward information, report no later than the end of the month following the month in which the subaward was issued. Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Additionally, Green Book Principle 10.02, “Response to Objectives and Risks,” Management designs control activities in response to . . . risks to achieve an effective internal control system. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives to achieve the entity’s objectives and address related risks. EFFECT Not meeting the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Specific conditions may include the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance; (3) Requiring additional or more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the recipient or subrecipient to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner should implement the supervisory review process documented in the risk assessment to ensure all subawards are reported completely and accurately in SAM as required. MANAGEMENT’S COMMENT The department concurs with this finding. The department’s State Director of School Nutrition, Senior Compliance and Data Manager, and Data Processing and Reporting Specialist have been working with the Federal Funding and Accountability Transparency Act (FFATA) System for Award Management (SAM) administrators to submit the required reports. The department is pursuing both internal practice adjustments and external collaboration with the United States Department of Agriculture (USDA) to ensure proper reporting. Internally, the department is working to develop an application programming interface (API) between the department’s nutrition data system and the recently updated federal reporting system to promote seamless report submissions. Externally, the department is collaborating with the Office of the CFO for the United States Department of Agriculture (USDA), noting the lack of more robust bulk upload options in the federal reporting system compared to the prior system. The department, alongside other states, continues to work with USDA to determine more efficient bulk upload options to streamline federal data reporting. The department will continue to leverage both these efforts to ensure reporting requirements are met. The department has created and deployed a standard operating procedure (SOP) to inform staff of the responsibilities our office has in uploading the required reports. The department will also include a certification process in its standard operating procedures so that reports are reviewed prior to submission in the SAM platform.

Finding Number 2025-005 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2022 and 2025 Finding Type Material Weakness and Noncompliance Compliance Requirement Matching, Level of Effort, Earmarking Repeat Finding 2024-006 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the two prior audits, Department of Education management did not establish internal controls related to Maintenance of Effort (MOE) and matching requirements, and did not comply with state administrative MOE requirements BACKGROUND AND COMPLIANCE CRITERIA The U.S. Department of Education provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006 (Perkins Act). The Perkins Act was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act, which provides grants to states to develop the academic knowledge and technical and employability skills of secondary and post-secondary students. As a recipient of federal funding, the department is subject to federal Matching and Level of Effort – Maintenance of Effort (MOE) requirements. Section 112(b) of the Perkins Act requires the department to match federal funds reserved for State Administration with non-federal funds, such as state appropriations, on a dollar-for-dollar basis. Sections 211(b) and 223(a) of the Perkins Act specify the following MOE requirements: • Section 211(b) requires the department to maintain its fiscal effort from state appropriations for CTE at a level not less than that of the preceding fiscal year. For example, state resources allocated for fiscal year 2025 must be equal to or greater than the amount allocated for fiscal year 2024. • Section 223(a)(7) additionally requires the department to contribute, from non-federal sources, an amount for State Administration that is at least equal to the amount contributed in the previous fiscal year. See Schedule of Findings and Questioned Costs for footnote. Each year, the U.S. Department of Education requires Perkins recipients to submit financial and performance information through the Consolidated Annual Report (CAR). The CAR includes data used to verify compliance with MOE requirements, including both Section 211(b) and 223(a) of the Perkins Act. Department staff prepare the CAR in January using data from the most recently completed fiscal year. For example, the CAR submitted in January 2025 included fiscal data for fiscal year 2024, and the CAR submitted in January 2024 included fiscal data for fiscal year 2023. PRIOR AUDIT RESULTS In the two prior single audits, we reported a finding related to the Matching, Level of Effort – Maintenance of Effort, and Earmarking compliance requirement. Specifically, we noted that department management had not developed or implemented adequate policies and procedures to ensure compliance with the matching(8) or MOE(9) requirements. The absence of controls limited management’s ability to provide sufficient documentation demonstrating compliance. See Schedule of Findings and Questioned Costs for footnote. As a result of these internal control deficiencies, we reported the following compliance-related conditions: • department management was unable to provide documentary evidence supporting compliance with matching requirements; and • department management was unable to provide documentation supporting adjustments or final amounts reported in the CAR for compliance with MOE. Department management concurred with the prior audit finding and stated that they would take corrective action, including assigning clear responsibility for control activities and compliance related to these requirements, developing policies and procedures, and maintaining documentation of review activities. CONDITION AND CAUSE Repeated Conditions Based on our review of controls and testwork to determine compliance, we found that although the department met both matching and overall MOE requirements for the program, management had still not established controls for the matching and MOE process. Specifically, management has yet to develop policies and procedures and maintain documentation of management’s review activities. The following repeated conditions are described as follows. Matching Based on our discussions with department management, CTE program staff attend monthly budget meetings to review and discuss program expenditures, which include both federal and state expenditures, and determine if any adjustments are needed. Department management thought that matching requirements were a part of this review; however, based on discussion with CTE program staff, the monthly budget meetings consist of a review for program allowability and not matching requirements specifically. Maintenance of Effort According to the Fiscal Director, the department’s Budget Director provides the financial data for the CAR each year from Edison, the state’s accounting system. The Fiscal Director stated that she reviews the financial data and discusses any concerns or questions with CTE Program Managers. However, the Fiscal Director was unable to provide any documentation of her review or discussion with the program managers. New Condition Additionally, we noted one new condition in the current audit. According to the CARs for fiscal years 2023 and 2024, the department reported non-federal contributions of $1,784,950 in 2023 and $1,262,644 in 2024 for State Administration. As a result, the department’s non-federal contributions decreased by $522,306 from fiscal year 2023 to fiscal year 2024, and department management was unable to provide any additional documentation to demonstrate compliance with Section 223(a) of the Perkins Act. Department management stated that their normal process is to review administrative expenditures and make necessary adjustments each year to meet state administrative MOE requirements; however, this process did not occur during fiscal year 2024. Current Risk Assessment and Internal Control Criteria In the department’s December 2024 Financial Integrity Act Risk Assessment, management identified risks associated with determining and meeting matching requirements for external grants, as well as risks related to maintaining compliance with overall MOE requirements. Management identified scheduled reviews as a control activity intended to mitigate these risks. However, based on the results of our review, we determined that management’s review procedures were not effective in reducing the risks of noncompliance with matching and MOE requirements. CRITERIA According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303, a non-federal entity must (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. . . . (c) Evaluate and monitor the non-Federal entity’s compliance with statutes, regulations, and the terms and conditions of Federal awards. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 10.03, “Design of Appropriate Types of Control Activities,” states, Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. Also, Green Book Principle 12.03, “Documentation of Responsibilities Through Policies,” states, Management documents in policies for each unit its responsibility for an operational process’s objectives and related risks, and control activity design, implementation, and operating effectiveness. Green Book Principle 12.04, “Documentation of Responsibilities Through Policies,” states, Management communicates to personnel the policies and procedures so that personnel can implement the control activities for their assigned responsibilities. EFFECT Without appropriate internal controls over matching and MOE requirements, there is an increased risk that the department will not comply with applicable federal requirements and may miscalculate the state's required matching and MOE amounts. Such miscalculations could result in noncompliance, placing the department at risk of a reduction in federal funding for CTE activities in subsequent award years. A reduction in federal funding could, in turn, adversely affect the department's ability to provide essential services to students in Tennessee schools. Federal regulations outline the actions that federal agencies may take if a state entity fails to comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Department management should design and implement effective internal controls to ensure compliance with federal matching and MOE requirements. These controls should include developing and documenting key processes and procedures to promote consistent and ongoing compliance. Management should also ensure they maintain documentation of review activities to demonstrate compliance and support ongoing monitoring of matching and MOE requirements. In addition, management should periodically evaluate the effectiveness of these control activities in mitigating identified risks and update the department’s annual risk assessment to reflect any new or revised controls implemented as a result of this finding. MANAGEMENT’S COMMENT The department concurs with this finding. Matching On July 10, 2025, cross‑divisional staff members from the Tennessee Department of Education (TDOE) participated in a virtual training with Andrew Johnson from the U.S. Department of Education (ED), Office of Career, Technical, and Adult Education (OCTAE). The training agenda included an overview of matching requirements for the Perkins grant. Additionally, TDOE has procured training scheduled for April 1, 2026. Cross‑divisional staff members will engage in a full day of training focused on both programmatic and fiscal topics, including matching requirements, to further build team capacity. To support internal collaboration, CTE program staff currently attend monthly budget meetings to review and discuss program expenditures—including both federal and state funds—and determine whether adjustments are needed. Historically, these meetings focused primarily on program allowability; however, they were expanded to include a review of matching requirements specifically. Maintenance of Effort (MOE) On July 10, 2025, cross‑divisional staff members from the Tennessee Department of Education (TDOE) participated in a virtual training with Andrew Johnson from the U.S. Department of Education (ED), Office of Career, Technical, and Adult Education (OCTAE). The training agenda included an overview of Maintenance of Effort (MOE) requirements for the Perkins grant. Additionally, TDOE has procured training scheduled for April 1, 2026. Cross‑divisional staff members will engage in a full day of training focused on both programmatic and fiscal topics, including MOE requirements, to further build team capacity. The Fiscal Director reviews financial data and discusses any concerns or questions with CTE Program Managers. Processes have been updated to include documentation of these discussions. The team is implementing internal controls to ensure compliance with federal matching and MOE requirements. These controls include developing and documenting key processes and procedures to promote consistent and ongoing compliance. Documentation of review activities will be collected to demonstrate compliance and support ongoing monitoring of fiscal practices. In addition, leadership will evaluate the effectiveness of these control activities in mitigating identified risks and update the department’s annual risk assessment to reflect any new or revised controls implemented as a result of this finding.

Finding Number 2025-006 Assistance Listing Number 10.555 Program Name Child Nutrition Cluster Federal Agency Department of Agriculture State Agency Department of Agriculture Federal Award Identification Number N/A Federal Award Year 2024 and 2025 Finding Type Material Weakness and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Tennessee Department of Agriculture did not perform annual inventories at food storage locations resulting in noncompliance with federal inventory requirements for the Child Nutrition Cluster programs BACKGROUND The Department of Agriculture (the department) is a pass-through entity for the Child Nutrition Cluster,(10) which is administered by the Food and Nutrition Service of the U.S. Department of Agriculture (USDA). The Child Nutrition Cluster is a cluster of federal programs that provide nutritious meals and snacks to eligible children in public schools and nonprofit private schools, residential childcare institutions, and summer recreation programs. See Schedule of Findings and Questioned Costs for footnote. The department serves as a food distribution agency for one of the cluster’s five programs, the National School Lunch Program. Based on the food selections made by school food authorities (SFAs), who function as subrecipients, the department places orders with the USDA for donated foods.(11) USDA then ships the food directly to department-contracted warehouses for storage or sends it to processors for additional preparation.(12) As SFAs have the need and capacity, they coordinate the distribution of food from the warehouses to their participating schools. In fiscal year 2025, the department ordered $33,125,180 of USDA-donated foods on behalf of SFAs. Federal regulations(13) require the department to manage its food inventory in the warehouses by tracking receipts and distributions, performing at least one physical inventory count each year, and documenting adjustments to inventory records, such as losses due to spoilage. See Schedule of Findings and Questioned Costs for footnote. CONDITION AND CAUSE Based on our discussions with department management, we found that management did not conduct the required annual inventories at the food storage warehouses. Instead of performing physical inventories, management relied on reports from warehouses, processors, or SFAs of food inventory changes. When discussing inventory requirements with management, the Commodity Distribution Administrator stated that, since assuming the role in February 2024, he continued the processes established by prior program leadership and was not aware of the inventory and recordkeeping requirements applicable to the Child Nutrition Cluster. Although the department’s warehouse contracts require the contractor to provide inventory reports and specify “the State will require an annual physical inventory of USDA commodity foods and will reconcile physical and book inventories,” management acknowledged that they had not reconciled records with the actual inventory on hand. Management also stated that they do not have the staffing capacity to perform the annual physical inventories required for the food storage warehouses. Because the department did not perform and document physical inventories to reconcile to other records, the department could not determine the amount of USDA food losses for which USDA requires reporting and restitution. Management further noted that USDA conducted a federal program review of the department’s administration of the Child Nutrition Cluster in August 2025 and identified the lack of annual inventories for USDA foods stored in warehouse facilities as a compliance issue. Management explained they intended to wait for the final results of USDA’s review before initiating annual inventory procedures. In addition, our review of the department’s 2025 Financial Integrity Act Risk Assessment showed that, although the department identified certain controls related to USDA foods administered through other programs, management did not perform a similar risk assessment for food inventory associated with the Child Nutrition Cluster. CRITERIA Maintenance of Records and Inventory Management According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303(a), a non-federal agency must: Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, according to 7 CFR 250.12(b), The distributing agency must ensure that donated foods at all storage facilities used by the distributing agency (or by a subdistributing agency) are stored in a manner that permits them to be distinguished from other foods, and must ensure that a separate inventory record of donated foods is maintained. The distributing agency’s system of inventory management must ensure that donated foods are distributed in a timely manner and in optimal condition. On an annual basis, the distributing agency must conduct a physical review of donated food inventories at all storage facilities used by the distributing agency (or by a subdistributing agency), and must reconcile physical and book inventories of donated foods. The distributing agency must report donated food losses to [the Food and Nutrition Service], and ensure that restitution is made for such losses. Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Additionally, according to Green Book Principle 10.02, “Response to Objectives and Risks,” Management designs control activities in response to the entity’s objectives and risks to achieve an effective internal control system. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives to achieve the entity’s objectives and address related risks. EFFECT By failing to perform a sufficient inventory, management increases the risk of noncompliance with federal requirements and heightens the potential for fraud, waste, and abuse within this federal program. Without adequate internal controls over the receipt, distribution, and inventory of USDA-donated foods, management cannot reasonably ensure that subrecipients meet federal program requirements or achieve the intended program outcomes. Additionally, federal regulations outline actions that federal agencies may take if a state entity fails to comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” additional federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance; (3) Requiring additional or more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the recipient or subrecipient to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of the Department of Agriculture should ensure that management strengthens its oversight and internal controls over USDA-donated food inventory by establishing written procedures that comply with federal Child Nutrition Cluster requirements and clearly outline responsibilities for maintaining complete inventory records and performing required reconciliations. Management should ensure that staff perform and document annual physical inventories for each warehouse and reconcile the results to book inventories. To support these responsibilities, management should evaluate staffing levels and allocate sufficient resources or explore operational alternatives to ensure the department can meet federal requirements. In addition, management should provide training to program staff on federal inventory requirements and the department’s updated procedures. Finally, management should review and update the risk assessment for the deficiencies noted in the finding, design and implement controls to address these risks, continue to monitor these risks, and take appropriate action to address other deficiencies as they occur. MANAGEMENT’S COMMENT We concur. To ensure effective internal controls over inventory at storage locations for school food distribution, the department added the risk of not complying with inventory requirements for school food to our Financial Integrity Act risk assessment along with the following mitigating controls: • Monthly inventory reports are required to be sent by each of the three school food warehouses to the Commodities team. • Developed monitoring guides and have begun using those guides to assist with warehouse visits. The department has a plan to begin observing inventory annually. We completed our first warehouse visit in February 2026 and anticipate completing visits to the other two warehouses by September 30, 2026. In addition to the annual on-site inventory observation, internal monthly inventory monitoring has been added to the duties of the Commodities team. Warehouses are now required to submit monthly inventory reports by the 10th of each month which are then analyzed by the team. We have been looking at ways to add a permanent position to the Commodities team. We have tried getting an additional position approved in the budget and we are exploring the possibility of repurposing vacant positions within the department. Finally, the department’s special projects team has been looking at SOPs in place as well as the need for SOPs in areas without them. The Commodities team is next on the list for special projects to help with drafting and revising SOPs. We plan to use this opportunity to establish written procedures that outline responsibilities for the school food program to help us ensure compliance with federal requirements. The Commodity Distribution Administrator will be responsible for ensuring corrective actions are implemented by the anticipated completion date of December 31, 2026.

Finding Number 2025-007 Assistance Listing Number 93.069 Program Name Public Health Emergency Preparedness Federal Agency Department of Health and Human Services State Agency Department of Health Federal Award Identification Number N/A Federal Award Year 2025 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Health did not comply with subrecipient monitoring requirements for the Public Health Emergency Preparedness program BACKGROUND The Department of Health, as a pass-through entity, administers the Public Health Emergency Preparedness (PHEP) program. The department provides subawards to subrecipients with the aim of strengthening the capacity and capability of state and local public health systems to prepare for, respond to, and recover from public health threats and emergencies. The department uses eight subrecipients for this program. According to the schedule of expenditures of federal awards, subrecipient spending accounts for approximately 30% of the total program. Federal regulations require pass-through entities to establish and implement effective internal controls to monitor subrecipients’ activities to ensure they use federal funds in compliance with statutes, regulations, and grant terms and conditions. As a part of these responsibilities, management must evaluate each subrecipient’s risk of fraud and noncompliance, which includes reviewing the results of subrecipients’ Single Audits when applicable. Based on this risk assessment, management must perform appropriate monitoring to ensure subrecipients meet programmatic and financial requirements. This monitoring could include providing technical assistance, reviewing Single Audit reports, issuing management decisions related to PHEP funding, conducting site visits, or performing other monitoring procedures. CONDITION AND CAUSE Our audit identified deficiencies in the department’s monitoring of PHEP subrecipients, specifically related to tracking Single Audit Reports and performing monitoring reviews. Single Audit Report Tracking First, as of October 27, 2025, management had not ensured that any of the eight PHEP subrecipients obtained required Single Audits in accordance with Title 2, Code of Federal Regulations (CFR), Part 200, Subpart F, nor had management followed up when subrecipients did not submit Single Audit reports on time. No staff member was responsible for tracking which subrecipients were required to obtain a Single Audit, confirming whether subrecipients submitted audits, or following up when the department did not receive the required reports. After we brought it to their attention, management assigned a staff member to verify subrecipient Single Audit submissions on October 27, 2025. Monitoring Reviews Additionally, although the department’s documented risk assessment identified plans to conduct monitoring reviews of two subrecipients for the PHEP program during the audit period, the department did not perform these reviews. The staff member assigned to perform the reviews left the team on May 28, 2025, and management did not reassign the monitoring duties. CRITERIA Although revisions to 2 CFR 200 became effective during the audit period, the subrecipient monitoring requirements relevant to this finding—including evaluating subrecipient risk, performing appropriate monitoring activities, and verifying whether subrecipients were audited under Subpart F—remain substantively unchanged under both the prior and current versions of the Uniform Guidance. Federal regulations require pass-through entities to establish and maintain effective internal controls over federal awards and to monitor the activities of subrecipients to ensure compliance with applicable requirements. Under 2 CFR 200.332, the department, as a pass-through entity, must • evaluate each subrecipient’s risk of fraud and noncompliance to determine the appropriate level and type of monitoring; • consider factors such as the subrecipient’s o prior experience with similar awards; o results of previous audits, including whether the subrecipient undergoes a Single Audit; o changes in personnel or financial/management systems; and o results of other federal monitoring; • monitor subrecipient activities as necessary to ensure federal statutes, regulations, and award terms are met and that the goals and objectives of the subaward are achieved; • use appropriate monitoring tools based on assessed risk, including providing technical assistance, conducting site visits, or arranging for agreed-upon procedures engagements; and • verify that each subrecipient is audited as required under Subpart F of the Uniform Guidance. In addition, 2 CFR 200.501(a) requires any non-federal entity that meets the expenditure threshold established under Subpart F to obtain a Single Audit or program-specific audit for that fiscal year. Additionally, the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 3, states that management should assign and communicate responsibility for internal control activities. Collectively, these requirements obligate the department to ensure subrecipients obtain required audits, review and act on audit results, and perform the monitoring procedures identified through its risk assessments. EFFECT When management does not perform required subrecipient monitoring activities, it increases the risk of not timely detecting, documenting, or correcting subrecipient noncompliance, misuse of federal funds, or potential fraud. By failing to verify whether subrecipients obtained required Single Audits, management limits its ability to identify financial reporting deficiencies, internal control weaknesses, or questioned costs that could affect the PHEP program. RECOMMENDATION Management should ensure that responsibilities for subrecipient monitoring are clearly assigned, communicated, and carried out in accordance with federal requirements. These responsibilities include verifying required Single Audits, reviewing audit reports, issuing management decisions, and conducting risk-based monitoring activities. Management should also establish a process to ensure monitoring activities continue uninterrupted during staffing changes, including timely reassigning monitoring duties and documenting any modifications to the risk-based monitoring plan. Furthermore, management should periodically evaluate the effectiveness of its subrecipient monitoring system to confirm that staff are performing monitoring activities as planned and to promptly address any delays or impediments. MANAGEMENT’S COMMENT We concur. With regard to the monitoring of single audit findings within subrecipients, Emergency Preparedness will work with their column’s Business and Grant Management (BGM) Team to ensure grantees that require an annual single audit are identified and that single audits are reviewed within 60 days of the audit date. If relevant findings and corresponding corrective actions are identified, the BGM Team will confer with program management, and communicate with the subrecipient as to whether the corrective actions taken are believed to sufficiently mitigate the deficiencies noted in the finding. This communication will be filed for reference by program management and shared with the Compliance & Ethics Office, where a log will be kept to track this activity. This process will be put in place by January 31, 2026 and be the responsibility of the BGM Team Compliance Manager. With regard to staffing issues, the Compliance & Ethics Office was challenged with the untimely death of their monitoring manager, while at the same time losing an additional staff member due to attrition. The Compliance & Ethics Office will ensure that in the event of staffing shortages, a hierarchical management structure is in place to make needed changes in the subrecipient monitoring plan if needed. The Assistant Commissioner that leads the Compliance & Ethics Office will be responsible for this effort and has put this structure in place effective January 1, 2026. Finally, the evaluation of the effectiveness of the subrecipient monitoring system will be conducted as part of the annual Financial Integrity Act Risk Assessment, conducted by December 31 of each year, beginning December 31, 2026. Additionally, the Compliance & Ethics Office will conduct an enterprise-wide refresher course on single audit review and other subrecipient compliance responsibilities on or before June 30 each year, beginning June 30, 2026.

Finding Number 2025-008 Assistance Listing Number 93.568 Program Name Low-Income Home Energy Assistance Federal Agency Department of Health and Human Services State Agency Tennessee Housing Development Agency Federal Award Identification Number N/A Federal Award Year 2024 and 2025 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Reporting Repeat Finding 2024-012 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the two prior audits, Tennessee Housing Development Agency (THDA) management did not have effective internal controls over reporting for the Low-Income Home Energy Assistance Program BACKGROUND The U.S. Department of Health and Human Services (HHS) provides grant funding through the Low-Income Home Energy Assistance Program (LIHEAP) to the Tennessee Housing Development Agency (the agency). The objective of LIHEAP is to help low-income households meet the costs of home energy, increase their energy self-sufficiency, and reduce their vulnerability resulting from energy needs. As a condition of the grant, HHS requires the agency to report on the use of federal funds through financial, performance, and special reports. In addition to federal requirements in the Code of Federal Regulations, the HHS Office of Administration for Children and Families, Office of Community Services (OCS), provides guidance to LIHEAP recipients by issuing Action Transmittals. In response to the prior-year finding noting ineffective controls over reporting, management stated that positions were filled, including the Community Services Division Director and LIHEAP Manager, who were working to strengthen internal processes to ensure reports are completed timely and accurately. CONDITION, CRITERIA, AND CAUSE As noted in the two prior years, the agency did not have adequate internal controls to ensure it provided the federal grantor (HHS) with timely or accurate reports. The primary cause for the special and performance reporting deficiencies was inadequate training of the new staff. Management assigned a secondary reviewer, but this reviewer did not always review the report data before submission, which led to inaccurate reported information. Special Reporting Annual Report on Households Assisted by LIHEAP According to Title 45, Code of Federal Regulations (CFR), Part 96, Section 82(a), the agency is required to submit to HHS an annual report on households assisted by LIHEAP “for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance.” We reviewed the 2024 annual report on households assisted by LIHEAP to determine that management submitted the report timely and reported line items accurately. Management originally submitted a timely estimated report on September 18, 2024. However, we noted that the agency did not submit the final corrected report until January 14, 2025, 14 days after the due date of December 31, 2024. The Director of Community Services stated the late submission was due to new staff onboarding and miscommunication, as the director was new to program administration and did not realize a subsequent report needed to be submitted after the estimated version. After the January 14, 2025, submission, APPRISE Inc., whose data consultants work with HHS, made THDA aware of two errors on the report: • The “Sum of Assistance Types” (reported as 117,537 households) did not reconcile with the figures reported in Line 14 (Any Type of LIHEAP Assistance) and Line 18 (Bill Payment Assistance), both listed as 109,045. • The weatherization program total of 264 households assisted was omitted from the report. After management submitted an updated report including the missing weatherization data, APPRISE Inc. followed up again, noting that the total households assisted (Line 14) still did not reflect the correct total of households served by the bill payment assistance and weatherization program, 117,801. Quarterly Performance and Management Reports LIHEAP Action Transmittal 2025-01 Quarterly Report Instructions Attachment 1 requires grant recipients to submit data and information about LIHEAP through quarterly performance and management reports. The quarterly report “collects valuable statistics on the number of assisted households, the impact of LIHEAP in ensuring access to home energy service, the amount of awarded funds that have been obligated, and successes and challenges that grant recipients are experiencing.” We reviewed the quarterly performance and management report for the first and second quarters of federal fiscal year 2025. During this review, we noted that management did not adequately review the second-quarter report prior to submission, causing inaccurate information to be reported until an amendment was made after the deadline. Management submitted the report timely; however, management reported the incorrect obligated amounts on the original report. The amount of funds obligated was reported at $24,303,853 instead of the correct amount of $58,379,528, an understatement of $34,075,675. The Director of Community Services stated that immediately after submission of the report, management discovered that the reported obligated amounts were not calculated in accordance with the LIHEAP model plan. The Director of Community Services stated that a new program staff member had been assigned to complete the reports but used the incorrect methodology. Management subsequently submitted an amended report on May 27, 2025. EFFECT When staff do not proactively perform procedures to ensure the reports are generated timely and without errors, management increases the risk of providing incorrect or untimely data to HHS, which could affect program oversight and funding decisions. Inaccurate reporting also increases the likelihood of noncompliance with federal grant requirements, including the risk of obligating more funds than are available. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Specific conditions may include the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance; (3) Requiring additional or more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the recipient or subrecipient to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • withholding further awards for the project or program, or • pursuing other available legal remedies. RECOMMENDATION THDA management should continue to strengthen the reporting process by ensuring new employees are adequately trained, reports are reviewed for accuracy prior to submission, and that management and staff have an adequate tracking system to ensure timeliness. Management should also continue to monitor reporting procedures and revise internal controls as necessary to ensure full compliance with federal reporting requirements. MANAGEMENT’S COMMENT We partially concur. THDA has continued to refine its process to ensure timely and accurate reporting. In 2025, steps were taken to review reports prior to submission. The manager additionally consulted with APPRISE, Inc., the data management firm contracted to support HHS and LIHEAP grantees, prior to report submission. APPRISE acknowledges that the report templates do not properly identify errors and encourages THDA to submit reports even when errors are noted. Any instances where errors were substantiated following report submission have been corrected in consultation with APPRISE. HHS has accepted all reports submitted by THDA, and we have received no communication from HHS that THDA is in jeopardy of their consideration of any of the effects noted in your finding. We do acknowledge that there was an instance where numbers were not reported correctly or timely due to lags in getting LIHEAP Weatherization data, as well as improper grantee reporting. We are working to resolve this issue through implementation of new software that will join the LIHEAP utility assistance and LIHEAP weatherization data together, on a single platform. THDA launched the software for the utility assistance segment of LIHEAP on November 1, 2025, and we expect the LIHEAP weatherization data to be online by October 1, 2026. THDA’s work in 2025 to improve its reporting accuracy has been impacted considerably by inconsistent guidance at the federal level. Since January 2025, due to periods of non-communication by HHS and subsequent reductions and changes in staffing at HHS, we have received various interpretations of HHS guidance. For instance, HHS has provided differing definitions of “obligation”, creating some confusion with reporting. To date, HHS has not provided a final definition. THDA will continue to report obligations as is stated in our Model Plan, when funds are awarded and a contract is fully executed with the sub-grantee. We appreciate the comments of the State Comptroller’s Office as we actively take steps to improve our reporting processes. AUDITOR’S COMMENT We reviewed and considered management’s comments. Although they provide additional context, the response does not alter the underlying condition or conclusion of the finding.

Finding Number 2025-009 Assistance Listing Number 20.106 Program Name Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs Federal Agency Department of Transportation State Agency Department of Transportation Federal Award Identification Number N/A Federal Award Year 2020 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Transportation did not establish internal controls related to federal reporting requirements for the Airport Improvement Program and did not comply with the requirements BACKGROUND The Federal Aviation Administration’s (FAA) Airport Improvement Program supports the development of a nationwide system of airports by funding projects that increase airport capacity and safety. To be eligible for the program, an airport must be open to the public and be included in the National Plan of Integrated Airport Systems.(14) Applications for grants must be submitted to the appropriate FAA Airports Office. See Schedule of Findings and Questioned Costs for footnote. The Federal Funding and Transparency Act (FFATA) requires the Department of Transportation (the department) to report financial information on all subawards of $30,000 or more in federal funds(15) through the System for Award Management (SAM).(16) According to federal regulations, reports are due “no later than the end of the month following the month in which the subaward was issued.”(17) The subaward information in SAM is then available to the public through the USA Spending website for transparency. See Schedule of Findings and Questioned Costs for footnote. Based on our walkthrough and discussion with the department’s Aeronautics Division management, the division holds bi-monthly meetings to discuss funding, which comes from federal, state, and local funding streams, for potential Airport Improvement Program projects. In collaboration, the department’s division management and the state’s Tennessee Aeronautics Commission (18) document their decisions to approve or deny subawards in a Project Status Report (PSR) spreadsheet. Following the bi-monthly meeting, the Aeronautics Division Grants and Compliance Team Lead uses the PSR to update a shared spreadsheet known as the “All AERO” to maintain all approved Airport Improvement Program subaward projects. See Schedule of Findings and Questioned Costs for footnote. Each month, the department’s Transportation Program Supervisor, who is responsible for reporting Airport Improvement Program subawards that meet the $30,000 threshold, uses the All AERO spreadsheet to filter subawards issued in the prior month and identify the subawards by Federal Award Identification Number.(19) The Transportation Program Supervisor then enters the information from the spreadsheet into SAM.gov. See Schedule of Findings and Questioned Costs for footnote. CONDITION AND CAUSE We obtained a population of 82 subawards, totaling $7,479,559 in federal dollars obligated during the fiscal year ending June 30, 2025. After filtering out subawards below the $30,000 reporting threshold, this left 74 subawards, totaling $7,384,452, to be sampled from. We then selected a nonstatistical, random sample and a haphazard sample and reviewed 18 subawards totaling $1,725,163. Based on our review of the subaward documentation, we found that 4 of the 18 subawards did not meet the $30,000 federal funding threshold for FFATA reporting. For the remaining 14 subawards, we found the following: • Unreported and Late Subawards: We found that the department did not report 2 subawards, totaling $177,300, as required. Additionally, the department reported 10 subawards, totaling $1,471,679, after the required reporting deadline. Management stated that the transition from the Federal Funding Accountability and Transparency Act Subaward Reporting System to SAM.gov contributed to the late reporting for 6 of these 10 subawards. • Subaward Amendments Unreported: We found that for 1 subaward, management did not report a $13,904 amendment to the subaward. The department reported the original $150,000 subaward in the prior scope period; however, management did not report the $13,904 increase, as required by FFATA reporting requirements. • Subaward Amendments Reported Late: We found that for 1 subaward, management reported a $9,090 amendment after the required deadline. The department reported the original $43,200 subaward in the prior scope period but did not report the $9,090 amendment within the FFATA reporting timeframe. Based on our discussions with management regarding the noncompliance, we determined that the department has not designed and implemented a supervisory review process to ensure the Transportation Program Supervisor timely enters all required subaward reports in SAM. See Figure 1. See Schedule of Findings and Questioned Costs for figure. We also reviewed the department’s 2024 Financial Integrity Act Risk Assessment, which confirmed that the Aeronautics Division’s management did not assess the FFATA reporting process related to the Airport Improvement Program for the potential risk of errors and noncompliance with federal laws and regulations and did not establish controls to mitigate risks. CRITERIA FFATA Reporting Appendix A to “Reporting Subaward and Executive Compensation Information,” Title 2, Code of Federal Regulations (CFR), Part 170, states: a. Reporting of first-tier subawards. 1. Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. 2. Reporting Requirements. i. The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the subaward was issued. Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Additionally, Green Book Principle 10.02, “Response to Objectives and Risks,” Management designs control activities in response to risks to achieve an effective internal control system. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives to achieve the entity’s objectives and address related risks. EFFECT Not meeting the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding the department’s expenditures of federal awards. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” additional federal award conditions may include items such as the following: • Requiring payments as reimbursements rather than advance payments; • Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance; • Requiring additional, more detailed financial reports; • Requiring additional project monitoring; • Requiring the recipient or subrecipient to obtain technical or management assistance; or • Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of the Department of Transportation should design and implement a supervisory review process to ensure all subawards and related amendments are reported as required. Management should include the risks associated with FFATA reporting in the annual risk assessment and develop compensating controls to address the risks.   MANAGEMENT’S COMMENT We concur. The following processes have been created to correct the issues with FFATA reporting: • An internal submittal deadline has been created to ensure the timely submission of the FFATA report each month. This timeframe is 15 days from project approval. In the event something happens and the 15 days is missed, there is still time to correct the issue before becoming noncompliant with the FAA. • All the information is kept on a separate excel strictly for FFATA reporting and contains checks in the file stating if it has been entered into SAM.gov and to ensure it is also on the ALL Aero spreadsheet. • Ensure that the information that is entered, is transferred into the folder for that month. Via pdf or screenshot. • Created a folder dedicated to FY26 for all things FFATA. This will be the norm going forward per fiscal year. • Trained two senior staff members within the Grants and Compliance section on entering the information if the Statewide Technical Specialist is out or unable to get it in within the allotted timeframe. • Emailing the Team Lead after the FFATA report has been entered as well as storing it on the shared drive in the FY26 FFATA Reporting Folder (or future corresponding folder). • Created a section on our section’s OneNote (SOP) of how to enter the information and also put the information for the paths to the share drive FFATA files as well for anyone else in case something happened to any of the people who are trained it, continuity will be maintained. • A line item has been created on the weekly one-on-one agenda between the Team Lead and Statewide Tech Spec following up on FFATA reporting status and cross-referenced with project approval list.

Finding Number 2025-010 Assistance Listing Number 93.558 Program Name Temporary Assistance for Needy Families Federal Agency Department of Health and Human Services State Agency Department of Human Services Federal Award Identification Number N/A Federal Award Year 2025 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Reporting Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The department and STS did not jointly establish effective oversight and monitoring of IT systems managed by STS and third-party vendors, or provide adequate internal controls in three other areas related to the department’s information systems, increasing the risk of errors and disruptions in the Temporary Assistance for Needy Families financial assistance program BACKGROUND The Department of Human Services (the department) modernized its information systems by replacing legacy applications with cloud-based platforms designed to improve reliability, reduce maintenance needs, and expand access to services. The department now relies on both custom-developed and Software-as-a-Service systems, many of which are operated by third-party vendors. The department uses these systems to support the Temporary Assistance for Needy Families (TANF) program by providing a single, digital system that simplifies families’ experiences with applying for benefits, submitting necessary documents, and viewing case updates. Because these systems support key business processes, the department and the Department of Finance and Administration’s Strategic Technology Solutions (STS) share oversight responsibilities to ensure systems are secure, compliant, and functioning as intended. Under a 2017 memorandum of understanding, STS is responsible for certain operational and vendor‑management functions. At the time of the audit, statewide guidance specific to monitoring third-party vendor risk had not yet been fully developed. Since then, statewide guidance has been developed and is currently under review for approval and implementation. As of 2024, the U.S. Department of Health and Human Services awarded the Tennessee Department of Human Services $190,885,719 for the TANF program. CONDITION AND CAUSE Department management and STS management did not effectively design and monitor internal controls over the department’s information systems, including controls related to vendor-managed systems. We identified deficiencies in overseeing and monitoring the department’s third-party information technology vendors. Because STS and the department did not implement effective monitoring, they did not identify three other internal control weaknesses in the department’s systems, which are confidential and omitted from this report. The third-party information technology vendor lacked oversight and monitoring While the department relies on STS and external vendors, such as Deloitte, to manage and operate its systems, the department did not establish sufficient oversight and monitoring controls over its third-party information technology vendor, which manages one of its custom-developed systems. Specifically, the department and STS did not effectively monitor daily operations, verify that the vendor implemented appropriate technical safeguards, or ensure that the vendor complied with statewide security requirements and department policies. As a result, neither the department nor STS consistently monitored the vendor’s performance or the effectiveness of controls over department systems. One reason for this oversight gap is that the department did not clearly define its own responsibilities, or those of STS, in the memorandum of understanding. In addition, during the audit, the Information Systems Council had not developed statewide policies for monitoring third-party vendor risk. After we completed the audit, STS prepared draft statewide guidance on third-party management, which the council approved during its December 17, 2025, meeting. The department’s and STS’s annual risk assessment does not sufficiently mitigate risks The department and STS did not identify the risks noted in this audit finding during their annual risk assessment and, therefore, did not establish internal controls to mitigate those risks.(20) See Schedule of Findings and Questioned Costs for footnote. STS management did identify the risk that STS and the consolidated agencies(21) are responsible for ongoing monitoring of third-party IT vendors to safeguard an agency’s mission-critical information systems. However, STS management’s identified controls focused only on Software-as-a-Service providers and independent audit reports. They did not address internal controls pertaining to vendors maintaining and managing the department’s IT environment, such as those supporting custom-developed systems.(22) Even when STS or external vendors perform IT functions, the department remains responsible for ensuring risks are managed and controls are effective. See Schedule of Findings and Questioned Costs for footnote. The department’s systems contained confidential internal control weaknesses Due to the lack of monitoring, the department and STS were not aware of internal control weaknesses in three other areas related to the department’s information systems. Department and STS management acknowledged these confidential internal control weaknesses and have taken steps to correct them. These identified weaknesses increased the risk of unauthorized access or modification to critical systems and processes because the department and STS did not adhere to state policies and federal internal control standards. Under Standard 9.61 of the U.S. Government Accountability Office’s Government Auditing Standards, we omitted details from this finding because they are confidential under the provisions of Section 10-7-504(i), Tennessee Code Annotated. We provided department and STS management with detailed information regarding the specific conditions we identified, as well as the related criteria, causes, and our specific recommendations for improvement. CRITERIA According to Title 2, Code of Federal Regulations, Part 200, Section 303(a), the department must Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According” to Green Book Section OV4.03, “External Parties,” Management may engage external parties to perform certain business processes for the entity . . . [but] management retains responsibility for the effectiveness of controls over business processes assigned to service organizations. . . . [M]anagement needs to understand the controls that service organizations design, implement, and operate. Additionally, Green Book Principle 7.02, “Identify Risks,” states, Management identifies risks throughout the entity . . . to provide a basis for analyzing risks. Furthermore, Green Book Principle 7.14, “Respond to Risks,” states, When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT TANF eligibility determinations, benefit calculations, and case management activities rely on accurate, complete, and timely information in the department’s information systems. Ineffective implementation and operation of internal IT controls increase the likelihood of errors, data loss, and unauthorized access to departmental systems that support the TANF program. As a result of these control deficiencies, management lacks reasonable assurance that it can effectively identify, monitor, and respond to risks affecting the protection and dependability of its systems and data. Weak controls increase the risk of data breaches, service disruptions, and system failures that could affect the delivery of services to Tennesseans. Limited monitoring also reduces management’s ability to detect control breakdowns promptly and respond quickly when problems occur. Collectively, these control deficiencies elevate the risk of someone altering, exposing, or disrupting TANF data without detection. These deficiencies not only threaten service delivery to Tennesseans but may also lead to noncompliance with federal requirements, which could impact the department’s continued access to federal support or participation in programs. RECOMMENDATION The department and STS should strengthen oversight and monitoring of vendor maintenance and system management for the department’s programs, including the TANF program. This should include updating their memorandum of understanding to clearly define each party’s responsibilities for monitoring vendors and system controls. At the statewide level, STS should work with the Information Systems Council to continue developing and refining guidance for overseeing third-party vendor risk related to vendor-maintained and managed systems, including those supporting TANF. The department and STS should update their vendor-management practices as statewide guidance is finalized. The department and STS should continue to correct the confidential control weaknesses identified during our audit and assign staff to monitor these areas moving forward. Finally, department management and STS management should evaluate the risks noted in this finding and implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. MANAGEMENT’S COMMENT Department Management and STS We concur. STS has taken steps to address the issues identified, implemented new processes to enhance oversight and risk management, and will continue to refine these efforts in alignment with evolving state policies and guidance. STS is working with DHS to establish a new Interagency Agreement that explicitly outlines each party’s responsibilities in monitoring vendor performance, validating security controls, and responding to risks associated with vendor-managed systems. In an effort to establish consistent standards for monitoring vendors, assessing technical safeguards, and ensuring alignment with applicable state and federal control frameworks, including the GAO Green Book and NIST 800-53, STS has also developed and presented a new Information Systems Council (ISC) policy regarding statewide guidance on third-party vendor oversight. Additionally, STS reviewed and updated departmental risk assessment documents to reflect third-party IT vendor oversight controls.

Finding Number 2025-011 Assistance Listing Number 64.053 Program Name Payments to States for Programs to Promote the Hiring and Retention of Nurses at State Veterans Homes Federal Agency Department of Veterans Affairs State Agency State Veterans’ Homes Board Federal Award Identification Number N/A Federal Award Year 2025 Finding Type Noncompliance Compliance Requirement Activities Allowed or Unallowed Allowable Costs/Cost Principles Repeat Finding N/A Pass-Through Entity N/A Questioned Costs $94,375 FINDING Tennessee State Veterans’ Homes Board management improperly claimed reimbursement from the federal nurse retention grant BACKGROUND In 2022, the U.S. Department of Veterans Affairs (VA) established a nurse retention grant program to help state veterans’ homes hire or retain nurses who provide direct clinical care to residents. For federal fiscal year 2025, the VA approved the Tennessee State Veterans’ Home Board’s (the board’s) application for grants for the Clarksville, Humboldt, Knoxville, and Murfreesboro veterans’ homes, as these homes had struggled with nursing turnover. The board used the grant funds to implement financial incentives to encourage nurses to join their staff, including bonuses for new-hire retention, referrals, and mentoring.(23) Figure 1 summarizes each financial incentive program. See Schedule of Findings and Questioned Costs for footnote. See Schedule of Findings and Questioned Costs for figure. Based on our discussions with management and a review of the incentive programs management described to us, management pays employees quarterly for the retention bonus and mentor incentive programs if the employee remains employed for that time. The referral bonus is paid after 90 and 180 days of successful employment. Each quarter, the executive office staff submits a reimbursement invoice to VA to recover 50% of the incentives/bonuses paid to the employees. CONDITION AND CRITERIA As part of the veterans’ homes’ grant application process, the VA approved the veterans’ homes’ referral and mentor bonuses, as well as the tuition/student loan reimbursement, as these programs aligned with the federal grant’s purpose to improve the nursing shortage each home faced. Based on our review of the grant application and agreement, however, we found that VA had not specifically approved the new-hire retention bonus as an allowable program for federal reimbursement. Furthermore, the VA approval letter for each nursing home states, The funds are to be used solely for the purpose of the specific employee incentive programs. In the original VA grant application, management did not include a description of new-hire retention bonuses in its description of the planned incentive programs. As such, the VA was not aware of the new-hire retention bonus program when it approved the other incentive programs. Based on our review of grant reimbursement records, we found that, even though the program was not specifically approved, management invoiced $94,375 in new-hire retention bonus payments under the approved mentor program category. In addition, we noted instances of employees participating simultaneously in both the mentor program and the new-hire retention bonus program, and management sought reimbursement for both programs through the mentor program category. CAUSE Based on our discussion with management, the new-hire retention bonus program was not explicitly described in the grant application, but management asserts that the program was included as part of the mentor program. EFFECT When management improperly invoices the federal grantor for unapproved programs, there may be fewer funds available for the approved incentive programs. For example, as of March 2025, management had exhausted all its federal nurse retention grant funds for its Clarksville home because they included the new-hire retention bonuses. Furthermore, management has submitted false claims to the federal grantor and may be required to pay back the improperly used funds. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 208(c), “Specific conditions,” these conditions may include (1) Requiring payments as reimbursement rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance; (3) Requiring additional or more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the recipient or subrecipient to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should seek specific approval from VA to use the nurse retention grant funds to assist with the new-hire employee retention bonus program or use veterans’ homes funds to pay for the new-hire bonuses. Management should contact the federal grantor for guidance on how to remedy the improper billings. MANAGEMENT’S COMMENT We concur in part: While our grant application did not explicitly itemize retention bonuses, their use is consistent with the framework and intent of the grant, as defined in 38 CFR Part 53.11(b), which states the purpose is for an “employee incentive program to reduce the shortage of nurses at the TSVH.” We are also actively consulting with the VA to clarify the status of prior billings and determine the appropriate path forward if any are deemed improper. As of the date of this update, we have not received a response. AUDITOR’S COMMENT As of the date of this report, the Veterans’ Home Board's management has not received explicit approval from the VA to use the nurse retention grant funds to support the new-hire employee retention bonus program.

Finding Number 2024-001 Assistance Listing Number 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Cash Management Repeat Finding 2023-002 Pass-Through Entity N/A Questioned Costs N/A Finding The financial aid office continued to not adequately reconcile its direct loan records to the Direct Loan Servicing System’s records, as required by federal regulations, and therefore could not resolve discrepancies timely Background The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for Student Financial Assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The United States Department of Education (ED) has established certain requirements for each school to participate in the Student Financial Assistance programs. For direct loans, ED requires schools to reconcile direct loan data monthly between the school’s financial aid office and business office, and between school data, ED’s Common Origination and Disbursement System, and ED’s Grants Management (G5) System. Condition As noted in the prior-year audit, the financial aid office at Tennessee State University could not provide adequate documentation showing that staff fully and timely reconciled the university’s direct loan financial records with the federal Direct Loan Servicing System monthly, as required. While the financial aid office was able to provide reconciliations, staff did not record documentation showing that the report was run timely, that unreconciled items were researched, and that the research was completed timely. The auditors reviewed the university’s procedures for the reconciliations and noted there were no instructions for documenting and signing off on the reconciliations. As a result, any discrepancies may not have been identified, investigated, and resolved timely. Management, as noted in the prior finding, created and filled the role of Assistant Director of Compliance; however, management did not hire an independent financial aid consultant until the end of the 2024 academic year. The partial action of creating and filling the new position did not correct the noncompliance during the period. Criteria Title 34, Code of Federal Regulations, Part 685, Section 300(b)(5), states that to participate in the Direct Loan program, a school must “on a monthly basis, reconcile institutional records with Direct Loan funds received from the Secretary and Direct Loan disbursement records submitted to and accepted by the Secretary.” The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 6, gives additional information regarding the reconciliation process: A school that participates in the Direct Loan Program is required to reconcile cash (funds it received from the G5 system to pay its students) with disbursements (actual disbursement records) it submitted to the Common Origination and Disbursement (COD) system monthly. In addition, Chapter 6 of the handbook goes on to state, A school has completed its monthly reconciliation when all differences between the Direct Loan SAS [Student Account Statement] and the school’s internal records (Direct Loan system, financial aid office, and business office system) have been resolved or documented and the school’s ending cash balance is zero. Schools should clearly outline their reconciliation process and documentation in both the business office and financial aid office procedures. Finally, while the handbook does not specify a particular format or reconciliation method, it does require that the school maintains “documented results of its monthly reconciliation to provide to auditors and reviewers at their request.” Cause The former Director of Financial Aid(1) stated that the financial aid office has differences from month to month because of the timing of funds being disbursed and drawn down, but these items will usually resolve themselves by the end of the award period. Because of these timing discrepancies, the university has not emphasized performing a complete reconciliation each month. Consequently, the university has not placed the same importance on the reconciliation process as ED. See Schedule of Findings and Questioned Costs for footnote. Effect When the university does not reconcile its financial aid records to the net cash drawdowns and net booked disbursements as reported to the federal government, there could be unresolved errors in either the federal government’s records or the university’s records. The university could draw too much cash from ED, resulting in questioned costs, or could underdraw, placing unnecessary financial stress on the institution. In addition, when the university does not fully reconcile direct loans each month, reconciling items and errors may be harder to identify over time, making the annual reconciliation more complex than necessary. Performing documented monthly reconciliations and retaining all supporting documentation ensures that financial aid staff will receive all direct loan funds from ED and will make timely and accurate disbursements to students. In addition, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate its participation in a Title IV program. These actions would negatively affect the university’s operations and the students impacted by the loss of Title IV aid. Recommendation The financial aid office and the business office should update policies and procedures for the reconciliation process. The Director of Financial Aid should ensure that staff prepare and document the required monthly reconciliations based on instructions in the Federal Student Aid Handbook. If any items in the School Account Statement do not agree with the institution’s financial records, financial aid staff should investigate, resolve, and record these differences promptly. The Director of Financial Aid and a member of the business office should review the reconciliation each month and at award year-end to ensure accuracy and completeness. The university should ensure reconciliations document the preparer and reviewers with the date each was completed. The reconciliation should contain sufficient information and documentation for identified differences and be completed within 30 days of the month's end. MANAGEMENT’S COMMENT We concur. TSU’s Financial Aid Office has updated its policies and procedures to comply with federal regulations. Our revised procedures outline a three-step process for monthly reconciliation. This process begins with the Loan Coordinator performing the initial reconciliation. The reconciliation will then be submitted to either the Assistant Director of Compliance or the Director of Financial Aid for further evaluation. Finally, the Director of Grants Accounting will conduct a comprehensive review. This structured approach ensures that the financial aid office completes the reconciliation efficiently with oversight from three distinct parties. All documentation related to the completed tasks, along with an accuracy checklist with signatures, will be maintained for future reference. The university is also committed to enhancing its financial aid operations by implementing the TSU Student Information System delivered processes to ensure thorough compliance with reconciliation standards. To support this initiative, we are collaborating with outside consultants, who bring valuable expertise to help us develop comprehensive, customized policies and procedures. We anticipate finalizing these documents by March 2025. To align with our goals, we have initiated job postings for two critical positions: the Loan Coordinator and the Assistant Director of Compliance. These roles are essential for driving our reconciliation efforts and ensuring optimal management of financial aid processes. Our primary objective is to achieve full reconciliation of the 2023-2024 Direct Loans by March 1, 2025. Additionally, we plan to start monthly reconciliations for the 2024-2025 loan disbursements in February 2025 to ensure accuracy and compliance. During the interim period, while we work to fill the Loan Coordinator and Assistant Director of Compliance positions, the Director of Financial Aid will actively oversee the reconciliation process. The Director will also receive initial support from our outside consultants to ensure that all reconciliation activities are conducted smoothly and meet compliance requirements. This collaborative approach fosters a more effective and accountable financial aid system within the university.

Finding Number 2024-001 Assistance Listing Number 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Cash Management Repeat Finding 2023-002 Pass-Through Entity N/A Questioned Costs N/A Finding The financial aid office continued to not adequately reconcile its direct loan records to the Direct Loan Servicing System’s records, as required by federal regulations, and therefore could not resolve discrepancies timely Background The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for Student Financial Assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The United States Department of Education (ED) has established certain requirements for each school to participate in the Student Financial Assistance programs. For direct loans, ED requires schools to reconcile direct loan data monthly between the school’s financial aid office and business office, and between school data, ED’s Common Origination and Disbursement System, and ED’s Grants Management (G5) System. Condition As noted in the prior-year audit, the financial aid office at Tennessee State University could not provide adequate documentation showing that staff fully and timely reconciled the university’s direct loan financial records with the federal Direct Loan Servicing System monthly, as required. While the financial aid office was able to provide reconciliations, staff did not record documentation showing that the report was run timely, that unreconciled items were researched, and that the research was completed timely. The auditors reviewed the university’s procedures for the reconciliations and noted there were no instructions for documenting and signing off on the reconciliations. As a result, any discrepancies may not have been identified, investigated, and resolved timely. Management, as noted in the prior finding, created and filled the role of Assistant Director of Compliance; however, management did not hire an independent financial aid consultant until the end of the 2024 academic year. The partial action of creating and filling the new position did not correct the noncompliance during the period. Criteria Title 34, Code of Federal Regulations, Part 685, Section 300(b)(5), states that to participate in the Direct Loan program, a school must “on a monthly basis, reconcile institutional records with Direct Loan funds received from the Secretary and Direct Loan disbursement records submitted to and accepted by the Secretary.” The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 6, gives additional information regarding the reconciliation process: A school that participates in the Direct Loan Program is required to reconcile cash (funds it received from the G5 system to pay its students) with disbursements (actual disbursement records) it submitted to the Common Origination and Disbursement (COD) system monthly. In addition, Chapter 6 of the handbook goes on to state, A school has completed its monthly reconciliation when all differences between the Direct Loan SAS [Student Account Statement] and the school’s internal records (Direct Loan system, financial aid office, and business office system) have been resolved or documented and the school’s ending cash balance is zero. Schools should clearly outline their reconciliation process and documentation in both the business office and financial aid office procedures. Finally, while the handbook does not specify a particular format or reconciliation method, it does require that the school maintains “documented results of its monthly reconciliation to provide to auditors and reviewers at their request.” Cause The former Director of Financial Aid(1) stated that the financial aid office has differences from month to month because of the timing of funds being disbursed and drawn down, but these items will usually resolve themselves by the end of the award period. Because of these timing discrepancies, the university has not emphasized performing a complete reconciliation each month. Consequently, the university has not placed the same importance on the reconciliation process as ED. See Schedule of Findings and Questioned Costs for footnote. Effect When the university does not reconcile its financial aid records to the net cash drawdowns and net booked disbursements as reported to the federal government, there could be unresolved errors in either the federal government’s records or the university’s records. The university could draw too much cash from ED, resulting in questioned costs, or could underdraw, placing unnecessary financial stress on the institution. In addition, when the university does not fully reconcile direct loans each month, reconciling items and errors may be harder to identify over time, making the annual reconciliation more complex than necessary. Performing documented monthly reconciliations and retaining all supporting documentation ensures that financial aid staff will receive all direct loan funds from ED and will make timely and accurate disbursements to students. In addition, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate its participation in a Title IV program. These actions would negatively affect the university’s operations and the students impacted by the loss of Title IV aid. Recommendation The financial aid office and the business office should update policies and procedures for the reconciliation process. The Director of Financial Aid should ensure that staff prepare and document the required monthly reconciliations based on instructions in the Federal Student Aid Handbook. If any items in the School Account Statement do not agree with the institution’s financial records, financial aid staff should investigate, resolve, and record these differences promptly. The Director of Financial Aid and a member of the business office should review the reconciliation each month and at award year-end to ensure accuracy and completeness. The university should ensure reconciliations document the preparer and reviewers with the date each was completed. The reconciliation should contain sufficient information and documentation for identified differences and be completed within 30 days of the month's end. MANAGEMENT’S COMMENT We concur. TSU’s Financial Aid Office has updated its policies and procedures to comply with federal regulations. Our revised procedures outline a three-step process for monthly reconciliation. This process begins with the Loan Coordinator performing the initial reconciliation. The reconciliation will then be submitted to either the Assistant Director of Compliance or the Director of Financial Aid for further evaluation. Finally, the Director of Grants Accounting will conduct a comprehensive review. This structured approach ensures that the financial aid office completes the reconciliation efficiently with oversight from three distinct parties. All documentation related to the completed tasks, along with an accuracy checklist with signatures, will be maintained for future reference. The university is also committed to enhancing its financial aid operations by implementing the TSU Student Information System delivered processes to ensure thorough compliance with reconciliation standards. To support this initiative, we are collaborating with outside consultants, who bring valuable expertise to help us develop comprehensive, customized policies and procedures. We anticipate finalizing these documents by March 2025. To align with our goals, we have initiated job postings for two critical positions: the Loan Coordinator and the Assistant Director of Compliance. These roles are essential for driving our reconciliation efforts and ensuring optimal management of financial aid processes. Our primary objective is to achieve full reconciliation of the 2023-2024 Direct Loans by March 1, 2025. Additionally, we plan to start monthly reconciliations for the 2024-2025 loan disbursements in February 2025 to ensure accuracy and compliance. During the interim period, while we work to fill the Loan Coordinator and Assistant Director of Compliance positions, the Director of Financial Aid will actively oversee the reconciliation process. The Director will also receive initial support from our outside consultants to ensure that all reconciliation activities are conducted smoothly and meet compliance requirements. This collaborative approach fosters a more effective and accountable financial aid system within the university.

Finding Number 2024-002 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-003 Pass-Through Entity N/A Questioned Costs N/A FINDING Tennessee State University continued to have inadequate procedures to ensure Title IV credits were refunded in accordance with federal guidelines BACKGROUND The student financial assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. These Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of the total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. As a condition of these programs, institutions must provide notifications of the amounts awarded and loans disbursed. In addition, institutions are required to refund credits to the student’s account within 14 days of posting the award to the student’s account. CONDITION In response to the prior finding, which noted compliance issues during the 2023 academic year, management restructured the Bursar’s office to include a Refund Analyst role, which reports to the new Account Manager. However, adding the new position and staff did not adequately address compliance issues for the 2024 academic year. In the current audit, we tested a sample of 15 Title IV recipients at Tennessee State University (TSU) to determine whether TSU met disbursement requirements and identified errors in 11 (73%) of the Title IV recipients. These requirements included disbursing the appropriate amount of Title IV aid in a timely manner, sending notices to students informing them of their awards and/or loan disbursements, and refunding any credits to student accounts created by Title IV aid within 14 days of disbursement. Refund Timeliness We noted that 2 of the 8 students (25%) in our testwork had Title IV credits that were not refunded within 14 days of the disbursement date. As noted in the table below, 3 separate refunds were not refunded timely, ranging from 3 to 88 days late. See Schedule of Findings and Questioned Costs for table. While conducting our testwork, we noted that 1 additional student also received a refund more than 14 days after the Title IV aid was disbursed to the student’s account. Because the student had a combination of federal and non-federal aid creating the credit, it did not meet the federal definition of a Title IV credit. However, the error is a further indication of TSU’s failure to process refunds in a timely manner. Disbursement Notifications We also tested our sample to determine whether 2 required notifications were sent to students. The first required letter notifies students of the amount and type of Title IV funds they are expected to receive, as well as how and when the disbursements will be made. We tested all items in our sample to determine whether this first notification was made. For 7 of the 15 students (47%) tested, the student did not receive the required notification. The second required letter is specific only to those students receiving direct loans or Teacher Education Assistance for College and Higher Education (TEACH) grants. The letter notifies students of 1) the date and amount of the disbursement, 2) the student’s or parent’s right to cancel, and 3) the procedure and time by which the student or parent must notify the institution that they wish to cancel. We noted that 11 students in our sample should have received the letter. However, 8 of these 11 students (73%) did not receive the required notification. CRITERIA The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 2, states: If FSA [federal student aid] disbursements to a student’s account at the school create a Title IV credit balance, the school must pay the credit balance directly to the student or parent as soon as possible but no later than 14 days after: [emphasis in original] • the first day of class of a payment period if the credit balance occurred on or before that day, or • the balance occurred if that was after the first day of class. In addition, Volume 4, Chapter 2, of the handbook states: A school must notify a student of the amount of funds the student and their parent can expect to receive from each FSA program, including FWS [Federal Work Study], and how and when those funds will be disbursed. This notification must be sent before any disbursements are made. Finally, Volume 4, Chapter 2, of the handbook also states: Except in the case of loan funds made as part of a post-withdrawal disbursement (see Volume 5 for notification requirements in such cases), when Direct Loan or TEACH funds are being credited to a student’s ledger account, the school must also notify the borrower in writing (paper or electronically) of the: • anticipated date and amount of the disbursement; • student’s or parent’s right to cancel all or a portion of a Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement and have the loan proceeds or TEACH Grant proceeds returned to the Department; and • procedures and deadlines by which the student or parent must notify the school that they wish to cancel the Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. CAUSE TSU management implemented a general refund policy outlining the timing of refunds, as well as the differences between automatic and manual refunds. However, management did not develop adequate procedures to ensure that all Title IV credits are refunded within the timeframes required by federal guidance. Per discussion with TSU management, employee shortages and turnover resulted in the process not always being performed as outlined in the policy. TSU management was uncertain as to the specific cause for unsent disbursement notifications as their financial aid system should automatically send out these notices. Based on these discussions, TSU management is overly reliant on automated processes, and they do not have verification or review processes to confirm that the processes occurred and were complete. EFFECT Timely refunding credits to students is essential to fulfilling the goals of Title IV programs. Students may depend on these refunds to pay for non-institutional charges, such as off-campus housing, transportation, or meals. Furthermore, if the university does not notify students of expected aid, this could impact decision-making for students and their families when determining whether to attend the university. Without these funds, students may not have the resources to pay for these potentially significant costs, which can be a barrier to a successful college career. In addition, failure to notify students of important deadlines and information regarding their direct loans or TEACH Grants could cause students to incur loans they wished to cancel, resulting in unwanted debt. Finally, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate TSU’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. RECOMMENDATION TSU management should revise and adequately document procedures to ensure that students receive the required disbursement notifications and to ensure that credits on student accounts are refunded within 14 days of Title IV aid being disbursed. In addition, leadership should take necessary steps to provide adequate staffing and training to ensure compliance. Finally, TSU management should establish additional review procedures to meet disbursement requirements. MANAGEMENT’S COMMENT We concur. The automatic refund process has been reactivated for spring 2025 as part of our pilot program to refine financial aid procedures. TSU’s consultants conducted a comprehensive review of the current detail codes in use, methodically analyzing their effectiveness and identifying areas for improvement. The recommendations that were made based on this assessment are anticipated to enhance both the efficiency and clarity of the payment process, allowing for a more straightforward identification of non-refundable amounts, which in turn will facilitate the more efficient allocation of funds for necessary financial aid adjustments. The revised procedures will be tested during the spring 2025 refund period to assess their effectiveness and reliability before implementing them on a larger scale. To further support students during this transition, TSU and its consultants will initiate a system of automatic notifications for all students receiving loan disbursements. This systematic communication will enhance transparency by providing information on the amounts disbursed and notifying students of their rights to cancel either part or all of their loans. Additionally, it will outline the specific steps students need to follow to initiate a cancellation. The notification system has been tested and is confirmed to work effectively for loan disbursements in spring 2025. Consequently, before each term, we will review all system parameters and then examine the output after the disbursements are run to ensure that all student notifications are issued correctly. In addition, TSU is taking proactive measures to inform students when their financial aid packages become available, ensuring that they are kept in the loop about their funding status. This process is confirmed to be operating smoothly for Spring 2025, ensuring students receive timely updates. TSU and its consultants will also check the job scheduling system regularly to verify that these processes are being carried out as intended. The completion of these initiatives are anticipated by July 2025, well ahead of the processing for fall 2025 refunds. This timeline will allow for the seamless integration of improvements and ensure that students benefit from the enhancements in the financial aid process moving forward. Lastly, to comply with university procedures and regulatory requirements, it is crucial to fill the Accounting Manager vacancy in the Bursar's office as soon as possible. The Accounting Manager will be vital in overseeing the reconciliation processes, managing refund operations, and improving our financial practices moving forward. This position is essential not only for ensuring accuracy in financial reporting but also for proactively addressing and resolving any discrepancies that may arise. The Vice President of Business and Finance will coordinate with the Bursar’s Office and the Human Resources Department to ensure the timely recruitment and hiring of a qualified candidate.

Finding Number 2024-002 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-003 Pass-Through Entity N/A Questioned Costs N/A FINDING Tennessee State University continued to have inadequate procedures to ensure Title IV credits were refunded in accordance with federal guidelines BACKGROUND The student financial assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. These Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of the total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. As a condition of these programs, institutions must provide notifications of the amounts awarded and loans disbursed. In addition, institutions are required to refund credits to the student’s account within 14 days of posting the award to the student’s account. CONDITION In response to the prior finding, which noted compliance issues during the 2023 academic year, management restructured the Bursar’s office to include a Refund Analyst role, which reports to the new Account Manager. However, adding the new position and staff did not adequately address compliance issues for the 2024 academic year. In the current audit, we tested a sample of 15 Title IV recipients at Tennessee State University (TSU) to determine whether TSU met disbursement requirements and identified errors in 11 (73%) of the Title IV recipients. These requirements included disbursing the appropriate amount of Title IV aid in a timely manner, sending notices to students informing them of their awards and/or loan disbursements, and refunding any credits to student accounts created by Title IV aid within 14 days of disbursement. Refund Timeliness We noted that 2 of the 8 students (25%) in our testwork had Title IV credits that were not refunded within 14 days of the disbursement date. As noted in the table below, 3 separate refunds were not refunded timely, ranging from 3 to 88 days late. See Schedule of Findings and Questioned Costs for table. While conducting our testwork, we noted that 1 additional student also received a refund more than 14 days after the Title IV aid was disbursed to the student’s account. Because the student had a combination of federal and non-federal aid creating the credit, it did not meet the federal definition of a Title IV credit. However, the error is a further indication of TSU’s failure to process refunds in a timely manner. Disbursement Notifications We also tested our sample to determine whether 2 required notifications were sent to students. The first required letter notifies students of the amount and type of Title IV funds they are expected to receive, as well as how and when the disbursements will be made. We tested all items in our sample to determine whether this first notification was made. For 7 of the 15 students (47%) tested, the student did not receive the required notification. The second required letter is specific only to those students receiving direct loans or Teacher Education Assistance for College and Higher Education (TEACH) grants. The letter notifies students of 1) the date and amount of the disbursement, 2) the student’s or parent’s right to cancel, and 3) the procedure and time by which the student or parent must notify the institution that they wish to cancel. We noted that 11 students in our sample should have received the letter. However, 8 of these 11 students (73%) did not receive the required notification. CRITERIA The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 2, states: If FSA [federal student aid] disbursements to a student’s account at the school create a Title IV credit balance, the school must pay the credit balance directly to the student or parent as soon as possible but no later than 14 days after: [emphasis in original] • the first day of class of a payment period if the credit balance occurred on or before that day, or • the balance occurred if that was after the first day of class. In addition, Volume 4, Chapter 2, of the handbook states: A school must notify a student of the amount of funds the student and their parent can expect to receive from each FSA program, including FWS [Federal Work Study], and how and when those funds will be disbursed. This notification must be sent before any disbursements are made. Finally, Volume 4, Chapter 2, of the handbook also states: Except in the case of loan funds made as part of a post-withdrawal disbursement (see Volume 5 for notification requirements in such cases), when Direct Loan or TEACH funds are being credited to a student’s ledger account, the school must also notify the borrower in writing (paper or electronically) of the: • anticipated date and amount of the disbursement; • student’s or parent’s right to cancel all or a portion of a Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement and have the loan proceeds or TEACH Grant proceeds returned to the Department; and • procedures and deadlines by which the student or parent must notify the school that they wish to cancel the Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. CAUSE TSU management implemented a general refund policy outlining the timing of refunds, as well as the differences between automatic and manual refunds. However, management did not develop adequate procedures to ensure that all Title IV credits are refunded within the timeframes required by federal guidance. Per discussion with TSU management, employee shortages and turnover resulted in the process not always being performed as outlined in the policy. TSU management was uncertain as to the specific cause for unsent disbursement notifications as their financial aid system should automatically send out these notices. Based on these discussions, TSU management is overly reliant on automated processes, and they do not have verification or review processes to confirm that the processes occurred and were complete. EFFECT Timely refunding credits to students is essential to fulfilling the goals of Title IV programs. Students may depend on these refunds to pay for non-institutional charges, such as off-campus housing, transportation, or meals. Furthermore, if the university does not notify students of expected aid, this could impact decision-making for students and their families when determining whether to attend the university. Without these funds, students may not have the resources to pay for these potentially significant costs, which can be a barrier to a successful college career. In addition, failure to notify students of important deadlines and information regarding their direct loans or TEACH Grants could cause students to incur loans they wished to cancel, resulting in unwanted debt. Finally, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate TSU’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. RECOMMENDATION TSU management should revise and adequately document procedures to ensure that students receive the required disbursement notifications and to ensure that credits on student accounts are refunded within 14 days of Title IV aid being disbursed. In addition, leadership should take necessary steps to provide adequate staffing and training to ensure compliance. Finally, TSU management should establish additional review procedures to meet disbursement requirements. MANAGEMENT’S COMMENT We concur. The automatic refund process has been reactivated for spring 2025 as part of our pilot program to refine financial aid procedures. TSU’s consultants conducted a comprehensive review of the current detail codes in use, methodically analyzing their effectiveness and identifying areas for improvement. The recommendations that were made based on this assessment are anticipated to enhance both the efficiency and clarity of the payment process, allowing for a more straightforward identification of non-refundable amounts, which in turn will facilitate the more efficient allocation of funds for necessary financial aid adjustments. The revised procedures will be tested during the spring 2025 refund period to assess their effectiveness and reliability before implementing them on a larger scale. To further support students during this transition, TSU and its consultants will initiate a system of automatic notifications for all students receiving loan disbursements. This systematic communication will enhance transparency by providing information on the amounts disbursed and notifying students of their rights to cancel either part or all of their loans. Additionally, it will outline the specific steps students need to follow to initiate a cancellation. The notification system has been tested and is confirmed to work effectively for loan disbursements in spring 2025. Consequently, before each term, we will review all system parameters and then examine the output after the disbursements are run to ensure that all student notifications are issued correctly. In addition, TSU is taking proactive measures to inform students when their financial aid packages become available, ensuring that they are kept in the loop about their funding status. This process is confirmed to be operating smoothly for Spring 2025, ensuring students receive timely updates. TSU and its consultants will also check the job scheduling system regularly to verify that these processes are being carried out as intended. The completion of these initiatives are anticipated by July 2025, well ahead of the processing for fall 2025 refunds. This timeline will allow for the seamless integration of improvements and ensure that students benefit from the enhancements in the financial aid process moving forward. Lastly, to comply with university procedures and regulatory requirements, it is crucial to fill the Accounting Manager vacancy in the Bursar's office as soon as possible. The Accounting Manager will be vital in overseeing the reconciliation processes, managing refund operations, and improving our financial practices moving forward. This position is essential not only for ensuring accuracy in financial reporting but also for proactively addressing and resolving any discrepancies that may arise. The Vice President of Business and Finance will coordinate with the Bursar’s Office and the Human Resources Department to ensure the timely recruitment and hiring of a qualified candidate.

Finding Number 2024-003 Assistance Listing Number 84.063 and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-004 Pass-Through Entity N/A Questioned Costs N/A FINDING For the federal Direct Loan and Pell Grant programs, Tennessee State University continued to not report timely and accurate information regarding students’ enrollment statuses BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For student recipients of Pell Grants or Direct Loans, ED requires institutions to report students’ enrollment statuses for each term to the National Student Loan Data System (NSLDS). The institution is also required to report changes to students’ enrollment, such as graduations, withdrawals, and transitions between full-time and part-time status. CONDITION Tennessee State University management, as noted in the prior finding, hired additional staff and communicated the withdrawal process in training and staff meetings. These corrections did not resolve the issues around enrollment reporting and withdrawal dates. We tested a sample of 60 Direct Loan borrowers and/or Pell Grant recipients at TSU. For these 60 students, TSU should have reported to NSLDS 75 separate incidents of an enrollment status change. As of November 8, 2024, the day of our testwork, we found that for 17 of 75 (23%) status changes tested, TSU either did not report any information, reported incorrect information, or did not timely report the status change to NSLDS. These errors impacted 16 of 60 (27%) students tested. Not Reported • For 3 students, management could not locate any record of enrollment history in NSLDS for some terms the students attended. Of the 3 students, management could not locate an NSLDS account for one student, indicating that TSU management did not report any information in NSLDS for the student. For the remaining 2 students, the enrollment history was missing for terms the student attended. The missing terms for these two students resulted in a combined 3 enrollment changes not being reported. • For 2 students, NSLDS showed a status of “No Record Found” for TSU’s enrollment records. This code should only be used if the school is closing, merging, or has become ineligible. TSU likely entered incorrect or inconsistent data, which can also generate the code. • The Enrollment Services Office did not properly enter a graduation for one student. The student completed the requirements for graduation on December 8, 2023. The failure to report the graduation likely occurred because the student had an account balance that was not paid off until December 9, 2023, the day after the graduation list would have been produced. However, as of the date of our testwork, November 8, 2024, the graduation had still not been reported to NSLDS. Reported Incorrectly • The Enrollment Services Office incorrectly reported enrollment status changes for 4 students during the summer semester. These students were purged during the summer semester due to failure to pay, reducing their hours enrolled to zero. The students were subsequently reported as withdrawn. However, when students reduce their course load below half-time during a summer term, they should maintain their spring status when half-time or greater. Therefore, the students should have been reported as full-time, rather than withdrawn. In addition, 2 of these 4 students had already completed and received grades for courses in Maymester, a month-long term within the summer semester, at the time they were purged. Despite completion, these classes were deleted from the system, including the grades and charges. • For one student, the Enrollment Services Office incorrectly reported the student as three-quarter time for the spring 2024 term despite the student’s attempting 13 hours during the term, which should have been reported as full-time. Reported Untimely • The Enrollment Services Office did not report the full-time status for one student until 80 days after the first day of the spring 2024 term, 20 days late. Students with Multiple Enrollment Reporting Issues • For one student, the Enrollment Services Office had not reported the student’s graduation on May 6, 2024, as of the date of our testwork, November 8, 2024. In addition, the student’s program in NSLDS recorded a major different from the university’s information system. • The Enrollment Services Office entered one student as less than half-time in the spring semester despite the student’s being enrolled in 9 hours, which should have been reported as three-quarter time. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. • The Enrollment Services Office entered one student as three-quarter time in the spring semester despite the student’s being enrolled in 12 hours, which should have been reported as full-time. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. • The Enrollment Services Office entered one graduate student as half-time in the spring semester despite the student’s being enrolled in 9 hours, which is considered full-time for graduate students. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. CRITERIA Federal Guidance The Federal Student Aid Handbook, Volume 2, Chapter 3, states that institutions “must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that file.” In the introduction to Chapter 1, the NSLDS Enrollment Reporting Guide states, “Accurate and timely Enrollment Reporting to NSLDS is essential to the Department of Education’s successful delivery of Title IV aid.” The requirements are established in Title 34, Code of Federal Regulations, Section 685.309(b). In Chapter 4, the NSLDS Enrollment Reporting Guide states . . . if the student enrolls in the summer term (or other non-required terms) at least half time, the student’s actual summer enrollment status is reported. If such a student subsequently withdraws from the summer term, the student’s most recent enrollment status of half time or greater should be reported throughout the remainder of the summer. In addition, Chapter 7 of the NSLDS Enrollment Reporting Guide states, “NSLDS records must be accurately matched with your enrollment records. You should review, update, or verify student enrollment statuses and other information with information that appears on the Enrollment Reporting Roster file.” CAUSE Management did not provide information to determine the cause or offer any possible explanations for the late status updates and the incorrect status reporting. Based on our review, TSU did not adequately review enrollment information in NSLDS to ensure changes were accurately reported. Adequately reviewing a sample of the information uploaded to NSLDS would have quickly determined the significant issues with the university enrollment reporting process. Furthermore, the Enrollment Services Office does not have sufficient knowledge or training on the specific summer reporting rules; instead, the office treats the summer term identically to the fall and spring terms. EFFECT Timely and accurate enrollment reporting is critical for effective management of ED programs. The accurate administration of the Title IV programs depends heavily on the accuracy of the enrollment information reported by schools. Accurate, timely, and complete enrollment data is also important to the students, who can view their current campus enrollment information and their program enrollment history. Also, if an individual no longer attends TSU but their lack of attendance is not reported, the individual’s loan repayment grace period could be improperly extended, resulting in the student’s loan repayments being improperly deferred. In addition, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate its participation in a Title IV program. These actions would negatively affect the university’s operations and the students impacted by the loss of Title IV aid. RECOMMENDATION TSU management should review and update its processes as necessary to ensure the Enrollment Services Office uploads and submits the correct information to NSLDS. In addition, the Assistant Vice President of Admissions and Records should ensure that staff know reporting deadlines, the importance of reporting enrollment status changes, and the summer reporting guidelines. The Assistant Vice President of Admissions and Records should also ensure that enrollment status changes are reported timely and the Financial Aid Office is promptly notified. TSU management should implement a review throughout each term to verify that the accurate information is reported in NSLDS. MANAGEMENT’S COMMENT We concur. TSU is firmly committed to ensuring accurate and timely reporting for the federal Direct Loan and Pell Grant programs, recognizing the importance of accurate data in supporting student financing and institutional integrity. To enhance the effectiveness of this process, the university has hired a Data Analyst whose primary responsibility is to manage and oversee enrollment reporting processes. The Office of Admissions and Records has also undertaken a review and update of its operational procedures with an outside consultant. This enhancement aims to ensure that the Enrollment Services Office uploads and submits the correct, up-to-date information to the National Student Clearinghouse (NSLDS), thereby minimizing the risk of discrepancies and ensuring compliance with federal guidelines. Updates to the NSLDS will be conducted following the census date, with a consistent reporting schedule planned for every 30 to 45 days thereafter, in addition to comprehensive submissions at the end of each academic term. This structured approach ensures that all enrollment changes, including withdrawals and adjustments in student status, are communicated promptly and accurately. If any errors are identified during these reporting processes, corrective measures will be initiated within a timeframe of 5 to 7 business days to rectify the issues, maintaining the integrity of the data reported. To improve clarity and ensure the successful implementation of these updates, the withdrawal process was thoroughly communicated to staff through dedicated training sessions and regular staff meetings. The combination of staff meetings and targeted training initiatives will ensure that all team members are thoroughly prepared to uphold the university's commitment to accurate reporting and strong student support.

Finding Number 2024-003 Assistance Listing Number 84.063 and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-004 Pass-Through Entity N/A Questioned Costs N/A FINDING For the federal Direct Loan and Pell Grant programs, Tennessee State University continued to not report timely and accurate information regarding students’ enrollment statuses BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For student recipients of Pell Grants or Direct Loans, ED requires institutions to report students’ enrollment statuses for each term to the National Student Loan Data System (NSLDS). The institution is also required to report changes to students’ enrollment, such as graduations, withdrawals, and transitions between full-time and part-time status. CONDITION Tennessee State University management, as noted in the prior finding, hired additional staff and communicated the withdrawal process in training and staff meetings. These corrections did not resolve the issues around enrollment reporting and withdrawal dates. We tested a sample of 60 Direct Loan borrowers and/or Pell Grant recipients at TSU. For these 60 students, TSU should have reported to NSLDS 75 separate incidents of an enrollment status change. As of November 8, 2024, the day of our testwork, we found that for 17 of 75 (23%) status changes tested, TSU either did not report any information, reported incorrect information, or did not timely report the status change to NSLDS. These errors impacted 16 of 60 (27%) students tested. Not Reported • For 3 students, management could not locate any record of enrollment history in NSLDS for some terms the students attended. Of the 3 students, management could not locate an NSLDS account for one student, indicating that TSU management did not report any information in NSLDS for the student. For the remaining 2 students, the enrollment history was missing for terms the student attended. The missing terms for these two students resulted in a combined 3 enrollment changes not being reported. • For 2 students, NSLDS showed a status of “No Record Found” for TSU’s enrollment records. This code should only be used if the school is closing, merging, or has become ineligible. TSU likely entered incorrect or inconsistent data, which can also generate the code. • The Enrollment Services Office did not properly enter a graduation for one student. The student completed the requirements for graduation on December 8, 2023. The failure to report the graduation likely occurred because the student had an account balance that was not paid off until December 9, 2023, the day after the graduation list would have been produced. However, as of the date of our testwork, November 8, 2024, the graduation had still not been reported to NSLDS. Reported Incorrectly • The Enrollment Services Office incorrectly reported enrollment status changes for 4 students during the summer semester. These students were purged during the summer semester due to failure to pay, reducing their hours enrolled to zero. The students were subsequently reported as withdrawn. However, when students reduce their course load below half-time during a summer term, they should maintain their spring status when half-time or greater. Therefore, the students should have been reported as full-time, rather than withdrawn. In addition, 2 of these 4 students had already completed and received grades for courses in Maymester, a month-long term within the summer semester, at the time they were purged. Despite completion, these classes were deleted from the system, including the grades and charges. • For one student, the Enrollment Services Office incorrectly reported the student as three-quarter time for the spring 2024 term despite the student’s attempting 13 hours during the term, which should have been reported as full-time. Reported Untimely • The Enrollment Services Office did not report the full-time status for one student until 80 days after the first day of the spring 2024 term, 20 days late. Students with Multiple Enrollment Reporting Issues • For one student, the Enrollment Services Office had not reported the student’s graduation on May 6, 2024, as of the date of our testwork, November 8, 2024. In addition, the student’s program in NSLDS recorded a major different from the university’s information system. • The Enrollment Services Office entered one student as less than half-time in the spring semester despite the student’s being enrolled in 9 hours, which should have been reported as three-quarter time. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. • The Enrollment Services Office entered one student as three-quarter time in the spring semester despite the student’s being enrolled in 12 hours, which should have been reported as full-time. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. • The Enrollment Services Office entered one graduate student as half-time in the spring semester despite the student’s being enrolled in 9 hours, which is considered full-time for graduate students. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. CRITERIA Federal Guidance The Federal Student Aid Handbook, Volume 2, Chapter 3, states that institutions “must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that file.” In the introduction to Chapter 1, the NSLDS Enrollment Reporting Guide states, “Accurate and timely Enrollment Reporting to NSLDS is essential to the Department of Education’s successful delivery of Title IV aid.” The requirements are established in Title 34, Code of Federal Regulations, Section 685.309(b). In Chapter 4, the NSLDS Enrollment Reporting Guide states . . . if the student enrolls in the summer term (or other non-required terms) at least half time, the student’s actual summer enrollment status is reported. If such a student subsequently withdraws from the summer term, the student’s most recent enrollment status of half time or greater should be reported throughout the remainder of the summer. In addition, Chapter 7 of the NSLDS Enrollment Reporting Guide states, “NSLDS records must be accurately matched with your enrollment records. You should review, update, or verify student enrollment statuses and other information with information that appears on the Enrollment Reporting Roster file.” CAUSE Management did not provide information to determine the cause or offer any possible explanations for the late status updates and the incorrect status reporting. Based on our review, TSU did not adequately review enrollment information in NSLDS to ensure changes were accurately reported. Adequately reviewing a sample of the information uploaded to NSLDS would have quickly determined the significant issues with the university enrollment reporting process. Furthermore, the Enrollment Services Office does not have sufficient knowledge or training on the specific summer reporting rules; instead, the office treats the summer term identically to the fall and spring terms. EFFECT Timely and accurate enrollment reporting is critical for effective management of ED programs. The accurate administration of the Title IV programs depends heavily on the accuracy of the enrollment information reported by schools. Accurate, timely, and complete enrollment data is also important to the students, who can view their current campus enrollment information and their program enrollment history. Also, if an individual no longer attends TSU but their lack of attendance is not reported, the individual’s loan repayment grace period could be improperly extended, resulting in the student’s loan repayments being improperly deferred. In addition, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate its participation in a Title IV program. These actions would negatively affect the university’s operations and the students impacted by the loss of Title IV aid. RECOMMENDATION TSU management should review and update its processes as necessary to ensure the Enrollment Services Office uploads and submits the correct information to NSLDS. In addition, the Assistant Vice President of Admissions and Records should ensure that staff know reporting deadlines, the importance of reporting enrollment status changes, and the summer reporting guidelines. The Assistant Vice President of Admissions and Records should also ensure that enrollment status changes are reported timely and the Financial Aid Office is promptly notified. TSU management should implement a review throughout each term to verify that the accurate information is reported in NSLDS. MANAGEMENT’S COMMENT We concur. TSU is firmly committed to ensuring accurate and timely reporting for the federal Direct Loan and Pell Grant programs, recognizing the importance of accurate data in supporting student financing and institutional integrity. To enhance the effectiveness of this process, the university has hired a Data Analyst whose primary responsibility is to manage and oversee enrollment reporting processes. The Office of Admissions and Records has also undertaken a review and update of its operational procedures with an outside consultant. This enhancement aims to ensure that the Enrollment Services Office uploads and submits the correct, up-to-date information to the National Student Clearinghouse (NSLDS), thereby minimizing the risk of discrepancies and ensuring compliance with federal guidelines. Updates to the NSLDS will be conducted following the census date, with a consistent reporting schedule planned for every 30 to 45 days thereafter, in addition to comprehensive submissions at the end of each academic term. This structured approach ensures that all enrollment changes, including withdrawals and adjustments in student status, are communicated promptly and accurately. If any errors are identified during these reporting processes, corrective measures will be initiated within a timeframe of 5 to 7 business days to rectify the issues, maintaining the integrity of the data reported. To improve clarity and ensure the successful implementation of these updates, the withdrawal process was thoroughly communicated to staff through dedicated training sessions and regular staff meetings. The combination of staff meetings and targeted training initiatives will ensure that all team members are thoroughly prepared to uphold the university's commitment to accurate reporting and strong student support.

Finding Number 2024-004 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-005 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.007 Federal Award Identification Number P007A073927 Amount $239 Assistance Listing Number 84.063 Federal Award Identification Number P063P070381 Amount $4,754 FINDING Tennessee State University continued not to return Title IV funds in compliance with federal regulations BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For Title IV recipients who did not complete at least 60% of the semester, the school is required to perform a calculation to determine the amount of unearned aid that it must return to ED. CONDITION In response to the prior audit finding, management stated the university created and hired an Assistant Director of Compliance. Management also stated they would implement a daily review of the Return to Title IV report by both the Financial Aid and Records office. These updates were insufficient in addressing the ongoing compliance issues. We tested two groups of students who officially or unofficially withdrew from classes at Tennessee State University (TSU) during the 2023–2024 award year. First, we selected 15 student withdrawals from a population of 43 students who had an official or unofficial withdrawal before the 60% completion date. We tested these withdrawn students to ensure that withdrawal dates were accurate, that calculations were performed correctly, and that amounts were returned to ED within the required timeframes. Of the 15 student withdrawals, we noted 13 (87%) contained errors. Of the 13 errors, TSU did not return the Title IV funds to ED within the required timeframe for two students, and TSU did not calculate the correct return of the Title IV funds to ED for eight students. For the remaining three students, TSU did not calculate the correct return of the Title IV funds and did not return the funds within the required timeframes. In addition to the above errors, TSU management was not able to provide withdrawal forms for 2 of the 15 students (13%). We tested these students based on the date of withdrawal noted in the university’s information system; however, we were unable to verify this date. One of the student withdrawals was otherwise correct, while the other is included as an error below. Of the 15 errors, 11 were the result of incorrect calculation of return of funds. Specifically, • For 5 students, TSU calculated the returns with withdrawal dates 7-35 days after the students signed and submitted their withdrawal documentation. This resulted in questioned costs of $1,959. • For 1 student, TSU did not return the full amount of Title IV funds to ED even though the student submitted withdrawal documentation before the start of the semester. TSU returned $1,453; however, the full amount of $2,773 should have been considered an overaward and fully returned. This led to questioned costs of $1,320. • For 1 student, TSU did not enter the correct amount of the student’s Pell disbursement in the return calculation. This led to TSU calculating and returning from university funds $3,272, which was $1,276 more than necessary. • For 3 students, TSU did not enter the correct institutional charges in the return calculation but instead used cost of attendance. This led to TSU calculating and returning $8,328 more than necessary from university funds. • For 1 student, TSU calculated the return based on an end of attendance that was three days before the student signed their withdrawal form. This led to TSU calculating and returning from university funds $2,638, which was $165 more than necessary In addition to the above, we noted that for 5 of the 15 student withdrawals tested (33%), TSU did not return the Title IV funds within the applicable timeframes. The timeframes are 30 days after the school becomes aware of the withdrawal if the student never began attendance for the semester and 45 days if the student withdrew during the semester. Of the 5 students, 3 were included above due to also having calculation errors, while TSU correctly calculated the return for the remaining two students. • For two students, TSU returned funds 139 and 259 days after TSU processed the students’ withdrawal forms. As these withdrawals occurred during the semester, the 45-day timeframe was applicable, resulting in the returns being between 94 and 214 days late. • For two students, the school applied charges and Title IV aid to the students’ accounts for the fall 2023 semester based on information from the FAFSA; however, both submitted withdrawal forms before the start of the semester. Despite receiving the forms before the semester, TSU did not process the withdrawals until October 9, 2023, while the return of funds was not completed until October 31, 2023, for one student and June 11, 2024, for the other student. ED specifies that awards to students who never begin attendance are overawards and must be returned within 30 days after the school has determined the student did not begin attendance. For these 2 students, TSU returned funds 74 and 258 days after the student made TSU aware of their withdrawal, or 44 and 228 days late. • For the remaining student, TSU initially processed a return of Title IV funds on October 31, 2023, after the student had notified TSU of their withdrawal for the fall 2023 semester on October 4, 2023. However, when the student registered for spring 2024 classes, federal direct loans were added, and the original return of Title IV funds was reversed. The incorrect reversal and posting of additional funds were not corrected until June 19, 2024, when the return of Title IV funds calculation was recomputed. The corrections were made 259 days after the date of withdrawal, 214 days late. We also selected a sample of 15 from a population of 21 students who completed over 60% of the semester in which they withdrew to ensure that TSU recorded the withdrawal dates correctly, had adequate attendance records to support the withdrawal date, and did not remove Title IV funds from the account. Of the original 15 sample items, we noted 1 (6.7%) error. For this 1 student, TSU entered a withdrawal date beyond the 60% point of the semester; however, the student signed their withdrawal form 7 days before the 60% point. This resulted in $1,714 in questioned costs. Due to the high number of errors and the significant percentage of the overall withdrawal population tested, 30 of 64, or 47%, we determined that additional testwork was not required. CRITERIA The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 1, page 3, states, A pro rata schedule is used to determine the amount of FSA [Federal Student Aid] funds the student has earned at the time of withdrawal up through the 60% point in each payment period or period of enrollment. After the 60% point in the payment period or period of enrollment, a student has earned 100% of the FSA funds the student received and was scheduled to receive during the period. The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 2, page 92, states, • Student’s Withdrawal Date Official notification – The date the student begins the school’s withdrawal process, or the date that the student otherwise provides notification (If both circumstances occur, use the earlier withdrawal date) • Official notification not provided – The date that the school determines is related to the circumstance beyond the student’s control, or the midpoint of the payment period or period of enrollment, as applicable • Alternative approach – In place of the dates listed, a school may always use, as a student’s withdrawal date, the student’s last date of attendance at an academically related activity if the school documents that the activity is academically related and that the student attended the activity. The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 3, page 3, states, Schools must return funds disbursed to a student who failed to begin attendance as soon as possible but no later than 30 days after the date they become aware that the student has not begun and will not begin attendance [emphasis in original]. The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 2, page 39, states, An institution is not required to return the inadvertent overpayment immediately but must return it within 45 days of the date of the institution’s determination that the student withdrew (the time frame for an institution’s return of Title IV funds under 34 CFR 668.22(j)(1)). An institution must return an inadvertent overpayment in accordance with the applicable regulations for returning overpayments. Please see Volume 4, Chapter 3 for more information on overpayment procedures [emphasis in original]. CAUSE Based on our review, it appears that TSU management did not have proper oversight and review procedures over the return of Title IV funds, as we noted multiple issues regarding both the calculation itself as well as the timing. Specifically, TSU performed the Title IV return calculation using cost of attendance instead of institutional charges and entered the withdrawal date as the date the withdrawal was processed instead of the last date the student attended or the date on the signed withdrawal forms. In addition, TSU did not have a system in place to ensure all withdrawals and returns were processed timely. EFFECT For the 30 students tested, TSU calculated a total return of $39,133 in Title IV funds. The corrected total after adjustment for the errors we noted in our testwork was $34,361. TSU overreturned funds to students by $9,769 and underreturned funds to other students by a total of $4,993. The $4,993 was identified as questioned costs. Violations of the federal requirement to timely return Title IV funds to ED could result in ED imposing a fine on TSU and/or limiting, suspending, or terminating TSU’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. In addition, incorrect return calculations and/or withdrawal dates can negatively impact students. If TSU incorrectly calculates and returns the amount of unearned aid to ED, it could impact the amount of aid the student is eligible to receive in future terms or result in a student having an account balance in error. RECOMMENDATION The Registrar’s Office and the Financial Aid Office should follow federal regulations. Management should ensure that the Financial Aid Office reperforms all return of Title IV funds calculations and makes necessary corrections to student and federal fund accounts for the 2023–2024 academic year. Finally, TSU should ensure that the Registrar’s Office communicates any withdrawals to the Financial Aid Office in a timely manner. MANAGEMENT’S COMMENT We concur. The Office of Financial Aid is set to conduct a comprehensive review of the Title IV funds for the 2023-2024 academic year in February 2025, with the review anticipated to be completed by the end of April 2025. The communication process between the Registrar’s Office and Financial Aid begins with a detailed examination of the daily Withdrawal Report generated by the Registrar’s Office. Upon receiving this report, an acknowledgment email will be sent to confirm its review. To facilitate accurate calculations regarding the return of funds, specific parameters will be established within the Banner system. These parameters will support the Funds Calculation process in determining the correct return amounts owed. Our team is actively working with outside consultants to restructure and enhance our financial aid processes. This collaboration aims to significantly update our existing policies and procedures, preventing compliance issues in the future while fostering a more efficient system. An important aspect of this process is how the effective date of withdrawals is determined. The Registrar’s Office must use the date on which the student submitted their withdrawal form as the official effective date. By accurately recording this date in the Student Course Registration system, we can ensure that the student’s information is correctly reflected on the Withdrawal Report. Having the right effective date is crucial for maintaining accurate academic records and complying with federal regulations. TSU, in conjunction with its consultant, will help identify students with the correct withdrawal dates in the Registrar’s Office and will also work with Student Accounts to ensure that the appropriate institutional charges are used in all calculations. Finally, the Withdrawal Report can be scheduled within the job scheduler to run automatically and on time each day. This scheduling will contribute to a smoother workflow, allowing for any necessary adjustments to be made efficiently. By employing the Banner-delivered process for funds calculation, we will ensure that the actual charges incurred by the student are used in the calculation of returns instead of the predetermined cost of attendance, leading to more accurate financial assessments.

Finding Number 2024-004 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-005 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.007 Federal Award Identification Number P007A073927 Amount $239 Assistance Listing Number 84.063 Federal Award Identification Number P063P070381 Amount $4,754 FINDING Tennessee State University continued not to return Title IV funds in compliance with federal regulations BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For Title IV recipients who did not complete at least 60% of the semester, the school is required to perform a calculation to determine the amount of unearned aid that it must return to ED. CONDITION In response to the prior audit finding, management stated the university created and hired an Assistant Director of Compliance. Management also stated they would implement a daily review of the Return to Title IV report by both the Financial Aid and Records office. These updates were insufficient in addressing the ongoing compliance issues. We tested two groups of students who officially or unofficially withdrew from classes at Tennessee State University (TSU) during the 2023–2024 award year. First, we selected 15 student withdrawals from a population of 43 students who had an official or unofficial withdrawal before the 60% completion date. We tested these withdrawn students to ensure that withdrawal dates were accurate, that calculations were performed correctly, and that amounts were returned to ED within the required timeframes. Of the 15 student withdrawals, we noted 13 (87%) contained errors. Of the 13 errors, TSU did not return the Title IV funds to ED within the required timeframe for two students, and TSU did not calculate the correct return of the Title IV funds to ED for eight students. For the remaining three students, TSU did not calculate the correct return of the Title IV funds and did not return the funds within the required timeframes. In addition to the above errors, TSU management was not able to provide withdrawal forms for 2 of the 15 students (13%). We tested these students based on the date of withdrawal noted in the university’s information system; however, we were unable to verify this date. One of the student withdrawals was otherwise correct, while the other is included as an error below. Of the 15 errors, 11 were the result of incorrect calculation of return of funds. Specifically, • For 5 students, TSU calculated the returns with withdrawal dates 7-35 days after the students signed and submitted their withdrawal documentation. This resulted in questioned costs of $1,959. • For 1 student, TSU did not return the full amount of Title IV funds to ED even though the student submitted withdrawal documentation before the start of the semester. TSU returned $1,453; however, the full amount of $2,773 should have been considered an overaward and fully returned. This led to questioned costs of $1,320. • For 1 student, TSU did not enter the correct amount of the student’s Pell disbursement in the return calculation. This led to TSU calculating and returning from university funds $3,272, which was $1,276 more than necessary. • For 3 students, TSU did not enter the correct institutional charges in the return calculation but instead used cost of attendance. This led to TSU calculating and returning $8,328 more than necessary from university funds. • For 1 student, TSU calculated the return based on an end of attendance that was three days before the student signed their withdrawal form. This led to TSU calculating and returning from university funds $2,638, which was $165 more than necessary In addition to the above, we noted that for 5 of the 15 student withdrawals tested (33%), TSU did not return the Title IV funds within the applicable timeframes. The timeframes are 30 days after the school becomes aware of the withdrawal if the student never began attendance for the semester and 45 days if the student withdrew during the semester. Of the 5 students, 3 were included above due to also having calculation errors, while TSU correctly calculated the return for the remaining two students. • For two students, TSU returned funds 139 and 259 days after TSU processed the students’ withdrawal forms. As these withdrawals occurred during the semester, the 45-day timeframe was applicable, resulting in the returns being between 94 and 214 days late. • For two students, the school applied charges and Title IV aid to the students’ accounts for the fall 2023 semester based on information from the FAFSA; however, both submitted withdrawal forms before the start of the semester. Despite receiving the forms before the semester, TSU did not process the withdrawals until October 9, 2023, while the return of funds was not completed until October 31, 2023, for one student and June 11, 2024, for the other student. ED specifies that awards to students who never begin attendance are overawards and must be returned within 30 days after the school has determined the student did not begin attendance. For these 2 students, TSU returned funds 74 and 258 days after the student made TSU aware of their withdrawal, or 44 and 228 days late. • For the remaining student, TSU initially processed a return of Title IV funds on October 31, 2023, after the student had notified TSU of their withdrawal for the fall 2023 semester on October 4, 2023. However, when the student registered for spring 2024 classes, federal direct loans were added, and the original return of Title IV funds was reversed. The incorrect reversal and posting of additional funds were not corrected until June 19, 2024, when the return of Title IV funds calculation was recomputed. The corrections were made 259 days after the date of withdrawal, 214 days late. We also selected a sample of 15 from a population of 21 students who completed over 60% of the semester in which they withdrew to ensure that TSU recorded the withdrawal dates correctly, had adequate attendance records to support the withdrawal date, and did not remove Title IV funds from the account. Of the original 15 sample items, we noted 1 (6.7%) error. For this 1 student, TSU entered a withdrawal date beyond the 60% point of the semester; however, the student signed their withdrawal form 7 days before the 60% point. This resulted in $1,714 in questioned costs. Due to the high number of errors and the significant percentage of the overall withdrawal population tested, 30 of 64, or 47%, we determined that additional testwork was not required. CRITERIA The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 1, page 3, states, A pro rata schedule is used to determine the amount of FSA [Federal Student Aid] funds the student has earned at the time of withdrawal up through the 60% point in each payment period or period of enrollment. After the 60% point in the payment period or period of enrollment, a student has earned 100% of the FSA funds the student received and was scheduled to receive during the period. The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 2, page 92, states, • Student’s Withdrawal Date Official notification – The date the student begins the school’s withdrawal process, or the date that the student otherwise provides notification (If both circumstances occur, use the earlier withdrawal date) • Official notification not provided – The date that the school determines is related to the circumstance beyond the student’s control, or the midpoint of the payment period or period of enrollment, as applicable • Alternative approach – In place of the dates listed, a school may always use, as a student’s withdrawal date, the student’s last date of attendance at an academically related activity if the school documents that the activity is academically related and that the student attended the activity. The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 3, page 3, states, Schools must return funds disbursed to a student who failed to begin attendance as soon as possible but no later than 30 days after the date they become aware that the student has not begun and will not begin attendance [emphasis in original]. The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 2, page 39, states, An institution is not required to return the inadvertent overpayment immediately but must return it within 45 days of the date of the institution’s determination that the student withdrew (the time frame for an institution’s return of Title IV funds under 34 CFR 668.22(j)(1)). An institution must return an inadvertent overpayment in accordance with the applicable regulations for returning overpayments. Please see Volume 4, Chapter 3 for more information on overpayment procedures [emphasis in original]. CAUSE Based on our review, it appears that TSU management did not have proper oversight and review procedures over the return of Title IV funds, as we noted multiple issues regarding both the calculation itself as well as the timing. Specifically, TSU performed the Title IV return calculation using cost of attendance instead of institutional charges and entered the withdrawal date as the date the withdrawal was processed instead of the last date the student attended or the date on the signed withdrawal forms. In addition, TSU did not have a system in place to ensure all withdrawals and returns were processed timely. EFFECT For the 30 students tested, TSU calculated a total return of $39,133 in Title IV funds. The corrected total after adjustment for the errors we noted in our testwork was $34,361. TSU overreturned funds to students by $9,769 and underreturned funds to other students by a total of $4,993. The $4,993 was identified as questioned costs. Violations of the federal requirement to timely return Title IV funds to ED could result in ED imposing a fine on TSU and/or limiting, suspending, or terminating TSU’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. In addition, incorrect return calculations and/or withdrawal dates can negatively impact students. If TSU incorrectly calculates and returns the amount of unearned aid to ED, it could impact the amount of aid the student is eligible to receive in future terms or result in a student having an account balance in error. RECOMMENDATION The Registrar’s Office and the Financial Aid Office should follow federal regulations. Management should ensure that the Financial Aid Office reperforms all return of Title IV funds calculations and makes necessary corrections to student and federal fund accounts for the 2023–2024 academic year. Finally, TSU should ensure that the Registrar’s Office communicates any withdrawals to the Financial Aid Office in a timely manner. MANAGEMENT’S COMMENT We concur. The Office of Financial Aid is set to conduct a comprehensive review of the Title IV funds for the 2023-2024 academic year in February 2025, with the review anticipated to be completed by the end of April 2025. The communication process between the Registrar’s Office and Financial Aid begins with a detailed examination of the daily Withdrawal Report generated by the Registrar’s Office. Upon receiving this report, an acknowledgment email will be sent to confirm its review. To facilitate accurate calculations regarding the return of funds, specific parameters will be established within the Banner system. These parameters will support the Funds Calculation process in determining the correct return amounts owed. Our team is actively working with outside consultants to restructure and enhance our financial aid processes. This collaboration aims to significantly update our existing policies and procedures, preventing compliance issues in the future while fostering a more efficient system. An important aspect of this process is how the effective date of withdrawals is determined. The Registrar’s Office must use the date on which the student submitted their withdrawal form as the official effective date. By accurately recording this date in the Student Course Registration system, we can ensure that the student’s information is correctly reflected on the Withdrawal Report. Having the right effective date is crucial for maintaining accurate academic records and complying with federal regulations. TSU, in conjunction with its consultant, will help identify students with the correct withdrawal dates in the Registrar’s Office and will also work with Student Accounts to ensure that the appropriate institutional charges are used in all calculations. Finally, the Withdrawal Report can be scheduled within the job scheduler to run automatically and on time each day. This scheduling will contribute to a smoother workflow, allowing for any necessary adjustments to be made efficiently. By employing the Banner-delivered process for funds calculation, we will ensure that the actual charges incurred by the student are used in the calculation of returns instead of the predetermined cost of attendance, leading to more accurate financial assessments.

Finding Number 2024-005 Assistance Listing Number 10.553, 10.555, 10.556, and 10.582 Program Name Child Nutrition Cluster Federal Agency Department of Agriculture State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Education did not comply with Federal Funding Accountability and Transparency Act reporting requirements for the Child Nutrition Cluster and did not implement the designed internal control over the reporting requirements BACKGROUND The Department of Education (the department) is the pass-through entity for the Child Nutrition Cluster,(2) which is administered by the Food and Nutrition Service of the U.S. Department of Agriculture. The Child Nutrition Cluster is a cluster of federal programs to provide healthful, nutritious meals and snacks to eligible children in public schools and nonprofit private schools, residential childcare institutions, and summer recreation programs. See Schedule of Findings and Questioned Costs for footnote. For the School Breakfast Program, the National School Lunch Program, and the Special Milk Program for Children, the department enters into agreements with subrecipient organizations, known as School Food Authorities (SFAs), for local-level program operation and the delivery of program services to eligible children. The department reimburses SFAs for each meal or snack served based on the rates established by the U.S. Department of Agriculture. Each month, the SFAs claim the number of meals or snacks served using the department’s Tennessee: Meals, Accounting, and Claiming (TMAC) system. For the Fresh Fruit and Vegetable Program(3), the department enters into additional agreements with approved SFAs for eligible elementary schools within those SFAs for local-level program operation and the delivery of program services to eligible children. The department awards a grant amount for each elementary school based on a rate set per child by the department. Each month, the SFAs claim the costs from procurement, operations, and administration using the department’s TMAC system. See Schedule of Findings and Questioned Costs for footnote. The Federal Funding and Accountability Transparency Act (FFATA) requires the department to report subrecipient subaward financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. According to federal regulations, reports are due “no later than the end of the month following the month in which the obligation was made.” The subaward information in FSRS is then available to the public on the USA Spending website for transparency. CONDITION AND CAUSE Based on our discussion with management, because management had not implemented cross-training for backups as outlined in their designed internal controls for succession planning, staff was not aware of the requirement and therefore, did not complete any FFATA reporting for the Child Nutrition Cluster for the entire fiscal year. Based on our review of the claim information for the year, staff did not report 189 SFAs’ Child Nutrition subawards,(4) totaling $449,928,320 and 25 FFVP subawards, totaling $4,499,375. See Schedule of Findings and Questioned Costs for footnote. The former Federal Reporting Specialist who was responsible for FFATA reporting left the department in September 2023. At the time he left, he had not done any reporting for fiscal year 2024. When the current State Director of School Nutrition began in his role in March 2024, the Assistant Commissioner had not reassigned the FFATA reporting tasks and did not inform the newly hired State Director to reassign the FFATA reporting responsibilities thus the State Director was unaware of the reporting requirement. We first inquired about the department’s current FFATA reporting process on July 1, 2024. The Data Processing and Reporting Specialist(5) who is currently responsible for FFATA reporting took the role on July 8, 2024. She requested access to FSRS almost immediately and after following up, received access on September 4, 2024. See Schedule of Findings and Questioned Costs for footnote. On August 7, 2024, the current State Director of School Nutrition provided us the FFATA Reporting Process Plan, effective October 2022, that was maintained in the former Federal Reporting Specialist’s files. The process plan includes the owner of the process, a description of the process, the statute or regulation that requires it, the team members associated with the process as well as their role, and risks associated with the process. While the process plan lists the team member responsible for reporting as well as a backup; neither one submitted the required reports. We also reviewed the Department of Education’s 2024 Financial Integrity Act Risk Assessment and determined that despite the fact that management’s documented process plan and risk assessment identified the risks, management did not include all mitigating controls and did not follow through with effective implementation of all the mitigating controls and, as such, the backup was not trained and was unaware of the FFATA responsibilities and requirements. When we brought the FFATA reporting deficiency to management’s attention, management stated that they had begun creating and implementing a standard operating procedure and are in the process of uploading the FFATA reports for fiscal year 2024. We will audit the FFATA reporting requirements for the Child Nutrition Cluster during the next audit. CRITERIA FFATA Reporting Appendix A to “Reporting Subaward and Executive Compensation Information,” Title 2, Code of Federal Regulations (CFR), Part 170, states: a. Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. EFFECT Not meeting the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner should work with staff to ensure that when turnover occurs, new staff are fully informed about the scope of their responsibilities and have access to the resources needed to perform them, such as FSRS access and the newly developed standard operating procedures. Management should evaluate the identified mitigating controls for risks associated with the conditions identified in this finding to ensure they are appropriately designed, assigned, and that they are implemented. Management should update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need to ensure that new staff are fully informed about the scope of their responsibilities and have access to essential resources, such as FSRS access and the newly developed standard operating procedures. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Onboarding and Resource Access: • The Division of Human Resources will work closely with management to ensure each office and division maintains a robust onboarding process, ensuring that new employees are fully informed about their responsibilities and have access to all necessary resources. • The Deputy Commissioner will designate a single point of contact for FSRS reporting coordination within the agency and ensure standard operating procedures are updated accordingly to reflect onboarding requirements of new staff with FSRS reporting responsibilities. • Regular training sessions will be conducted to keep new and existing staff up to date with any changes in procedures and responsibilities. 2. Evaluation of Mitigating Controls: • Management will carefully evaluate the identified mitigating controls for the risks associated with the conditions mentioned in the audit finding. • We will ensure that these controls are appropriately designed, assigned, and effectively implemented to mitigate any potential risks. 3. Risk Assessment Updates: • The risk assessment will be updated regularly to reflect any changes in the operational environment, identified risks, and the effectiveness of mitigating controls. • This process will involve continuous monitoring and review to ensure that the risk assessment remains relevant and effective. 4. Ongoing Monitoring and Accountability: • The Deputy Commissioner will assign the Chief Operating Officer to continually monitor risks and assess the effectiveness of mitigating controls. • Clear protocols will be established for timely corrective actions if any deficiencies are identified, ensuring that any issues are promptly addressed and resolved. The department is fully committed to ensuring that staff have the necessary resources and support to perform their roles effectively. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment, minimize risks, and ensure the continued success of our operations. We appreciate the audit team's insights and recommendations and are dedicated to demonstrating progress in these areas.

Finding Number 2024-005 Assistance Listing Number 10.553, 10.555, 10.556, and 10.582 Program Name Child Nutrition Cluster Federal Agency Department of Agriculture State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Education did not comply with Federal Funding Accountability and Transparency Act reporting requirements for the Child Nutrition Cluster and did not implement the designed internal control over the reporting requirements BACKGROUND The Department of Education (the department) is the pass-through entity for the Child Nutrition Cluster,(2) which is administered by the Food and Nutrition Service of the U.S. Department of Agriculture. The Child Nutrition Cluster is a cluster of federal programs to provide healthful, nutritious meals and snacks to eligible children in public schools and nonprofit private schools, residential childcare institutions, and summer recreation programs. See Schedule of Findings and Questioned Costs for footnote. For the School Breakfast Program, the National School Lunch Program, and the Special Milk Program for Children, the department enters into agreements with subrecipient organizations, known as School Food Authorities (SFAs), for local-level program operation and the delivery of program services to eligible children. The department reimburses SFAs for each meal or snack served based on the rates established by the U.S. Department of Agriculture. Each month, the SFAs claim the number of meals or snacks served using the department’s Tennessee: Meals, Accounting, and Claiming (TMAC) system. For the Fresh Fruit and Vegetable Program(3), the department enters into additional agreements with approved SFAs for eligible elementary schools within those SFAs for local-level program operation and the delivery of program services to eligible children. The department awards a grant amount for each elementary school based on a rate set per child by the department. Each month, the SFAs claim the costs from procurement, operations, and administration using the department’s TMAC system. See Schedule of Findings and Questioned Costs for footnote. The Federal Funding and Accountability Transparency Act (FFATA) requires the department to report subrecipient subaward financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. According to federal regulations, reports are due “no later than the end of the month following the month in which the obligation was made.” The subaward information in FSRS is then available to the public on the USA Spending website for transparency. CONDITION AND CAUSE Based on our discussion with management, because management had not implemented cross-training for backups as outlined in their designed internal controls for succession planning, staff was not aware of the requirement and therefore, did not complete any FFATA reporting for the Child Nutrition Cluster for the entire fiscal year. Based on our review of the claim information for the year, staff did not report 189 SFAs’ Child Nutrition subawards,(4) totaling $449,928,320 and 25 FFVP subawards, totaling $4,499,375. See Schedule of Findings and Questioned Costs for footnote. The former Federal Reporting Specialist who was responsible for FFATA reporting left the department in September 2023. At the time he left, he had not done any reporting for fiscal year 2024. When the current State Director of School Nutrition began in his role in March 2024, the Assistant Commissioner had not reassigned the FFATA reporting tasks and did not inform the newly hired State Director to reassign the FFATA reporting responsibilities thus the State Director was unaware of the reporting requirement. We first inquired about the department’s current FFATA reporting process on July 1, 2024. The Data Processing and Reporting Specialist(5) who is currently responsible for FFATA reporting took the role on July 8, 2024. She requested access to FSRS almost immediately and after following up, received access on September 4, 2024. See Schedule of Findings and Questioned Costs for footnote. On August 7, 2024, the current State Director of School Nutrition provided us the FFATA Reporting Process Plan, effective October 2022, that was maintained in the former Federal Reporting Specialist’s files. The process plan includes the owner of the process, a description of the process, the statute or regulation that requires it, the team members associated with the process as well as their role, and risks associated with the process. While the process plan lists the team member responsible for reporting as well as a backup; neither one submitted the required reports. We also reviewed the Department of Education’s 2024 Financial Integrity Act Risk Assessment and determined that despite the fact that management’s documented process plan and risk assessment identified the risks, management did not include all mitigating controls and did not follow through with effective implementation of all the mitigating controls and, as such, the backup was not trained and was unaware of the FFATA responsibilities and requirements. When we brought the FFATA reporting deficiency to management’s attention, management stated that they had begun creating and implementing a standard operating procedure and are in the process of uploading the FFATA reports for fiscal year 2024. We will audit the FFATA reporting requirements for the Child Nutrition Cluster during the next audit. CRITERIA FFATA Reporting Appendix A to “Reporting Subaward and Executive Compensation Information,” Title 2, Code of Federal Regulations (CFR), Part 170, states: a. Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. EFFECT Not meeting the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner should work with staff to ensure that when turnover occurs, new staff are fully informed about the scope of their responsibilities and have access to the resources needed to perform them, such as FSRS access and the newly developed standard operating procedures. Management should evaluate the identified mitigating controls for risks associated with the conditions identified in this finding to ensure they are appropriately designed, assigned, and that they are implemented. Management should update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need to ensure that new staff are fully informed about the scope of their responsibilities and have access to essential resources, such as FSRS access and the newly developed standard operating procedures. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Onboarding and Resource Access: • The Division of Human Resources will work closely with management to ensure each office and division maintains a robust onboarding process, ensuring that new employees are fully informed about their responsibilities and have access to all necessary resources. • The Deputy Commissioner will designate a single point of contact for FSRS reporting coordination within the agency and ensure standard operating procedures are updated accordingly to reflect onboarding requirements of new staff with FSRS reporting responsibilities. • Regular training sessions will be conducted to keep new and existing staff up to date with any changes in procedures and responsibilities. 2. Evaluation of Mitigating Controls: • Management will carefully evaluate the identified mitigating controls for the risks associated with the conditions mentioned in the audit finding. • We will ensure that these controls are appropriately designed, assigned, and effectively implemented to mitigate any potential risks. 3. Risk Assessment Updates: • The risk assessment will be updated regularly to reflect any changes in the operational environment, identified risks, and the effectiveness of mitigating controls. • This process will involve continuous monitoring and review to ensure that the risk assessment remains relevant and effective. 4. Ongoing Monitoring and Accountability: • The Deputy Commissioner will assign the Chief Operating Officer to continually monitor risks and assess the effectiveness of mitigating controls. • Clear protocols will be established for timely corrective actions if any deficiencies are identified, ensuring that any issues are promptly addressed and resolved. The department is fully committed to ensuring that staff have the necessary resources and support to perform their roles effectively. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment, minimize risks, and ensure the continued success of our operations. We appreciate the audit team's insights and recommendations and are dedicated to demonstrating progress in these areas.

Finding Number 2024-006 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Matching, Level of Effort, Earmarking Repeat Finding 2023-011 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior audit, Department of Education management did not have effective internal controls over matching, maintenance of effort, and earmarking requirements and could not provide evidence of compliance with requirements BACKGROUND AND COMPLIANCE CRITERIA The US Department of Education (ED) provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006, which was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act (Perkins V). Perkins V provides grants to states to develop the academic knowledge and technical and employability skills of secondary students and postsecondary students. The Tennessee Department of Education (the department) is the pass-through entity for Perkins funds and disburses those funds to local education agencies (LEAs) within the state and the Tennessee Board of Regents. As a recipient of federal funding, the department is subject to federal matching, level of effort – maintenance of effort (MOE), and earmarking requirements.(6) Section 211(b) of the Perkins Act mandates that the department maintain its fiscal effort from state appropriations for CTE when compared with the preceding years; for example, the department must allocate state resources in fiscal year 2024 that meet or exceed the allocated state resources for fiscal year 2023. Per Section 112(a) of the Perkins Act, the department must also allocate CTE funds received for specific activities in keeping with the following requirements: • not less than 85 percent to Secondary and Postsecondary Career and Technical Education Programs; • not more than 10 percent to State Leadership Activities; and • not more than 5 percent or $250,000, whichever is greater, to State Administration. See Schedule of Findings and Questioned Costs for footnote. In addition, Section 112(b) of the Perkins Act requires the department to match federal funds reserved for State Administration with non-federal funds, such as state appropriations, on a dollar-for-dollar basis. Annually, ED requires Perkins recipients to submit financial and performance data via the Consolidated Annual Report (CAR). The CAR contains CTE programmatic and financial information and includes the department’s demonstrated compliance with maintenance of effort and matching requirements. Department staff completes the CAR in December using the two most recent fiscal years’ financial data—for example, the CAR submitted in December 2023 included data from state fiscal years 2022 and 2023. PRIOR AUDIT RESULTS In the prior audit, we reported a finding related to the Matching, Level of Effort – Maintenance of Effort, and Earmarking compliance requirement. We reported that management had not developed and implemented policies and procedures to ensure that the department complied with these requirements and the lack of policies and procedures, combined with turnover, led to management’s inability to provide documentation to demonstrate compliance. Due to the lack of internal controls, we reported the following conditions related to compliance: • Department management was unable to provide any documentary evidence of the department’s compliance with matching requirements, • Department management was unable to provide documentation for adjustments or final amounts reported in the CAR, and • Department management was unable to provide key earmarking documentation to ensure correct earmarking amounts were calculated. Department management concurred with the prior audit finding and stated they would collaborate to create sufficient controls for the calculation of MOE, including a complete supervisory review, and the department’s Office of Finance would serve as a secondary internal check. Additionally, department management stated they would create a process to ensure documents are maintained and are not tied to a specific employee’s hardware, including but not limited to data stored on a physical storage device. CONDITION, CRITERIA, AND CAUSE CURRENT AUDIT RESULTS In the current audit, we found that management did not take corrective action to address the prior audit finding regarding development and implementation of policies and procedures to ensure matching, MOE, and earmarking compliance requirements were met. Management also did not take corrective action to address the lack of documentation as evidence of matching and MOE compliance and did not maintain documentation of management’s review of their required earmarking calculations. Ultimately, we were only able to determine that management met earmarking requirements. We provide specific details of our results below. Insufficient Internal Controls and Lack of Evidence of Compliance Due to the condition above, we noted the following: Matching Because management has still not developed policies and procedures, they were unable to describe the process used for determining compliance with matching requirements during the audit period or provide any documentary evidence of the department’s compliance with matching requirements. As a result, we were unable to perform any procedures to verify if the department met the matching requirements independently. Maintenance of Effort As reported in the prior audit, department management was unable to provide supporting documentation for the final MOE amounts reported in the CAR for state fiscal year 2023. We attempted to verify the amounts reported in the CAR, but without sufficient support for those calculations, we were unable to independently verify that the reported MOE numbers were accurate; therefore, we were unable to determine that management met MOE compliance requirements. Additionally, in the prior audit, management stated that although they reviewed the MOE calculation, the review was not documented. In the current audit, management stated that they did not perform a supervisory review of the calculations submitted in the CAR. Earmarking Although department management provided key earmarking documentation that demonstrated compliance requirements were met and stated they reviewed the calculations, management could not provide any evidence of this review. Department management explained that due to turnover and staffing challenges, appropriate staff were not assigned control and compliance tasks to ensure that the CTE fiscal requirements were met; however, they have hired more staff to be responsible for performing the work and ensuring that requirements are met in the future. Additionally, management stated that standard operating procedures would be created and implemented to document the matching, maintenance of effort, and earmarking processes. Current Risk Assessment and Internal Control Criteria We reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risks to identify or meet matching requirements for external grants, meet overall maintenance of effort requirements, and meet minimum or maximum set-aside limits (earmarking requirements). Management identified scheduled reviews as a control to mitigate these risks; however, based on the results of our audit work, management stated they did not conduct a review of the CAR calculations and did not document other reviews to ensure they are occurring and operating as intended. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303, a non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. . . . (c) Evaluate and monitor the non-Federal entity’s compliance with statutes, regulations, and the terms and conditions of Federal awards. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government, Principle 10.03, “Design of Appropriate Types of Control Activities,” states, Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. . . . Also, Principle 12.03, “Documentation of Responsibilities through Policies,” states, Management documents in policies for each unit its responsibility for an operational process’s objectives and related risks, and control activity design, implementation, and operating effectiveness. . . . Additionally, Principle 12.04, “Documentation of Responsibilities through Policies,” states, . . . Management communicates to personnel the policies and procedures so that personnel can implement the control activities for their assigned responsibilities. EFFECT Without appropriate internal controls over matching, MOE, and earmarking requirements, there is a risk that the department will not comply with all related federal requirements and potentially miscalculate the state’s matching, MOE, and earmarking amounts. If a miscalculation results in the state’s noncompliance, the department risks a reduction of federal funding for CTE activities in subsequent award years, which may impact the department’s ability to provide services to students at Tennessee’s schools. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies.   RECOMMENDATION Department management should design and implement sufficient controls for matching, MOE, and earmarking compliance requirements, which includes assigning responsibility for control activities and compliance, and developing policies and procedures and documenting key processes to ensure ongoing compliance. Management should also ensure that the agency maintains supporting documentation, including documentation of review activities, to monitor ongoing compliance. Management should evaluate the effectiveness of the control activities for the risks identified in this finding and update the department’s annual risk assessment to reflect any new controls management implements. MANAGEMENT’S COMMENT The department concurs with this finding and is committed to addressing the identified compliance requirements and enhancing our control environment. Action Plan: 1. Assignment of Responsibilities: • Management will assign clear responsibility for control activities and compliance related to matching, Maintenance of Effort (MOE), and earmarking requirements. This will ensure accountability and enhance our ability to meet compliance requirements. 2. Policy and Procedure Development: • Policies: We will develop comprehensive policies that define the expectations for compliance with matching, MOE, and earmarking requirements. • Procedures: We will document key processes to ensure these policies are consistently applied. This will include specific steps for maintaining compliance and addressing any potential issues promptly. 3. Documentation and Review Activities: • We will maintain detailed supporting documentation to demonstrate compliance with matching, MOE, and earmarking requirements. • We will also document review activities to monitor ongoing compliance. This documentation will be regularly reviewed and updated as needed. 4. Risk Assessment and Control Evaluation: • Management will evaluate the effectiveness of current control activities for the risks identified in this finding. • We will update the department’s annual risk assessment to reflect any new controls implemented. This will ensure that our risk management approach remains robust and responsive to emerging compliance risks. 5. Monitoring and Continuous Improvement: • We will establish a monitoring plan to ensure ongoing compliance with matching, MOE, and earmarking requirements. This plan will include regular review and evaluation of control activities. • Management is committed to continuous improvement and will regularly review and update our policies, procedures, and control activities to address any new compliance requirements or risks. We anticipate an estimated completion date of 9/30/2025. Thank you for highlighting these areas for improvement. We believe that the actions outlined above will strengthen our compliance framework and ensure that we meet the necessary requirements.

Finding Number 2024-006 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Matching, Level of Effort, Earmarking Repeat Finding 2023-011 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior audit, Department of Education management did not have effective internal controls over matching, maintenance of effort, and earmarking requirements and could not provide evidence of compliance with requirements BACKGROUND AND COMPLIANCE CRITERIA The US Department of Education (ED) provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006, which was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act (Perkins V). Perkins V provides grants to states to develop the academic knowledge and technical and employability skills of secondary students and postsecondary students. The Tennessee Department of Education (the department) is the pass-through entity for Perkins funds and disburses those funds to local education agencies (LEAs) within the state and the Tennessee Board of Regents. As a recipient of federal funding, the department is subject to federal matching, level of effort – maintenance of effort (MOE), and earmarking requirements.(6) Section 211(b) of the Perkins Act mandates that the department maintain its fiscal effort from state appropriations for CTE when compared with the preceding years; for example, the department must allocate state resources in fiscal year 2024 that meet or exceed the allocated state resources for fiscal year 2023. Per Section 112(a) of the Perkins Act, the department must also allocate CTE funds received for specific activities in keeping with the following requirements: • not less than 85 percent to Secondary and Postsecondary Career and Technical Education Programs; • not more than 10 percent to State Leadership Activities; and • not more than 5 percent or $250,000, whichever is greater, to State Administration. See Schedule of Findings and Questioned Costs for footnote. In addition, Section 112(b) of the Perkins Act requires the department to match federal funds reserved for State Administration with non-federal funds, such as state appropriations, on a dollar-for-dollar basis. Annually, ED requires Perkins recipients to submit financial and performance data via the Consolidated Annual Report (CAR). The CAR contains CTE programmatic and financial information and includes the department’s demonstrated compliance with maintenance of effort and matching requirements. Department staff completes the CAR in December using the two most recent fiscal years’ financial data—for example, the CAR submitted in December 2023 included data from state fiscal years 2022 and 2023. PRIOR AUDIT RESULTS In the prior audit, we reported a finding related to the Matching, Level of Effort – Maintenance of Effort, and Earmarking compliance requirement. We reported that management had not developed and implemented policies and procedures to ensure that the department complied with these requirements and the lack of policies and procedures, combined with turnover, led to management’s inability to provide documentation to demonstrate compliance. Due to the lack of internal controls, we reported the following conditions related to compliance: • Department management was unable to provide any documentary evidence of the department’s compliance with matching requirements, • Department management was unable to provide documentation for adjustments or final amounts reported in the CAR, and • Department management was unable to provide key earmarking documentation to ensure correct earmarking amounts were calculated. Department management concurred with the prior audit finding and stated they would collaborate to create sufficient controls for the calculation of MOE, including a complete supervisory review, and the department’s Office of Finance would serve as a secondary internal check. Additionally, department management stated they would create a process to ensure documents are maintained and are not tied to a specific employee’s hardware, including but not limited to data stored on a physical storage device. CONDITION, CRITERIA, AND CAUSE CURRENT AUDIT RESULTS In the current audit, we found that management did not take corrective action to address the prior audit finding regarding development and implementation of policies and procedures to ensure matching, MOE, and earmarking compliance requirements were met. Management also did not take corrective action to address the lack of documentation as evidence of matching and MOE compliance and did not maintain documentation of management’s review of their required earmarking calculations. Ultimately, we were only able to determine that management met earmarking requirements. We provide specific details of our results below. Insufficient Internal Controls and Lack of Evidence of Compliance Due to the condition above, we noted the following: Matching Because management has still not developed policies and procedures, they were unable to describe the process used for determining compliance with matching requirements during the audit period or provide any documentary evidence of the department’s compliance with matching requirements. As a result, we were unable to perform any procedures to verify if the department met the matching requirements independently. Maintenance of Effort As reported in the prior audit, department management was unable to provide supporting documentation for the final MOE amounts reported in the CAR for state fiscal year 2023. We attempted to verify the amounts reported in the CAR, but without sufficient support for those calculations, we were unable to independently verify that the reported MOE numbers were accurate; therefore, we were unable to determine that management met MOE compliance requirements. Additionally, in the prior audit, management stated that although they reviewed the MOE calculation, the review was not documented. In the current audit, management stated that they did not perform a supervisory review of the calculations submitted in the CAR. Earmarking Although department management provided key earmarking documentation that demonstrated compliance requirements were met and stated they reviewed the calculations, management could not provide any evidence of this review. Department management explained that due to turnover and staffing challenges, appropriate staff were not assigned control and compliance tasks to ensure that the CTE fiscal requirements were met; however, they have hired more staff to be responsible for performing the work and ensuring that requirements are met in the future. Additionally, management stated that standard operating procedures would be created and implemented to document the matching, maintenance of effort, and earmarking processes. Current Risk Assessment and Internal Control Criteria We reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risks to identify or meet matching requirements for external grants, meet overall maintenance of effort requirements, and meet minimum or maximum set-aside limits (earmarking requirements). Management identified scheduled reviews as a control to mitigate these risks; however, based on the results of our audit work, management stated they did not conduct a review of the CAR calculations and did not document other reviews to ensure they are occurring and operating as intended. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303, a non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. . . . (c) Evaluate and monitor the non-Federal entity’s compliance with statutes, regulations, and the terms and conditions of Federal awards. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government, Principle 10.03, “Design of Appropriate Types of Control Activities,” states, Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. . . . Also, Principle 12.03, “Documentation of Responsibilities through Policies,” states, Management documents in policies for each unit its responsibility for an operational process’s objectives and related risks, and control activity design, implementation, and operating effectiveness. . . . Additionally, Principle 12.04, “Documentation of Responsibilities through Policies,” states, . . . Management communicates to personnel the policies and procedures so that personnel can implement the control activities for their assigned responsibilities. EFFECT Without appropriate internal controls over matching, MOE, and earmarking requirements, there is a risk that the department will not comply with all related federal requirements and potentially miscalculate the state’s matching, MOE, and earmarking amounts. If a miscalculation results in the state’s noncompliance, the department risks a reduction of federal funding for CTE activities in subsequent award years, which may impact the department’s ability to provide services to students at Tennessee’s schools. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies.   RECOMMENDATION Department management should design and implement sufficient controls for matching, MOE, and earmarking compliance requirements, which includes assigning responsibility for control activities and compliance, and developing policies and procedures and documenting key processes to ensure ongoing compliance. Management should also ensure that the agency maintains supporting documentation, including documentation of review activities, to monitor ongoing compliance. Management should evaluate the effectiveness of the control activities for the risks identified in this finding and update the department’s annual risk assessment to reflect any new controls management implements. MANAGEMENT’S COMMENT The department concurs with this finding and is committed to addressing the identified compliance requirements and enhancing our control environment. Action Plan: 1. Assignment of Responsibilities: • Management will assign clear responsibility for control activities and compliance related to matching, Maintenance of Effort (MOE), and earmarking requirements. This will ensure accountability and enhance our ability to meet compliance requirements. 2. Policy and Procedure Development: • Policies: We will develop comprehensive policies that define the expectations for compliance with matching, MOE, and earmarking requirements. • Procedures: We will document key processes to ensure these policies are consistently applied. This will include specific steps for maintaining compliance and addressing any potential issues promptly. 3. Documentation and Review Activities: • We will maintain detailed supporting documentation to demonstrate compliance with matching, MOE, and earmarking requirements. • We will also document review activities to monitor ongoing compliance. This documentation will be regularly reviewed and updated as needed. 4. Risk Assessment and Control Evaluation: • Management will evaluate the effectiveness of current control activities for the risks identified in this finding. • We will update the department’s annual risk assessment to reflect any new controls implemented. This will ensure that our risk management approach remains robust and responsive to emerging compliance risks. 5. Monitoring and Continuous Improvement: • We will establish a monitoring plan to ensure ongoing compliance with matching, MOE, and earmarking requirements. This plan will include regular review and evaluation of control activities. • Management is committed to continuous improvement and will regularly review and update our policies, procedures, and control activities to address any new compliance requirements or risks. We anticipate an estimated completion date of 9/30/2025. Thank you for highlighting these areas for improvement. We believe that the actions outlined above will strengthen our compliance framework and ensure that we meet the necessary requirements.

Finding Number 2024-007 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-012 Pass-Through Entity N/A Questioned Costs 154,392 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures outside of the Career and Technical Education Program grant’s period of performance BACKGROUND The U.S. Department of Education provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006, which was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act (Perkins V). Perkins V provides grants to states to develop the academic knowledge, technical skills, and employment readiness skills of secondary students and postsecondary students. The Tennessee Department of Education (the department) is the pass-through entity for CTE-Perkins funds and disburses those funds to local education agencies within the state and the Tennessee Board of Regents.(7) Federal funding for CTE is only available to the department and its subrecipients for a limited time (referred to as the grant’s period of performance).(8) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the CTE award amount and the period of performance (budget period).(9) The department has 15 months to charge expenditures to each grant award based on the budget period; however, CTE is governed by the requirements of the Tydings Amendment,(10) which extends the period of performance 12 additional months, for a total of 27 months. According to 2 CFR 200.344, the department must liquidate all financial obligations incurred under the federal award within 120 days of the end of the period of performance. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management incurred administrative expenditures outside of the CTE grant’s period of performance and that internal controls were not effective in ensuring compliance with the grant’s period of performance. Management concurred with the prior finding and stated they would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls implemented, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. In response to the prior audit finding, department management created period of performance operating procedures, implemented professional development for staff, and updated the annual risk assessment. However, management’s actions did not prevent the errors noted below from occurring. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the CTE grants for fiscal year ended June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates to the grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis of payroll expenditures for fiscal year ended June 30, 2024, totaling $2,511,558, we found department management charged payroll expenditures in the amount of $154,289 to the CTE grant award V048A210042 that were obligated after the grant’s period of performance. In addition, based on our analysis, we identified 433 expenditures charged to CTE grant award V048A210042, totaling $2,587,293, occurring on or after July 1, 2023. We tested a nonstatistical, random sample of 60 of these expenditure transactions, totaling $298,666, to determine if the non-payroll administrative transactions were obligated within the grant’s period of performance. Based on our testwork, we found that for 2 of 60 (3%) expenditure transactions tested, the department paid expenses totaling $103 that were obligated after the grant’s period of performance, resulting in a total of $154,392 known questioned costs for the compliance requirement. Management explained that insufficient training and a lack of instruction from management, along with employee turnover and staffing challenges, caused department staff to mistakenly approve payments for expenses that were obligated after the grant’s period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance requirement and identified the review of charges to federal grants and training staff as controls to mitigate the risk. According to management, program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment; however, based on the results of our review, staff’s review and training was not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should develop effective control procedures to ensure that expenditures occurred during the grant award’s period of performance. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-007 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-012 Pass-Through Entity N/A Questioned Costs 154,392 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures outside of the Career and Technical Education Program grant’s period of performance BACKGROUND The U.S. Department of Education provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006, which was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act (Perkins V). Perkins V provides grants to states to develop the academic knowledge, technical skills, and employment readiness skills of secondary students and postsecondary students. The Tennessee Department of Education (the department) is the pass-through entity for CTE-Perkins funds and disburses those funds to local education agencies within the state and the Tennessee Board of Regents.(7) Federal funding for CTE is only available to the department and its subrecipients for a limited time (referred to as the grant’s period of performance).(8) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the CTE award amount and the period of performance (budget period).(9) The department has 15 months to charge expenditures to each grant award based on the budget period; however, CTE is governed by the requirements of the Tydings Amendment,(10) which extends the period of performance 12 additional months, for a total of 27 months. According to 2 CFR 200.344, the department must liquidate all financial obligations incurred under the federal award within 120 days of the end of the period of performance. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management incurred administrative expenditures outside of the CTE grant’s period of performance and that internal controls were not effective in ensuring compliance with the grant’s period of performance. Management concurred with the prior finding and stated they would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls implemented, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. In response to the prior audit finding, department management created period of performance operating procedures, implemented professional development for staff, and updated the annual risk assessment. However, management’s actions did not prevent the errors noted below from occurring. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the CTE grants for fiscal year ended June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates to the grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis of payroll expenditures for fiscal year ended June 30, 2024, totaling $2,511,558, we found department management charged payroll expenditures in the amount of $154,289 to the CTE grant award V048A210042 that were obligated after the grant’s period of performance. In addition, based on our analysis, we identified 433 expenditures charged to CTE grant award V048A210042, totaling $2,587,293, occurring on or after July 1, 2023. We tested a nonstatistical, random sample of 60 of these expenditure transactions, totaling $298,666, to determine if the non-payroll administrative transactions were obligated within the grant’s period of performance. Based on our testwork, we found that for 2 of 60 (3%) expenditure transactions tested, the department paid expenses totaling $103 that were obligated after the grant’s period of performance, resulting in a total of $154,392 known questioned costs for the compliance requirement. Management explained that insufficient training and a lack of instruction from management, along with employee turnover and staffing challenges, caused department staff to mistakenly approve payments for expenses that were obligated after the grant’s period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance requirement and identified the review of charges to federal grants and training staff as controls to mitigate the risk. According to management, program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment; however, based on the results of our review, staff’s review and training was not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should develop effective control procedures to ensure that expenditures occurred during the grant award’s period of performance. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-008 Assistance Listing Number 84.424 Program Name Student Support and Academic Enrichment Program Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-008 Pass-Through Entity N/A Questioned Costs 37,860 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures and reimbursed local educational agencies for expenditures that occurred outside of the Student Support and Academic Enrichment Program grant’s period of performance BACKGROUND The Title IV, Part A, Student Support and Academic Enrichment Program (Title IV) is a federal program to improve students’ academic achievement by providing all students with access to a well-rounded education, improving school conditions for student learning, and improving the use of technology in order to improve the academic achievement and digital literacy of all students. Federal funding for Title IV is only available to the Department of Education (the department) and its subrecipients for a limited time (referred to as the grant’s period of performance).(11) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the Title IV award amount and the period of performance (budget period).(12) The department has 15 months to charge expenditures to each grant award; however, Title IV is governed by the requirements of the Tydings Amendment,(13) which extends the period of performance 12 additional months, for a total of 27 months. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management reimbursed local educational agencies for expenditures that occurred outside of the grant’s period of performance and that internal controls were not effective in ensuring compliance with the grant’s period of performance. Management concurred with the prior finding and stated that management would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls management implements, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the Title IV grants for fiscal year ended June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates to the grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis, we identified and tested 62 expenditure transactions, totaling $1,425,557, that were charged to the Title IV grant award S424A210044 after June 30, 2023, to determine if the transactions were obligated within the grant’s period of performance. Based on our testwork, we found that for 5 of 62 expenditure transactions tested (8%), management reimbursed local educational agencies (LEAs) and paid administrative expenses that were obligated after the grant’s period of performance, resulting in $37,599 in known questioned costs. Management did reverse one of the five transactions, totaling $449, after we informed them of the results of our testwork; therefore, we did not include the $449 in the known questioned costs. Management stated that this transaction was accidentally charged to the wrong grant. Management also stated that in January 2024, they found the other 4 transactions that were obligated after the grant’s period of performance; however, the transactions were accidentally left off the adjustment to correct the transactions. In addition, based on our analysis, we identified 1,868 adjusting entry expenditure transactions, totaling $2,615,473, that were charged to the Title IV grants during fiscal year ended June 30, 2024. We tested a nonstatistical, random sample of 60 adjusting entry expenditure transactions, totaling $1,976,846, to determine if the transactions were obligated within the grants’ period of performance. Based on our testwork, we found that for 3 of 60 adjusting entry expenditure transactions tested (5%), management paid $261 in administrative expenses that were obligated after grant award S424A210044 period of performance, resulting in a total of $37,860 in known questioned costs for the compliance requirement. Management stated that they accidentally charged these 3 transactions to the grant after it ended. Management stated that program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment. Additionally, according to department management, between October 1 and January 30 of each year, the department reviews all LEA reimbursement requests to determine if the reimbursement request is charged to a grant that ended on September 30 of that year. If so, the department contacts the LEA to determine if the reimbursement request contains any expenditures that occurred after September 30. For those expenditures that occurred after September 30, the department sends the reimbursement request back to the LEA to remove those expenditures. If the reimbursement request contains no expenditures that occurred after September 30, the department approves the request and processes it for payment. Even though department management stated they had controls in place, we found that due to the volume of transactions included in the manual review, the controls were not effective to ensure compliance with the period of performance requirement. As a result, the department paid administrative expenses and reimbursed LEAs for costs that occurred outside the authorized period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance. Management identified the review of charges to federal grants and training staff as controls to mitigate the risk; however, based on the results of our review, management’s review and training was not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. According to the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should refine their current control procedures, including utilizing data analytics tools to assist in evaluating the large number of reimbursements and administrative expenditures and training staff, to ensure that expenditures occurred during the grant award’s period of performance. Procedures should be designed to ensure that all identified expenditures occurring outside the period of performance are included in any adjusting entries. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-008 Assistance Listing Number 84.424 Program Name Student Support and Academic Enrichment Program Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-008 Pass-Through Entity N/A Questioned Costs 37,860 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures and reimbursed local educational agencies for expenditures that occurred outside of the Student Support and Academic Enrichment Program grant’s period of performance BACKGROUND The Title IV, Part A, Student Support and Academic Enrichment Program (Title IV) is a federal program to improve students’ academic achievement by providing all students with access to a well-rounded education, improving school conditions for student learning, and improving the use of technology in order to improve the academic achievement and digital literacy of all students. Federal funding for Title IV is only available to the Department of Education (the department) and its subrecipients for a limited time (referred to as the grant’s period of performance).(11) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the Title IV award amount and the period of performance (budget period).(12) The department has 15 months to charge expenditures to each grant award; however, Title IV is governed by the requirements of the Tydings Amendment,(13) which extends the period of performance 12 additional months, for a total of 27 months. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management reimbursed local educational agencies for expenditures that occurred outside of the grant’s period of performance and that internal controls were not effective in ensuring compliance with the grant’s period of performance. Management concurred with the prior finding and stated that management would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls management implements, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the Title IV grants for fiscal year ended June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates to the grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis, we identified and tested 62 expenditure transactions, totaling $1,425,557, that were charged to the Title IV grant award S424A210044 after June 30, 2023, to determine if the transactions were obligated within the grant’s period of performance. Based on our testwork, we found that for 5 of 62 expenditure transactions tested (8%), management reimbursed local educational agencies (LEAs) and paid administrative expenses that were obligated after the grant’s period of performance, resulting in $37,599 in known questioned costs. Management did reverse one of the five transactions, totaling $449, after we informed them of the results of our testwork; therefore, we did not include the $449 in the known questioned costs. Management stated that this transaction was accidentally charged to the wrong grant. Management also stated that in January 2024, they found the other 4 transactions that were obligated after the grant’s period of performance; however, the transactions were accidentally left off the adjustment to correct the transactions. In addition, based on our analysis, we identified 1,868 adjusting entry expenditure transactions, totaling $2,615,473, that were charged to the Title IV grants during fiscal year ended June 30, 2024. We tested a nonstatistical, random sample of 60 adjusting entry expenditure transactions, totaling $1,976,846, to determine if the transactions were obligated within the grants’ period of performance. Based on our testwork, we found that for 3 of 60 adjusting entry expenditure transactions tested (5%), management paid $261 in administrative expenses that were obligated after grant award S424A210044 period of performance, resulting in a total of $37,860 in known questioned costs for the compliance requirement. Management stated that they accidentally charged these 3 transactions to the grant after it ended. Management stated that program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment. Additionally, according to department management, between October 1 and January 30 of each year, the department reviews all LEA reimbursement requests to determine if the reimbursement request is charged to a grant that ended on September 30 of that year. If so, the department contacts the LEA to determine if the reimbursement request contains any expenditures that occurred after September 30. For those expenditures that occurred after September 30, the department sends the reimbursement request back to the LEA to remove those expenditures. If the reimbursement request contains no expenditures that occurred after September 30, the department approves the request and processes it for payment. Even though department management stated they had controls in place, we found that due to the volume of transactions included in the manual review, the controls were not effective to ensure compliance with the period of performance requirement. As a result, the department paid administrative expenses and reimbursed LEAs for costs that occurred outside the authorized period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance. Management identified the review of charges to federal grants and training staff as controls to mitigate the risk; however, based on the results of our review, management’s review and training was not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. According to the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should refine their current control procedures, including utilizing data analytics tools to assist in evaluating the large number of reimbursements and administrative expenditures and training staff, to ensure that expenditures occurred during the grant award’s period of performance. Procedures should be designed to ensure that all identified expenditures occurring outside the period of performance are included in any adjusting entries. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-009 Assistance Listing Number 84.027 and 84.173 Program Name Special Education Cluster (IDEA) Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-010 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.027 Federal Award Identification Number H027A210052 Amount $40,355 Assistance Listing Number 84.173 Federal Award Identification Number H173A210095 Amount $22,675 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures and reimbursed local educational agencies for expenditures that occurred outside of the Special Education Cluster Program grants’ period of performance BACKGROUND The Individuals with Disabilities Education Act (IDEA) is a cluster of federal programs(14) to assist states in providing children with disabilities a free, appropriate public education. Federal funding for IDEA is only available to the Department of Education (the department) and its subrecipients for a limited time (referred to as the grants’ period of performance).(15) Each year, the department receives grant award notifications for each award from the U.S. Department of Education outlining the award amounts and the period of performance (budget period).(16) The department has 15 months to charge expenditures to each grant award; however, IDEA is governed by the requirements of the Tydings Amendment,(17) which extends the period of performance 12 additional months, for a total of 27 months. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 344, the department must liquidate all financial obligations incurred under the federal award within 120 days of the end of the period of performance. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management reimbursed local educational agencies for expenditures and incurred administrative expenditures outside of the grants’ period of performance and that internal controls were not effective in ensuring compliance with the grants’ period of performance. Management concurred with the prior finding and stated they would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls implemented, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. In response to the prior audit finding, department management created period of performance operating procedures, implemented professional development for staff, and updated the annual risk assessment. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the IDEA grants for the fiscal year ending June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates for each grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis of payroll expenditures for fiscal year 2024, totaling $5,011,056, we found that department management charged payroll expenditures to the IDEA grant award H027A210052 that were obligated after the grant’s period of performance, resulting in of $40,314 in known questioned costs. In addition, based on our analysis, we identified 1,028 IDEA grant expenditures totaling $15,091,866 occurring on or after July 1, 2023. We tested a nonstatistical, random sample of 60 of these expenditure transactions, totaling $9,970,590, to determine if the transactions were obligated within the applicable grant’s period of performance. Based on our testwork, we found that for 4 of 60 (7%) expenditure transactions tested, department management paid expenses, totaling $22,675, for IDEA grant award H173A210095 and $41 for IDEA grant award H027A210052 that were obligated after the grants’ periods of performance. These errors resulted in $22,716 in known questioned costs and $34,385 in likely questioned costs. Table 2 summarizes the questioned costs for this issue. See Schedule of Findings and Questioned Costs for table. Management explained that insufficient training and a lack of instruction from management, along with employee turnover and staffing challenges, caused department staff to mistakenly approve expenditures that were obligated after the grant’s period of performance. According to management, program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment. Additionally, according to department management, between October 1 and January 30 of each year, the department reviews all LEA reimbursement requests to determine if the reimbursement request is charged to a grant that ended on September 30 of that year. If so, the department contacts the LEA to determine if the reimbursement request contains any expenditures that occurred after September 30. For those expenditures that occurred after September 30, the department sends the reimbursement request back to the LEA to remove those expenditures. If the reimbursement request contains no expenditures that occurred after September 30, the department approves the request and processes it for payment. Even though department management stated they had controls in place, we found that, due to the volume of transactions included in the manual review, the controls were not effective to ensure compliance with the period of performance requirement. As a result, the department paid administrative expenses and reimbursed LEAs for costs that occurred outside the authorized period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance requirement and identified reviewing charges to federal grants and training staff as controls to mitigate the risk. However, based on the results of our review, staff’s review and training were not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. According to the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 7.09, “Response to Risk,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that the funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines that the state agency cannot remedy its noncompliance through the actions above, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should refine their current control procedures, including utilizing data analytics tools to assist in evaluating the large number of reimbursements and administrative expenditures and training staff, to ensure that expenditures occurred during the grant award’s period of performance. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-009 Assistance Listing Number 84.027 and 84.173 Program Name Special Education Cluster (IDEA) Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-010 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.027 Federal Award Identification Number H027A210052 Amount $40,355 Assistance Listing Number 84.173 Federal Award Identification Number H173A210095 Amount $22,675 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures and reimbursed local educational agencies for expenditures that occurred outside of the Special Education Cluster Program grants’ period of performance BACKGROUND The Individuals with Disabilities Education Act (IDEA) is a cluster of federal programs(14) to assist states in providing children with disabilities a free, appropriate public education. Federal funding for IDEA is only available to the Department of Education (the department) and its subrecipients for a limited time (referred to as the grants’ period of performance).(15) Each year, the department receives grant award notifications for each award from the U.S. Department of Education outlining the award amounts and the period of performance (budget period).(16) The department has 15 months to charge expenditures to each grant award; however, IDEA is governed by the requirements of the Tydings Amendment,(17) which extends the period of performance 12 additional months, for a total of 27 months. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 344, the department must liquidate all financial obligations incurred under the federal award within 120 days of the end of the period of performance. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management reimbursed local educational agencies for expenditures and incurred administrative expenditures outside of the grants’ period of performance and that internal controls were not effective in ensuring compliance with the grants’ period of performance. Management concurred with the prior finding and stated they would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls implemented, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. In response to the prior audit finding, department management created period of performance operating procedures, implemented professional development for staff, and updated the annual risk assessment. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the IDEA grants for the fiscal year ending June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates for each grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis of payroll expenditures for fiscal year 2024, totaling $5,011,056, we found that department management charged payroll expenditures to the IDEA grant award H027A210052 that were obligated after the grant’s period of performance, resulting in of $40,314 in known questioned costs. In addition, based on our analysis, we identified 1,028 IDEA grant expenditures totaling $15,091,866 occurring on or after July 1, 2023. We tested a nonstatistical, random sample of 60 of these expenditure transactions, totaling $9,970,590, to determine if the transactions were obligated within the applicable grant’s period of performance. Based on our testwork, we found that for 4 of 60 (7%) expenditure transactions tested, department management paid expenses, totaling $22,675, for IDEA grant award H173A210095 and $41 for IDEA grant award H027A210052 that were obligated after the grants’ periods of performance. These errors resulted in $22,716 in known questioned costs and $34,385 in likely questioned costs. Table 2 summarizes the questioned costs for this issue. See Schedule of Findings and Questioned Costs for table. Management explained that insufficient training and a lack of instruction from management, along with employee turnover and staffing challenges, caused department staff to mistakenly approve expenditures that were obligated after the grant’s period of performance. According to management, program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment. Additionally, according to department management, between October 1 and January 30 of each year, the department reviews all LEA reimbursement requests to determine if the reimbursement request is charged to a grant that ended on September 30 of that year. If so, the department contacts the LEA to determine if the reimbursement request contains any expenditures that occurred after September 30. For those expenditures that occurred after September 30, the department sends the reimbursement request back to the LEA to remove those expenditures. If the reimbursement request contains no expenditures that occurred after September 30, the department approves the request and processes it for payment. Even though department management stated they had controls in place, we found that, due to the volume of transactions included in the manual review, the controls were not effective to ensure compliance with the period of performance requirement. As a result, the department paid administrative expenses and reimbursed LEAs for costs that occurred outside the authorized period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance requirement and identified reviewing charges to federal grants and training staff as controls to mitigate the risk. However, based on the results of our review, staff’s review and training were not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. According to the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 7.09, “Response to Risk,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that the funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines that the state agency cannot remedy its noncompliance through the actions above, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should refine their current control procedures, including utilizing data analytics tools to assist in evaluating the large number of reimbursements and administrative expenditures and training staff, to ensure that expenditures occurred during the grant award’s period of performance. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-010 Assistance Listing Number 10.568 and 10.569 Program Name Food Distribution Cluster Federal Agency Department of Agriculture State Agency Department of Agriculture Federal Award Identification Number N/A Federal Award Year 2023 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Subrecipient Monitoring Special Tests and Provisions Repeat Finding 2023-026 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the three prior audits, the Tennessee Department of Agriculture did not have effective internal controls over household eligibility determinations and inventory at storage locations for the Emergency Food Assistance Program BACKGROUND The Department of Agriculture (the department), in partnership with the U.S. Department of Agriculture (USDA) and local organizations, operates the Emergency Food Assistance Program (food program) to provide emergency food assistance to low-income households. USDA purchases a variety of food items and makes them available to state distributing agencies. During our audit period, the department contracted with 22 subrecipients(18) to administer the program. See Schedule of Findings and Questioned Costs for footnote. Food Inventory The department places food orders with USDA on behalf of the subrecipients, and USDA delivers the food directly to the subrecipients’ warehouses. USDA Policy FD-107 requires subrecipients to manage the inventory in their warehouses by tracking food receipts and food distributions, performing a physical food inventory count at least annually, and documenting adjustments to food inventory records, such as losses due to spoilage. Individual Eligibility The 22 subrecipients work with local partner agencies, such as soup kitchens and food pantries, to directly serve the public. Because partner agencies directly serve the public, they are responsible for determining the eligibility of individuals to receive food, either before or on the date of distribution, and maintaining supporting documentation. To qualify, an individual must be a resident of the State of Tennessee and may 1. show participation in a means-tested program such as the Supplemental Nutrition Assistance Program (food stamps), Families First, Supplemental Security Income, or Low-Income Home Energy Assistance Program; or 2. complete a signed self-declaration of income showing that the total amount of household income is below 185% of the current federal poverty income level. The department conducted desk reviews during our audit period to determine whether each subrecipient had a process to ensure compliance with both inventory and individual eligibility grant requirements. The desk reviews also ensured that subrecipients had a process to monitor partner agencies for compliance with these same requirements. Department management plans to schedule on-site monitoring of subrecipients in January 2025. We will audit the on-site monitoring activities in future audits. PRIOR AUDIT RESULTS In years before 2021, the department performed on-site subrecipient reviews to determine if subrecipients were accurately determining household eligibility and managing the inventory according to federal requirements. According to management, they stopped performing these reviews of subrecipients in March 2020 due to the effects of the COVID-19 pandemic. Without a federal waiver to alleviate the impacts of the health emergency, management was required to either continue their established control activities or implement alternative controls to ensure subrecipients complied with the federal requirements. In the 2021 Single Audit, we noted that management did not have controls in place for household eligibility determinations and food inventory. In addition, we also found noncompliance related to maintaining accurate inventory records and performing an annual inventory. In response to this finding, management stated they would develop a desk-based review monitoring plan and obtain USDA approval for the new plan. During the 2022 Single Audit, we reported that the department did not monitor its subrecipients because management was waiting for USDA to approve the department’s new monitoring plan. This resulted in a repeat finding because department management still did not have controls in place for household eligibility determinations. We also identified subrecipient noncompliance related to not performing annual inventory counts and inaccurate inventory records. Management concurred and stated it would implement the USDA-approved monitoring plan in April 2023 and complete the monitoring by September 2023 to coincide with the end of the federal fiscal year. The plan included conducting desk reviews during the federal fiscal year 2023 to serve as a baseline for annual reviews of 25% of subrecipients in subsequent years. During the 2023 Single Audit, we again reported that management had neither resumed their previous control activity of on-site reviews nor implemented other control activities to ensure subrecipients reasonably complied with the federal regulations. We also identified instances of noncompliance due to inaccurate inventory records and failures to perform the required annual inventory. Management concurred and stated that they had delayed the implementation of on-site reviews, but they had conducted desk reviews of all 22 subrecipients as required by the new plan. CONDITION AND CAUSE Monitoring Activities As part of our follow-up on management’s corrective actions, we found that management conducted desk reviews of the 22 subrecipients’ self-reported information, but based on our review of subrecipient compliance, these desk reviews(19) were not effective and did not detect errors in inventory records, annual inventory counts, and individual eligibility determination, as detailed below. Specifically, the desk reviews did not include evidence to support the subrecipients’ monitoring of their partnering agencies, which is necessary to ensure that the subrecipients and their partnering agencies are complying with the requirements. We also performed our own compliance testwork and found noncompliance with inventory management and individual eligibility, as detailed below. See Schedule of Findings and Questioned Costs for footnote. Inventory Management and Household Eligibility Based on our current compliance testwork and discussions with department and subrecipient management, we found that subrecipients did not maintain accurate monthly food inventory records, and the subrecipients who contract with a distributor did not conduct the required annual inventory. We also found that one subrecipient’s partner agency distributed food to ineligible individuals. Inaccurate Inventory Records We randomly selected 3 of 22 (14%) subrecipients to determine compliance with federal regulations for inventory records. For each subrecipient tested, we randomly sampled three months(20) of monthly inventory reports for each subrecipient during our scope period (July 1, 2023, through June 30, 2024) and recalculated the reports based on receipt, distribution, and food loss adjustments. We noted discrepancies at 2 of the 3 subrecipient agencies we visited: • For 1 subrecipient, we noted inaccurate food records and food counts. For example, based on the most recent monthly inventory report completed before our visit, we expected to find 9,012 bags of dry pinto beans but instead counted 17,592. We also expected to see 7,992 cans of sliced potatoes and counted 13,632 cans. The agency could not provide documentation, such as invoices, to support the difference for either item. • The second subrecipient lacked distribution documentation to support the data reported to the department for the 3 months tested. See Schedule of Findings and Questioned Costs for footnote. Annual Inventory Not Performed In the prior audit, we noted that 5 subrecipients, which use a centralized distributor to receive and store commodities received from the USDA, did not perform the required annual inventory. We identified during follow-up interviews that department management has not ensured corrective action. Specifically, according to department management, they are still using the distributor, and these 5 subrecipients relied solely on the weekly inventory report provided by the distributor and still did not conduct an annual inventory or request tracking documents, such as bills of lading, receipts for received food, or documents showing food distributed to corroborate the amount reported on the food program’s monthly inventory report provided to the department. Individual Eligibility To determine compliance with individual eligibility requirements, we randomly selected and reviewed 14 partner agencies from the 5 food banks contracted with the department between January 1, 2024, and March 31, 2024. For 1 of the 14 partner agencies tested (7%), we determined that the partner agency distributed commodities to 65 of 1,094 (6%) individuals who did not meet eligibility requirements. Once we informed the department of these issues, department management discussed with the subrecipient the eligibility requirements that all partner agencies should follow. In response, the subrecipient plans to retrain this partner agency’s staff. Additionally, the subrecipient’s Program Director will create a list of allowable and prohibited actions to email to all other partner agencies. CRITERIA Inventory Management and Household Eligibility According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, according to 7 CFR 251.10(e), (1) Each State agency must monitor the operation of the program to ensure that it is being administered in accordance with Federal and State requirements. State agencies may not delegate this responsibility. . . . (3) Each [subrecipient monitoring] review must encompass, as applicable, eligibility determinations, food ordering procedures, storage and warehousing practices, inventory controls, approval of distribution sites, reporting and recordkeeping requirements, and civil rights. Additionally, according to 7 CFR 251.5(b) (b) Criteria for determining recipient eligibility. Each State agency must establish uniform Statewide criteria for determining the eligibility of households to receive commodities provided under this part for home consumption. The criteria must: (1) Enable the State agency to ensure that only households which are in need of food assistance because of inadequate household income receive [Emergency Food Assistance Program] commodities; (2) Include income-based standards and the methods by which households may demonstrate eligibility under such standards; and (3) Include a requirement that the household reside in the geographic location served by the State agency at the time of applying for assistance, but length of residency shall not be used as an eligibility criterion. EFFECT The lack of sufficient monitoring controls over inventory management and individual eligibility increases the risk of noncompliance with federal requirements and fraud, waste, and abuse in this federal program. Without sufficient monitoring, department management cannot reasonably ensure that subrecipients fulfill federal requirements and meet the goals of this federal program. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of the Department of Agriculture should ensure staff members have the resources to establish internal controls to ensure staff and subrecipients comply with inventory and eligibility requirements, including designing and implementing a subrecipient monitoring process to effectively address the risks noted in this finding. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT We concur. To ensure effective internal controls over household eligibility determinations and inventory at storage locations for The Emergency Food Assistance Program (TEFAP), the department added three (3) mitigating controls to the enterprise risk management assessment. The controls added are as follows: • Monitoring will include on site reviews to ensure compliance at sites included in the monitoring plan. • Monitoring tools have been developed and will be reviewed annually and revised as needed to ensure all requirements are captured including inventory and eligibility. • Commodities staff will ensure annual inventory is performed as required. Furthermore, we have a new Commodity Distribution Administrator who has developed a monitoring plan for FY25 based on risk assessment. Risk assessments have identified three (3) agencies for monitoring in FY25 which will be completed on site to ensure proper assessment of eligibility and inventory at these locations. Inventory Controls The department has begun observing inventory. In FY24, the new Commodity Distribution Administrator observed inventory at the Chattanooga Area Food Bank and Second Harvest Food Bank of Middle TN. We have a plan in place to observe inventory at all five (5) food banks for FY25. In addition to the on-site inventory observation, internal monthly inventory monitoring has been bolstered and reconciled month to month with our subrecipients. Currently, Eligible Recipient Agency’s (ERA) monthly inventory reports for the previous months are due by the 10th day of each following month. ERA’s beginning monthly inventory in their reports must match the previous month’s reports generated by USDA’s online management site, WBSCM. Each agency’s inventory is fully reconciled no later than the end of the month. For example, January’s inventory report is due by February 10. By the end of February, the month of January’s inventory for each agency is reconciled. Eligibility Controls/ERA Training TN Commodity Distribution has also revised our State Plan to include updated eligibility guidelines including updating language in the plan and revising the intake form. Once approved by USDA, action will be taken so each ERA has a copy of the new State Plan, updated intake form, and daily roster. With a new Commodities Administrator and new guidance published by the USDA, measures will be taken and formally documented to ensure ERA compliance from not only those with direct agreements with TDA, but also those who have contractual agreements with TDA’s ERA’s. These new measures will include trainings (schedule TBD) in the form of recorded PowerPoint presentations sent out to ERAs with a formal signature page of those individuals working for ERAs to sign off attesting they watched the video in full and agree to implement new guidance henceforth in their daily responsibilities. Trainings will be required for all ERA staff that are responsible for working with TEFAP. These records will be collected by a prescribed due date and followed up on during on-site monitoring reviews. Lastly, all agencies identified with deficiencies in the audit will be required to complete a Corrective Action Plan and submit to us within 30 business days of receipt of the request. The Commodity Distribution Administrator will be responsible for ensuring corrective actions are implemented by the anticipated completion date of September 30, 2025.

Finding Number 2024-010 Assistance Listing Number 10.568 and 10.569 Program Name Food Distribution Cluster Federal Agency Department of Agriculture State Agency Department of Agriculture Federal Award Identification Number N/A Federal Award Year 2023 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Subrecipient Monitoring Special Tests and Provisions Repeat Finding 2023-026 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the three prior audits, the Tennessee Department of Agriculture did not have effective internal controls over household eligibility determinations and inventory at storage locations for the Emergency Food Assistance Program BACKGROUND The Department of Agriculture (the department), in partnership with the U.S. Department of Agriculture (USDA) and local organizations, operates the Emergency Food Assistance Program (food program) to provide emergency food assistance to low-income households. USDA purchases a variety of food items and makes them available to state distributing agencies. During our audit period, the department contracted with 22 subrecipients(18) to administer the program. See Schedule of Findings and Questioned Costs for footnote. Food Inventory The department places food orders with USDA on behalf of the subrecipients, and USDA delivers the food directly to the subrecipients’ warehouses. USDA Policy FD-107 requires subrecipients to manage the inventory in their warehouses by tracking food receipts and food distributions, performing a physical food inventory count at least annually, and documenting adjustments to food inventory records, such as losses due to spoilage. Individual Eligibility The 22 subrecipients work with local partner agencies, such as soup kitchens and food pantries, to directly serve the public. Because partner agencies directly serve the public, they are responsible for determining the eligibility of individuals to receive food, either before or on the date of distribution, and maintaining supporting documentation. To qualify, an individual must be a resident of the State of Tennessee and may 1. show participation in a means-tested program such as the Supplemental Nutrition Assistance Program (food stamps), Families First, Supplemental Security Income, or Low-Income Home Energy Assistance Program; or 2. complete a signed self-declaration of income showing that the total amount of household income is below 185% of the current federal poverty income level. The department conducted desk reviews during our audit period to determine whether each subrecipient had a process to ensure compliance with both inventory and individual eligibility grant requirements. The desk reviews also ensured that subrecipients had a process to monitor partner agencies for compliance with these same requirements. Department management plans to schedule on-site monitoring of subrecipients in January 2025. We will audit the on-site monitoring activities in future audits. PRIOR AUDIT RESULTS In years before 2021, the department performed on-site subrecipient reviews to determine if subrecipients were accurately determining household eligibility and managing the inventory according to federal requirements. According to management, they stopped performing these reviews of subrecipients in March 2020 due to the effects of the COVID-19 pandemic. Without a federal waiver to alleviate the impacts of the health emergency, management was required to either continue their established control activities or implement alternative controls to ensure subrecipients complied with the federal requirements. In the 2021 Single Audit, we noted that management did not have controls in place for household eligibility determinations and food inventory. In addition, we also found noncompliance related to maintaining accurate inventory records and performing an annual inventory. In response to this finding, management stated they would develop a desk-based review monitoring plan and obtain USDA approval for the new plan. During the 2022 Single Audit, we reported that the department did not monitor its subrecipients because management was waiting for USDA to approve the department’s new monitoring plan. This resulted in a repeat finding because department management still did not have controls in place for household eligibility determinations. We also identified subrecipient noncompliance related to not performing annual inventory counts and inaccurate inventory records. Management concurred and stated it would implement the USDA-approved monitoring plan in April 2023 and complete the monitoring by September 2023 to coincide with the end of the federal fiscal year. The plan included conducting desk reviews during the federal fiscal year 2023 to serve as a baseline for annual reviews of 25% of subrecipients in subsequent years. During the 2023 Single Audit, we again reported that management had neither resumed their previous control activity of on-site reviews nor implemented other control activities to ensure subrecipients reasonably complied with the federal regulations. We also identified instances of noncompliance due to inaccurate inventory records and failures to perform the required annual inventory. Management concurred and stated that they had delayed the implementation of on-site reviews, but they had conducted desk reviews of all 22 subrecipients as required by the new plan. CONDITION AND CAUSE Monitoring Activities As part of our follow-up on management’s corrective actions, we found that management conducted desk reviews of the 22 subrecipients’ self-reported information, but based on our review of subrecipient compliance, these desk reviews(19) were not effective and did not detect errors in inventory records, annual inventory counts, and individual eligibility determination, as detailed below. Specifically, the desk reviews did not include evidence to support the subrecipients’ monitoring of their partnering agencies, which is necessary to ensure that the subrecipients and their partnering agencies are complying with the requirements. We also performed our own compliance testwork and found noncompliance with inventory management and individual eligibility, as detailed below. See Schedule of Findings and Questioned Costs for footnote. Inventory Management and Household Eligibility Based on our current compliance testwork and discussions with department and subrecipient management, we found that subrecipients did not maintain accurate monthly food inventory records, and the subrecipients who contract with a distributor did not conduct the required annual inventory. We also found that one subrecipient’s partner agency distributed food to ineligible individuals. Inaccurate Inventory Records We randomly selected 3 of 22 (14%) subrecipients to determine compliance with federal regulations for inventory records. For each subrecipient tested, we randomly sampled three months(20) of monthly inventory reports for each subrecipient during our scope period (July 1, 2023, through June 30, 2024) and recalculated the reports based on receipt, distribution, and food loss adjustments. We noted discrepancies at 2 of the 3 subrecipient agencies we visited: • For 1 subrecipient, we noted inaccurate food records and food counts. For example, based on the most recent monthly inventory report completed before our visit, we expected to find 9,012 bags of dry pinto beans but instead counted 17,592. We also expected to see 7,992 cans of sliced potatoes and counted 13,632 cans. The agency could not provide documentation, such as invoices, to support the difference for either item. • The second subrecipient lacked distribution documentation to support the data reported to the department for the 3 months tested. See Schedule of Findings and Questioned Costs for footnote. Annual Inventory Not Performed In the prior audit, we noted that 5 subrecipients, which use a centralized distributor to receive and store commodities received from the USDA, did not perform the required annual inventory. We identified during follow-up interviews that department management has not ensured corrective action. Specifically, according to department management, they are still using the distributor, and these 5 subrecipients relied solely on the weekly inventory report provided by the distributor and still did not conduct an annual inventory or request tracking documents, such as bills of lading, receipts for received food, or documents showing food distributed to corroborate the amount reported on the food program’s monthly inventory report provided to the department. Individual Eligibility To determine compliance with individual eligibility requirements, we randomly selected and reviewed 14 partner agencies from the 5 food banks contracted with the department between January 1, 2024, and March 31, 2024. For 1 of the 14 partner agencies tested (7%), we determined that the partner agency distributed commodities to 65 of 1,094 (6%) individuals who did not meet eligibility requirements. Once we informed the department of these issues, department management discussed with the subrecipient the eligibility requirements that all partner agencies should follow. In response, the subrecipient plans to retrain this partner agency’s staff. Additionally, the subrecipient’s Program Director will create a list of allowable and prohibited actions to email to all other partner agencies. CRITERIA Inventory Management and Household Eligibility According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, according to 7 CFR 251.10(e), (1) Each State agency must monitor the operation of the program to ensure that it is being administered in accordance with Federal and State requirements. State agencies may not delegate this responsibility. . . . (3) Each [subrecipient monitoring] review must encompass, as applicable, eligibility determinations, food ordering procedures, storage and warehousing practices, inventory controls, approval of distribution sites, reporting and recordkeeping requirements, and civil rights. Additionally, according to 7 CFR 251.5(b) (b) Criteria for determining recipient eligibility. Each State agency must establish uniform Statewide criteria for determining the eligibility of households to receive commodities provided under this part for home consumption. The criteria must: (1) Enable the State agency to ensure that only households which are in need of food assistance because of inadequate household income receive [Emergency Food Assistance Program] commodities; (2) Include income-based standards and the methods by which households may demonstrate eligibility under such standards; and (3) Include a requirement that the household reside in the geographic location served by the State agency at the time of applying for assistance, but length of residency shall not be used as an eligibility criterion. EFFECT The lack of sufficient monitoring controls over inventory management and individual eligibility increases the risk of noncompliance with federal requirements and fraud, waste, and abuse in this federal program. Without sufficient monitoring, department management cannot reasonably ensure that subrecipients fulfill federal requirements and meet the goals of this federal program. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of the Department of Agriculture should ensure staff members have the resources to establish internal controls to ensure staff and subrecipients comply with inventory and eligibility requirements, including designing and implementing a subrecipient monitoring process to effectively address the risks noted in this finding. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT We concur. To ensure effective internal controls over household eligibility determinations and inventory at storage locations for The Emergency Food Assistance Program (TEFAP), the department added three (3) mitigating controls to the enterprise risk management assessment. The controls added are as follows: • Monitoring will include on site reviews to ensure compliance at sites included in the monitoring plan. • Monitoring tools have been developed and will be reviewed annually and revised as needed to ensure all requirements are captured including inventory and eligibility. • Commodities staff will ensure annual inventory is performed as required. Furthermore, we have a new Commodity Distribution Administrator who has developed a monitoring plan for FY25 based on risk assessment. Risk assessments have identified three (3) agencies for monitoring in FY25 which will be completed on site to ensure proper assessment of eligibility and inventory at these locations. Inventory Controls The department has begun observing inventory. In FY24, the new Commodity Distribution Administrator observed inventory at the Chattanooga Area Food Bank and Second Harvest Food Bank of Middle TN. We have a plan in place to observe inventory at all five (5) food banks for FY25. In addition to the on-site inventory observation, internal monthly inventory monitoring has been bolstered and reconciled month to month with our subrecipients. Currently, Eligible Recipient Agency’s (ERA) monthly inventory reports for the previous months are due by the 10th day of each following month. ERA’s beginning monthly inventory in their reports must match the previous month’s reports generated by USDA’s online management site, WBSCM. Each agency’s inventory is fully reconciled no later than the end of the month. For example, January’s inventory report is due by February 10. By the end of February, the month of January’s inventory for each agency is reconciled. Eligibility Controls/ERA Training TN Commodity Distribution has also revised our State Plan to include updated eligibility guidelines including updating language in the plan and revising the intake form. Once approved by USDA, action will be taken so each ERA has a copy of the new State Plan, updated intake form, and daily roster. With a new Commodities Administrator and new guidance published by the USDA, measures will be taken and formally documented to ensure ERA compliance from not only those with direct agreements with TDA, but also those who have contractual agreements with TDA’s ERA’s. These new measures will include trainings (schedule TBD) in the form of recorded PowerPoint presentations sent out to ERAs with a formal signature page of those individuals working for ERAs to sign off attesting they watched the video in full and agree to implement new guidance henceforth in their daily responsibilities. Trainings will be required for all ERA staff that are responsible for working with TEFAP. These records will be collected by a prescribed due date and followed up on during on-site monitoring reviews. Lastly, all agencies identified with deficiencies in the audit will be required to complete a Corrective Action Plan and submit to us within 30 business days of receipt of the request. The Commodity Distribution Administrator will be responsible for ensuring corrective actions are implemented by the anticipated completion date of September 30, 2025.

Finding Number 2024-011 Assistance Listing Number 93.917 Program Name HIV Care Formula Grants Federal Agency Department of Health and Human Services State Agency Department of Health Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Health does not have adequate procedures to ensure compliance with subrecipient monitoring requirements for the HIV Care Formula Grants program BACKGROUND The Department of Health as a pass-through entity administers the HIV Care Formula Grants program (HIV Program) and provides subawards to 20 subrecipients to plan, develop, and deliver healthcare and support services to low-income, uninsured, and underinsured individuals with Human Immunodeficiency Virus (HIV). Federal grantors require pass-through entities to monitor subrecipients’ activities to ensure subrecipients use grant funds for authorized purposes in compliance with statutes, regulations, and any applicable grant terms and conditions. Pass-through entity responsibilities include review of subrecipient single audit reports and the issuance of management decisions for findings related to the federal awards provided by the pass-through entity. Title 2, Code of Federal Regulations (CFR), Part 200, Section 1, states that management decisions are written determinations provided to the subrecipient by the pass-through entity of the sufficiency of the subrecipient’s proposed corrective actions to address the findings. CONDITION Management did not issue a management decision as required for one subrecipient that had a finding pertaining to the HIV program within the required timeframe. The other 19 of the program’s 20 subrecipients either did not require a single audit or the audit performed did not have a finding pertaining to the HIV program. The subrecipient’s single audit report that required the management decision was accepted by the Federal Audit Clearinghouse (FAC) on August 3, 2023; therefore, the department was required to issue a management decision by February 3, 2024. CRITERIA As a pass-through entity, the department is required by 2 CFR 200. 332(d) to Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. . . Pass through entity monitoring of the subrecipient must include . . . (3) Issuing a management decision for applicable audit findings. . . According to 2 CFR 200.521(d), the “. . . pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. . . .” CAUSE According to discussions with department management, a management decision related to the subrecipient’s audit finding was not issued due to the loss of key personnel and lack of communication between divisions. Subrecipient monitoring responsibilities for the HIV program are divided between various divisions, and there was a breakdown in communication between the divisions to ensure all subrecipient monitoring requirements were performed. Additionally, per management, the division does not have written procedures clearly assigning duties related to the verification of single audits and issuance of management decisions to specific personnel. EFFECT When management does not issue a decision within the required timeframe, management increases the risk that subrecipients will not correct problems related to internal controls or compliance with regulations in a timely manner. RECOMMENDATION Management should ensure subrecipient monitoring policies clearly assign responsibility of reviewing subrecipient single audit reports and issuing management decisions in a timely manner to specific personnel. MANAGEMENT’S COMMENT We concur with this finding. Tennessee Department of Health practice guided by written memorandum, Subject: Single Audit Requirements and Subrecipient Grant Contract Language, May 8, 2019, provides guidance for the following processes: 1.) Grant contract language stipulates that subrecipients meeting OMB 2 CFR 200. 332(d) criteria should engage a single audit and send a co+B3py to TDH at the same time they send a copy to the Federal Clearing House. 2.) TDH staff should review and evaluate the findings and corrective actions and communicate with the grantee within 30 days of receipt of the single audit report. 3.) Receipt of grantees’ reports and the program’s responses should be communicated to the TDH Office of Compliance and Ethics. Corrective action: CEDEP program and administrative staff working with HIV contracts will be retrained on these requirements by the HIV and Business and Grants Management section leaders. Current contracts will be reviewed to ensure inclusion of audit guidance. Ryan White Program Director and/or Deputy Director will be responsible to issue a management decision within thirty (30) days related to each audit finding from all auditable subrecipients’ reports. Retraining, contracts review, and process implementation will occur no later than March 31, 2025.

Finding Number 2024-011 Assistance Listing Number 93.917 Program Name HIV Care Formula Grants Federal Agency Department of Health and Human Services State Agency Department of Health Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Health does not have adequate procedures to ensure compliance with subrecipient monitoring requirements for the HIV Care Formula Grants program BACKGROUND The Department of Health as a pass-through entity administers the HIV Care Formula Grants program (HIV Program) and provides subawards to 20 subrecipients to plan, develop, and deliver healthcare and support services to low-income, uninsured, and underinsured individuals with Human Immunodeficiency Virus (HIV). Federal grantors require pass-through entities to monitor subrecipients’ activities to ensure subrecipients use grant funds for authorized purposes in compliance with statutes, regulations, and any applicable grant terms and conditions. Pass-through entity responsibilities include review of subrecipient single audit reports and the issuance of management decisions for findings related to the federal awards provided by the pass-through entity. Title 2, Code of Federal Regulations (CFR), Part 200, Section 1, states that management decisions are written determinations provided to the subrecipient by the pass-through entity of the sufficiency of the subrecipient’s proposed corrective actions to address the findings. CONDITION Management did not issue a management decision as required for one subrecipient that had a finding pertaining to the HIV program within the required timeframe. The other 19 of the program’s 20 subrecipients either did not require a single audit or the audit performed did not have a finding pertaining to the HIV program. The subrecipient’s single audit report that required the management decision was accepted by the Federal Audit Clearinghouse (FAC) on August 3, 2023; therefore, the department was required to issue a management decision by February 3, 2024. CRITERIA As a pass-through entity, the department is required by 2 CFR 200. 332(d) to Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. . . Pass through entity monitoring of the subrecipient must include . . . (3) Issuing a management decision for applicable audit findings. . . According to 2 CFR 200.521(d), the “. . . pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. . . .” CAUSE According to discussions with department management, a management decision related to the subrecipient’s audit finding was not issued due to the loss of key personnel and lack of communication between divisions. Subrecipient monitoring responsibilities for the HIV program are divided between various divisions, and there was a breakdown in communication between the divisions to ensure all subrecipient monitoring requirements were performed. Additionally, per management, the division does not have written procedures clearly assigning duties related to the verification of single audits and issuance of management decisions to specific personnel. EFFECT When management does not issue a decision within the required timeframe, management increases the risk that subrecipients will not correct problems related to internal controls or compliance with regulations in a timely manner. RECOMMENDATION Management should ensure subrecipient monitoring policies clearly assign responsibility of reviewing subrecipient single audit reports and issuing management decisions in a timely manner to specific personnel. MANAGEMENT’S COMMENT We concur with this finding. Tennessee Department of Health practice guided by written memorandum, Subject: Single Audit Requirements and Subrecipient Grant Contract Language, May 8, 2019, provides guidance for the following processes: 1.) Grant contract language stipulates that subrecipients meeting OMB 2 CFR 200. 332(d) criteria should engage a single audit and send a co+B3py to TDH at the same time they send a copy to the Federal Clearing House. 2.) TDH staff should review and evaluate the findings and corrective actions and communicate with the grantee within 30 days of receipt of the single audit report. 3.) Receipt of grantees’ reports and the program’s responses should be communicated to the TDH Office of Compliance and Ethics. Corrective action: CEDEP program and administrative staff working with HIV contracts will be retrained on these requirements by the HIV and Business and Grants Management section leaders. Current contracts will be reviewed to ensure inclusion of audit guidance. Ryan White Program Director and/or Deputy Director will be responsible to issue a management decision within thirty (30) days related to each audit finding from all auditable subrecipients’ reports. Retraining, contracts review, and process implementation will occur no later than March 31, 2025.

Finding Number 2024-012 Assistance Listing Number 93.568 Program Name Low-Income Home Energy Assistance Federal Agency Department of Health and Human Services State Agency Tennessee Housing Development Agency Federal Award Identification Number N/A Federal Award Year 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Reporting Repeat Finding 2023-019 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior year, Tennessee Housing Development Agency management did not have effective internal controls over reporting for the Low-Income Home Energy Assistance Program BACKGROUND The U.S. Department of Health and Human Services (HHS) provides grant funding through the Low-Income Home Energy Assistance Program (LIHEAP) to the Tennessee Housing Development Agency (the agency). The objective of LIHEAP is to help low-income households meet the costs of home energy, increase their energy self-sufficiency, and reduce their vulnerability resulting from energy needs. As a condition of the grant, HHS requires the agency to report on the use of federal funds through financial, performance, and special reports. In addition to federal requirements in the Code of Federal Regulations, the HHS Office of Administration for Children and Families, Office of Community Services (OCS), provides guidance to LIHEAP recipients by issuing Action Transmittals. In response to the prior-year finding noting ineffective controls over reporting, management stated that they would implement a schedule of report due dates, along with periodic checkpoints between the preparer and the supervisor to address issues prior to the due dates. Management also stated that each federal report would be reviewed by a supervisor prior to its submission to confirm its accuracy. The supervisor position was vacant until November 2023. Although management implemented additional controls when the supervisor position was filled, controls were not adequate to ensure reports were submitted timely or accurately. CONDITION, CRITERIA, AND CAUSE As noted in the prior year, the agency did not have adequate internal controls to ensure it provided the federal grantor (HHS) with timely or accurate reports. The vacant supervisor position was the primary cause for the special and performance reporting deficiencies. THDA also did not assign a secondary reviewer to ensure the reporting was accurate prior to submission. Special Reporting Annual Report on Households Assisted by LIHEAP According to Title 45, Code of Federal Regulations (CFR), Part 96, Section 82(a), the agency is required to submit to HHS the Annual Report on Households Assisted by LIHEAP “for the 12-month period corresponding to the federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance.” We reviewed the 2023 Annual Report on Households Assisted by LIHEAP to ensure management submitted the report timely and reported line items accurately. We noted errors on two line items on the report. See Schedule of Findings and Questioned Costs for table. Quarterly Performance and Management Report LIHEAP Action Transmittal 2023-03 Quarterly Report Instructions Attachment 1 requires grant recipients to submit data and information about LIHEAP through the Quarterly Performance and Management Reports. The quarterly reports “focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility assistance programs, and training and technical assistance needs.” We reviewed the 2023 Quarterly Performance and Management Report for the fourth quarter of the fiscal year to ensure management submitted the report timely and reported line items accurately. We noted that the report was submitted on November 27, 2023, 27 days after the due date of October 31, 2023. FFATA Reporting The Federal Funding Accountability and Transparency Act (FFATA) and 2 CFR 170, Appendix A, require the agency to report subrecipient financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. Reports are due no later than the end of the month following the month when the obligation occurred. The subaward information in FSRS is then made available to the public on USAspending.gov for transparency. We reviewed FSRS to determine the agency’s compliance with FFATA reporting. Based on our review of the system and discussion with management, management did not report any of their 21 subawards within the required timeframe. Management stated that they are working to improve the reporting process. Performance Reporting LIHEAP Action Transmittal 2024-01 states that the LIHEAP Performance Data Form is an annual report in response to Title 42, United States Code, Section 8629(b), which requires the Secretary of the HHS to submit a report to Congress containing a detailed compilation of information on home energy consumption; the amount, cost, and type of fuels used for households eligible for assistance; the number and income levels of households assisted; and the number of households that received such assistance and include 1 or more individuals who are 60 years or older or disabled or include young children. We reviewed the LIHEAP Performance Data Form to ensure management submitted the report timely and reported line items accurately. We noted errors on two line items in the report. See Schedule of Findings and Questioned Costs for table. EFFECT When agency staff do not proactively perform procedures to ensure that reports generated are timely and adequately supported, management increases the risk of reporting inaccurate or untimely data to HHS. For the Quarterly Performance and Management Report, when obligations are understated, management runs the risk of obligating more funds than are available. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional program monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should continue to improve the reporting process by implementing additional controls, as necessary, to ensure timely and accurate reports. MANAGEMENT’S COMMENT We concur. Regarding the Annual Report on Households Assisted by LIHEAP the original submission did not include the Weatherization information and "any type" was under reported. After the new CS Director reviewed and gained some understanding of the report and data used to complete the report, the CS Director reached out to Apprise, Inc. - the data consultants for HHS, ACF - and met with an associate to gain a better understanding of where the errors where and how to correct them. Following this call, the CS Director was able to correct the original submission and gain clearance on the report. Regarding Quarterly Performance and Management Report for 2023, the Quarter 4 report was submitted late. During this period, the Community Services Division had vacancies in both the Director and LIHEAP Manager position requiring other staff to learn and handle the report preparation while also handling their main job functions. Both positions are now filled and a new obligation tracking document has been adopted and a new reporting deadline process put in place to ensure that a reporting preparation, multi-level review and submission process is complete in advance of any reporting deadline. FFATA Reporting continued to be a challenge in 2024, but a new process was adopted by the CS Division and implemented on January 1, 2025 that requires each manager to maintain a monthly FFATA tracking document. As contracts are executed and funding is obligated by our Legal team, a copy of the final contract is sent to the manager and for entry into the tracking document. The Finance team then accesses the tracking document monthly for entry into the federal system. Finally, the LIHEAP Performance Data report was submitted shortly after the CS Director began employment. Although the report was submitted on time, there were errors on the report that were later corrected with the assistance of Apprise, Inc. We do not anticipate the same issues with the 2024 LIHEAP Performance Data report. Overall, the CS Division is working to strengthen internal processes and ensure timeliness of reporting. The CS Director and managers work closely to develop new processes that will bring efficiency to the process and strengthen accuracy.

Finding Number 2024-012 Assistance Listing Number 93.568 Program Name Low-Income Home Energy Assistance Federal Agency Department of Health and Human Services State Agency Tennessee Housing Development Agency Federal Award Identification Number N/A Federal Award Year 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Reporting Repeat Finding 2023-019 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior year, Tennessee Housing Development Agency management did not have effective internal controls over reporting for the Low-Income Home Energy Assistance Program BACKGROUND The U.S. Department of Health and Human Services (HHS) provides grant funding through the Low-Income Home Energy Assistance Program (LIHEAP) to the Tennessee Housing Development Agency (the agency). The objective of LIHEAP is to help low-income households meet the costs of home energy, increase their energy self-sufficiency, and reduce their vulnerability resulting from energy needs. As a condition of the grant, HHS requires the agency to report on the use of federal funds through financial, performance, and special reports. In addition to federal requirements in the Code of Federal Regulations, the HHS Office of Administration for Children and Families, Office of Community Services (OCS), provides guidance to LIHEAP recipients by issuing Action Transmittals. In response to the prior-year finding noting ineffective controls over reporting, management stated that they would implement a schedule of report due dates, along with periodic checkpoints between the preparer and the supervisor to address issues prior to the due dates. Management also stated that each federal report would be reviewed by a supervisor prior to its submission to confirm its accuracy. The supervisor position was vacant until November 2023. Although management implemented additional controls when the supervisor position was filled, controls were not adequate to ensure reports were submitted timely or accurately. CONDITION, CRITERIA, AND CAUSE As noted in the prior year, the agency did not have adequate internal controls to ensure it provided the federal grantor (HHS) with timely or accurate reports. The vacant supervisor position was the primary cause for the special and performance reporting deficiencies. THDA also did not assign a secondary reviewer to ensure the reporting was accurate prior to submission. Special Reporting Annual Report on Households Assisted by LIHEAP According to Title 45, Code of Federal Regulations (CFR), Part 96, Section 82(a), the agency is required to submit to HHS the Annual Report on Households Assisted by LIHEAP “for the 12-month period corresponding to the federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance.” We reviewed the 2023 Annual Report on Households Assisted by LIHEAP to ensure management submitted the report timely and reported line items accurately. We noted errors on two line items on the report. See Schedule of Findings and Questioned Costs for table. Quarterly Performance and Management Report LIHEAP Action Transmittal 2023-03 Quarterly Report Instructions Attachment 1 requires grant recipients to submit data and information about LIHEAP through the Quarterly Performance and Management Reports. The quarterly reports “focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility assistance programs, and training and technical assistance needs.” We reviewed the 2023 Quarterly Performance and Management Report for the fourth quarter of the fiscal year to ensure management submitted the report timely and reported line items accurately. We noted that the report was submitted on November 27, 2023, 27 days after the due date of October 31, 2023. FFATA Reporting The Federal Funding Accountability and Transparency Act (FFATA) and 2 CFR 170, Appendix A, require the agency to report subrecipient financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. Reports are due no later than the end of the month following the month when the obligation occurred. The subaward information in FSRS is then made available to the public on USAspending.gov for transparency. We reviewed FSRS to determine the agency’s compliance with FFATA reporting. Based on our review of the system and discussion with management, management did not report any of their 21 subawards within the required timeframe. Management stated that they are working to improve the reporting process. Performance Reporting LIHEAP Action Transmittal 2024-01 states that the LIHEAP Performance Data Form is an annual report in response to Title 42, United States Code, Section 8629(b), which requires the Secretary of the HHS to submit a report to Congress containing a detailed compilation of information on home energy consumption; the amount, cost, and type of fuels used for households eligible for assistance; the number and income levels of households assisted; and the number of households that received such assistance and include 1 or more individuals who are 60 years or older or disabled or include young children. We reviewed the LIHEAP Performance Data Form to ensure management submitted the report timely and reported line items accurately. We noted errors on two line items in the report. See Schedule of Findings and Questioned Costs for table. EFFECT When agency staff do not proactively perform procedures to ensure that reports generated are timely and adequately supported, management increases the risk of reporting inaccurate or untimely data to HHS. For the Quarterly Performance and Management Report, when obligations are understated, management runs the risk of obligating more funds than are available. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional program monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should continue to improve the reporting process by implementing additional controls, as necessary, to ensure timely and accurate reports. MANAGEMENT’S COMMENT We concur. Regarding the Annual Report on Households Assisted by LIHEAP the original submission did not include the Weatherization information and "any type" was under reported. After the new CS Director reviewed and gained some understanding of the report and data used to complete the report, the CS Director reached out to Apprise, Inc. - the data consultants for HHS, ACF - and met with an associate to gain a better understanding of where the errors where and how to correct them. Following this call, the CS Director was able to correct the original submission and gain clearance on the report. Regarding Quarterly Performance and Management Report for 2023, the Quarter 4 report was submitted late. During this period, the Community Services Division had vacancies in both the Director and LIHEAP Manager position requiring other staff to learn and handle the report preparation while also handling their main job functions. Both positions are now filled and a new obligation tracking document has been adopted and a new reporting deadline process put in place to ensure that a reporting preparation, multi-level review and submission process is complete in advance of any reporting deadline. FFATA Reporting continued to be a challenge in 2024, but a new process was adopted by the CS Division and implemented on January 1, 2025 that requires each manager to maintain a monthly FFATA tracking document. As contracts are executed and funding is obligated by our Legal team, a copy of the final contract is sent to the manager and for entry into the tracking document. The Finance team then accesses the tracking document monthly for entry into the federal system. Finally, the LIHEAP Performance Data report was submitted shortly after the CS Director began employment. Although the report was submitted on time, there were errors on the report that were later corrected with the assistance of Apprise, Inc. We do not anticipate the same issues with the 2024 LIHEAP Performance Data report. Overall, the CS Division is working to strengthen internal processes and ensure timeliness of reporting. The CS Director and managers work closely to develop new processes that will bring efficiency to the process and strengthen accuracy.

Finding Number 2024-013 Assistance Listing Number 10.558 Program Name Child and Adult Care Food Program Federal Agency Department of Agriculture State Agency Department of Human Services Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Human Services did not establish effective internal controls to ensure the management and monitors properly documented subrecipient monitoring activities BACKGROUND The Child and Adult Care Food Program (CACFP) is a year-round food program for eligible participants at childcare centers, day care homes, after-school care programs, emergency shelters, and adult day care centers. CACFP is funded by the U.S. Department of Agriculture (USDA) and administered on the state level by the Department of Human Services (DHS). DHS contracts with these institutions, called subrecipients, who administer the program by providing meals. As a pass-through entity, DHS is responsible for ensuring that subrecipients are eligible to participate in the program and that the subrecipients comply with federal requirements. State Agency Monitoring Requirements To fulfill the federal monitoring requirements outlined in the USDA’s Monitoring Handbook for State Agencies: A Child and Adult Care Food Care Program Handbook (CACFP Monitoring Handbook), the department’s Division of Audit Services (division) is responsible for performing regular monitoring visits of participating subrecipients approximately every three years. If department management identified or became aware of problems related to a subrecipient, the division monitors the subrecipient more frequently. These visits occur during the award period and cover three components of monitoring: • ensuring subrecipients comply with federal program requirements; • ensuring subrecipients that receive $750,000 or more in federal awards receive a single audit as required by federal regulations; and • following up on previously reported issues. To document subrecipient monitoring work, division staff use Diligent, a third-party electronic audit management application. Within Diligent, Audit Services management requires working papers have three levels of documented review to ensure the work performed supports the monitoring report. Subrecipient Single Audit Requirements Pursuant to the Office of Management and Budget’s Uniform Grant Guidance and “Audit Requirements,” Title 2, Code of Federal Regulations (CFR), Part 200, Section 501, (a) Audit required.(21) A non-Federal entity [subrecipient] that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. See Schedule of Findings and Questioned Costs for footnote. Furthermore, as the pass-through entity, DHS is required by 2 CFR 200.332(f) to verify that all subrecipients that spend $750,000 or more obtain a single audit within 9 months after the subrecipient’s fiscal year-end. As part of that single audit, if a subrecipient receives an audit finding, the department must issue a management decision within six months of the audit report’s release, indicate if the department agreed with the finding, and describe any corrective action the subrecipient must take. Based on discussions with the Division of Audit Services’ management, division staff compiles subrecipient expenditure information from Edison, the state’s accounting system, to determine if the subrecipient received over $750,000 in federal funds. Once management identifies the subrecipients who meet the audit threshold, the Director of Audit Services creates a tracker spreadsheet using Microsoft Excel. The director tracks the receipt of required single audit reports throughout the fiscal year and notes on the tracker if the audit reports identified findings relevant to the federal program. If a subrecipient’s audit report identified findings, the Director of Audit Services notifies program management responsible for ensuring the subrecipient’s compliance with federal requirements. Program management must then obtain and review the subrecipient’s single audit findings and corrective actions and issue a management decision for any program-related findings. Current Audit Methodology From a population of 81 subrecipient monitoring reports the department issued from July 1, 2023, through June 30, 2024, we tested a nonstatistical random sample of 60 monitoring reports to determine if DHS management conducted subrecipient program monitoring in accordance with the CACFP Monitoring Handbook. We also tested the population of 36 subrecipients that received $750,000 or more in federal awards during the subrecipient’s fiscal year to determine if management obtained a single audit report. If applicable, we determined if DHS program management followed up on any findings in the subrecipient’s single audit and issued a management decision. CONDITION, CRITERIA, AND CAUSE Subrecipient’s Compliance with Household Contact Policy Not Documented Based on our testwork, we found that for 7 of 20(22) (35%) monitoring reports tested, the department’s monitors did not document their review of the subrecipient’s Household Contact Policy. Federal regulations define a household contact as an adult member in a household who has a child enrolled in childcare that the sponsoring organization or the state can contact “to verify the attendance and enrollment of the child and the specific meal service(s) which the child routinely receives while in care.”(23) According to 7 CFR 226.6(m)(5), “State agencies must establish a system for sponsoring organizations to use in making household contacts as part of their review and oversight of participating facilities.” Furthermore, in 7 CFR 226.6(m)(3)(x), the department is required to review the sponsoring organization’s implementation of the household contact system (policy) to assess its compliance with federal regulations. See Schedule of Findings and Questioned Costs for footnotes. Based on our review of the working papers in Diligent, the department’s internal procedure requires the monitor to document their review of the policy and upload it into the working papers to document their review. For all 7 subrecipients, the monitor did not upload the household contact policy into the working papers. For one subrecipient, although the monitor did not upload the policy in the working papers, the monitor indicated in the working papers that one existed. Because the policies were not uploaded, we could not determine if the monitor assessed whether the subrecipient’s household contact policy complied with federal regulations. In all 7 instances, three reviewers signed off on the monitor’s work related to the household contact policy even though the monitors’ documentation was incomplete. According to the Director of Audit Services, he agreed that monitors did not document the Household Contact Policy. He stated that he would identify the monitors who performed the work and provide training. Ineffective Internal Controls Related to Late Subrecipient Single Audit Reports Based on our review, we found that for 4 of 36 (11%) subrecipients that met the $750,000 threshold to obtain a single audit, DHS program management did not ensure that the subrecipients’ audits were released within the required 9-month timeframe. We noted that the subrecipients’ auditors released the reports between 3 to 10 months late. According to the Director of Operations for the Child and Adult Care Food Program and the Summer Food Service Program, they rely on regular communication as a control to ensure they obtain subrecipients’ single audits. According to the director, as of January 10, 2023, management regularly communicated with the subrecipients to complete their single audit reports; however, the director could not provide the evidence explaining why the audits were delayed. According to 2 CFR 200.332(f), DHS must “[v]erify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded [$750,000].” Subpart F(24) states that audit reports must be submitted within “. . . nine months after the end of the audit period.”(25) See Schedule of Findings and Questioned Costs for footnotes. No Management Decisions Issued According to 2 CFR 200.521(d), “The . . . pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by [the federal audit clearinghouse].” As noted above, the Director of Audit Services notifies program management that a subrecipient’s audit report identified findings, which is the control to ensure that program management reviews the findings and corrective actions and issues a management decision. The Director of Operations for the Child and Adult Care Food Program and the Summer Food Service Program is responsible for providing DHS subrecipients with a management decision related to the subrecipient’s corrective actions within six months of the audit report’s issuance. However, during our review of the three subrecipients whose audit reports included findings, the Director of Operations could not provide the management decisions when we requested them. The findings in question related to the lack of controls over both food programs’ meal counts, which is the supporting documentation for the program’s expenditures. Risk Assessment We reviewed the department’s 2023 Financial Integrity Act Risk Assessment and determined that management did not identify the risks of noncompliance identified in this finding. As such, management did not establish control activities to ensure compliance with CACFP’s subrecipient monitoring requirements. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, “Identify, Analyze, and Respond to Risks,” Identification of Risks, 7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. EFFECT When management does not document that program monitors verify that subrecipients met program requirements, ensure subrecipients obtain a single audit when required, or issue management decisions, DHS management increases the risk that their subrecipients may use federal grant funds for unauthorized purposes and fail to comply with federal statutes and regulations. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. Specifically, the Director of Audit Services should ensure that program monitors adequately document and assess whether subrecipients comply with program requirements that are subject to program monitoring. The Director of Operations for the for the Child and Adult Care Food Program and the Summer Food Service Program should maintain documentation of communication with subrecipients who do not obtain a single audit within the required timeframe. In addition, when independent audits identify findings in the audit reports, the Director of Operations should issue timely management decisions in response to the subrecipients’ corrective action plans as required by federal regulations. MANAGEMENT’S COMMENT Subrecipient’s Compliance with Household Contact Policy Not Documented We concur. We agree that few of the Sponsoring Organizations Household Contact policy were not uploaded into the working papers within the audit software. In October 2024, we created a permanent folder within the audit software to upload and maintain all Sponsoring Organizations Household Contact policy. Ineffective Internal Controls Related to Late Subrecipient Single Audit Reports We concur. Food program is implementing a tracking system to specifically identify subrecipients who do not obtain a single audit within the required timeframe. Food program will specifically maintain documentation of communication with subrecipients identified with this tool. This tool will be implemented by April 1, 2025. No Management Decisions Issued We concur. Food program will use the tracking system identified above to identify the required timelines for issuing management decisions in response to the subrecipients’ corrective action plans. Food program will issue timely management decisions. This tool will be implemented by April 1, 2025. Risk Assessment We concur. Food program will update the risk assessment to include risk of noncompliance with CACFP’s subrecipient monitoring requirements.

Finding Number 2024-013 Assistance Listing Number 10.558 Program Name Child and Adult Care Food Program Federal Agency Department of Agriculture State Agency Department of Human Services Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Human Services did not establish effective internal controls to ensure the management and monitors properly documented subrecipient monitoring activities BACKGROUND The Child and Adult Care Food Program (CACFP) is a year-round food program for eligible participants at childcare centers, day care homes, after-school care programs, emergency shelters, and adult day care centers. CACFP is funded by the U.S. Department of Agriculture (USDA) and administered on the state level by the Department of Human Services (DHS). DHS contracts with these institutions, called subrecipients, who administer the program by providing meals. As a pass-through entity, DHS is responsible for ensuring that subrecipients are eligible to participate in the program and that the subrecipients comply with federal requirements. State Agency Monitoring Requirements To fulfill the federal monitoring requirements outlined in the USDA’s Monitoring Handbook for State Agencies: A Child and Adult Care Food Care Program Handbook (CACFP Monitoring Handbook), the department’s Division of Audit Services (division) is responsible for performing regular monitoring visits of participating subrecipients approximately every three years. If department management identified or became aware of problems related to a subrecipient, the division monitors the subrecipient more frequently. These visits occur during the award period and cover three components of monitoring: • ensuring subrecipients comply with federal program requirements; • ensuring subrecipients that receive $750,000 or more in federal awards receive a single audit as required by federal regulations; and • following up on previously reported issues. To document subrecipient monitoring work, division staff use Diligent, a third-party electronic audit management application. Within Diligent, Audit Services management requires working papers have three levels of documented review to ensure the work performed supports the monitoring report. Subrecipient Single Audit Requirements Pursuant to the Office of Management and Budget’s Uniform Grant Guidance and “Audit Requirements,” Title 2, Code of Federal Regulations (CFR), Part 200, Section 501, (a) Audit required.(21) A non-Federal entity [subrecipient] that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. See Schedule of Findings and Questioned Costs for footnote. Furthermore, as the pass-through entity, DHS is required by 2 CFR 200.332(f) to verify that all subrecipients that spend $750,000 or more obtain a single audit within 9 months after the subrecipient’s fiscal year-end. As part of that single audit, if a subrecipient receives an audit finding, the department must issue a management decision within six months of the audit report’s release, indicate if the department agreed with the finding, and describe any corrective action the subrecipient must take. Based on discussions with the Division of Audit Services’ management, division staff compiles subrecipient expenditure information from Edison, the state’s accounting system, to determine if the subrecipient received over $750,000 in federal funds. Once management identifies the subrecipients who meet the audit threshold, the Director of Audit Services creates a tracker spreadsheet using Microsoft Excel. The director tracks the receipt of required single audit reports throughout the fiscal year and notes on the tracker if the audit reports identified findings relevant to the federal program. If a subrecipient’s audit report identified findings, the Director of Audit Services notifies program management responsible for ensuring the subrecipient’s compliance with federal requirements. Program management must then obtain and review the subrecipient’s single audit findings and corrective actions and issue a management decision for any program-related findings. Current Audit Methodology From a population of 81 subrecipient monitoring reports the department issued from July 1, 2023, through June 30, 2024, we tested a nonstatistical random sample of 60 monitoring reports to determine if DHS management conducted subrecipient program monitoring in accordance with the CACFP Monitoring Handbook. We also tested the population of 36 subrecipients that received $750,000 or more in federal awards during the subrecipient’s fiscal year to determine if management obtained a single audit report. If applicable, we determined if DHS program management followed up on any findings in the subrecipient’s single audit and issued a management decision. CONDITION, CRITERIA, AND CAUSE Subrecipient’s Compliance with Household Contact Policy Not Documented Based on our testwork, we found that for 7 of 20(22) (35%) monitoring reports tested, the department’s monitors did not document their review of the subrecipient’s Household Contact Policy. Federal regulations define a household contact as an adult member in a household who has a child enrolled in childcare that the sponsoring organization or the state can contact “to verify the attendance and enrollment of the child and the specific meal service(s) which the child routinely receives while in care.”(23) According to 7 CFR 226.6(m)(5), “State agencies must establish a system for sponsoring organizations to use in making household contacts as part of their review and oversight of participating facilities.” Furthermore, in 7 CFR 226.6(m)(3)(x), the department is required to review the sponsoring organization’s implementation of the household contact system (policy) to assess its compliance with federal regulations. See Schedule of Findings and Questioned Costs for footnotes. Based on our review of the working papers in Diligent, the department’s internal procedure requires the monitor to document their review of the policy and upload it into the working papers to document their review. For all 7 subrecipients, the monitor did not upload the household contact policy into the working papers. For one subrecipient, although the monitor did not upload the policy in the working papers, the monitor indicated in the working papers that one existed. Because the policies were not uploaded, we could not determine if the monitor assessed whether the subrecipient’s household contact policy complied with federal regulations. In all 7 instances, three reviewers signed off on the monitor’s work related to the household contact policy even though the monitors’ documentation was incomplete. According to the Director of Audit Services, he agreed that monitors did not document the Household Contact Policy. He stated that he would identify the monitors who performed the work and provide training. Ineffective Internal Controls Related to Late Subrecipient Single Audit Reports Based on our review, we found that for 4 of 36 (11%) subrecipients that met the $750,000 threshold to obtain a single audit, DHS program management did not ensure that the subrecipients’ audits were released within the required 9-month timeframe. We noted that the subrecipients’ auditors released the reports between 3 to 10 months late. According to the Director of Operations for the Child and Adult Care Food Program and the Summer Food Service Program, they rely on regular communication as a control to ensure they obtain subrecipients’ single audits. According to the director, as of January 10, 2023, management regularly communicated with the subrecipients to complete their single audit reports; however, the director could not provide the evidence explaining why the audits were delayed. According to 2 CFR 200.332(f), DHS must “[v]erify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded [$750,000].” Subpart F(24) states that audit reports must be submitted within “. . . nine months after the end of the audit period.”(25) See Schedule of Findings and Questioned Costs for footnotes. No Management Decisions Issued According to 2 CFR 200.521(d), “The . . . pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by [the federal audit clearinghouse].” As noted above, the Director of Audit Services notifies program management that a subrecipient’s audit report identified findings, which is the control to ensure that program management reviews the findings and corrective actions and issues a management decision. The Director of Operations for the Child and Adult Care Food Program and the Summer Food Service Program is responsible for providing DHS subrecipients with a management decision related to the subrecipient’s corrective actions within six months of the audit report’s issuance. However, during our review of the three subrecipients whose audit reports included findings, the Director of Operations could not provide the management decisions when we requested them. The findings in question related to the lack of controls over both food programs’ meal counts, which is the supporting documentation for the program’s expenditures. Risk Assessment We reviewed the department’s 2023 Financial Integrity Act Risk Assessment and determined that management did not identify the risks of noncompliance identified in this finding. As such, management did not establish control activities to ensure compliance with CACFP’s subrecipient monitoring requirements. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, “Identify, Analyze, and Respond to Risks,” Identification of Risks, 7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. EFFECT When management does not document that program monitors verify that subrecipients met program requirements, ensure subrecipients obtain a single audit when required, or issue management decisions, DHS management increases the risk that their subrecipients may use federal grant funds for unauthorized purposes and fail to comply with federal statutes and regulations. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. Specifically, the Director of Audit Services should ensure that program monitors adequately document and assess whether subrecipients comply with program requirements that are subject to program monitoring. The Director of Operations for the for the Child and Adult Care Food Program and the Summer Food Service Program should maintain documentation of communication with subrecipients who do not obtain a single audit within the required timeframe. In addition, when independent audits identify findings in the audit reports, the Director of Operations should issue timely management decisions in response to the subrecipients’ corrective action plans as required by federal regulations. MANAGEMENT’S COMMENT Subrecipient’s Compliance with Household Contact Policy Not Documented We concur. We agree that few of the Sponsoring Organizations Household Contact policy were not uploaded into the working papers within the audit software. In October 2024, we created a permanent folder within the audit software to upload and maintain all Sponsoring Organizations Household Contact policy. Ineffective Internal Controls Related to Late Subrecipient Single Audit Reports We concur. Food program is implementing a tracking system to specifically identify subrecipients who do not obtain a single audit within the required timeframe. Food program will specifically maintain documentation of communication with subrecipients identified with this tool. This tool will be implemented by April 1, 2025. No Management Decisions Issued We concur. Food program will use the tracking system identified above to identify the required timelines for issuing management decisions in response to the subrecipients’ corrective action plans. Food program will issue timely management decisions. This tool will be implemented by April 1, 2025. Risk Assessment We concur. Food program will update the risk assessment to include risk of noncompliance with CACFP’s subrecipient monitoring requirements.

Finding Number 2024-014 Assistance Listing Number 15.605 and 15.611 Program Name Fish and Wildlife Cluster Federal Agency Department of the Interior State Agency Tennessee Wildlife Resources Agency Federal Award Identification Number N/A Federal Award Year 2019 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding 2023-025 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior two audits, Tennessee Wildlife Resources Agency management did not fully implement controls to ensure that the agency complied with the federal requirements for subrecipient monitoring BACKGROUND The Tennessee Wildlife Resources Agency (TWRA) administers the Fish and Wildlife cluster of programs, which are federal programs under the oversight of the U.S. Fish and Wildlife Service. The Fish and Wildlife Cluster includes the following programs: • The Sport Fish Restoration program provides funds to restore, conserve, and enhance sport fish populations and to provide for public use and enjoyment of these fishery resources. • The Wildlife Restoration program provides funds to restore, rehabilitate, and improve wildlife populations and their habitats; to conduct wildlife management research, and wildlife population surveys and inventories; to acquire land; and to provide for public use of wildlife resources. • The Basic Hunter Education program provides training to hunters in the safe handling and use of firearms and archery equipment; hunter responsibilities and ethics; survival; construction, operation, and maintenance of public shooting ranges; and basic wildlife management and identification. • The Enhanced Hunter Education and Safety program provides funds to enhance programs for hunter education, recruitment, and safety; to increase interstate coordination of hunter education programs; to enhance programs for bow hunters and archers; to enhance construction and development of firearm and archery ranges; and to update safety features of firearm and archery ranges. For fiscal year 2024, TWRA awarded $4,784,164 in federal funds to 14 subrecipients, such as nonprofit foundations and universities, to carry out the activities of the Fish and Wildlife Cluster programs. Prior Audit Results Beginning in the 2022 Single Audit, we reported that TWRA management did not perform required subrecipient monitoring and did not obtain and review subrecipient Single Audits. Additionally, we reviewed the 2021 Financial Integrity Act Risk Assessment and determined that management did not identify risks related to failure to perform subrecipient monitoring and review Single Audit reports. Management concurred with the finding and stated that they would determine assignments to carry out effective monitoring and update their 2022 risk assessment. During the 2023 Single Audit, we again reported that management did not perform subrecipient monitoring and did not obtain and review subrecipients’ Single Audit reports. We also reported that although TWRA’s December 2022 Financial Integrity Act Risk Assessment identified risks associated with the lack of subrecipient monitoring and with the failure to review subrecipient Single Audit reports, management still did not fully design and implement controls to mitigate these risks. TWRA management concurred with the finding and stated that the agency did not perform subrecipient monitoring and did not obtain and review subrecipients’ Single Audit reports due to a lack of staff. TWRA management stated they developed the TWRA Federal Aid Procedures Manual and included chapters on subrecipient monitoring, procedures and risk assessments. They assigned responsibility for the subrecipient monitoring process to the TWRA Federal Aid Grants Manager (Grants Manager), TWRA Project Managers, the Department of Finance and Administration Controller for TWRA, and the TWRA Federal Aid and Real Estate Division. The agency also requires staff to attend annual update training, which includes the subrecipient monitoring process. They stated that they anticipated full implementation of the process by June 30, 2024. In the agency’s six-month follow-up report of corrective action, dated September 24, 2024, management stated that all corrective actions noted above and the hiring of a Grants Manager to oversee subrecipient monitoring activities were fully implemented as of June 30, 2024. Current Audit During the current audit and in response to the prior audit findings, TWRA management developed procedures for subrecipient monitoring in the October 2023 TWRA Federal Aid Procedures Manual. Also, management hired a Grants Manager in April 2024, exclusively dedicated to subrecipient monitoring, who has started implementing the new subrecipient monitoring procedures. Management also completed a risk assessment for each subrecipient and each project or grant award. These risk assessments evaluate the subrecipient’s previous compliance audit findings, prior experience, and new personnel or systems. Management’s assessed level of risk for the subrecipients determines the number of monitoring visits the project manager will conduct for each subrecipient project, which is documented in each project’s monitoring plan. Finally, management now requires project managers to sign the monitoring plan indicating completion of the plan and return it to the Grants Manager for review. Our goal was to focus on the agency implementing its corrective actions to address the prior finding. CONDITION, CRITERIA, AND CAUSE We met with management to understand TWRA management’s subrecipient monitoring procedures and reviewed the TWRA Federal Aid Procedures Manual. Based on our discussions and review, we determined that for fiscal year ended June 30, 2024, management still had not fully implemented the controls as described to ensure compliance with the subrecipient monitoring requirements and specifically did not perform subrecipient monitoring activities, including reviewing financial and performance reports as required by Title 2, Code of Federal Regulations (CFR), Part 200, Section 332(d): Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. Based on our review of the documentation, we found that TWRA management did not monitor subrecipients by performing complete monitoring reviews(26) to ensure the subrecipients were meeting both programmatic and financial expectations. According to the Assistant Chief of Federal Aid and Real Estate, staff performed only one partial review for one subrecipient out of 57(27) projects representing the 14 subrecipients that required complete reviews (programmatic and financial) for the period. In this one partial monitoring review, staff performed only the programmatic review of the subrecipient. Based on our follow-up discussions with management, management agreed with our conclusions and stated that the lack of subrecipient monitoring was due to a lack of staff. See Schedule of Findings and Questioned Costs for footnotes. EFFECT When TWRA management does not implement controls timely to ensure management and staff follow federal requirements to perform subrecipient monitoring, management cannot ensure subrecipients have reasonably complied with federal statutes, regulations, and terms and conditions of the grant award. This includes both programmatic and financial reviews. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Executive Director should address the root cause of any monitoring deficiencies and take the final action to fully implement the controls they created to guide agency staff tasked to perform subrecipient monitoring activities required by federal regulations and requirements. Specifically, management should ensure staff perform the complete monitoring reviews to ensure subrecipients are meeting both programmatic and financial expectations for the grant funds they receive. Management should take prompt action to identify any areas of subrecipient noncompliance with the grant regulations and follow up on required corrective action as needed. MANAGEMENT’S COMMENT We partially concur. The Agency appreciates and respects the Comptroller’s Office position, and while the Agency acknowledges that the Federal Aid and Real Estate team did not produce an adequate number of monitoring reviews, it is merely due to the control being implemented in FY 2024 and not having had adequate time to become fully operational rather than a process deficiency or lack of corrective actions taken by TWRA. Further, the corrective action to address this issue would not be to revise or create additions to the internal control, it is to allow adequate time for the internal control to operate. The position that further corrective actions are unnecessary is supported in communications subsequent to our recent Office of the Inspector General (OIG) U.S. Fish and Wildlife Service Grants for the period ended June 30, 2022, in which the OIG had “reviewed the (sub-recipient monitoring) procedures and found them to be adequate” albeit not fully implemented. Discussions with the Comptroller Auditors yielded similar agreement. The Agency believes that the corrective actions taken in and prior to FY 2024 listed in the Single Audit Report, coupled with the continued direct sub-recipient monitoring activities of Agency’s project managers, substantially mitigate both the risk of non-compliance with Title 2, Code of Federal Regulations (CFR) Part 200, Section 332(d) and the risk of potential adverse actions from the US Fish and Wildlife Service. TWRA will continue to support the internal control activities of the Federal Aid and Real Estate Division, and the project managers assigned to directly manage the sub-recipient activities. The Agency looks forward to a review of the complete process in FY 2025. AUDITOR’S COMMENT We have reviewed management’s comments, and the finding stands as written. We would like to note that while management had not performed all needed financial and programmatic monitoring reviews of subrecipients during the audit period, management did initiate corrective changes to the monitoring process to ensure financial and programmatic monitoring reviews will be performed in the future. We will follow up on the monitoring process changes in the next audit.

Finding Number 2024-014 Assistance Listing Number 15.605 and 15.611 Program Name Fish and Wildlife Cluster Federal Agency Department of the Interior State Agency Tennessee Wildlife Resources Agency Federal Award Identification Number N/A Federal Award Year 2019 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding 2023-025 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior two audits, Tennessee Wildlife Resources Agency management did not fully implement controls to ensure that the agency complied with the federal requirements for subrecipient monitoring BACKGROUND The Tennessee Wildlife Resources Agency (TWRA) administers the Fish and Wildlife cluster of programs, which are federal programs under the oversight of the U.S. Fish and Wildlife Service. The Fish and Wildlife Cluster includes the following programs: • The Sport Fish Restoration program provides funds to restore, conserve, and enhance sport fish populations and to provide for public use and enjoyment of these fishery resources. • The Wildlife Restoration program provides funds to restore, rehabilitate, and improve wildlife populations and their habitats; to conduct wildlife management research, and wildlife population surveys and inventories; to acquire land; and to provide for public use of wildlife resources. • The Basic Hunter Education program provides training to hunters in the safe handling and use of firearms and archery equipment; hunter responsibilities and ethics; survival; construction, operation, and maintenance of public shooting ranges; and basic wildlife management and identification. • The Enhanced Hunter Education and Safety program provides funds to enhance programs for hunter education, recruitment, and safety; to increase interstate coordination of hunter education programs; to enhance programs for bow hunters and archers; to enhance construction and development of firearm and archery ranges; and to update safety features of firearm and archery ranges. For fiscal year 2024, TWRA awarded $4,784,164 in federal funds to 14 subrecipients, such as nonprofit foundations and universities, to carry out the activities of the Fish and Wildlife Cluster programs. Prior Audit Results Beginning in the 2022 Single Audit, we reported that TWRA management did not perform required subrecipient monitoring and did not obtain and review subrecipient Single Audits. Additionally, we reviewed the 2021 Financial Integrity Act Risk Assessment and determined that management did not identify risks related to failure to perform subrecipient monitoring and review Single Audit reports. Management concurred with the finding and stated that they would determine assignments to carry out effective monitoring and update their 2022 risk assessment. During the 2023 Single Audit, we again reported that management did not perform subrecipient monitoring and did not obtain and review subrecipients’ Single Audit reports. We also reported that although TWRA’s December 2022 Financial Integrity Act Risk Assessment identified risks associated with the lack of subrecipient monitoring and with the failure to review subrecipient Single Audit reports, management still did not fully design and implement controls to mitigate these risks. TWRA management concurred with the finding and stated that the agency did not perform subrecipient monitoring and did not obtain and review subrecipients’ Single Audit reports due to a lack of staff. TWRA management stated they developed the TWRA Federal Aid Procedures Manual and included chapters on subrecipient monitoring, procedures and risk assessments. They assigned responsibility for the subrecipient monitoring process to the TWRA Federal Aid Grants Manager (Grants Manager), TWRA Project Managers, the Department of Finance and Administration Controller for TWRA, and the TWRA Federal Aid and Real Estate Division. The agency also requires staff to attend annual update training, which includes the subrecipient monitoring process. They stated that they anticipated full implementation of the process by June 30, 2024. In the agency’s six-month follow-up report of corrective action, dated September 24, 2024, management stated that all corrective actions noted above and the hiring of a Grants Manager to oversee subrecipient monitoring activities were fully implemented as of June 30, 2024. Current Audit During the current audit and in response to the prior audit findings, TWRA management developed procedures for subrecipient monitoring in the October 2023 TWRA Federal Aid Procedures Manual. Also, management hired a Grants Manager in April 2024, exclusively dedicated to subrecipient monitoring, who has started implementing the new subrecipient monitoring procedures. Management also completed a risk assessment for each subrecipient and each project or grant award. These risk assessments evaluate the subrecipient’s previous compliance audit findings, prior experience, and new personnel or systems. Management’s assessed level of risk for the subrecipients determines the number of monitoring visits the project manager will conduct for each subrecipient project, which is documented in each project’s monitoring plan. Finally, management now requires project managers to sign the monitoring plan indicating completion of the plan and return it to the Grants Manager for review. Our goal was to focus on the agency implementing its corrective actions to address the prior finding. CONDITION, CRITERIA, AND CAUSE We met with management to understand TWRA management’s subrecipient monitoring procedures and reviewed the TWRA Federal Aid Procedures Manual. Based on our discussions and review, we determined that for fiscal year ended June 30, 2024, management still had not fully implemented the controls as described to ensure compliance with the subrecipient monitoring requirements and specifically did not perform subrecipient monitoring activities, including reviewing financial and performance reports as required by Title 2, Code of Federal Regulations (CFR), Part 200, Section 332(d): Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. Based on our review of the documentation, we found that TWRA management did not monitor subrecipients by performing complete monitoring reviews(26) to ensure the subrecipients were meeting both programmatic and financial expectations. According to the Assistant Chief of Federal Aid and Real Estate, staff performed only one partial review for one subrecipient out of 57(27) projects representing the 14 subrecipients that required complete reviews (programmatic and financial) for the period. In this one partial monitoring review, staff performed only the programmatic review of the subrecipient. Based on our follow-up discussions with management, management agreed with our conclusions and stated that the lack of subrecipient monitoring was due to a lack of staff. See Schedule of Findings and Questioned Costs for footnotes. EFFECT When TWRA management does not implement controls timely to ensure management and staff follow federal requirements to perform subrecipient monitoring, management cannot ensure subrecipients have reasonably complied with federal statutes, regulations, and terms and conditions of the grant award. This includes both programmatic and financial reviews. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Executive Director should address the root cause of any monitoring deficiencies and take the final action to fully implement the controls they created to guide agency staff tasked to perform subrecipient monitoring activities required by federal regulations and requirements. Specifically, management should ensure staff perform the complete monitoring reviews to ensure subrecipients are meeting both programmatic and financial expectations for the grant funds they receive. Management should take prompt action to identify any areas of subrecipient noncompliance with the grant regulations and follow up on required corrective action as needed. MANAGEMENT’S COMMENT We partially concur. The Agency appreciates and respects the Comptroller’s Office position, and while the Agency acknowledges that the Federal Aid and Real Estate team did not produce an adequate number of monitoring reviews, it is merely due to the control being implemented in FY 2024 and not having had adequate time to become fully operational rather than a process deficiency or lack of corrective actions taken by TWRA. Further, the corrective action to address this issue would not be to revise or create additions to the internal control, it is to allow adequate time for the internal control to operate. The position that further corrective actions are unnecessary is supported in communications subsequent to our recent Office of the Inspector General (OIG) U.S. Fish and Wildlife Service Grants for the period ended June 30, 2022, in which the OIG had “reviewed the (sub-recipient monitoring) procedures and found them to be adequate” albeit not fully implemented. Discussions with the Comptroller Auditors yielded similar agreement. The Agency believes that the corrective actions taken in and prior to FY 2024 listed in the Single Audit Report, coupled with the continued direct sub-recipient monitoring activities of Agency’s project managers, substantially mitigate both the risk of non-compliance with Title 2, Code of Federal Regulations (CFR) Part 200, Section 332(d) and the risk of potential adverse actions from the US Fish and Wildlife Service. TWRA will continue to support the internal control activities of the Federal Aid and Real Estate Division, and the project managers assigned to directly manage the sub-recipient activities. The Agency looks forward to a review of the complete process in FY 2025. AUDITOR’S COMMENT We have reviewed management’s comments, and the finding stands as written. We would like to note that while management had not performed all needed financial and programmatic monitoring reviews of subrecipients during the audit period, management did initiate corrective changes to the monitoring process to ensure financial and programmatic monitoring reviews will be performed in the future. We will follow up on the monitoring process changes in the next audit.

Finding Number 2024-001 Assistance Listing Number 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Cash Management Repeat Finding 2023-002 Pass-Through Entity N/A Questioned Costs N/A Finding The financial aid office continued to not adequately reconcile its direct loan records to the Direct Loan Servicing System’s records, as required by federal regulations, and therefore could not resolve discrepancies timely Background The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for Student Financial Assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The United States Department of Education (ED) has established certain requirements for each school to participate in the Student Financial Assistance programs. For direct loans, ED requires schools to reconcile direct loan data monthly between the school’s financial aid office and business office, and between school data, ED’s Common Origination and Disbursement System, and ED’s Grants Management (G5) System. Condition As noted in the prior-year audit, the financial aid office at Tennessee State University could not provide adequate documentation showing that staff fully and timely reconciled the university’s direct loan financial records with the federal Direct Loan Servicing System monthly, as required. While the financial aid office was able to provide reconciliations, staff did not record documentation showing that the report was run timely, that unreconciled items were researched, and that the research was completed timely. The auditors reviewed the university’s procedures for the reconciliations and noted there were no instructions for documenting and signing off on the reconciliations. As a result, any discrepancies may not have been identified, investigated, and resolved timely. Management, as noted in the prior finding, created and filled the role of Assistant Director of Compliance; however, management did not hire an independent financial aid consultant until the end of the 2024 academic year. The partial action of creating and filling the new position did not correct the noncompliance during the period. Criteria Title 34, Code of Federal Regulations, Part 685, Section 300(b)(5), states that to participate in the Direct Loan program, a school must “on a monthly basis, reconcile institutional records with Direct Loan funds received from the Secretary and Direct Loan disbursement records submitted to and accepted by the Secretary.” The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 6, gives additional information regarding the reconciliation process: A school that participates in the Direct Loan Program is required to reconcile cash (funds it received from the G5 system to pay its students) with disbursements (actual disbursement records) it submitted to the Common Origination and Disbursement (COD) system monthly. In addition, Chapter 6 of the handbook goes on to state, A school has completed its monthly reconciliation when all differences between the Direct Loan SAS [Student Account Statement] and the school’s internal records (Direct Loan system, financial aid office, and business office system) have been resolved or documented and the school’s ending cash balance is zero. Schools should clearly outline their reconciliation process and documentation in both the business office and financial aid office procedures. Finally, while the handbook does not specify a particular format or reconciliation method, it does require that the school maintains “documented results of its monthly reconciliation to provide to auditors and reviewers at their request.” Cause The former Director of Financial Aid(1) stated that the financial aid office has differences from month to month because of the timing of funds being disbursed and drawn down, but these items will usually resolve themselves by the end of the award period. Because of these timing discrepancies, the university has not emphasized performing a complete reconciliation each month. Consequently, the university has not placed the same importance on the reconciliation process as ED. See Schedule of Findings and Questioned Costs for footnote. Effect When the university does not reconcile its financial aid records to the net cash drawdowns and net booked disbursements as reported to the federal government, there could be unresolved errors in either the federal government’s records or the university’s records. The university could draw too much cash from ED, resulting in questioned costs, or could underdraw, placing unnecessary financial stress on the institution. In addition, when the university does not fully reconcile direct loans each month, reconciling items and errors may be harder to identify over time, making the annual reconciliation more complex than necessary. Performing documented monthly reconciliations and retaining all supporting documentation ensures that financial aid staff will receive all direct loan funds from ED and will make timely and accurate disbursements to students. In addition, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate its participation in a Title IV program. These actions would negatively affect the university’s operations and the students impacted by the loss of Title IV aid. Recommendation The financial aid office and the business office should update policies and procedures for the reconciliation process. The Director of Financial Aid should ensure that staff prepare and document the required monthly reconciliations based on instructions in the Federal Student Aid Handbook. If any items in the School Account Statement do not agree with the institution’s financial records, financial aid staff should investigate, resolve, and record these differences promptly. The Director of Financial Aid and a member of the business office should review the reconciliation each month and at award year-end to ensure accuracy and completeness. The university should ensure reconciliations document the preparer and reviewers with the date each was completed. The reconciliation should contain sufficient information and documentation for identified differences and be completed within 30 days of the month's end. MANAGEMENT’S COMMENT We concur. TSU’s Financial Aid Office has updated its policies and procedures to comply with federal regulations. Our revised procedures outline a three-step process for monthly reconciliation. This process begins with the Loan Coordinator performing the initial reconciliation. The reconciliation will then be submitted to either the Assistant Director of Compliance or the Director of Financial Aid for further evaluation. Finally, the Director of Grants Accounting will conduct a comprehensive review. This structured approach ensures that the financial aid office completes the reconciliation efficiently with oversight from three distinct parties. All documentation related to the completed tasks, along with an accuracy checklist with signatures, will be maintained for future reference. The university is also committed to enhancing its financial aid operations by implementing the TSU Student Information System delivered processes to ensure thorough compliance with reconciliation standards. To support this initiative, we are collaborating with outside consultants, who bring valuable expertise to help us develop comprehensive, customized policies and procedures. We anticipate finalizing these documents by March 2025. To align with our goals, we have initiated job postings for two critical positions: the Loan Coordinator and the Assistant Director of Compliance. These roles are essential for driving our reconciliation efforts and ensuring optimal management of financial aid processes. Our primary objective is to achieve full reconciliation of the 2023-2024 Direct Loans by March 1, 2025. Additionally, we plan to start monthly reconciliations for the 2024-2025 loan disbursements in February 2025 to ensure accuracy and compliance. During the interim period, while we work to fill the Loan Coordinator and Assistant Director of Compliance positions, the Director of Financial Aid will actively oversee the reconciliation process. The Director will also receive initial support from our outside consultants to ensure that all reconciliation activities are conducted smoothly and meet compliance requirements. This collaborative approach fosters a more effective and accountable financial aid system within the university.

Finding Number 2024-001 Assistance Listing Number 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Cash Management Repeat Finding 2023-002 Pass-Through Entity N/A Questioned Costs N/A Finding The financial aid office continued to not adequately reconcile its direct loan records to the Direct Loan Servicing System’s records, as required by federal regulations, and therefore could not resolve discrepancies timely Background The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for Student Financial Assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The United States Department of Education (ED) has established certain requirements for each school to participate in the Student Financial Assistance programs. For direct loans, ED requires schools to reconcile direct loan data monthly between the school’s financial aid office and business office, and between school data, ED’s Common Origination and Disbursement System, and ED’s Grants Management (G5) System. Condition As noted in the prior-year audit, the financial aid office at Tennessee State University could not provide adequate documentation showing that staff fully and timely reconciled the university’s direct loan financial records with the federal Direct Loan Servicing System monthly, as required. While the financial aid office was able to provide reconciliations, staff did not record documentation showing that the report was run timely, that unreconciled items were researched, and that the research was completed timely. The auditors reviewed the university’s procedures for the reconciliations and noted there were no instructions for documenting and signing off on the reconciliations. As a result, any discrepancies may not have been identified, investigated, and resolved timely. Management, as noted in the prior finding, created and filled the role of Assistant Director of Compliance; however, management did not hire an independent financial aid consultant until the end of the 2024 academic year. The partial action of creating and filling the new position did not correct the noncompliance during the period. Criteria Title 34, Code of Federal Regulations, Part 685, Section 300(b)(5), states that to participate in the Direct Loan program, a school must “on a monthly basis, reconcile institutional records with Direct Loan funds received from the Secretary and Direct Loan disbursement records submitted to and accepted by the Secretary.” The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 6, gives additional information regarding the reconciliation process: A school that participates in the Direct Loan Program is required to reconcile cash (funds it received from the G5 system to pay its students) with disbursements (actual disbursement records) it submitted to the Common Origination and Disbursement (COD) system monthly. In addition, Chapter 6 of the handbook goes on to state, A school has completed its monthly reconciliation when all differences between the Direct Loan SAS [Student Account Statement] and the school’s internal records (Direct Loan system, financial aid office, and business office system) have been resolved or documented and the school’s ending cash balance is zero. Schools should clearly outline their reconciliation process and documentation in both the business office and financial aid office procedures. Finally, while the handbook does not specify a particular format or reconciliation method, it does require that the school maintains “documented results of its monthly reconciliation to provide to auditors and reviewers at their request.” Cause The former Director of Financial Aid(1) stated that the financial aid office has differences from month to month because of the timing of funds being disbursed and drawn down, but these items will usually resolve themselves by the end of the award period. Because of these timing discrepancies, the university has not emphasized performing a complete reconciliation each month. Consequently, the university has not placed the same importance on the reconciliation process as ED. See Schedule of Findings and Questioned Costs for footnote. Effect When the university does not reconcile its financial aid records to the net cash drawdowns and net booked disbursements as reported to the federal government, there could be unresolved errors in either the federal government’s records or the university’s records. The university could draw too much cash from ED, resulting in questioned costs, or could underdraw, placing unnecessary financial stress on the institution. In addition, when the university does not fully reconcile direct loans each month, reconciling items and errors may be harder to identify over time, making the annual reconciliation more complex than necessary. Performing documented monthly reconciliations and retaining all supporting documentation ensures that financial aid staff will receive all direct loan funds from ED and will make timely and accurate disbursements to students. In addition, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate its participation in a Title IV program. These actions would negatively affect the university’s operations and the students impacted by the loss of Title IV aid. Recommendation The financial aid office and the business office should update policies and procedures for the reconciliation process. The Director of Financial Aid should ensure that staff prepare and document the required monthly reconciliations based on instructions in the Federal Student Aid Handbook. If any items in the School Account Statement do not agree with the institution’s financial records, financial aid staff should investigate, resolve, and record these differences promptly. The Director of Financial Aid and a member of the business office should review the reconciliation each month and at award year-end to ensure accuracy and completeness. The university should ensure reconciliations document the preparer and reviewers with the date each was completed. The reconciliation should contain sufficient information and documentation for identified differences and be completed within 30 days of the month's end. MANAGEMENT’S COMMENT We concur. TSU’s Financial Aid Office has updated its policies and procedures to comply with federal regulations. Our revised procedures outline a three-step process for monthly reconciliation. This process begins with the Loan Coordinator performing the initial reconciliation. The reconciliation will then be submitted to either the Assistant Director of Compliance or the Director of Financial Aid for further evaluation. Finally, the Director of Grants Accounting will conduct a comprehensive review. This structured approach ensures that the financial aid office completes the reconciliation efficiently with oversight from three distinct parties. All documentation related to the completed tasks, along with an accuracy checklist with signatures, will be maintained for future reference. The university is also committed to enhancing its financial aid operations by implementing the TSU Student Information System delivered processes to ensure thorough compliance with reconciliation standards. To support this initiative, we are collaborating with outside consultants, who bring valuable expertise to help us develop comprehensive, customized policies and procedures. We anticipate finalizing these documents by March 2025. To align with our goals, we have initiated job postings for two critical positions: the Loan Coordinator and the Assistant Director of Compliance. These roles are essential for driving our reconciliation efforts and ensuring optimal management of financial aid processes. Our primary objective is to achieve full reconciliation of the 2023-2024 Direct Loans by March 1, 2025. Additionally, we plan to start monthly reconciliations for the 2024-2025 loan disbursements in February 2025 to ensure accuracy and compliance. During the interim period, while we work to fill the Loan Coordinator and Assistant Director of Compliance positions, the Director of Financial Aid will actively oversee the reconciliation process. The Director will also receive initial support from our outside consultants to ensure that all reconciliation activities are conducted smoothly and meet compliance requirements. This collaborative approach fosters a more effective and accountable financial aid system within the university.

Finding Number 2024-002 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-003 Pass-Through Entity N/A Questioned Costs N/A FINDING Tennessee State University continued to have inadequate procedures to ensure Title IV credits were refunded in accordance with federal guidelines BACKGROUND The student financial assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. These Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of the total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. As a condition of these programs, institutions must provide notifications of the amounts awarded and loans disbursed. In addition, institutions are required to refund credits to the student’s account within 14 days of posting the award to the student’s account. CONDITION In response to the prior finding, which noted compliance issues during the 2023 academic year, management restructured the Bursar’s office to include a Refund Analyst role, which reports to the new Account Manager. However, adding the new position and staff did not adequately address compliance issues for the 2024 academic year. In the current audit, we tested a sample of 15 Title IV recipients at Tennessee State University (TSU) to determine whether TSU met disbursement requirements and identified errors in 11 (73%) of the Title IV recipients. These requirements included disbursing the appropriate amount of Title IV aid in a timely manner, sending notices to students informing them of their awards and/or loan disbursements, and refunding any credits to student accounts created by Title IV aid within 14 days of disbursement. Refund Timeliness We noted that 2 of the 8 students (25%) in our testwork had Title IV credits that were not refunded within 14 days of the disbursement date. As noted in the table below, 3 separate refunds were not refunded timely, ranging from 3 to 88 days late. See Schedule of Findings and Questioned Costs for table. While conducting our testwork, we noted that 1 additional student also received a refund more than 14 days after the Title IV aid was disbursed to the student’s account. Because the student had a combination of federal and non-federal aid creating the credit, it did not meet the federal definition of a Title IV credit. However, the error is a further indication of TSU’s failure to process refunds in a timely manner. Disbursement Notifications We also tested our sample to determine whether 2 required notifications were sent to students. The first required letter notifies students of the amount and type of Title IV funds they are expected to receive, as well as how and when the disbursements will be made. We tested all items in our sample to determine whether this first notification was made. For 7 of the 15 students (47%) tested, the student did not receive the required notification. The second required letter is specific only to those students receiving direct loans or Teacher Education Assistance for College and Higher Education (TEACH) grants. The letter notifies students of 1) the date and amount of the disbursement, 2) the student’s or parent’s right to cancel, and 3) the procedure and time by which the student or parent must notify the institution that they wish to cancel. We noted that 11 students in our sample should have received the letter. However, 8 of these 11 students (73%) did not receive the required notification. CRITERIA The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 2, states: If FSA [federal student aid] disbursements to a student’s account at the school create a Title IV credit balance, the school must pay the credit balance directly to the student or parent as soon as possible but no later than 14 days after: [emphasis in original] • the first day of class of a payment period if the credit balance occurred on or before that day, or • the balance occurred if that was after the first day of class. In addition, Volume 4, Chapter 2, of the handbook states: A school must notify a student of the amount of funds the student and their parent can expect to receive from each FSA program, including FWS [Federal Work Study], and how and when those funds will be disbursed. This notification must be sent before any disbursements are made. Finally, Volume 4, Chapter 2, of the handbook also states: Except in the case of loan funds made as part of a post-withdrawal disbursement (see Volume 5 for notification requirements in such cases), when Direct Loan or TEACH funds are being credited to a student’s ledger account, the school must also notify the borrower in writing (paper or electronically) of the: • anticipated date and amount of the disbursement; • student’s or parent’s right to cancel all or a portion of a Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement and have the loan proceeds or TEACH Grant proceeds returned to the Department; and • procedures and deadlines by which the student or parent must notify the school that they wish to cancel the Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. CAUSE TSU management implemented a general refund policy outlining the timing of refunds, as well as the differences between automatic and manual refunds. However, management did not develop adequate procedures to ensure that all Title IV credits are refunded within the timeframes required by federal guidance. Per discussion with TSU management, employee shortages and turnover resulted in the process not always being performed as outlined in the policy. TSU management was uncertain as to the specific cause for unsent disbursement notifications as their financial aid system should automatically send out these notices. Based on these discussions, TSU management is overly reliant on automated processes, and they do not have verification or review processes to confirm that the processes occurred and were complete. EFFECT Timely refunding credits to students is essential to fulfilling the goals of Title IV programs. Students may depend on these refunds to pay for non-institutional charges, such as off-campus housing, transportation, or meals. Furthermore, if the university does not notify students of expected aid, this could impact decision-making for students and their families when determining whether to attend the university. Without these funds, students may not have the resources to pay for these potentially significant costs, which can be a barrier to a successful college career. In addition, failure to notify students of important deadlines and information regarding their direct loans or TEACH Grants could cause students to incur loans they wished to cancel, resulting in unwanted debt. Finally, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate TSU’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. RECOMMENDATION TSU management should revise and adequately document procedures to ensure that students receive the required disbursement notifications and to ensure that credits on student accounts are refunded within 14 days of Title IV aid being disbursed. In addition, leadership should take necessary steps to provide adequate staffing and training to ensure compliance. Finally, TSU management should establish additional review procedures to meet disbursement requirements. MANAGEMENT’S COMMENT We concur. The automatic refund process has been reactivated for spring 2025 as part of our pilot program to refine financial aid procedures. TSU’s consultants conducted a comprehensive review of the current detail codes in use, methodically analyzing their effectiveness and identifying areas for improvement. The recommendations that were made based on this assessment are anticipated to enhance both the efficiency and clarity of the payment process, allowing for a more straightforward identification of non-refundable amounts, which in turn will facilitate the more efficient allocation of funds for necessary financial aid adjustments. The revised procedures will be tested during the spring 2025 refund period to assess their effectiveness and reliability before implementing them on a larger scale. To further support students during this transition, TSU and its consultants will initiate a system of automatic notifications for all students receiving loan disbursements. This systematic communication will enhance transparency by providing information on the amounts disbursed and notifying students of their rights to cancel either part or all of their loans. Additionally, it will outline the specific steps students need to follow to initiate a cancellation. The notification system has been tested and is confirmed to work effectively for loan disbursements in spring 2025. Consequently, before each term, we will review all system parameters and then examine the output after the disbursements are run to ensure that all student notifications are issued correctly. In addition, TSU is taking proactive measures to inform students when their financial aid packages become available, ensuring that they are kept in the loop about their funding status. This process is confirmed to be operating smoothly for Spring 2025, ensuring students receive timely updates. TSU and its consultants will also check the job scheduling system regularly to verify that these processes are being carried out as intended. The completion of these initiatives are anticipated by July 2025, well ahead of the processing for fall 2025 refunds. This timeline will allow for the seamless integration of improvements and ensure that students benefit from the enhancements in the financial aid process moving forward. Lastly, to comply with university procedures and regulatory requirements, it is crucial to fill the Accounting Manager vacancy in the Bursar's office as soon as possible. The Accounting Manager will be vital in overseeing the reconciliation processes, managing refund operations, and improving our financial practices moving forward. This position is essential not only for ensuring accuracy in financial reporting but also for proactively addressing and resolving any discrepancies that may arise. The Vice President of Business and Finance will coordinate with the Bursar’s Office and the Human Resources Department to ensure the timely recruitment and hiring of a qualified candidate.

Finding Number 2024-002 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-003 Pass-Through Entity N/A Questioned Costs N/A FINDING Tennessee State University continued to have inadequate procedures to ensure Title IV credits were refunded in accordance with federal guidelines BACKGROUND The student financial assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. These Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of the total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. As a condition of these programs, institutions must provide notifications of the amounts awarded and loans disbursed. In addition, institutions are required to refund credits to the student’s account within 14 days of posting the award to the student’s account. CONDITION In response to the prior finding, which noted compliance issues during the 2023 academic year, management restructured the Bursar’s office to include a Refund Analyst role, which reports to the new Account Manager. However, adding the new position and staff did not adequately address compliance issues for the 2024 academic year. In the current audit, we tested a sample of 15 Title IV recipients at Tennessee State University (TSU) to determine whether TSU met disbursement requirements and identified errors in 11 (73%) of the Title IV recipients. These requirements included disbursing the appropriate amount of Title IV aid in a timely manner, sending notices to students informing them of their awards and/or loan disbursements, and refunding any credits to student accounts created by Title IV aid within 14 days of disbursement. Refund Timeliness We noted that 2 of the 8 students (25%) in our testwork had Title IV credits that were not refunded within 14 days of the disbursement date. As noted in the table below, 3 separate refunds were not refunded timely, ranging from 3 to 88 days late. See Schedule of Findings and Questioned Costs for table. While conducting our testwork, we noted that 1 additional student also received a refund more than 14 days after the Title IV aid was disbursed to the student’s account. Because the student had a combination of federal and non-federal aid creating the credit, it did not meet the federal definition of a Title IV credit. However, the error is a further indication of TSU’s failure to process refunds in a timely manner. Disbursement Notifications We also tested our sample to determine whether 2 required notifications were sent to students. The first required letter notifies students of the amount and type of Title IV funds they are expected to receive, as well as how and when the disbursements will be made. We tested all items in our sample to determine whether this first notification was made. For 7 of the 15 students (47%) tested, the student did not receive the required notification. The second required letter is specific only to those students receiving direct loans or Teacher Education Assistance for College and Higher Education (TEACH) grants. The letter notifies students of 1) the date and amount of the disbursement, 2) the student’s or parent’s right to cancel, and 3) the procedure and time by which the student or parent must notify the institution that they wish to cancel. We noted that 11 students in our sample should have received the letter. However, 8 of these 11 students (73%) did not receive the required notification. CRITERIA The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 2, states: If FSA [federal student aid] disbursements to a student’s account at the school create a Title IV credit balance, the school must pay the credit balance directly to the student or parent as soon as possible but no later than 14 days after: [emphasis in original] • the first day of class of a payment period if the credit balance occurred on or before that day, or • the balance occurred if that was after the first day of class. In addition, Volume 4, Chapter 2, of the handbook states: A school must notify a student of the amount of funds the student and their parent can expect to receive from each FSA program, including FWS [Federal Work Study], and how and when those funds will be disbursed. This notification must be sent before any disbursements are made. Finally, Volume 4, Chapter 2, of the handbook also states: Except in the case of loan funds made as part of a post-withdrawal disbursement (see Volume 5 for notification requirements in such cases), when Direct Loan or TEACH funds are being credited to a student’s ledger account, the school must also notify the borrower in writing (paper or electronically) of the: • anticipated date and amount of the disbursement; • student’s or parent’s right to cancel all or a portion of a Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement and have the loan proceeds or TEACH Grant proceeds returned to the Department; and • procedures and deadlines by which the student or parent must notify the school that they wish to cancel the Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. CAUSE TSU management implemented a general refund policy outlining the timing of refunds, as well as the differences between automatic and manual refunds. However, management did not develop adequate procedures to ensure that all Title IV credits are refunded within the timeframes required by federal guidance. Per discussion with TSU management, employee shortages and turnover resulted in the process not always being performed as outlined in the policy. TSU management was uncertain as to the specific cause for unsent disbursement notifications as their financial aid system should automatically send out these notices. Based on these discussions, TSU management is overly reliant on automated processes, and they do not have verification or review processes to confirm that the processes occurred and were complete. EFFECT Timely refunding credits to students is essential to fulfilling the goals of Title IV programs. Students may depend on these refunds to pay for non-institutional charges, such as off-campus housing, transportation, or meals. Furthermore, if the university does not notify students of expected aid, this could impact decision-making for students and their families when determining whether to attend the university. Without these funds, students may not have the resources to pay for these potentially significant costs, which can be a barrier to a successful college career. In addition, failure to notify students of important deadlines and information regarding their direct loans or TEACH Grants could cause students to incur loans they wished to cancel, resulting in unwanted debt. Finally, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate TSU’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. RECOMMENDATION TSU management should revise and adequately document procedures to ensure that students receive the required disbursement notifications and to ensure that credits on student accounts are refunded within 14 days of Title IV aid being disbursed. In addition, leadership should take necessary steps to provide adequate staffing and training to ensure compliance. Finally, TSU management should establish additional review procedures to meet disbursement requirements. MANAGEMENT’S COMMENT We concur. The automatic refund process has been reactivated for spring 2025 as part of our pilot program to refine financial aid procedures. TSU’s consultants conducted a comprehensive review of the current detail codes in use, methodically analyzing their effectiveness and identifying areas for improvement. The recommendations that were made based on this assessment are anticipated to enhance both the efficiency and clarity of the payment process, allowing for a more straightforward identification of non-refundable amounts, which in turn will facilitate the more efficient allocation of funds for necessary financial aid adjustments. The revised procedures will be tested during the spring 2025 refund period to assess their effectiveness and reliability before implementing them on a larger scale. To further support students during this transition, TSU and its consultants will initiate a system of automatic notifications for all students receiving loan disbursements. This systematic communication will enhance transparency by providing information on the amounts disbursed and notifying students of their rights to cancel either part or all of their loans. Additionally, it will outline the specific steps students need to follow to initiate a cancellation. The notification system has been tested and is confirmed to work effectively for loan disbursements in spring 2025. Consequently, before each term, we will review all system parameters and then examine the output after the disbursements are run to ensure that all student notifications are issued correctly. In addition, TSU is taking proactive measures to inform students when their financial aid packages become available, ensuring that they are kept in the loop about their funding status. This process is confirmed to be operating smoothly for Spring 2025, ensuring students receive timely updates. TSU and its consultants will also check the job scheduling system regularly to verify that these processes are being carried out as intended. The completion of these initiatives are anticipated by July 2025, well ahead of the processing for fall 2025 refunds. This timeline will allow for the seamless integration of improvements and ensure that students benefit from the enhancements in the financial aid process moving forward. Lastly, to comply with university procedures and regulatory requirements, it is crucial to fill the Accounting Manager vacancy in the Bursar's office as soon as possible. The Accounting Manager will be vital in overseeing the reconciliation processes, managing refund operations, and improving our financial practices moving forward. This position is essential not only for ensuring accuracy in financial reporting but also for proactively addressing and resolving any discrepancies that may arise. The Vice President of Business and Finance will coordinate with the Bursar’s Office and the Human Resources Department to ensure the timely recruitment and hiring of a qualified candidate.

Finding Number 2024-003 Assistance Listing Number 84.063 and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-004 Pass-Through Entity N/A Questioned Costs N/A FINDING For the federal Direct Loan and Pell Grant programs, Tennessee State University continued to not report timely and accurate information regarding students’ enrollment statuses BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For student recipients of Pell Grants or Direct Loans, ED requires institutions to report students’ enrollment statuses for each term to the National Student Loan Data System (NSLDS). The institution is also required to report changes to students’ enrollment, such as graduations, withdrawals, and transitions between full-time and part-time status. CONDITION Tennessee State University management, as noted in the prior finding, hired additional staff and communicated the withdrawal process in training and staff meetings. These corrections did not resolve the issues around enrollment reporting and withdrawal dates. We tested a sample of 60 Direct Loan borrowers and/or Pell Grant recipients at TSU. For these 60 students, TSU should have reported to NSLDS 75 separate incidents of an enrollment status change. As of November 8, 2024, the day of our testwork, we found that for 17 of 75 (23%) status changes tested, TSU either did not report any information, reported incorrect information, or did not timely report the status change to NSLDS. These errors impacted 16 of 60 (27%) students tested. Not Reported • For 3 students, management could not locate any record of enrollment history in NSLDS for some terms the students attended. Of the 3 students, management could not locate an NSLDS account for one student, indicating that TSU management did not report any information in NSLDS for the student. For the remaining 2 students, the enrollment history was missing for terms the student attended. The missing terms for these two students resulted in a combined 3 enrollment changes not being reported. • For 2 students, NSLDS showed a status of “No Record Found” for TSU’s enrollment records. This code should only be used if the school is closing, merging, or has become ineligible. TSU likely entered incorrect or inconsistent data, which can also generate the code. • The Enrollment Services Office did not properly enter a graduation for one student. The student completed the requirements for graduation on December 8, 2023. The failure to report the graduation likely occurred because the student had an account balance that was not paid off until December 9, 2023, the day after the graduation list would have been produced. However, as of the date of our testwork, November 8, 2024, the graduation had still not been reported to NSLDS. Reported Incorrectly • The Enrollment Services Office incorrectly reported enrollment status changes for 4 students during the summer semester. These students were purged during the summer semester due to failure to pay, reducing their hours enrolled to zero. The students were subsequently reported as withdrawn. However, when students reduce their course load below half-time during a summer term, they should maintain their spring status when half-time or greater. Therefore, the students should have been reported as full-time, rather than withdrawn. In addition, 2 of these 4 students had already completed and received grades for courses in Maymester, a month-long term within the summer semester, at the time they were purged. Despite completion, these classes were deleted from the system, including the grades and charges. • For one student, the Enrollment Services Office incorrectly reported the student as three-quarter time for the spring 2024 term despite the student’s attempting 13 hours during the term, which should have been reported as full-time. Reported Untimely • The Enrollment Services Office did not report the full-time status for one student until 80 days after the first day of the spring 2024 term, 20 days late. Students with Multiple Enrollment Reporting Issues • For one student, the Enrollment Services Office had not reported the student’s graduation on May 6, 2024, as of the date of our testwork, November 8, 2024. In addition, the student’s program in NSLDS recorded a major different from the university’s information system. • The Enrollment Services Office entered one student as less than half-time in the spring semester despite the student’s being enrolled in 9 hours, which should have been reported as three-quarter time. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. • The Enrollment Services Office entered one student as three-quarter time in the spring semester despite the student’s being enrolled in 12 hours, which should have been reported as full-time. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. • The Enrollment Services Office entered one graduate student as half-time in the spring semester despite the student’s being enrolled in 9 hours, which is considered full-time for graduate students. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. CRITERIA Federal Guidance The Federal Student Aid Handbook, Volume 2, Chapter 3, states that institutions “must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that file.” In the introduction to Chapter 1, the NSLDS Enrollment Reporting Guide states, “Accurate and timely Enrollment Reporting to NSLDS is essential to the Department of Education’s successful delivery of Title IV aid.” The requirements are established in Title 34, Code of Federal Regulations, Section 685.309(b). In Chapter 4, the NSLDS Enrollment Reporting Guide states . . . if the student enrolls in the summer term (or other non-required terms) at least half time, the student’s actual summer enrollment status is reported. If such a student subsequently withdraws from the summer term, the student’s most recent enrollment status of half time or greater should be reported throughout the remainder of the summer. In addition, Chapter 7 of the NSLDS Enrollment Reporting Guide states, “NSLDS records must be accurately matched with your enrollment records. You should review, update, or verify student enrollment statuses and other information with information that appears on the Enrollment Reporting Roster file.” CAUSE Management did not provide information to determine the cause or offer any possible explanations for the late status updates and the incorrect status reporting. Based on our review, TSU did not adequately review enrollment information in NSLDS to ensure changes were accurately reported. Adequately reviewing a sample of the information uploaded to NSLDS would have quickly determined the significant issues with the university enrollment reporting process. Furthermore, the Enrollment Services Office does not have sufficient knowledge or training on the specific summer reporting rules; instead, the office treats the summer term identically to the fall and spring terms. EFFECT Timely and accurate enrollment reporting is critical for effective management of ED programs. The accurate administration of the Title IV programs depends heavily on the accuracy of the enrollment information reported by schools. Accurate, timely, and complete enrollment data is also important to the students, who can view their current campus enrollment information and their program enrollment history. Also, if an individual no longer attends TSU but their lack of attendance is not reported, the individual’s loan repayment grace period could be improperly extended, resulting in the student’s loan repayments being improperly deferred. In addition, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate its participation in a Title IV program. These actions would negatively affect the university’s operations and the students impacted by the loss of Title IV aid. RECOMMENDATION TSU management should review and update its processes as necessary to ensure the Enrollment Services Office uploads and submits the correct information to NSLDS. In addition, the Assistant Vice President of Admissions and Records should ensure that staff know reporting deadlines, the importance of reporting enrollment status changes, and the summer reporting guidelines. The Assistant Vice President of Admissions and Records should also ensure that enrollment status changes are reported timely and the Financial Aid Office is promptly notified. TSU management should implement a review throughout each term to verify that the accurate information is reported in NSLDS. MANAGEMENT’S COMMENT We concur. TSU is firmly committed to ensuring accurate and timely reporting for the federal Direct Loan and Pell Grant programs, recognizing the importance of accurate data in supporting student financing and institutional integrity. To enhance the effectiveness of this process, the university has hired a Data Analyst whose primary responsibility is to manage and oversee enrollment reporting processes. The Office of Admissions and Records has also undertaken a review and update of its operational procedures with an outside consultant. This enhancement aims to ensure that the Enrollment Services Office uploads and submits the correct, up-to-date information to the National Student Clearinghouse (NSLDS), thereby minimizing the risk of discrepancies and ensuring compliance with federal guidelines. Updates to the NSLDS will be conducted following the census date, with a consistent reporting schedule planned for every 30 to 45 days thereafter, in addition to comprehensive submissions at the end of each academic term. This structured approach ensures that all enrollment changes, including withdrawals and adjustments in student status, are communicated promptly and accurately. If any errors are identified during these reporting processes, corrective measures will be initiated within a timeframe of 5 to 7 business days to rectify the issues, maintaining the integrity of the data reported. To improve clarity and ensure the successful implementation of these updates, the withdrawal process was thoroughly communicated to staff through dedicated training sessions and regular staff meetings. The combination of staff meetings and targeted training initiatives will ensure that all team members are thoroughly prepared to uphold the university's commitment to accurate reporting and strong student support.

Finding Number 2024-003 Assistance Listing Number 84.063 and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-004 Pass-Through Entity N/A Questioned Costs N/A FINDING For the federal Direct Loan and Pell Grant programs, Tennessee State University continued to not report timely and accurate information regarding students’ enrollment statuses BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For student recipients of Pell Grants or Direct Loans, ED requires institutions to report students’ enrollment statuses for each term to the National Student Loan Data System (NSLDS). The institution is also required to report changes to students’ enrollment, such as graduations, withdrawals, and transitions between full-time and part-time status. CONDITION Tennessee State University management, as noted in the prior finding, hired additional staff and communicated the withdrawal process in training and staff meetings. These corrections did not resolve the issues around enrollment reporting and withdrawal dates. We tested a sample of 60 Direct Loan borrowers and/or Pell Grant recipients at TSU. For these 60 students, TSU should have reported to NSLDS 75 separate incidents of an enrollment status change. As of November 8, 2024, the day of our testwork, we found that for 17 of 75 (23%) status changes tested, TSU either did not report any information, reported incorrect information, or did not timely report the status change to NSLDS. These errors impacted 16 of 60 (27%) students tested. Not Reported • For 3 students, management could not locate any record of enrollment history in NSLDS for some terms the students attended. Of the 3 students, management could not locate an NSLDS account for one student, indicating that TSU management did not report any information in NSLDS for the student. For the remaining 2 students, the enrollment history was missing for terms the student attended. The missing terms for these two students resulted in a combined 3 enrollment changes not being reported. • For 2 students, NSLDS showed a status of “No Record Found” for TSU’s enrollment records. This code should only be used if the school is closing, merging, or has become ineligible. TSU likely entered incorrect or inconsistent data, which can also generate the code. • The Enrollment Services Office did not properly enter a graduation for one student. The student completed the requirements for graduation on December 8, 2023. The failure to report the graduation likely occurred because the student had an account balance that was not paid off until December 9, 2023, the day after the graduation list would have been produced. However, as of the date of our testwork, November 8, 2024, the graduation had still not been reported to NSLDS. Reported Incorrectly • The Enrollment Services Office incorrectly reported enrollment status changes for 4 students during the summer semester. These students were purged during the summer semester due to failure to pay, reducing their hours enrolled to zero. The students were subsequently reported as withdrawn. However, when students reduce their course load below half-time during a summer term, they should maintain their spring status when half-time or greater. Therefore, the students should have been reported as full-time, rather than withdrawn. In addition, 2 of these 4 students had already completed and received grades for courses in Maymester, a month-long term within the summer semester, at the time they were purged. Despite completion, these classes were deleted from the system, including the grades and charges. • For one student, the Enrollment Services Office incorrectly reported the student as three-quarter time for the spring 2024 term despite the student’s attempting 13 hours during the term, which should have been reported as full-time. Reported Untimely • The Enrollment Services Office did not report the full-time status for one student until 80 days after the first day of the spring 2024 term, 20 days late. Students with Multiple Enrollment Reporting Issues • For one student, the Enrollment Services Office had not reported the student’s graduation on May 6, 2024, as of the date of our testwork, November 8, 2024. In addition, the student’s program in NSLDS recorded a major different from the university’s information system. • The Enrollment Services Office entered one student as less than half-time in the spring semester despite the student’s being enrolled in 9 hours, which should have been reported as three-quarter time. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. • The Enrollment Services Office entered one student as three-quarter time in the spring semester despite the student’s being enrolled in 12 hours, which should have been reported as full-time. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. • The Enrollment Services Office entered one graduate student as half-time in the spring semester despite the student’s being enrolled in 9 hours, which is considered full-time for graduate students. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. CRITERIA Federal Guidance The Federal Student Aid Handbook, Volume 2, Chapter 3, states that institutions “must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that file.” In the introduction to Chapter 1, the NSLDS Enrollment Reporting Guide states, “Accurate and timely Enrollment Reporting to NSLDS is essential to the Department of Education’s successful delivery of Title IV aid.” The requirements are established in Title 34, Code of Federal Regulations, Section 685.309(b). In Chapter 4, the NSLDS Enrollment Reporting Guide states . . . if the student enrolls in the summer term (or other non-required terms) at least half time, the student’s actual summer enrollment status is reported. If such a student subsequently withdraws from the summer term, the student’s most recent enrollment status of half time or greater should be reported throughout the remainder of the summer. In addition, Chapter 7 of the NSLDS Enrollment Reporting Guide states, “NSLDS records must be accurately matched with your enrollment records. You should review, update, or verify student enrollment statuses and other information with information that appears on the Enrollment Reporting Roster file.” CAUSE Management did not provide information to determine the cause or offer any possible explanations for the late status updates and the incorrect status reporting. Based on our review, TSU did not adequately review enrollment information in NSLDS to ensure changes were accurately reported. Adequately reviewing a sample of the information uploaded to NSLDS would have quickly determined the significant issues with the university enrollment reporting process. Furthermore, the Enrollment Services Office does not have sufficient knowledge or training on the specific summer reporting rules; instead, the office treats the summer term identically to the fall and spring terms. EFFECT Timely and accurate enrollment reporting is critical for effective management of ED programs. The accurate administration of the Title IV programs depends heavily on the accuracy of the enrollment information reported by schools. Accurate, timely, and complete enrollment data is also important to the students, who can view their current campus enrollment information and their program enrollment history. Also, if an individual no longer attends TSU but their lack of attendance is not reported, the individual’s loan repayment grace period could be improperly extended, resulting in the student’s loan repayments being improperly deferred. In addition, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate its participation in a Title IV program. These actions would negatively affect the university’s operations and the students impacted by the loss of Title IV aid. RECOMMENDATION TSU management should review and update its processes as necessary to ensure the Enrollment Services Office uploads and submits the correct information to NSLDS. In addition, the Assistant Vice President of Admissions and Records should ensure that staff know reporting deadlines, the importance of reporting enrollment status changes, and the summer reporting guidelines. The Assistant Vice President of Admissions and Records should also ensure that enrollment status changes are reported timely and the Financial Aid Office is promptly notified. TSU management should implement a review throughout each term to verify that the accurate information is reported in NSLDS. MANAGEMENT’S COMMENT We concur. TSU is firmly committed to ensuring accurate and timely reporting for the federal Direct Loan and Pell Grant programs, recognizing the importance of accurate data in supporting student financing and institutional integrity. To enhance the effectiveness of this process, the university has hired a Data Analyst whose primary responsibility is to manage and oversee enrollment reporting processes. The Office of Admissions and Records has also undertaken a review and update of its operational procedures with an outside consultant. This enhancement aims to ensure that the Enrollment Services Office uploads and submits the correct, up-to-date information to the National Student Clearinghouse (NSLDS), thereby minimizing the risk of discrepancies and ensuring compliance with federal guidelines. Updates to the NSLDS will be conducted following the census date, with a consistent reporting schedule planned for every 30 to 45 days thereafter, in addition to comprehensive submissions at the end of each academic term. This structured approach ensures that all enrollment changes, including withdrawals and adjustments in student status, are communicated promptly and accurately. If any errors are identified during these reporting processes, corrective measures will be initiated within a timeframe of 5 to 7 business days to rectify the issues, maintaining the integrity of the data reported. To improve clarity and ensure the successful implementation of these updates, the withdrawal process was thoroughly communicated to staff through dedicated training sessions and regular staff meetings. The combination of staff meetings and targeted training initiatives will ensure that all team members are thoroughly prepared to uphold the university's commitment to accurate reporting and strong student support.

Finding Number 2024-004 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-005 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.007 Federal Award Identification Number P007A073927 Amount $239 Assistance Listing Number 84.063 Federal Award Identification Number P063P070381 Amount $4,754 FINDING Tennessee State University continued not to return Title IV funds in compliance with federal regulations BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For Title IV recipients who did not complete at least 60% of the semester, the school is required to perform a calculation to determine the amount of unearned aid that it must return to ED. CONDITION In response to the prior audit finding, management stated the university created and hired an Assistant Director of Compliance. Management also stated they would implement a daily review of the Return to Title IV report by both the Financial Aid and Records office. These updates were insufficient in addressing the ongoing compliance issues. We tested two groups of students who officially or unofficially withdrew from classes at Tennessee State University (TSU) during the 2023–2024 award year. First, we selected 15 student withdrawals from a population of 43 students who had an official or unofficial withdrawal before the 60% completion date. We tested these withdrawn students to ensure that withdrawal dates were accurate, that calculations were performed correctly, and that amounts were returned to ED within the required timeframes. Of the 15 student withdrawals, we noted 13 (87%) contained errors. Of the 13 errors, TSU did not return the Title IV funds to ED within the required timeframe for two students, and TSU did not calculate the correct return of the Title IV funds to ED for eight students. For the remaining three students, TSU did not calculate the correct return of the Title IV funds and did not return the funds within the required timeframes. In addition to the above errors, TSU management was not able to provide withdrawal forms for 2 of the 15 students (13%). We tested these students based on the date of withdrawal noted in the university’s information system; however, we were unable to verify this date. One of the student withdrawals was otherwise correct, while the other is included as an error below. Of the 15 errors, 11 were the result of incorrect calculation of return of funds. Specifically, • For 5 students, TSU calculated the returns with withdrawal dates 7-35 days after the students signed and submitted their withdrawal documentation. This resulted in questioned costs of $1,959. • For 1 student, TSU did not return the full amount of Title IV funds to ED even though the student submitted withdrawal documentation before the start of the semester. TSU returned $1,453; however, the full amount of $2,773 should have been considered an overaward and fully returned. This led to questioned costs of $1,320. • For 1 student, TSU did not enter the correct amount of the student’s Pell disbursement in the return calculation. This led to TSU calculating and returning from university funds $3,272, which was $1,276 more than necessary. • For 3 students, TSU did not enter the correct institutional charges in the return calculation but instead used cost of attendance. This led to TSU calculating and returning $8,328 more than necessary from university funds. • For 1 student, TSU calculated the return based on an end of attendance that was three days before the student signed their withdrawal form. This led to TSU calculating and returning from university funds $2,638, which was $165 more than necessary In addition to the above, we noted that for 5 of the 15 student withdrawals tested (33%), TSU did not return the Title IV funds within the applicable timeframes. The timeframes are 30 days after the school becomes aware of the withdrawal if the student never began attendance for the semester and 45 days if the student withdrew during the semester. Of the 5 students, 3 were included above due to also having calculation errors, while TSU correctly calculated the return for the remaining two students. • For two students, TSU returned funds 139 and 259 days after TSU processed the students’ withdrawal forms. As these withdrawals occurred during the semester, the 45-day timeframe was applicable, resulting in the returns being between 94 and 214 days late. • For two students, the school applied charges and Title IV aid to the students’ accounts for the fall 2023 semester based on information from the FAFSA; however, both submitted withdrawal forms before the start of the semester. Despite receiving the forms before the semester, TSU did not process the withdrawals until October 9, 2023, while the return of funds was not completed until October 31, 2023, for one student and June 11, 2024, for the other student. ED specifies that awards to students who never begin attendance are overawards and must be returned within 30 days after the school has determined the student did not begin attendance. For these 2 students, TSU returned funds 74 and 258 days after the student made TSU aware of their withdrawal, or 44 and 228 days late. • For the remaining student, TSU initially processed a return of Title IV funds on October 31, 2023, after the student had notified TSU of their withdrawal for the fall 2023 semester on October 4, 2023. However, when the student registered for spring 2024 classes, federal direct loans were added, and the original return of Title IV funds was reversed. The incorrect reversal and posting of additional funds were not corrected until June 19, 2024, when the return of Title IV funds calculation was recomputed. The corrections were made 259 days after the date of withdrawal, 214 days late. We also selected a sample of 15 from a population of 21 students who completed over 60% of the semester in which they withdrew to ensure that TSU recorded the withdrawal dates correctly, had adequate attendance records to support the withdrawal date, and did not remove Title IV funds from the account. Of the original 15 sample items, we noted 1 (6.7%) error. For this 1 student, TSU entered a withdrawal date beyond the 60% point of the semester; however, the student signed their withdrawal form 7 days before the 60% point. This resulted in $1,714 in questioned costs. Due to the high number of errors and the significant percentage of the overall withdrawal population tested, 30 of 64, or 47%, we determined that additional testwork was not required. CRITERIA The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 1, page 3, states, A pro rata schedule is used to determine the amount of FSA [Federal Student Aid] funds the student has earned at the time of withdrawal up through the 60% point in each payment period or period of enrollment. After the 60% point in the payment period or period of enrollment, a student has earned 100% of the FSA funds the student received and was scheduled to receive during the period. The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 2, page 92, states, • Student’s Withdrawal Date Official notification – The date the student begins the school’s withdrawal process, or the date that the student otherwise provides notification (If both circumstances occur, use the earlier withdrawal date) • Official notification not provided – The date that the school determines is related to the circumstance beyond the student’s control, or the midpoint of the payment period or period of enrollment, as applicable • Alternative approach – In place of the dates listed, a school may always use, as a student’s withdrawal date, the student’s last date of attendance at an academically related activity if the school documents that the activity is academically related and that the student attended the activity. The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 3, page 3, states, Schools must return funds disbursed to a student who failed to begin attendance as soon as possible but no later than 30 days after the date they become aware that the student has not begun and will not begin attendance [emphasis in original]. The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 2, page 39, states, An institution is not required to return the inadvertent overpayment immediately but must return it within 45 days of the date of the institution’s determination that the student withdrew (the time frame for an institution’s return of Title IV funds under 34 CFR 668.22(j)(1)). An institution must return an inadvertent overpayment in accordance with the applicable regulations for returning overpayments. Please see Volume 4, Chapter 3 for more information on overpayment procedures [emphasis in original]. CAUSE Based on our review, it appears that TSU management did not have proper oversight and review procedures over the return of Title IV funds, as we noted multiple issues regarding both the calculation itself as well as the timing. Specifically, TSU performed the Title IV return calculation using cost of attendance instead of institutional charges and entered the withdrawal date as the date the withdrawal was processed instead of the last date the student attended or the date on the signed withdrawal forms. In addition, TSU did not have a system in place to ensure all withdrawals and returns were processed timely. EFFECT For the 30 students tested, TSU calculated a total return of $39,133 in Title IV funds. The corrected total after adjustment for the errors we noted in our testwork was $34,361. TSU overreturned funds to students by $9,769 and underreturned funds to other students by a total of $4,993. The $4,993 was identified as questioned costs. Violations of the federal requirement to timely return Title IV funds to ED could result in ED imposing a fine on TSU and/or limiting, suspending, or terminating TSU’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. In addition, incorrect return calculations and/or withdrawal dates can negatively impact students. If TSU incorrectly calculates and returns the amount of unearned aid to ED, it could impact the amount of aid the student is eligible to receive in future terms or result in a student having an account balance in error. RECOMMENDATION The Registrar’s Office and the Financial Aid Office should follow federal regulations. Management should ensure that the Financial Aid Office reperforms all return of Title IV funds calculations and makes necessary corrections to student and federal fund accounts for the 2023–2024 academic year. Finally, TSU should ensure that the Registrar’s Office communicates any withdrawals to the Financial Aid Office in a timely manner. MANAGEMENT’S COMMENT We concur. The Office of Financial Aid is set to conduct a comprehensive review of the Title IV funds for the 2023-2024 academic year in February 2025, with the review anticipated to be completed by the end of April 2025. The communication process between the Registrar’s Office and Financial Aid begins with a detailed examination of the daily Withdrawal Report generated by the Registrar’s Office. Upon receiving this report, an acknowledgment email will be sent to confirm its review. To facilitate accurate calculations regarding the return of funds, specific parameters will be established within the Banner system. These parameters will support the Funds Calculation process in determining the correct return amounts owed. Our team is actively working with outside consultants to restructure and enhance our financial aid processes. This collaboration aims to significantly update our existing policies and procedures, preventing compliance issues in the future while fostering a more efficient system. An important aspect of this process is how the effective date of withdrawals is determined. The Registrar’s Office must use the date on which the student submitted their withdrawal form as the official effective date. By accurately recording this date in the Student Course Registration system, we can ensure that the student’s information is correctly reflected on the Withdrawal Report. Having the right effective date is crucial for maintaining accurate academic records and complying with federal regulations. TSU, in conjunction with its consultant, will help identify students with the correct withdrawal dates in the Registrar’s Office and will also work with Student Accounts to ensure that the appropriate institutional charges are used in all calculations. Finally, the Withdrawal Report can be scheduled within the job scheduler to run automatically and on time each day. This scheduling will contribute to a smoother workflow, allowing for any necessary adjustments to be made efficiently. By employing the Banner-delivered process for funds calculation, we will ensure that the actual charges incurred by the student are used in the calculation of returns instead of the predetermined cost of attendance, leading to more accurate financial assessments.

Finding Number 2024-004 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-005 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.007 Federal Award Identification Number P007A073927 Amount $239 Assistance Listing Number 84.063 Federal Award Identification Number P063P070381 Amount $4,754 FINDING Tennessee State University continued not to return Title IV funds in compliance with federal regulations BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For Title IV recipients who did not complete at least 60% of the semester, the school is required to perform a calculation to determine the amount of unearned aid that it must return to ED. CONDITION In response to the prior audit finding, management stated the university created and hired an Assistant Director of Compliance. Management also stated they would implement a daily review of the Return to Title IV report by both the Financial Aid and Records office. These updates were insufficient in addressing the ongoing compliance issues. We tested two groups of students who officially or unofficially withdrew from classes at Tennessee State University (TSU) during the 2023–2024 award year. First, we selected 15 student withdrawals from a population of 43 students who had an official or unofficial withdrawal before the 60% completion date. We tested these withdrawn students to ensure that withdrawal dates were accurate, that calculations were performed correctly, and that amounts were returned to ED within the required timeframes. Of the 15 student withdrawals, we noted 13 (87%) contained errors. Of the 13 errors, TSU did not return the Title IV funds to ED within the required timeframe for two students, and TSU did not calculate the correct return of the Title IV funds to ED for eight students. For the remaining three students, TSU did not calculate the correct return of the Title IV funds and did not return the funds within the required timeframes. In addition to the above errors, TSU management was not able to provide withdrawal forms for 2 of the 15 students (13%). We tested these students based on the date of withdrawal noted in the university’s information system; however, we were unable to verify this date. One of the student withdrawals was otherwise correct, while the other is included as an error below. Of the 15 errors, 11 were the result of incorrect calculation of return of funds. Specifically, • For 5 students, TSU calculated the returns with withdrawal dates 7-35 days after the students signed and submitted their withdrawal documentation. This resulted in questioned costs of $1,959. • For 1 student, TSU did not return the full amount of Title IV funds to ED even though the student submitted withdrawal documentation before the start of the semester. TSU returned $1,453; however, the full amount of $2,773 should have been considered an overaward and fully returned. This led to questioned costs of $1,320. • For 1 student, TSU did not enter the correct amount of the student’s Pell disbursement in the return calculation. This led to TSU calculating and returning from university funds $3,272, which was $1,276 more than necessary. • For 3 students, TSU did not enter the correct institutional charges in the return calculation but instead used cost of attendance. This led to TSU calculating and returning $8,328 more than necessary from university funds. • For 1 student, TSU calculated the return based on an end of attendance that was three days before the student signed their withdrawal form. This led to TSU calculating and returning from university funds $2,638, which was $165 more than necessary In addition to the above, we noted that for 5 of the 15 student withdrawals tested (33%), TSU did not return the Title IV funds within the applicable timeframes. The timeframes are 30 days after the school becomes aware of the withdrawal if the student never began attendance for the semester and 45 days if the student withdrew during the semester. Of the 5 students, 3 were included above due to also having calculation errors, while TSU correctly calculated the return for the remaining two students. • For two students, TSU returned funds 139 and 259 days after TSU processed the students’ withdrawal forms. As these withdrawals occurred during the semester, the 45-day timeframe was applicable, resulting in the returns being between 94 and 214 days late. • For two students, the school applied charges and Title IV aid to the students’ accounts for the fall 2023 semester based on information from the FAFSA; however, both submitted withdrawal forms before the start of the semester. Despite receiving the forms before the semester, TSU did not process the withdrawals until October 9, 2023, while the return of funds was not completed until October 31, 2023, for one student and June 11, 2024, for the other student. ED specifies that awards to students who never begin attendance are overawards and must be returned within 30 days after the school has determined the student did not begin attendance. For these 2 students, TSU returned funds 74 and 258 days after the student made TSU aware of their withdrawal, or 44 and 228 days late. • For the remaining student, TSU initially processed a return of Title IV funds on October 31, 2023, after the student had notified TSU of their withdrawal for the fall 2023 semester on October 4, 2023. However, when the student registered for spring 2024 classes, federal direct loans were added, and the original return of Title IV funds was reversed. The incorrect reversal and posting of additional funds were not corrected until June 19, 2024, when the return of Title IV funds calculation was recomputed. The corrections were made 259 days after the date of withdrawal, 214 days late. We also selected a sample of 15 from a population of 21 students who completed over 60% of the semester in which they withdrew to ensure that TSU recorded the withdrawal dates correctly, had adequate attendance records to support the withdrawal date, and did not remove Title IV funds from the account. Of the original 15 sample items, we noted 1 (6.7%) error. For this 1 student, TSU entered a withdrawal date beyond the 60% point of the semester; however, the student signed their withdrawal form 7 days before the 60% point. This resulted in $1,714 in questioned costs. Due to the high number of errors and the significant percentage of the overall withdrawal population tested, 30 of 64, or 47%, we determined that additional testwork was not required. CRITERIA The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 1, page 3, states, A pro rata schedule is used to determine the amount of FSA [Federal Student Aid] funds the student has earned at the time of withdrawal up through the 60% point in each payment period or period of enrollment. After the 60% point in the payment period or period of enrollment, a student has earned 100% of the FSA funds the student received and was scheduled to receive during the period. The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 2, page 92, states, • Student’s Withdrawal Date Official notification – The date the student begins the school’s withdrawal process, or the date that the student otherwise provides notification (If both circumstances occur, use the earlier withdrawal date) • Official notification not provided – The date that the school determines is related to the circumstance beyond the student’s control, or the midpoint of the payment period or period of enrollment, as applicable • Alternative approach – In place of the dates listed, a school may always use, as a student’s withdrawal date, the student’s last date of attendance at an academically related activity if the school documents that the activity is academically related and that the student attended the activity. The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 3, page 3, states, Schools must return funds disbursed to a student who failed to begin attendance as soon as possible but no later than 30 days after the date they become aware that the student has not begun and will not begin attendance [emphasis in original]. The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 2, page 39, states, An institution is not required to return the inadvertent overpayment immediately but must return it within 45 days of the date of the institution’s determination that the student withdrew (the time frame for an institution’s return of Title IV funds under 34 CFR 668.22(j)(1)). An institution must return an inadvertent overpayment in accordance with the applicable regulations for returning overpayments. Please see Volume 4, Chapter 3 for more information on overpayment procedures [emphasis in original]. CAUSE Based on our review, it appears that TSU management did not have proper oversight and review procedures over the return of Title IV funds, as we noted multiple issues regarding both the calculation itself as well as the timing. Specifically, TSU performed the Title IV return calculation using cost of attendance instead of institutional charges and entered the withdrawal date as the date the withdrawal was processed instead of the last date the student attended or the date on the signed withdrawal forms. In addition, TSU did not have a system in place to ensure all withdrawals and returns were processed timely. EFFECT For the 30 students tested, TSU calculated a total return of $39,133 in Title IV funds. The corrected total after adjustment for the errors we noted in our testwork was $34,361. TSU overreturned funds to students by $9,769 and underreturned funds to other students by a total of $4,993. The $4,993 was identified as questioned costs. Violations of the federal requirement to timely return Title IV funds to ED could result in ED imposing a fine on TSU and/or limiting, suspending, or terminating TSU’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. In addition, incorrect return calculations and/or withdrawal dates can negatively impact students. If TSU incorrectly calculates and returns the amount of unearned aid to ED, it could impact the amount of aid the student is eligible to receive in future terms or result in a student having an account balance in error. RECOMMENDATION The Registrar’s Office and the Financial Aid Office should follow federal regulations. Management should ensure that the Financial Aid Office reperforms all return of Title IV funds calculations and makes necessary corrections to student and federal fund accounts for the 2023–2024 academic year. Finally, TSU should ensure that the Registrar’s Office communicates any withdrawals to the Financial Aid Office in a timely manner. MANAGEMENT’S COMMENT We concur. The Office of Financial Aid is set to conduct a comprehensive review of the Title IV funds for the 2023-2024 academic year in February 2025, with the review anticipated to be completed by the end of April 2025. The communication process between the Registrar’s Office and Financial Aid begins with a detailed examination of the daily Withdrawal Report generated by the Registrar’s Office. Upon receiving this report, an acknowledgment email will be sent to confirm its review. To facilitate accurate calculations regarding the return of funds, specific parameters will be established within the Banner system. These parameters will support the Funds Calculation process in determining the correct return amounts owed. Our team is actively working with outside consultants to restructure and enhance our financial aid processes. This collaboration aims to significantly update our existing policies and procedures, preventing compliance issues in the future while fostering a more efficient system. An important aspect of this process is how the effective date of withdrawals is determined. The Registrar’s Office must use the date on which the student submitted their withdrawal form as the official effective date. By accurately recording this date in the Student Course Registration system, we can ensure that the student’s information is correctly reflected on the Withdrawal Report. Having the right effective date is crucial for maintaining accurate academic records and complying with federal regulations. TSU, in conjunction with its consultant, will help identify students with the correct withdrawal dates in the Registrar’s Office and will also work with Student Accounts to ensure that the appropriate institutional charges are used in all calculations. Finally, the Withdrawal Report can be scheduled within the job scheduler to run automatically and on time each day. This scheduling will contribute to a smoother workflow, allowing for any necessary adjustments to be made efficiently. By employing the Banner-delivered process for funds calculation, we will ensure that the actual charges incurred by the student are used in the calculation of returns instead of the predetermined cost of attendance, leading to more accurate financial assessments.

Finding Number 2024-005 Assistance Listing Number 10.553, 10.555, 10.556, and 10.582 Program Name Child Nutrition Cluster Federal Agency Department of Agriculture State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Education did not comply with Federal Funding Accountability and Transparency Act reporting requirements for the Child Nutrition Cluster and did not implement the designed internal control over the reporting requirements BACKGROUND The Department of Education (the department) is the pass-through entity for the Child Nutrition Cluster,(2) which is administered by the Food and Nutrition Service of the U.S. Department of Agriculture. The Child Nutrition Cluster is a cluster of federal programs to provide healthful, nutritious meals and snacks to eligible children in public schools and nonprofit private schools, residential childcare institutions, and summer recreation programs. See Schedule of Findings and Questioned Costs for footnote. For the School Breakfast Program, the National School Lunch Program, and the Special Milk Program for Children, the department enters into agreements with subrecipient organizations, known as School Food Authorities (SFAs), for local-level program operation and the delivery of program services to eligible children. The department reimburses SFAs for each meal or snack served based on the rates established by the U.S. Department of Agriculture. Each month, the SFAs claim the number of meals or snacks served using the department’s Tennessee: Meals, Accounting, and Claiming (TMAC) system. For the Fresh Fruit and Vegetable Program(3), the department enters into additional agreements with approved SFAs for eligible elementary schools within those SFAs for local-level program operation and the delivery of program services to eligible children. The department awards a grant amount for each elementary school based on a rate set per child by the department. Each month, the SFAs claim the costs from procurement, operations, and administration using the department’s TMAC system. See Schedule of Findings and Questioned Costs for footnote. The Federal Funding and Accountability Transparency Act (FFATA) requires the department to report subrecipient subaward financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. According to federal regulations, reports are due “no later than the end of the month following the month in which the obligation was made.” The subaward information in FSRS is then available to the public on the USA Spending website for transparency. CONDITION AND CAUSE Based on our discussion with management, because management had not implemented cross-training for backups as outlined in their designed internal controls for succession planning, staff was not aware of the requirement and therefore, did not complete any FFATA reporting for the Child Nutrition Cluster for the entire fiscal year. Based on our review of the claim information for the year, staff did not report 189 SFAs’ Child Nutrition subawards,(4) totaling $449,928,320 and 25 FFVP subawards, totaling $4,499,375. See Schedule of Findings and Questioned Costs for footnote. The former Federal Reporting Specialist who was responsible for FFATA reporting left the department in September 2023. At the time he left, he had not done any reporting for fiscal year 2024. When the current State Director of School Nutrition began in his role in March 2024, the Assistant Commissioner had not reassigned the FFATA reporting tasks and did not inform the newly hired State Director to reassign the FFATA reporting responsibilities thus the State Director was unaware of the reporting requirement. We first inquired about the department’s current FFATA reporting process on July 1, 2024. The Data Processing and Reporting Specialist(5) who is currently responsible for FFATA reporting took the role on July 8, 2024. She requested access to FSRS almost immediately and after following up, received access on September 4, 2024. See Schedule of Findings and Questioned Costs for footnote. On August 7, 2024, the current State Director of School Nutrition provided us the FFATA Reporting Process Plan, effective October 2022, that was maintained in the former Federal Reporting Specialist’s files. The process plan includes the owner of the process, a description of the process, the statute or regulation that requires it, the team members associated with the process as well as their role, and risks associated with the process. While the process plan lists the team member responsible for reporting as well as a backup; neither one submitted the required reports. We also reviewed the Department of Education’s 2024 Financial Integrity Act Risk Assessment and determined that despite the fact that management’s documented process plan and risk assessment identified the risks, management did not include all mitigating controls and did not follow through with effective implementation of all the mitigating controls and, as such, the backup was not trained and was unaware of the FFATA responsibilities and requirements. When we brought the FFATA reporting deficiency to management’s attention, management stated that they had begun creating and implementing a standard operating procedure and are in the process of uploading the FFATA reports for fiscal year 2024. We will audit the FFATA reporting requirements for the Child Nutrition Cluster during the next audit. CRITERIA FFATA Reporting Appendix A to “Reporting Subaward and Executive Compensation Information,” Title 2, Code of Federal Regulations (CFR), Part 170, states: a. Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. EFFECT Not meeting the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner should work with staff to ensure that when turnover occurs, new staff are fully informed about the scope of their responsibilities and have access to the resources needed to perform them, such as FSRS access and the newly developed standard operating procedures. Management should evaluate the identified mitigating controls for risks associated with the conditions identified in this finding to ensure they are appropriately designed, assigned, and that they are implemented. Management should update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need to ensure that new staff are fully informed about the scope of their responsibilities and have access to essential resources, such as FSRS access and the newly developed standard operating procedures. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Onboarding and Resource Access: • The Division of Human Resources will work closely with management to ensure each office and division maintains a robust onboarding process, ensuring that new employees are fully informed about their responsibilities and have access to all necessary resources. • The Deputy Commissioner will designate a single point of contact for FSRS reporting coordination within the agency and ensure standard operating procedures are updated accordingly to reflect onboarding requirements of new staff with FSRS reporting responsibilities. • Regular training sessions will be conducted to keep new and existing staff up to date with any changes in procedures and responsibilities. 2. Evaluation of Mitigating Controls: • Management will carefully evaluate the identified mitigating controls for the risks associated with the conditions mentioned in the audit finding. • We will ensure that these controls are appropriately designed, assigned, and effectively implemented to mitigate any potential risks. 3. Risk Assessment Updates: • The risk assessment will be updated regularly to reflect any changes in the operational environment, identified risks, and the effectiveness of mitigating controls. • This process will involve continuous monitoring and review to ensure that the risk assessment remains relevant and effective. 4. Ongoing Monitoring and Accountability: • The Deputy Commissioner will assign the Chief Operating Officer to continually monitor risks and assess the effectiveness of mitigating controls. • Clear protocols will be established for timely corrective actions if any deficiencies are identified, ensuring that any issues are promptly addressed and resolved. The department is fully committed to ensuring that staff have the necessary resources and support to perform their roles effectively. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment, minimize risks, and ensure the continued success of our operations. We appreciate the audit team's insights and recommendations and are dedicated to demonstrating progress in these areas.

Finding Number 2024-005 Assistance Listing Number 10.553, 10.555, 10.556, and 10.582 Program Name Child Nutrition Cluster Federal Agency Department of Agriculture State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Education did not comply with Federal Funding Accountability and Transparency Act reporting requirements for the Child Nutrition Cluster and did not implement the designed internal control over the reporting requirements BACKGROUND The Department of Education (the department) is the pass-through entity for the Child Nutrition Cluster,(2) which is administered by the Food and Nutrition Service of the U.S. Department of Agriculture. The Child Nutrition Cluster is a cluster of federal programs to provide healthful, nutritious meals and snacks to eligible children in public schools and nonprofit private schools, residential childcare institutions, and summer recreation programs. See Schedule of Findings and Questioned Costs for footnote. For the School Breakfast Program, the National School Lunch Program, and the Special Milk Program for Children, the department enters into agreements with subrecipient organizations, known as School Food Authorities (SFAs), for local-level program operation and the delivery of program services to eligible children. The department reimburses SFAs for each meal or snack served based on the rates established by the U.S. Department of Agriculture. Each month, the SFAs claim the number of meals or snacks served using the department’s Tennessee: Meals, Accounting, and Claiming (TMAC) system. For the Fresh Fruit and Vegetable Program(3), the department enters into additional agreements with approved SFAs for eligible elementary schools within those SFAs for local-level program operation and the delivery of program services to eligible children. The department awards a grant amount for each elementary school based on a rate set per child by the department. Each month, the SFAs claim the costs from procurement, operations, and administration using the department’s TMAC system. See Schedule of Findings and Questioned Costs for footnote. The Federal Funding and Accountability Transparency Act (FFATA) requires the department to report subrecipient subaward financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. According to federal regulations, reports are due “no later than the end of the month following the month in which the obligation was made.” The subaward information in FSRS is then available to the public on the USA Spending website for transparency. CONDITION AND CAUSE Based on our discussion with management, because management had not implemented cross-training for backups as outlined in their designed internal controls for succession planning, staff was not aware of the requirement and therefore, did not complete any FFATA reporting for the Child Nutrition Cluster for the entire fiscal year. Based on our review of the claim information for the year, staff did not report 189 SFAs’ Child Nutrition subawards,(4) totaling $449,928,320 and 25 FFVP subawards, totaling $4,499,375. See Schedule of Findings and Questioned Costs for footnote. The former Federal Reporting Specialist who was responsible for FFATA reporting left the department in September 2023. At the time he left, he had not done any reporting for fiscal year 2024. When the current State Director of School Nutrition began in his role in March 2024, the Assistant Commissioner had not reassigned the FFATA reporting tasks and did not inform the newly hired State Director to reassign the FFATA reporting responsibilities thus the State Director was unaware of the reporting requirement. We first inquired about the department’s current FFATA reporting process on July 1, 2024. The Data Processing and Reporting Specialist(5) who is currently responsible for FFATA reporting took the role on July 8, 2024. She requested access to FSRS almost immediately and after following up, received access on September 4, 2024. See Schedule of Findings and Questioned Costs for footnote. On August 7, 2024, the current State Director of School Nutrition provided us the FFATA Reporting Process Plan, effective October 2022, that was maintained in the former Federal Reporting Specialist’s files. The process plan includes the owner of the process, a description of the process, the statute or regulation that requires it, the team members associated with the process as well as their role, and risks associated with the process. While the process plan lists the team member responsible for reporting as well as a backup; neither one submitted the required reports. We also reviewed the Department of Education’s 2024 Financial Integrity Act Risk Assessment and determined that despite the fact that management’s documented process plan and risk assessment identified the risks, management did not include all mitigating controls and did not follow through with effective implementation of all the mitigating controls and, as such, the backup was not trained and was unaware of the FFATA responsibilities and requirements. When we brought the FFATA reporting deficiency to management’s attention, management stated that they had begun creating and implementing a standard operating procedure and are in the process of uploading the FFATA reports for fiscal year 2024. We will audit the FFATA reporting requirements for the Child Nutrition Cluster during the next audit. CRITERIA FFATA Reporting Appendix A to “Reporting Subaward and Executive Compensation Information,” Title 2, Code of Federal Regulations (CFR), Part 170, states: a. Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. EFFECT Not meeting the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner should work with staff to ensure that when turnover occurs, new staff are fully informed about the scope of their responsibilities and have access to the resources needed to perform them, such as FSRS access and the newly developed standard operating procedures. Management should evaluate the identified mitigating controls for risks associated with the conditions identified in this finding to ensure they are appropriately designed, assigned, and that they are implemented. Management should update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need to ensure that new staff are fully informed about the scope of their responsibilities and have access to essential resources, such as FSRS access and the newly developed standard operating procedures. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Onboarding and Resource Access: • The Division of Human Resources will work closely with management to ensure each office and division maintains a robust onboarding process, ensuring that new employees are fully informed about their responsibilities and have access to all necessary resources. • The Deputy Commissioner will designate a single point of contact for FSRS reporting coordination within the agency and ensure standard operating procedures are updated accordingly to reflect onboarding requirements of new staff with FSRS reporting responsibilities. • Regular training sessions will be conducted to keep new and existing staff up to date with any changes in procedures and responsibilities. 2. Evaluation of Mitigating Controls: • Management will carefully evaluate the identified mitigating controls for the risks associated with the conditions mentioned in the audit finding. • We will ensure that these controls are appropriately designed, assigned, and effectively implemented to mitigate any potential risks. 3. Risk Assessment Updates: • The risk assessment will be updated regularly to reflect any changes in the operational environment, identified risks, and the effectiveness of mitigating controls. • This process will involve continuous monitoring and review to ensure that the risk assessment remains relevant and effective. 4. Ongoing Monitoring and Accountability: • The Deputy Commissioner will assign the Chief Operating Officer to continually monitor risks and assess the effectiveness of mitigating controls. • Clear protocols will be established for timely corrective actions if any deficiencies are identified, ensuring that any issues are promptly addressed and resolved. The department is fully committed to ensuring that staff have the necessary resources and support to perform their roles effectively. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment, minimize risks, and ensure the continued success of our operations. We appreciate the audit team's insights and recommendations and are dedicated to demonstrating progress in these areas.

Finding Number 2024-006 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Matching, Level of Effort, Earmarking Repeat Finding 2023-011 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior audit, Department of Education management did not have effective internal controls over matching, maintenance of effort, and earmarking requirements and could not provide evidence of compliance with requirements BACKGROUND AND COMPLIANCE CRITERIA The US Department of Education (ED) provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006, which was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act (Perkins V). Perkins V provides grants to states to develop the academic knowledge and technical and employability skills of secondary students and postsecondary students. The Tennessee Department of Education (the department) is the pass-through entity for Perkins funds and disburses those funds to local education agencies (LEAs) within the state and the Tennessee Board of Regents. As a recipient of federal funding, the department is subject to federal matching, level of effort – maintenance of effort (MOE), and earmarking requirements.(6) Section 211(b) of the Perkins Act mandates that the department maintain its fiscal effort from state appropriations for CTE when compared with the preceding years; for example, the department must allocate state resources in fiscal year 2024 that meet or exceed the allocated state resources for fiscal year 2023. Per Section 112(a) of the Perkins Act, the department must also allocate CTE funds received for specific activities in keeping with the following requirements: • not less than 85 percent to Secondary and Postsecondary Career and Technical Education Programs; • not more than 10 percent to State Leadership Activities; and • not more than 5 percent or $250,000, whichever is greater, to State Administration. See Schedule of Findings and Questioned Costs for footnote. In addition, Section 112(b) of the Perkins Act requires the department to match federal funds reserved for State Administration with non-federal funds, such as state appropriations, on a dollar-for-dollar basis. Annually, ED requires Perkins recipients to submit financial and performance data via the Consolidated Annual Report (CAR). The CAR contains CTE programmatic and financial information and includes the department’s demonstrated compliance with maintenance of effort and matching requirements. Department staff completes the CAR in December using the two most recent fiscal years’ financial data—for example, the CAR submitted in December 2023 included data from state fiscal years 2022 and 2023. PRIOR AUDIT RESULTS In the prior audit, we reported a finding related to the Matching, Level of Effort – Maintenance of Effort, and Earmarking compliance requirement. We reported that management had not developed and implemented policies and procedures to ensure that the department complied with these requirements and the lack of policies and procedures, combined with turnover, led to management’s inability to provide documentation to demonstrate compliance. Due to the lack of internal controls, we reported the following conditions related to compliance: • Department management was unable to provide any documentary evidence of the department’s compliance with matching requirements, • Department management was unable to provide documentation for adjustments or final amounts reported in the CAR, and • Department management was unable to provide key earmarking documentation to ensure correct earmarking amounts were calculated. Department management concurred with the prior audit finding and stated they would collaborate to create sufficient controls for the calculation of MOE, including a complete supervisory review, and the department’s Office of Finance would serve as a secondary internal check. Additionally, department management stated they would create a process to ensure documents are maintained and are not tied to a specific employee’s hardware, including but not limited to data stored on a physical storage device. CONDITION, CRITERIA, AND CAUSE CURRENT AUDIT RESULTS In the current audit, we found that management did not take corrective action to address the prior audit finding regarding development and implementation of policies and procedures to ensure matching, MOE, and earmarking compliance requirements were met. Management also did not take corrective action to address the lack of documentation as evidence of matching and MOE compliance and did not maintain documentation of management’s review of their required earmarking calculations. Ultimately, we were only able to determine that management met earmarking requirements. We provide specific details of our results below. Insufficient Internal Controls and Lack of Evidence of Compliance Due to the condition above, we noted the following: Matching Because management has still not developed policies and procedures, they were unable to describe the process used for determining compliance with matching requirements during the audit period or provide any documentary evidence of the department’s compliance with matching requirements. As a result, we were unable to perform any procedures to verify if the department met the matching requirements independently. Maintenance of Effort As reported in the prior audit, department management was unable to provide supporting documentation for the final MOE amounts reported in the CAR for state fiscal year 2023. We attempted to verify the amounts reported in the CAR, but without sufficient support for those calculations, we were unable to independently verify that the reported MOE numbers were accurate; therefore, we were unable to determine that management met MOE compliance requirements. Additionally, in the prior audit, management stated that although they reviewed the MOE calculation, the review was not documented. In the current audit, management stated that they did not perform a supervisory review of the calculations submitted in the CAR. Earmarking Although department management provided key earmarking documentation that demonstrated compliance requirements were met and stated they reviewed the calculations, management could not provide any evidence of this review. Department management explained that due to turnover and staffing challenges, appropriate staff were not assigned control and compliance tasks to ensure that the CTE fiscal requirements were met; however, they have hired more staff to be responsible for performing the work and ensuring that requirements are met in the future. Additionally, management stated that standard operating procedures would be created and implemented to document the matching, maintenance of effort, and earmarking processes. Current Risk Assessment and Internal Control Criteria We reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risks to identify or meet matching requirements for external grants, meet overall maintenance of effort requirements, and meet minimum or maximum set-aside limits (earmarking requirements). Management identified scheduled reviews as a control to mitigate these risks; however, based on the results of our audit work, management stated they did not conduct a review of the CAR calculations and did not document other reviews to ensure they are occurring and operating as intended. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303, a non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. . . . (c) Evaluate and monitor the non-Federal entity’s compliance with statutes, regulations, and the terms and conditions of Federal awards. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government, Principle 10.03, “Design of Appropriate Types of Control Activities,” states, Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. . . . Also, Principle 12.03, “Documentation of Responsibilities through Policies,” states, Management documents in policies for each unit its responsibility for an operational process’s objectives and related risks, and control activity design, implementation, and operating effectiveness. . . . Additionally, Principle 12.04, “Documentation of Responsibilities through Policies,” states, . . . Management communicates to personnel the policies and procedures so that personnel can implement the control activities for their assigned responsibilities. EFFECT Without appropriate internal controls over matching, MOE, and earmarking requirements, there is a risk that the department will not comply with all related federal requirements and potentially miscalculate the state’s matching, MOE, and earmarking amounts. If a miscalculation results in the state’s noncompliance, the department risks a reduction of federal funding for CTE activities in subsequent award years, which may impact the department’s ability to provide services to students at Tennessee’s schools. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies.   RECOMMENDATION Department management should design and implement sufficient controls for matching, MOE, and earmarking compliance requirements, which includes assigning responsibility for control activities and compliance, and developing policies and procedures and documenting key processes to ensure ongoing compliance. Management should also ensure that the agency maintains supporting documentation, including documentation of review activities, to monitor ongoing compliance. Management should evaluate the effectiveness of the control activities for the risks identified in this finding and update the department’s annual risk assessment to reflect any new controls management implements. MANAGEMENT’S COMMENT The department concurs with this finding and is committed to addressing the identified compliance requirements and enhancing our control environment. Action Plan: 1. Assignment of Responsibilities: • Management will assign clear responsibility for control activities and compliance related to matching, Maintenance of Effort (MOE), and earmarking requirements. This will ensure accountability and enhance our ability to meet compliance requirements. 2. Policy and Procedure Development: • Policies: We will develop comprehensive policies that define the expectations for compliance with matching, MOE, and earmarking requirements. • Procedures: We will document key processes to ensure these policies are consistently applied. This will include specific steps for maintaining compliance and addressing any potential issues promptly. 3. Documentation and Review Activities: • We will maintain detailed supporting documentation to demonstrate compliance with matching, MOE, and earmarking requirements. • We will also document review activities to monitor ongoing compliance. This documentation will be regularly reviewed and updated as needed. 4. Risk Assessment and Control Evaluation: • Management will evaluate the effectiveness of current control activities for the risks identified in this finding. • We will update the department’s annual risk assessment to reflect any new controls implemented. This will ensure that our risk management approach remains robust and responsive to emerging compliance risks. 5. Monitoring and Continuous Improvement: • We will establish a monitoring plan to ensure ongoing compliance with matching, MOE, and earmarking requirements. This plan will include regular review and evaluation of control activities. • Management is committed to continuous improvement and will regularly review and update our policies, procedures, and control activities to address any new compliance requirements or risks. We anticipate an estimated completion date of 9/30/2025. Thank you for highlighting these areas for improvement. We believe that the actions outlined above will strengthen our compliance framework and ensure that we meet the necessary requirements.

Finding Number 2024-006 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Matching, Level of Effort, Earmarking Repeat Finding 2023-011 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior audit, Department of Education management did not have effective internal controls over matching, maintenance of effort, and earmarking requirements and could not provide evidence of compliance with requirements BACKGROUND AND COMPLIANCE CRITERIA The US Department of Education (ED) provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006, which was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act (Perkins V). Perkins V provides grants to states to develop the academic knowledge and technical and employability skills of secondary students and postsecondary students. The Tennessee Department of Education (the department) is the pass-through entity for Perkins funds and disburses those funds to local education agencies (LEAs) within the state and the Tennessee Board of Regents. As a recipient of federal funding, the department is subject to federal matching, level of effort – maintenance of effort (MOE), and earmarking requirements.(6) Section 211(b) of the Perkins Act mandates that the department maintain its fiscal effort from state appropriations for CTE when compared with the preceding years; for example, the department must allocate state resources in fiscal year 2024 that meet or exceed the allocated state resources for fiscal year 2023. Per Section 112(a) of the Perkins Act, the department must also allocate CTE funds received for specific activities in keeping with the following requirements: • not less than 85 percent to Secondary and Postsecondary Career and Technical Education Programs; • not more than 10 percent to State Leadership Activities; and • not more than 5 percent or $250,000, whichever is greater, to State Administration. See Schedule of Findings and Questioned Costs for footnote. In addition, Section 112(b) of the Perkins Act requires the department to match federal funds reserved for State Administration with non-federal funds, such as state appropriations, on a dollar-for-dollar basis. Annually, ED requires Perkins recipients to submit financial and performance data via the Consolidated Annual Report (CAR). The CAR contains CTE programmatic and financial information and includes the department’s demonstrated compliance with maintenance of effort and matching requirements. Department staff completes the CAR in December using the two most recent fiscal years’ financial data—for example, the CAR submitted in December 2023 included data from state fiscal years 2022 and 2023. PRIOR AUDIT RESULTS In the prior audit, we reported a finding related to the Matching, Level of Effort – Maintenance of Effort, and Earmarking compliance requirement. We reported that management had not developed and implemented policies and procedures to ensure that the department complied with these requirements and the lack of policies and procedures, combined with turnover, led to management’s inability to provide documentation to demonstrate compliance. Due to the lack of internal controls, we reported the following conditions related to compliance: • Department management was unable to provide any documentary evidence of the department’s compliance with matching requirements, • Department management was unable to provide documentation for adjustments or final amounts reported in the CAR, and • Department management was unable to provide key earmarking documentation to ensure correct earmarking amounts were calculated. Department management concurred with the prior audit finding and stated they would collaborate to create sufficient controls for the calculation of MOE, including a complete supervisory review, and the department’s Office of Finance would serve as a secondary internal check. Additionally, department management stated they would create a process to ensure documents are maintained and are not tied to a specific employee’s hardware, including but not limited to data stored on a physical storage device. CONDITION, CRITERIA, AND CAUSE CURRENT AUDIT RESULTS In the current audit, we found that management did not take corrective action to address the prior audit finding regarding development and implementation of policies and procedures to ensure matching, MOE, and earmarking compliance requirements were met. Management also did not take corrective action to address the lack of documentation as evidence of matching and MOE compliance and did not maintain documentation of management’s review of their required earmarking calculations. Ultimately, we were only able to determine that management met earmarking requirements. We provide specific details of our results below. Insufficient Internal Controls and Lack of Evidence of Compliance Due to the condition above, we noted the following: Matching Because management has still not developed policies and procedures, they were unable to describe the process used for determining compliance with matching requirements during the audit period or provide any documentary evidence of the department’s compliance with matching requirements. As a result, we were unable to perform any procedures to verify if the department met the matching requirements independently. Maintenance of Effort As reported in the prior audit, department management was unable to provide supporting documentation for the final MOE amounts reported in the CAR for state fiscal year 2023. We attempted to verify the amounts reported in the CAR, but without sufficient support for those calculations, we were unable to independently verify that the reported MOE numbers were accurate; therefore, we were unable to determine that management met MOE compliance requirements. Additionally, in the prior audit, management stated that although they reviewed the MOE calculation, the review was not documented. In the current audit, management stated that they did not perform a supervisory review of the calculations submitted in the CAR. Earmarking Although department management provided key earmarking documentation that demonstrated compliance requirements were met and stated they reviewed the calculations, management could not provide any evidence of this review. Department management explained that due to turnover and staffing challenges, appropriate staff were not assigned control and compliance tasks to ensure that the CTE fiscal requirements were met; however, they have hired more staff to be responsible for performing the work and ensuring that requirements are met in the future. Additionally, management stated that standard operating procedures would be created and implemented to document the matching, maintenance of effort, and earmarking processes. Current Risk Assessment and Internal Control Criteria We reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risks to identify or meet matching requirements for external grants, meet overall maintenance of effort requirements, and meet minimum or maximum set-aside limits (earmarking requirements). Management identified scheduled reviews as a control to mitigate these risks; however, based on the results of our audit work, management stated they did not conduct a review of the CAR calculations and did not document other reviews to ensure they are occurring and operating as intended. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303, a non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. . . . (c) Evaluate and monitor the non-Federal entity’s compliance with statutes, regulations, and the terms and conditions of Federal awards. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government, Principle 10.03, “Design of Appropriate Types of Control Activities,” states, Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. . . . Also, Principle 12.03, “Documentation of Responsibilities through Policies,” states, Management documents in policies for each unit its responsibility for an operational process’s objectives and related risks, and control activity design, implementation, and operating effectiveness. . . . Additionally, Principle 12.04, “Documentation of Responsibilities through Policies,” states, . . . Management communicates to personnel the policies and procedures so that personnel can implement the control activities for their assigned responsibilities. EFFECT Without appropriate internal controls over matching, MOE, and earmarking requirements, there is a risk that the department will not comply with all related federal requirements and potentially miscalculate the state’s matching, MOE, and earmarking amounts. If a miscalculation results in the state’s noncompliance, the department risks a reduction of federal funding for CTE activities in subsequent award years, which may impact the department’s ability to provide services to students at Tennessee’s schools. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies.   RECOMMENDATION Department management should design and implement sufficient controls for matching, MOE, and earmarking compliance requirements, which includes assigning responsibility for control activities and compliance, and developing policies and procedures and documenting key processes to ensure ongoing compliance. Management should also ensure that the agency maintains supporting documentation, including documentation of review activities, to monitor ongoing compliance. Management should evaluate the effectiveness of the control activities for the risks identified in this finding and update the department’s annual risk assessment to reflect any new controls management implements. MANAGEMENT’S COMMENT The department concurs with this finding and is committed to addressing the identified compliance requirements and enhancing our control environment. Action Plan: 1. Assignment of Responsibilities: • Management will assign clear responsibility for control activities and compliance related to matching, Maintenance of Effort (MOE), and earmarking requirements. This will ensure accountability and enhance our ability to meet compliance requirements. 2. Policy and Procedure Development: • Policies: We will develop comprehensive policies that define the expectations for compliance with matching, MOE, and earmarking requirements. • Procedures: We will document key processes to ensure these policies are consistently applied. This will include specific steps for maintaining compliance and addressing any potential issues promptly. 3. Documentation and Review Activities: • We will maintain detailed supporting documentation to demonstrate compliance with matching, MOE, and earmarking requirements. • We will also document review activities to monitor ongoing compliance. This documentation will be regularly reviewed and updated as needed. 4. Risk Assessment and Control Evaluation: • Management will evaluate the effectiveness of current control activities for the risks identified in this finding. • We will update the department’s annual risk assessment to reflect any new controls implemented. This will ensure that our risk management approach remains robust and responsive to emerging compliance risks. 5. Monitoring and Continuous Improvement: • We will establish a monitoring plan to ensure ongoing compliance with matching, MOE, and earmarking requirements. This plan will include regular review and evaluation of control activities. • Management is committed to continuous improvement and will regularly review and update our policies, procedures, and control activities to address any new compliance requirements or risks. We anticipate an estimated completion date of 9/30/2025. Thank you for highlighting these areas for improvement. We believe that the actions outlined above will strengthen our compliance framework and ensure that we meet the necessary requirements.

Finding Number 2024-007 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-012 Pass-Through Entity N/A Questioned Costs 154,392 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures outside of the Career and Technical Education Program grant’s period of performance BACKGROUND The U.S. Department of Education provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006, which was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act (Perkins V). Perkins V provides grants to states to develop the academic knowledge, technical skills, and employment readiness skills of secondary students and postsecondary students. The Tennessee Department of Education (the department) is the pass-through entity for CTE-Perkins funds and disburses those funds to local education agencies within the state and the Tennessee Board of Regents.(7) Federal funding for CTE is only available to the department and its subrecipients for a limited time (referred to as the grant’s period of performance).(8) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the CTE award amount and the period of performance (budget period).(9) The department has 15 months to charge expenditures to each grant award based on the budget period; however, CTE is governed by the requirements of the Tydings Amendment,(10) which extends the period of performance 12 additional months, for a total of 27 months. According to 2 CFR 200.344, the department must liquidate all financial obligations incurred under the federal award within 120 days of the end of the period of performance. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management incurred administrative expenditures outside of the CTE grant’s period of performance and that internal controls were not effective in ensuring compliance with the grant’s period of performance. Management concurred with the prior finding and stated they would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls implemented, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. In response to the prior audit finding, department management created period of performance operating procedures, implemented professional development for staff, and updated the annual risk assessment. However, management’s actions did not prevent the errors noted below from occurring. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the CTE grants for fiscal year ended June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates to the grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis of payroll expenditures for fiscal year ended June 30, 2024, totaling $2,511,558, we found department management charged payroll expenditures in the amount of $154,289 to the CTE grant award V048A210042 that were obligated after the grant’s period of performance. In addition, based on our analysis, we identified 433 expenditures charged to CTE grant award V048A210042, totaling $2,587,293, occurring on or after July 1, 2023. We tested a nonstatistical, random sample of 60 of these expenditure transactions, totaling $298,666, to determine if the non-payroll administrative transactions were obligated within the grant’s period of performance. Based on our testwork, we found that for 2 of 60 (3%) expenditure transactions tested, the department paid expenses totaling $103 that were obligated after the grant’s period of performance, resulting in a total of $154,392 known questioned costs for the compliance requirement. Management explained that insufficient training and a lack of instruction from management, along with employee turnover and staffing challenges, caused department staff to mistakenly approve payments for expenses that were obligated after the grant’s period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance requirement and identified the review of charges to federal grants and training staff as controls to mitigate the risk. According to management, program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment; however, based on the results of our review, staff’s review and training was not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should develop effective control procedures to ensure that expenditures occurred during the grant award’s period of performance. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-007 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-012 Pass-Through Entity N/A Questioned Costs 154,392 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures outside of the Career and Technical Education Program grant’s period of performance BACKGROUND The U.S. Department of Education provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006, which was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act (Perkins V). Perkins V provides grants to states to develop the academic knowledge, technical skills, and employment readiness skills of secondary students and postsecondary students. The Tennessee Department of Education (the department) is the pass-through entity for CTE-Perkins funds and disburses those funds to local education agencies within the state and the Tennessee Board of Regents.(7) Federal funding for CTE is only available to the department and its subrecipients for a limited time (referred to as the grant’s period of performance).(8) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the CTE award amount and the period of performance (budget period).(9) The department has 15 months to charge expenditures to each grant award based on the budget period; however, CTE is governed by the requirements of the Tydings Amendment,(10) which extends the period of performance 12 additional months, for a total of 27 months. According to 2 CFR 200.344, the department must liquidate all financial obligations incurred under the federal award within 120 days of the end of the period of performance. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management incurred administrative expenditures outside of the CTE grant’s period of performance and that internal controls were not effective in ensuring compliance with the grant’s period of performance. Management concurred with the prior finding and stated they would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls implemented, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. In response to the prior audit finding, department management created period of performance operating procedures, implemented professional development for staff, and updated the annual risk assessment. However, management’s actions did not prevent the errors noted below from occurring. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the CTE grants for fiscal year ended June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates to the grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis of payroll expenditures for fiscal year ended June 30, 2024, totaling $2,511,558, we found department management charged payroll expenditures in the amount of $154,289 to the CTE grant award V048A210042 that were obligated after the grant’s period of performance. In addition, based on our analysis, we identified 433 expenditures charged to CTE grant award V048A210042, totaling $2,587,293, occurring on or after July 1, 2023. We tested a nonstatistical, random sample of 60 of these expenditure transactions, totaling $298,666, to determine if the non-payroll administrative transactions were obligated within the grant’s period of performance. Based on our testwork, we found that for 2 of 60 (3%) expenditure transactions tested, the department paid expenses totaling $103 that were obligated after the grant’s period of performance, resulting in a total of $154,392 known questioned costs for the compliance requirement. Management explained that insufficient training and a lack of instruction from management, along with employee turnover and staffing challenges, caused department staff to mistakenly approve payments for expenses that were obligated after the grant’s period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance requirement and identified the review of charges to federal grants and training staff as controls to mitigate the risk. According to management, program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment; however, based on the results of our review, staff’s review and training was not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should develop effective control procedures to ensure that expenditures occurred during the grant award’s period of performance. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-008 Assistance Listing Number 84.424 Program Name Student Support and Academic Enrichment Program Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-008 Pass-Through Entity N/A Questioned Costs 37,860 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures and reimbursed local educational agencies for expenditures that occurred outside of the Student Support and Academic Enrichment Program grant’s period of performance BACKGROUND The Title IV, Part A, Student Support and Academic Enrichment Program (Title IV) is a federal program to improve students’ academic achievement by providing all students with access to a well-rounded education, improving school conditions for student learning, and improving the use of technology in order to improve the academic achievement and digital literacy of all students. Federal funding for Title IV is only available to the Department of Education (the department) and its subrecipients for a limited time (referred to as the grant’s period of performance).(11) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the Title IV award amount and the period of performance (budget period).(12) The department has 15 months to charge expenditures to each grant award; however, Title IV is governed by the requirements of the Tydings Amendment,(13) which extends the period of performance 12 additional months, for a total of 27 months. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management reimbursed local educational agencies for expenditures that occurred outside of the grant’s period of performance and that internal controls were not effective in ensuring compliance with the grant’s period of performance. Management concurred with the prior finding and stated that management would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls management implements, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the Title IV grants for fiscal year ended June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates to the grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis, we identified and tested 62 expenditure transactions, totaling $1,425,557, that were charged to the Title IV grant award S424A210044 after June 30, 2023, to determine if the transactions were obligated within the grant’s period of performance. Based on our testwork, we found that for 5 of 62 expenditure transactions tested (8%), management reimbursed local educational agencies (LEAs) and paid administrative expenses that were obligated after the grant’s period of performance, resulting in $37,599 in known questioned costs. Management did reverse one of the five transactions, totaling $449, after we informed them of the results of our testwork; therefore, we did not include the $449 in the known questioned costs. Management stated that this transaction was accidentally charged to the wrong grant. Management also stated that in January 2024, they found the other 4 transactions that were obligated after the grant’s period of performance; however, the transactions were accidentally left off the adjustment to correct the transactions. In addition, based on our analysis, we identified 1,868 adjusting entry expenditure transactions, totaling $2,615,473, that were charged to the Title IV grants during fiscal year ended June 30, 2024. We tested a nonstatistical, random sample of 60 adjusting entry expenditure transactions, totaling $1,976,846, to determine if the transactions were obligated within the grants’ period of performance. Based on our testwork, we found that for 3 of 60 adjusting entry expenditure transactions tested (5%), management paid $261 in administrative expenses that were obligated after grant award S424A210044 period of performance, resulting in a total of $37,860 in known questioned costs for the compliance requirement. Management stated that they accidentally charged these 3 transactions to the grant after it ended. Management stated that program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment. Additionally, according to department management, between October 1 and January 30 of each year, the department reviews all LEA reimbursement requests to determine if the reimbursement request is charged to a grant that ended on September 30 of that year. If so, the department contacts the LEA to determine if the reimbursement request contains any expenditures that occurred after September 30. For those expenditures that occurred after September 30, the department sends the reimbursement request back to the LEA to remove those expenditures. If the reimbursement request contains no expenditures that occurred after September 30, the department approves the request and processes it for payment. Even though department management stated they had controls in place, we found that due to the volume of transactions included in the manual review, the controls were not effective to ensure compliance with the period of performance requirement. As a result, the department paid administrative expenses and reimbursed LEAs for costs that occurred outside the authorized period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance. Management identified the review of charges to federal grants and training staff as controls to mitigate the risk; however, based on the results of our review, management’s review and training was not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. According to the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should refine their current control procedures, including utilizing data analytics tools to assist in evaluating the large number of reimbursements and administrative expenditures and training staff, to ensure that expenditures occurred during the grant award’s period of performance. Procedures should be designed to ensure that all identified expenditures occurring outside the period of performance are included in any adjusting entries. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-008 Assistance Listing Number 84.424 Program Name Student Support and Academic Enrichment Program Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-008 Pass-Through Entity N/A Questioned Costs 37,860 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures and reimbursed local educational agencies for expenditures that occurred outside of the Student Support and Academic Enrichment Program grant’s period of performance BACKGROUND The Title IV, Part A, Student Support and Academic Enrichment Program (Title IV) is a federal program to improve students’ academic achievement by providing all students with access to a well-rounded education, improving school conditions for student learning, and improving the use of technology in order to improve the academic achievement and digital literacy of all students. Federal funding for Title IV is only available to the Department of Education (the department) and its subrecipients for a limited time (referred to as the grant’s period of performance).(11) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the Title IV award amount and the period of performance (budget period).(12) The department has 15 months to charge expenditures to each grant award; however, Title IV is governed by the requirements of the Tydings Amendment,(13) which extends the period of performance 12 additional months, for a total of 27 months. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management reimbursed local educational agencies for expenditures that occurred outside of the grant’s period of performance and that internal controls were not effective in ensuring compliance with the grant’s period of performance. Management concurred with the prior finding and stated that management would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls management implements, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the Title IV grants for fiscal year ended June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates to the grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis, we identified and tested 62 expenditure transactions, totaling $1,425,557, that were charged to the Title IV grant award S424A210044 after June 30, 2023, to determine if the transactions were obligated within the grant’s period of performance. Based on our testwork, we found that for 5 of 62 expenditure transactions tested (8%), management reimbursed local educational agencies (LEAs) and paid administrative expenses that were obligated after the grant’s period of performance, resulting in $37,599 in known questioned costs. Management did reverse one of the five transactions, totaling $449, after we informed them of the results of our testwork; therefore, we did not include the $449 in the known questioned costs. Management stated that this transaction was accidentally charged to the wrong grant. Management also stated that in January 2024, they found the other 4 transactions that were obligated after the grant’s period of performance; however, the transactions were accidentally left off the adjustment to correct the transactions. In addition, based on our analysis, we identified 1,868 adjusting entry expenditure transactions, totaling $2,615,473, that were charged to the Title IV grants during fiscal year ended June 30, 2024. We tested a nonstatistical, random sample of 60 adjusting entry expenditure transactions, totaling $1,976,846, to determine if the transactions were obligated within the grants’ period of performance. Based on our testwork, we found that for 3 of 60 adjusting entry expenditure transactions tested (5%), management paid $261 in administrative expenses that were obligated after grant award S424A210044 period of performance, resulting in a total of $37,860 in known questioned costs for the compliance requirement. Management stated that they accidentally charged these 3 transactions to the grant after it ended. Management stated that program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment. Additionally, according to department management, between October 1 and January 30 of each year, the department reviews all LEA reimbursement requests to determine if the reimbursement request is charged to a grant that ended on September 30 of that year. If so, the department contacts the LEA to determine if the reimbursement request contains any expenditures that occurred after September 30. For those expenditures that occurred after September 30, the department sends the reimbursement request back to the LEA to remove those expenditures. If the reimbursement request contains no expenditures that occurred after September 30, the department approves the request and processes it for payment. Even though department management stated they had controls in place, we found that due to the volume of transactions included in the manual review, the controls were not effective to ensure compliance with the period of performance requirement. As a result, the department paid administrative expenses and reimbursed LEAs for costs that occurred outside the authorized period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance. Management identified the review of charges to federal grants and training staff as controls to mitigate the risk; however, based on the results of our review, management’s review and training was not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. According to the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should refine their current control procedures, including utilizing data analytics tools to assist in evaluating the large number of reimbursements and administrative expenditures and training staff, to ensure that expenditures occurred during the grant award’s period of performance. Procedures should be designed to ensure that all identified expenditures occurring outside the period of performance are included in any adjusting entries. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-009 Assistance Listing Number 84.027 and 84.173 Program Name Special Education Cluster (IDEA) Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-010 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.027 Federal Award Identification Number H027A210052 Amount $40,355 Assistance Listing Number 84.173 Federal Award Identification Number H173A210095 Amount $22,675 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures and reimbursed local educational agencies for expenditures that occurred outside of the Special Education Cluster Program grants’ period of performance BACKGROUND The Individuals with Disabilities Education Act (IDEA) is a cluster of federal programs(14) to assist states in providing children with disabilities a free, appropriate public education. Federal funding for IDEA is only available to the Department of Education (the department) and its subrecipients for a limited time (referred to as the grants’ period of performance).(15) Each year, the department receives grant award notifications for each award from the U.S. Department of Education outlining the award amounts and the period of performance (budget period).(16) The department has 15 months to charge expenditures to each grant award; however, IDEA is governed by the requirements of the Tydings Amendment,(17) which extends the period of performance 12 additional months, for a total of 27 months. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 344, the department must liquidate all financial obligations incurred under the federal award within 120 days of the end of the period of performance. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management reimbursed local educational agencies for expenditures and incurred administrative expenditures outside of the grants’ period of performance and that internal controls were not effective in ensuring compliance with the grants’ period of performance. Management concurred with the prior finding and stated they would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls implemented, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. In response to the prior audit finding, department management created period of performance operating procedures, implemented professional development for staff, and updated the annual risk assessment. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the IDEA grants for the fiscal year ending June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates for each grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis of payroll expenditures for fiscal year 2024, totaling $5,011,056, we found that department management charged payroll expenditures to the IDEA grant award H027A210052 that were obligated after the grant’s period of performance, resulting in of $40,314 in known questioned costs. In addition, based on our analysis, we identified 1,028 IDEA grant expenditures totaling $15,091,866 occurring on or after July 1, 2023. We tested a nonstatistical, random sample of 60 of these expenditure transactions, totaling $9,970,590, to determine if the transactions were obligated within the applicable grant’s period of performance. Based on our testwork, we found that for 4 of 60 (7%) expenditure transactions tested, department management paid expenses, totaling $22,675, for IDEA grant award H173A210095 and $41 for IDEA grant award H027A210052 that were obligated after the grants’ periods of performance. These errors resulted in $22,716 in known questioned costs and $34,385 in likely questioned costs. Table 2 summarizes the questioned costs for this issue. See Schedule of Findings and Questioned Costs for table. Management explained that insufficient training and a lack of instruction from management, along with employee turnover and staffing challenges, caused department staff to mistakenly approve expenditures that were obligated after the grant’s period of performance. According to management, program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment. Additionally, according to department management, between October 1 and January 30 of each year, the department reviews all LEA reimbursement requests to determine if the reimbursement request is charged to a grant that ended on September 30 of that year. If so, the department contacts the LEA to determine if the reimbursement request contains any expenditures that occurred after September 30. For those expenditures that occurred after September 30, the department sends the reimbursement request back to the LEA to remove those expenditures. If the reimbursement request contains no expenditures that occurred after September 30, the department approves the request and processes it for payment. Even though department management stated they had controls in place, we found that, due to the volume of transactions included in the manual review, the controls were not effective to ensure compliance with the period of performance requirement. As a result, the department paid administrative expenses and reimbursed LEAs for costs that occurred outside the authorized period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance requirement and identified reviewing charges to federal grants and training staff as controls to mitigate the risk. However, based on the results of our review, staff’s review and training were not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. According to the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 7.09, “Response to Risk,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that the funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines that the state agency cannot remedy its noncompliance through the actions above, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should refine their current control procedures, including utilizing data analytics tools to assist in evaluating the large number of reimbursements and administrative expenditures and training staff, to ensure that expenditures occurred during the grant award’s period of performance. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-009 Assistance Listing Number 84.027 and 84.173 Program Name Special Education Cluster (IDEA) Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-010 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.027 Federal Award Identification Number H027A210052 Amount $40,355 Assistance Listing Number 84.173 Federal Award Identification Number H173A210095 Amount $22,675 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures and reimbursed local educational agencies for expenditures that occurred outside of the Special Education Cluster Program grants’ period of performance BACKGROUND The Individuals with Disabilities Education Act (IDEA) is a cluster of federal programs(14) to assist states in providing children with disabilities a free, appropriate public education. Federal funding for IDEA is only available to the Department of Education (the department) and its subrecipients for a limited time (referred to as the grants’ period of performance).(15) Each year, the department receives grant award notifications for each award from the U.S. Department of Education outlining the award amounts and the period of performance (budget period).(16) The department has 15 months to charge expenditures to each grant award; however, IDEA is governed by the requirements of the Tydings Amendment,(17) which extends the period of performance 12 additional months, for a total of 27 months. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 344, the department must liquidate all financial obligations incurred under the federal award within 120 days of the end of the period of performance. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management reimbursed local educational agencies for expenditures and incurred administrative expenditures outside of the grants’ period of performance and that internal controls were not effective in ensuring compliance with the grants’ period of performance. Management concurred with the prior finding and stated they would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls implemented, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. In response to the prior audit finding, department management created period of performance operating procedures, implemented professional development for staff, and updated the annual risk assessment. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the IDEA grants for the fiscal year ending June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates for each grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis of payroll expenditures for fiscal year 2024, totaling $5,011,056, we found that department management charged payroll expenditures to the IDEA grant award H027A210052 that were obligated after the grant’s period of performance, resulting in of $40,314 in known questioned costs. In addition, based on our analysis, we identified 1,028 IDEA grant expenditures totaling $15,091,866 occurring on or after July 1, 2023. We tested a nonstatistical, random sample of 60 of these expenditure transactions, totaling $9,970,590, to determine if the transactions were obligated within the applicable grant’s period of performance. Based on our testwork, we found that for 4 of 60 (7%) expenditure transactions tested, department management paid expenses, totaling $22,675, for IDEA grant award H173A210095 and $41 for IDEA grant award H027A210052 that were obligated after the grants’ periods of performance. These errors resulted in $22,716 in known questioned costs and $34,385 in likely questioned costs. Table 2 summarizes the questioned costs for this issue. See Schedule of Findings and Questioned Costs for table. Management explained that insufficient training and a lack of instruction from management, along with employee turnover and staffing challenges, caused department staff to mistakenly approve expenditures that were obligated after the grant’s period of performance. According to management, program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment. Additionally, according to department management, between October 1 and January 30 of each year, the department reviews all LEA reimbursement requests to determine if the reimbursement request is charged to a grant that ended on September 30 of that year. If so, the department contacts the LEA to determine if the reimbursement request contains any expenditures that occurred after September 30. For those expenditures that occurred after September 30, the department sends the reimbursement request back to the LEA to remove those expenditures. If the reimbursement request contains no expenditures that occurred after September 30, the department approves the request and processes it for payment. Even though department management stated they had controls in place, we found that, due to the volume of transactions included in the manual review, the controls were not effective to ensure compliance with the period of performance requirement. As a result, the department paid administrative expenses and reimbursed LEAs for costs that occurred outside the authorized period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance requirement and identified reviewing charges to federal grants and training staff as controls to mitigate the risk. However, based on the results of our review, staff’s review and training were not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. According to the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 7.09, “Response to Risk,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that the funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines that the state agency cannot remedy its noncompliance through the actions above, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should refine their current control procedures, including utilizing data analytics tools to assist in evaluating the large number of reimbursements and administrative expenditures and training staff, to ensure that expenditures occurred during the grant award’s period of performance. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-010 Assistance Listing Number 10.568 and 10.569 Program Name Food Distribution Cluster Federal Agency Department of Agriculture State Agency Department of Agriculture Federal Award Identification Number N/A Federal Award Year 2023 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Subrecipient Monitoring Special Tests and Provisions Repeat Finding 2023-026 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the three prior audits, the Tennessee Department of Agriculture did not have effective internal controls over household eligibility determinations and inventory at storage locations for the Emergency Food Assistance Program BACKGROUND The Department of Agriculture (the department), in partnership with the U.S. Department of Agriculture (USDA) and local organizations, operates the Emergency Food Assistance Program (food program) to provide emergency food assistance to low-income households. USDA purchases a variety of food items and makes them available to state distributing agencies. During our audit period, the department contracted with 22 subrecipients(18) to administer the program. See Schedule of Findings and Questioned Costs for footnote. Food Inventory The department places food orders with USDA on behalf of the subrecipients, and USDA delivers the food directly to the subrecipients’ warehouses. USDA Policy FD-107 requires subrecipients to manage the inventory in their warehouses by tracking food receipts and food distributions, performing a physical food inventory count at least annually, and documenting adjustments to food inventory records, such as losses due to spoilage. Individual Eligibility The 22 subrecipients work with local partner agencies, such as soup kitchens and food pantries, to directly serve the public. Because partner agencies directly serve the public, they are responsible for determining the eligibility of individuals to receive food, either before or on the date of distribution, and maintaining supporting documentation. To qualify, an individual must be a resident of the State of Tennessee and may 1. show participation in a means-tested program such as the Supplemental Nutrition Assistance Program (food stamps), Families First, Supplemental Security Income, or Low-Income Home Energy Assistance Program; or 2. complete a signed self-declaration of income showing that the total amount of household income is below 185% of the current federal poverty income level. The department conducted desk reviews during our audit period to determine whether each subrecipient had a process to ensure compliance with both inventory and individual eligibility grant requirements. The desk reviews also ensured that subrecipients had a process to monitor partner agencies for compliance with these same requirements. Department management plans to schedule on-site monitoring of subrecipients in January 2025. We will audit the on-site monitoring activities in future audits. PRIOR AUDIT RESULTS In years before 2021, the department performed on-site subrecipient reviews to determine if subrecipients were accurately determining household eligibility and managing the inventory according to federal requirements. According to management, they stopped performing these reviews of subrecipients in March 2020 due to the effects of the COVID-19 pandemic. Without a federal waiver to alleviate the impacts of the health emergency, management was required to either continue their established control activities or implement alternative controls to ensure subrecipients complied with the federal requirements. In the 2021 Single Audit, we noted that management did not have controls in place for household eligibility determinations and food inventory. In addition, we also found noncompliance related to maintaining accurate inventory records and performing an annual inventory. In response to this finding, management stated they would develop a desk-based review monitoring plan and obtain USDA approval for the new plan. During the 2022 Single Audit, we reported that the department did not monitor its subrecipients because management was waiting for USDA to approve the department’s new monitoring plan. This resulted in a repeat finding because department management still did not have controls in place for household eligibility determinations. We also identified subrecipient noncompliance related to not performing annual inventory counts and inaccurate inventory records. Management concurred and stated it would implement the USDA-approved monitoring plan in April 2023 and complete the monitoring by September 2023 to coincide with the end of the federal fiscal year. The plan included conducting desk reviews during the federal fiscal year 2023 to serve as a baseline for annual reviews of 25% of subrecipients in subsequent years. During the 2023 Single Audit, we again reported that management had neither resumed their previous control activity of on-site reviews nor implemented other control activities to ensure subrecipients reasonably complied with the federal regulations. We also identified instances of noncompliance due to inaccurate inventory records and failures to perform the required annual inventory. Management concurred and stated that they had delayed the implementation of on-site reviews, but they had conducted desk reviews of all 22 subrecipients as required by the new plan. CONDITION AND CAUSE Monitoring Activities As part of our follow-up on management’s corrective actions, we found that management conducted desk reviews of the 22 subrecipients’ self-reported information, but based on our review of subrecipient compliance, these desk reviews(19) were not effective and did not detect errors in inventory records, annual inventory counts, and individual eligibility determination, as detailed below. Specifically, the desk reviews did not include evidence to support the subrecipients’ monitoring of their partnering agencies, which is necessary to ensure that the subrecipients and their partnering agencies are complying with the requirements. We also performed our own compliance testwork and found noncompliance with inventory management and individual eligibility, as detailed below. See Schedule of Findings and Questioned Costs for footnote. Inventory Management and Household Eligibility Based on our current compliance testwork and discussions with department and subrecipient management, we found that subrecipients did not maintain accurate monthly food inventory records, and the subrecipients who contract with a distributor did not conduct the required annual inventory. We also found that one subrecipient’s partner agency distributed food to ineligible individuals. Inaccurate Inventory Records We randomly selected 3 of 22 (14%) subrecipients to determine compliance with federal regulations for inventory records. For each subrecipient tested, we randomly sampled three months(20) of monthly inventory reports for each subrecipient during our scope period (July 1, 2023, through June 30, 2024) and recalculated the reports based on receipt, distribution, and food loss adjustments. We noted discrepancies at 2 of the 3 subrecipient agencies we visited: • For 1 subrecipient, we noted inaccurate food records and food counts. For example, based on the most recent monthly inventory report completed before our visit, we expected to find 9,012 bags of dry pinto beans but instead counted 17,592. We also expected to see 7,992 cans of sliced potatoes and counted 13,632 cans. The agency could not provide documentation, such as invoices, to support the difference for either item. • The second subrecipient lacked distribution documentation to support the data reported to the department for the 3 months tested. See Schedule of Findings and Questioned Costs for footnote. Annual Inventory Not Performed In the prior audit, we noted that 5 subrecipients, which use a centralized distributor to receive and store commodities received from the USDA, did not perform the required annual inventory. We identified during follow-up interviews that department management has not ensured corrective action. Specifically, according to department management, they are still using the distributor, and these 5 subrecipients relied solely on the weekly inventory report provided by the distributor and still did not conduct an annual inventory or request tracking documents, such as bills of lading, receipts for received food, or documents showing food distributed to corroborate the amount reported on the food program’s monthly inventory report provided to the department. Individual Eligibility To determine compliance with individual eligibility requirements, we randomly selected and reviewed 14 partner agencies from the 5 food banks contracted with the department between January 1, 2024, and March 31, 2024. For 1 of the 14 partner agencies tested (7%), we determined that the partner agency distributed commodities to 65 of 1,094 (6%) individuals who did not meet eligibility requirements. Once we informed the department of these issues, department management discussed with the subrecipient the eligibility requirements that all partner agencies should follow. In response, the subrecipient plans to retrain this partner agency’s staff. Additionally, the subrecipient’s Program Director will create a list of allowable and prohibited actions to email to all other partner agencies. CRITERIA Inventory Management and Household Eligibility According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, according to 7 CFR 251.10(e), (1) Each State agency must monitor the operation of the program to ensure that it is being administered in accordance with Federal and State requirements. State agencies may not delegate this responsibility. . . . (3) Each [subrecipient monitoring] review must encompass, as applicable, eligibility determinations, food ordering procedures, storage and warehousing practices, inventory controls, approval of distribution sites, reporting and recordkeeping requirements, and civil rights. Additionally, according to 7 CFR 251.5(b) (b) Criteria for determining recipient eligibility. Each State agency must establish uniform Statewide criteria for determining the eligibility of households to receive commodities provided under this part for home consumption. The criteria must: (1) Enable the State agency to ensure that only households which are in need of food assistance because of inadequate household income receive [Emergency Food Assistance Program] commodities; (2) Include income-based standards and the methods by which households may demonstrate eligibility under such standards; and (3) Include a requirement that the household reside in the geographic location served by the State agency at the time of applying for assistance, but length of residency shall not be used as an eligibility criterion. EFFECT The lack of sufficient monitoring controls over inventory management and individual eligibility increases the risk of noncompliance with federal requirements and fraud, waste, and abuse in this federal program. Without sufficient monitoring, department management cannot reasonably ensure that subrecipients fulfill federal requirements and meet the goals of this federal program. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of the Department of Agriculture should ensure staff members have the resources to establish internal controls to ensure staff and subrecipients comply with inventory and eligibility requirements, including designing and implementing a subrecipient monitoring process to effectively address the risks noted in this finding. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT We concur. To ensure effective internal controls over household eligibility determinations and inventory at storage locations for The Emergency Food Assistance Program (TEFAP), the department added three (3) mitigating controls to the enterprise risk management assessment. The controls added are as follows: • Monitoring will include on site reviews to ensure compliance at sites included in the monitoring plan. • Monitoring tools have been developed and will be reviewed annually and revised as needed to ensure all requirements are captured including inventory and eligibility. • Commodities staff will ensure annual inventory is performed as required. Furthermore, we have a new Commodity Distribution Administrator who has developed a monitoring plan for FY25 based on risk assessment. Risk assessments have identified three (3) agencies for monitoring in FY25 which will be completed on site to ensure proper assessment of eligibility and inventory at these locations. Inventory Controls The department has begun observing inventory. In FY24, the new Commodity Distribution Administrator observed inventory at the Chattanooga Area Food Bank and Second Harvest Food Bank of Middle TN. We have a plan in place to observe inventory at all five (5) food banks for FY25. In addition to the on-site inventory observation, internal monthly inventory monitoring has been bolstered and reconciled month to month with our subrecipients. Currently, Eligible Recipient Agency’s (ERA) monthly inventory reports for the previous months are due by the 10th day of each following month. ERA’s beginning monthly inventory in their reports must match the previous month’s reports generated by USDA’s online management site, WBSCM. Each agency’s inventory is fully reconciled no later than the end of the month. For example, January’s inventory report is due by February 10. By the end of February, the month of January’s inventory for each agency is reconciled. Eligibility Controls/ERA Training TN Commodity Distribution has also revised our State Plan to include updated eligibility guidelines including updating language in the plan and revising the intake form. Once approved by USDA, action will be taken so each ERA has a copy of the new State Plan, updated intake form, and daily roster. With a new Commodities Administrator and new guidance published by the USDA, measures will be taken and formally documented to ensure ERA compliance from not only those with direct agreements with TDA, but also those who have contractual agreements with TDA’s ERA’s. These new measures will include trainings (schedule TBD) in the form of recorded PowerPoint presentations sent out to ERAs with a formal signature page of those individuals working for ERAs to sign off attesting they watched the video in full and agree to implement new guidance henceforth in their daily responsibilities. Trainings will be required for all ERA staff that are responsible for working with TEFAP. These records will be collected by a prescribed due date and followed up on during on-site monitoring reviews. Lastly, all agencies identified with deficiencies in the audit will be required to complete a Corrective Action Plan and submit to us within 30 business days of receipt of the request. The Commodity Distribution Administrator will be responsible for ensuring corrective actions are implemented by the anticipated completion date of September 30, 2025.

Finding Number 2024-010 Assistance Listing Number 10.568 and 10.569 Program Name Food Distribution Cluster Federal Agency Department of Agriculture State Agency Department of Agriculture Federal Award Identification Number N/A Federal Award Year 2023 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Subrecipient Monitoring Special Tests and Provisions Repeat Finding 2023-026 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the three prior audits, the Tennessee Department of Agriculture did not have effective internal controls over household eligibility determinations and inventory at storage locations for the Emergency Food Assistance Program BACKGROUND The Department of Agriculture (the department), in partnership with the U.S. Department of Agriculture (USDA) and local organizations, operates the Emergency Food Assistance Program (food program) to provide emergency food assistance to low-income households. USDA purchases a variety of food items and makes them available to state distributing agencies. During our audit period, the department contracted with 22 subrecipients(18) to administer the program. See Schedule of Findings and Questioned Costs for footnote. Food Inventory The department places food orders with USDA on behalf of the subrecipients, and USDA delivers the food directly to the subrecipients’ warehouses. USDA Policy FD-107 requires subrecipients to manage the inventory in their warehouses by tracking food receipts and food distributions, performing a physical food inventory count at least annually, and documenting adjustments to food inventory records, such as losses due to spoilage. Individual Eligibility The 22 subrecipients work with local partner agencies, such as soup kitchens and food pantries, to directly serve the public. Because partner agencies directly serve the public, they are responsible for determining the eligibility of individuals to receive food, either before or on the date of distribution, and maintaining supporting documentation. To qualify, an individual must be a resident of the State of Tennessee and may 1. show participation in a means-tested program such as the Supplemental Nutrition Assistance Program (food stamps), Families First, Supplemental Security Income, or Low-Income Home Energy Assistance Program; or 2. complete a signed self-declaration of income showing that the total amount of household income is below 185% of the current federal poverty income level. The department conducted desk reviews during our audit period to determine whether each subrecipient had a process to ensure compliance with both inventory and individual eligibility grant requirements. The desk reviews also ensured that subrecipients had a process to monitor partner agencies for compliance with these same requirements. Department management plans to schedule on-site monitoring of subrecipients in January 2025. We will audit the on-site monitoring activities in future audits. PRIOR AUDIT RESULTS In years before 2021, the department performed on-site subrecipient reviews to determine if subrecipients were accurately determining household eligibility and managing the inventory according to federal requirements. According to management, they stopped performing these reviews of subrecipients in March 2020 due to the effects of the COVID-19 pandemic. Without a federal waiver to alleviate the impacts of the health emergency, management was required to either continue their established control activities or implement alternative controls to ensure subrecipients complied with the federal requirements. In the 2021 Single Audit, we noted that management did not have controls in place for household eligibility determinations and food inventory. In addition, we also found noncompliance related to maintaining accurate inventory records and performing an annual inventory. In response to this finding, management stated they would develop a desk-based review monitoring plan and obtain USDA approval for the new plan. During the 2022 Single Audit, we reported that the department did not monitor its subrecipients because management was waiting for USDA to approve the department’s new monitoring plan. This resulted in a repeat finding because department management still did not have controls in place for household eligibility determinations. We also identified subrecipient noncompliance related to not performing annual inventory counts and inaccurate inventory records. Management concurred and stated it would implement the USDA-approved monitoring plan in April 2023 and complete the monitoring by September 2023 to coincide with the end of the federal fiscal year. The plan included conducting desk reviews during the federal fiscal year 2023 to serve as a baseline for annual reviews of 25% of subrecipients in subsequent years. During the 2023 Single Audit, we again reported that management had neither resumed their previous control activity of on-site reviews nor implemented other control activities to ensure subrecipients reasonably complied with the federal regulations. We also identified instances of noncompliance due to inaccurate inventory records and failures to perform the required annual inventory. Management concurred and stated that they had delayed the implementation of on-site reviews, but they had conducted desk reviews of all 22 subrecipients as required by the new plan. CONDITION AND CAUSE Monitoring Activities As part of our follow-up on management’s corrective actions, we found that management conducted desk reviews of the 22 subrecipients’ self-reported information, but based on our review of subrecipient compliance, these desk reviews(19) were not effective and did not detect errors in inventory records, annual inventory counts, and individual eligibility determination, as detailed below. Specifically, the desk reviews did not include evidence to support the subrecipients’ monitoring of their partnering agencies, which is necessary to ensure that the subrecipients and their partnering agencies are complying with the requirements. We also performed our own compliance testwork and found noncompliance with inventory management and individual eligibility, as detailed below. See Schedule of Findings and Questioned Costs for footnote. Inventory Management and Household Eligibility Based on our current compliance testwork and discussions with department and subrecipient management, we found that subrecipients did not maintain accurate monthly food inventory records, and the subrecipients who contract with a distributor did not conduct the required annual inventory. We also found that one subrecipient’s partner agency distributed food to ineligible individuals. Inaccurate Inventory Records We randomly selected 3 of 22 (14%) subrecipients to determine compliance with federal regulations for inventory records. For each subrecipient tested, we randomly sampled three months(20) of monthly inventory reports for each subrecipient during our scope period (July 1, 2023, through June 30, 2024) and recalculated the reports based on receipt, distribution, and food loss adjustments. We noted discrepancies at 2 of the 3 subrecipient agencies we visited: • For 1 subrecipient, we noted inaccurate food records and food counts. For example, based on the most recent monthly inventory report completed before our visit, we expected to find 9,012 bags of dry pinto beans but instead counted 17,592. We also expected to see 7,992 cans of sliced potatoes and counted 13,632 cans. The agency could not provide documentation, such as invoices, to support the difference for either item. • The second subrecipient lacked distribution documentation to support the data reported to the department for the 3 months tested. See Schedule of Findings and Questioned Costs for footnote. Annual Inventory Not Performed In the prior audit, we noted that 5 subrecipients, which use a centralized distributor to receive and store commodities received from the USDA, did not perform the required annual inventory. We identified during follow-up interviews that department management has not ensured corrective action. Specifically, according to department management, they are still using the distributor, and these 5 subrecipients relied solely on the weekly inventory report provided by the distributor and still did not conduct an annual inventory or request tracking documents, such as bills of lading, receipts for received food, or documents showing food distributed to corroborate the amount reported on the food program’s monthly inventory report provided to the department. Individual Eligibility To determine compliance with individual eligibility requirements, we randomly selected and reviewed 14 partner agencies from the 5 food banks contracted with the department between January 1, 2024, and March 31, 2024. For 1 of the 14 partner agencies tested (7%), we determined that the partner agency distributed commodities to 65 of 1,094 (6%) individuals who did not meet eligibility requirements. Once we informed the department of these issues, department management discussed with the subrecipient the eligibility requirements that all partner agencies should follow. In response, the subrecipient plans to retrain this partner agency’s staff. Additionally, the subrecipient’s Program Director will create a list of allowable and prohibited actions to email to all other partner agencies. CRITERIA Inventory Management and Household Eligibility According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, according to 7 CFR 251.10(e), (1) Each State agency must monitor the operation of the program to ensure that it is being administered in accordance with Federal and State requirements. State agencies may not delegate this responsibility. . . . (3) Each [subrecipient monitoring] review must encompass, as applicable, eligibility determinations, food ordering procedures, storage and warehousing practices, inventory controls, approval of distribution sites, reporting and recordkeeping requirements, and civil rights. Additionally, according to 7 CFR 251.5(b) (b) Criteria for determining recipient eligibility. Each State agency must establish uniform Statewide criteria for determining the eligibility of households to receive commodities provided under this part for home consumption. The criteria must: (1) Enable the State agency to ensure that only households which are in need of food assistance because of inadequate household income receive [Emergency Food Assistance Program] commodities; (2) Include income-based standards and the methods by which households may demonstrate eligibility under such standards; and (3) Include a requirement that the household reside in the geographic location served by the State agency at the time of applying for assistance, but length of residency shall not be used as an eligibility criterion. EFFECT The lack of sufficient monitoring controls over inventory management and individual eligibility increases the risk of noncompliance with federal requirements and fraud, waste, and abuse in this federal program. Without sufficient monitoring, department management cannot reasonably ensure that subrecipients fulfill federal requirements and meet the goals of this federal program. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of the Department of Agriculture should ensure staff members have the resources to establish internal controls to ensure staff and subrecipients comply with inventory and eligibility requirements, including designing and implementing a subrecipient monitoring process to effectively address the risks noted in this finding. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT We concur. To ensure effective internal controls over household eligibility determinations and inventory at storage locations for The Emergency Food Assistance Program (TEFAP), the department added three (3) mitigating controls to the enterprise risk management assessment. The controls added are as follows: • Monitoring will include on site reviews to ensure compliance at sites included in the monitoring plan. • Monitoring tools have been developed and will be reviewed annually and revised as needed to ensure all requirements are captured including inventory and eligibility. • Commodities staff will ensure annual inventory is performed as required. Furthermore, we have a new Commodity Distribution Administrator who has developed a monitoring plan for FY25 based on risk assessment. Risk assessments have identified three (3) agencies for monitoring in FY25 which will be completed on site to ensure proper assessment of eligibility and inventory at these locations. Inventory Controls The department has begun observing inventory. In FY24, the new Commodity Distribution Administrator observed inventory at the Chattanooga Area Food Bank and Second Harvest Food Bank of Middle TN. We have a plan in place to observe inventory at all five (5) food banks for FY25. In addition to the on-site inventory observation, internal monthly inventory monitoring has been bolstered and reconciled month to month with our subrecipients. Currently, Eligible Recipient Agency’s (ERA) monthly inventory reports for the previous months are due by the 10th day of each following month. ERA’s beginning monthly inventory in their reports must match the previous month’s reports generated by USDA’s online management site, WBSCM. Each agency’s inventory is fully reconciled no later than the end of the month. For example, January’s inventory report is due by February 10. By the end of February, the month of January’s inventory for each agency is reconciled. Eligibility Controls/ERA Training TN Commodity Distribution has also revised our State Plan to include updated eligibility guidelines including updating language in the plan and revising the intake form. Once approved by USDA, action will be taken so each ERA has a copy of the new State Plan, updated intake form, and daily roster. With a new Commodities Administrator and new guidance published by the USDA, measures will be taken and formally documented to ensure ERA compliance from not only those with direct agreements with TDA, but also those who have contractual agreements with TDA’s ERA’s. These new measures will include trainings (schedule TBD) in the form of recorded PowerPoint presentations sent out to ERAs with a formal signature page of those individuals working for ERAs to sign off attesting they watched the video in full and agree to implement new guidance henceforth in their daily responsibilities. Trainings will be required for all ERA staff that are responsible for working with TEFAP. These records will be collected by a prescribed due date and followed up on during on-site monitoring reviews. Lastly, all agencies identified with deficiencies in the audit will be required to complete a Corrective Action Plan and submit to us within 30 business days of receipt of the request. The Commodity Distribution Administrator will be responsible for ensuring corrective actions are implemented by the anticipated completion date of September 30, 2025.

Finding Number 2024-011 Assistance Listing Number 93.917 Program Name HIV Care Formula Grants Federal Agency Department of Health and Human Services State Agency Department of Health Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Health does not have adequate procedures to ensure compliance with subrecipient monitoring requirements for the HIV Care Formula Grants program BACKGROUND The Department of Health as a pass-through entity administers the HIV Care Formula Grants program (HIV Program) and provides subawards to 20 subrecipients to plan, develop, and deliver healthcare and support services to low-income, uninsured, and underinsured individuals with Human Immunodeficiency Virus (HIV). Federal grantors require pass-through entities to monitor subrecipients’ activities to ensure subrecipients use grant funds for authorized purposes in compliance with statutes, regulations, and any applicable grant terms and conditions. Pass-through entity responsibilities include review of subrecipient single audit reports and the issuance of management decisions for findings related to the federal awards provided by the pass-through entity. Title 2, Code of Federal Regulations (CFR), Part 200, Section 1, states that management decisions are written determinations provided to the subrecipient by the pass-through entity of the sufficiency of the subrecipient’s proposed corrective actions to address the findings. CONDITION Management did not issue a management decision as required for one subrecipient that had a finding pertaining to the HIV program within the required timeframe. The other 19 of the program’s 20 subrecipients either did not require a single audit or the audit performed did not have a finding pertaining to the HIV program. The subrecipient’s single audit report that required the management decision was accepted by the Federal Audit Clearinghouse (FAC) on August 3, 2023; therefore, the department was required to issue a management decision by February 3, 2024. CRITERIA As a pass-through entity, the department is required by 2 CFR 200. 332(d) to Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. . . Pass through entity monitoring of the subrecipient must include . . . (3) Issuing a management decision for applicable audit findings. . . According to 2 CFR 200.521(d), the “. . . pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. . . .” CAUSE According to discussions with department management, a management decision related to the subrecipient’s audit finding was not issued due to the loss of key personnel and lack of communication between divisions. Subrecipient monitoring responsibilities for the HIV program are divided between various divisions, and there was a breakdown in communication between the divisions to ensure all subrecipient monitoring requirements were performed. Additionally, per management, the division does not have written procedures clearly assigning duties related to the verification of single audits and issuance of management decisions to specific personnel. EFFECT When management does not issue a decision within the required timeframe, management increases the risk that subrecipients will not correct problems related to internal controls or compliance with regulations in a timely manner. RECOMMENDATION Management should ensure subrecipient monitoring policies clearly assign responsibility of reviewing subrecipient single audit reports and issuing management decisions in a timely manner to specific personnel. MANAGEMENT’S COMMENT We concur with this finding. Tennessee Department of Health practice guided by written memorandum, Subject: Single Audit Requirements and Subrecipient Grant Contract Language, May 8, 2019, provides guidance for the following processes: 1.) Grant contract language stipulates that subrecipients meeting OMB 2 CFR 200. 332(d) criteria should engage a single audit and send a co+B3py to TDH at the same time they send a copy to the Federal Clearing House. 2.) TDH staff should review and evaluate the findings and corrective actions and communicate with the grantee within 30 days of receipt of the single audit report. 3.) Receipt of grantees’ reports and the program’s responses should be communicated to the TDH Office of Compliance and Ethics. Corrective action: CEDEP program and administrative staff working with HIV contracts will be retrained on these requirements by the HIV and Business and Grants Management section leaders. Current contracts will be reviewed to ensure inclusion of audit guidance. Ryan White Program Director and/or Deputy Director will be responsible to issue a management decision within thirty (30) days related to each audit finding from all auditable subrecipients’ reports. Retraining, contracts review, and process implementation will occur no later than March 31, 2025.

Finding Number 2024-011 Assistance Listing Number 93.917 Program Name HIV Care Formula Grants Federal Agency Department of Health and Human Services State Agency Department of Health Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Health does not have adequate procedures to ensure compliance with subrecipient monitoring requirements for the HIV Care Formula Grants program BACKGROUND The Department of Health as a pass-through entity administers the HIV Care Formula Grants program (HIV Program) and provides subawards to 20 subrecipients to plan, develop, and deliver healthcare and support services to low-income, uninsured, and underinsured individuals with Human Immunodeficiency Virus (HIV). Federal grantors require pass-through entities to monitor subrecipients’ activities to ensure subrecipients use grant funds for authorized purposes in compliance with statutes, regulations, and any applicable grant terms and conditions. Pass-through entity responsibilities include review of subrecipient single audit reports and the issuance of management decisions for findings related to the federal awards provided by the pass-through entity. Title 2, Code of Federal Regulations (CFR), Part 200, Section 1, states that management decisions are written determinations provided to the subrecipient by the pass-through entity of the sufficiency of the subrecipient’s proposed corrective actions to address the findings. CONDITION Management did not issue a management decision as required for one subrecipient that had a finding pertaining to the HIV program within the required timeframe. The other 19 of the program’s 20 subrecipients either did not require a single audit or the audit performed did not have a finding pertaining to the HIV program. The subrecipient’s single audit report that required the management decision was accepted by the Federal Audit Clearinghouse (FAC) on August 3, 2023; therefore, the department was required to issue a management decision by February 3, 2024. CRITERIA As a pass-through entity, the department is required by 2 CFR 200. 332(d) to Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. . . Pass through entity monitoring of the subrecipient must include . . . (3) Issuing a management decision for applicable audit findings. . . According to 2 CFR 200.521(d), the “. . . pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. . . .” CAUSE According to discussions with department management, a management decision related to the subrecipient’s audit finding was not issued due to the loss of key personnel and lack of communication between divisions. Subrecipient monitoring responsibilities for the HIV program are divided between various divisions, and there was a breakdown in communication between the divisions to ensure all subrecipient monitoring requirements were performed. Additionally, per management, the division does not have written procedures clearly assigning duties related to the verification of single audits and issuance of management decisions to specific personnel. EFFECT When management does not issue a decision within the required timeframe, management increases the risk that subrecipients will not correct problems related to internal controls or compliance with regulations in a timely manner. RECOMMENDATION Management should ensure subrecipient monitoring policies clearly assign responsibility of reviewing subrecipient single audit reports and issuing management decisions in a timely manner to specific personnel. MANAGEMENT’S COMMENT We concur with this finding. Tennessee Department of Health practice guided by written memorandum, Subject: Single Audit Requirements and Subrecipient Grant Contract Language, May 8, 2019, provides guidance for the following processes: 1.) Grant contract language stipulates that subrecipients meeting OMB 2 CFR 200. 332(d) criteria should engage a single audit and send a co+B3py to TDH at the same time they send a copy to the Federal Clearing House. 2.) TDH staff should review and evaluate the findings and corrective actions and communicate with the grantee within 30 days of receipt of the single audit report. 3.) Receipt of grantees’ reports and the program’s responses should be communicated to the TDH Office of Compliance and Ethics. Corrective action: CEDEP program and administrative staff working with HIV contracts will be retrained on these requirements by the HIV and Business and Grants Management section leaders. Current contracts will be reviewed to ensure inclusion of audit guidance. Ryan White Program Director and/or Deputy Director will be responsible to issue a management decision within thirty (30) days related to each audit finding from all auditable subrecipients’ reports. Retraining, contracts review, and process implementation will occur no later than March 31, 2025.

Finding Number 2024-012 Assistance Listing Number 93.568 Program Name Low-Income Home Energy Assistance Federal Agency Department of Health and Human Services State Agency Tennessee Housing Development Agency Federal Award Identification Number N/A Federal Award Year 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Reporting Repeat Finding 2023-019 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior year, Tennessee Housing Development Agency management did not have effective internal controls over reporting for the Low-Income Home Energy Assistance Program BACKGROUND The U.S. Department of Health and Human Services (HHS) provides grant funding through the Low-Income Home Energy Assistance Program (LIHEAP) to the Tennessee Housing Development Agency (the agency). The objective of LIHEAP is to help low-income households meet the costs of home energy, increase their energy self-sufficiency, and reduce their vulnerability resulting from energy needs. As a condition of the grant, HHS requires the agency to report on the use of federal funds through financial, performance, and special reports. In addition to federal requirements in the Code of Federal Regulations, the HHS Office of Administration for Children and Families, Office of Community Services (OCS), provides guidance to LIHEAP recipients by issuing Action Transmittals. In response to the prior-year finding noting ineffective controls over reporting, management stated that they would implement a schedule of report due dates, along with periodic checkpoints between the preparer and the supervisor to address issues prior to the due dates. Management also stated that each federal report would be reviewed by a supervisor prior to its submission to confirm its accuracy. The supervisor position was vacant until November 2023. Although management implemented additional controls when the supervisor position was filled, controls were not adequate to ensure reports were submitted timely or accurately. CONDITION, CRITERIA, AND CAUSE As noted in the prior year, the agency did not have adequate internal controls to ensure it provided the federal grantor (HHS) with timely or accurate reports. The vacant supervisor position was the primary cause for the special and performance reporting deficiencies. THDA also did not assign a secondary reviewer to ensure the reporting was accurate prior to submission. Special Reporting Annual Report on Households Assisted by LIHEAP According to Title 45, Code of Federal Regulations (CFR), Part 96, Section 82(a), the agency is required to submit to HHS the Annual Report on Households Assisted by LIHEAP “for the 12-month period corresponding to the federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance.” We reviewed the 2023 Annual Report on Households Assisted by LIHEAP to ensure management submitted the report timely and reported line items accurately. We noted errors on two line items on the report. See Schedule of Findings and Questioned Costs for table. Quarterly Performance and Management Report LIHEAP Action Transmittal 2023-03 Quarterly Report Instructions Attachment 1 requires grant recipients to submit data and information about LIHEAP through the Quarterly Performance and Management Reports. The quarterly reports “focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility assistance programs, and training and technical assistance needs.” We reviewed the 2023 Quarterly Performance and Management Report for the fourth quarter of the fiscal year to ensure management submitted the report timely and reported line items accurately. We noted that the report was submitted on November 27, 2023, 27 days after the due date of October 31, 2023. FFATA Reporting The Federal Funding Accountability and Transparency Act (FFATA) and 2 CFR 170, Appendix A, require the agency to report subrecipient financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. Reports are due no later than the end of the month following the month when the obligation occurred. The subaward information in FSRS is then made available to the public on USAspending.gov for transparency. We reviewed FSRS to determine the agency’s compliance with FFATA reporting. Based on our review of the system and discussion with management, management did not report any of their 21 subawards within the required timeframe. Management stated that they are working to improve the reporting process. Performance Reporting LIHEAP Action Transmittal 2024-01 states that the LIHEAP Performance Data Form is an annual report in response to Title 42, United States Code, Section 8629(b), which requires the Secretary of the HHS to submit a report to Congress containing a detailed compilation of information on home energy consumption; the amount, cost, and type of fuels used for households eligible for assistance; the number and income levels of households assisted; and the number of households that received such assistance and include 1 or more individuals who are 60 years or older or disabled or include young children. We reviewed the LIHEAP Performance Data Form to ensure management submitted the report timely and reported line items accurately. We noted errors on two line items in the report. See Schedule of Findings and Questioned Costs for table. EFFECT When agency staff do not proactively perform procedures to ensure that reports generated are timely and adequately supported, management increases the risk of reporting inaccurate or untimely data to HHS. For the Quarterly Performance and Management Report, when obligations are understated, management runs the risk of obligating more funds than are available. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional program monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should continue to improve the reporting process by implementing additional controls, as necessary, to ensure timely and accurate reports. MANAGEMENT’S COMMENT We concur. Regarding the Annual Report on Households Assisted by LIHEAP the original submission did not include the Weatherization information and "any type" was under reported. After the new CS Director reviewed and gained some understanding of the report and data used to complete the report, the CS Director reached out to Apprise, Inc. - the data consultants for HHS, ACF - and met with an associate to gain a better understanding of where the errors where and how to correct them. Following this call, the CS Director was able to correct the original submission and gain clearance on the report. Regarding Quarterly Performance and Management Report for 2023, the Quarter 4 report was submitted late. During this period, the Community Services Division had vacancies in both the Director and LIHEAP Manager position requiring other staff to learn and handle the report preparation while also handling their main job functions. Both positions are now filled and a new obligation tracking document has been adopted and a new reporting deadline process put in place to ensure that a reporting preparation, multi-level review and submission process is complete in advance of any reporting deadline. FFATA Reporting continued to be a challenge in 2024, but a new process was adopted by the CS Division and implemented on January 1, 2025 that requires each manager to maintain a monthly FFATA tracking document. As contracts are executed and funding is obligated by our Legal team, a copy of the final contract is sent to the manager and for entry into the tracking document. The Finance team then accesses the tracking document monthly for entry into the federal system. Finally, the LIHEAP Performance Data report was submitted shortly after the CS Director began employment. Although the report was submitted on time, there were errors on the report that were later corrected with the assistance of Apprise, Inc. We do not anticipate the same issues with the 2024 LIHEAP Performance Data report. Overall, the CS Division is working to strengthen internal processes and ensure timeliness of reporting. The CS Director and managers work closely to develop new processes that will bring efficiency to the process and strengthen accuracy.

Finding Number 2024-012 Assistance Listing Number 93.568 Program Name Low-Income Home Energy Assistance Federal Agency Department of Health and Human Services State Agency Tennessee Housing Development Agency Federal Award Identification Number N/A Federal Award Year 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Reporting Repeat Finding 2023-019 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior year, Tennessee Housing Development Agency management did not have effective internal controls over reporting for the Low-Income Home Energy Assistance Program BACKGROUND The U.S. Department of Health and Human Services (HHS) provides grant funding through the Low-Income Home Energy Assistance Program (LIHEAP) to the Tennessee Housing Development Agency (the agency). The objective of LIHEAP is to help low-income households meet the costs of home energy, increase their energy self-sufficiency, and reduce their vulnerability resulting from energy needs. As a condition of the grant, HHS requires the agency to report on the use of federal funds through financial, performance, and special reports. In addition to federal requirements in the Code of Federal Regulations, the HHS Office of Administration for Children and Families, Office of Community Services (OCS), provides guidance to LIHEAP recipients by issuing Action Transmittals. In response to the prior-year finding noting ineffective controls over reporting, management stated that they would implement a schedule of report due dates, along with periodic checkpoints between the preparer and the supervisor to address issues prior to the due dates. Management also stated that each federal report would be reviewed by a supervisor prior to its submission to confirm its accuracy. The supervisor position was vacant until November 2023. Although management implemented additional controls when the supervisor position was filled, controls were not adequate to ensure reports were submitted timely or accurately. CONDITION, CRITERIA, AND CAUSE As noted in the prior year, the agency did not have adequate internal controls to ensure it provided the federal grantor (HHS) with timely or accurate reports. The vacant supervisor position was the primary cause for the special and performance reporting deficiencies. THDA also did not assign a secondary reviewer to ensure the reporting was accurate prior to submission. Special Reporting Annual Report on Households Assisted by LIHEAP According to Title 45, Code of Federal Regulations (CFR), Part 96, Section 82(a), the agency is required to submit to HHS the Annual Report on Households Assisted by LIHEAP “for the 12-month period corresponding to the federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance.” We reviewed the 2023 Annual Report on Households Assisted by LIHEAP to ensure management submitted the report timely and reported line items accurately. We noted errors on two line items on the report. See Schedule of Findings and Questioned Costs for table. Quarterly Performance and Management Report LIHEAP Action Transmittal 2023-03 Quarterly Report Instructions Attachment 1 requires grant recipients to submit data and information about LIHEAP through the Quarterly Performance and Management Reports. The quarterly reports “focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility assistance programs, and training and technical assistance needs.” We reviewed the 2023 Quarterly Performance and Management Report for the fourth quarter of the fiscal year to ensure management submitted the report timely and reported line items accurately. We noted that the report was submitted on November 27, 2023, 27 days after the due date of October 31, 2023. FFATA Reporting The Federal Funding Accountability and Transparency Act (FFATA) and 2 CFR 170, Appendix A, require the agency to report subrecipient financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. Reports are due no later than the end of the month following the month when the obligation occurred. The subaward information in FSRS is then made available to the public on USAspending.gov for transparency. We reviewed FSRS to determine the agency’s compliance with FFATA reporting. Based on our review of the system and discussion with management, management did not report any of their 21 subawards within the required timeframe. Management stated that they are working to improve the reporting process. Performance Reporting LIHEAP Action Transmittal 2024-01 states that the LIHEAP Performance Data Form is an annual report in response to Title 42, United States Code, Section 8629(b), which requires the Secretary of the HHS to submit a report to Congress containing a detailed compilation of information on home energy consumption; the amount, cost, and type of fuels used for households eligible for assistance; the number and income levels of households assisted; and the number of households that received such assistance and include 1 or more individuals who are 60 years or older or disabled or include young children. We reviewed the LIHEAP Performance Data Form to ensure management submitted the report timely and reported line items accurately. We noted errors on two line items in the report. See Schedule of Findings and Questioned Costs for table. EFFECT When agency staff do not proactively perform procedures to ensure that reports generated are timely and adequately supported, management increases the risk of reporting inaccurate or untimely data to HHS. For the Quarterly Performance and Management Report, when obligations are understated, management runs the risk of obligating more funds than are available. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional program monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should continue to improve the reporting process by implementing additional controls, as necessary, to ensure timely and accurate reports. MANAGEMENT’S COMMENT We concur. Regarding the Annual Report on Households Assisted by LIHEAP the original submission did not include the Weatherization information and "any type" was under reported. After the new CS Director reviewed and gained some understanding of the report and data used to complete the report, the CS Director reached out to Apprise, Inc. - the data consultants for HHS, ACF - and met with an associate to gain a better understanding of where the errors where and how to correct them. Following this call, the CS Director was able to correct the original submission and gain clearance on the report. Regarding Quarterly Performance and Management Report for 2023, the Quarter 4 report was submitted late. During this period, the Community Services Division had vacancies in both the Director and LIHEAP Manager position requiring other staff to learn and handle the report preparation while also handling their main job functions. Both positions are now filled and a new obligation tracking document has been adopted and a new reporting deadline process put in place to ensure that a reporting preparation, multi-level review and submission process is complete in advance of any reporting deadline. FFATA Reporting continued to be a challenge in 2024, but a new process was adopted by the CS Division and implemented on January 1, 2025 that requires each manager to maintain a monthly FFATA tracking document. As contracts are executed and funding is obligated by our Legal team, a copy of the final contract is sent to the manager and for entry into the tracking document. The Finance team then accesses the tracking document monthly for entry into the federal system. Finally, the LIHEAP Performance Data report was submitted shortly after the CS Director began employment. Although the report was submitted on time, there were errors on the report that were later corrected with the assistance of Apprise, Inc. We do not anticipate the same issues with the 2024 LIHEAP Performance Data report. Overall, the CS Division is working to strengthen internal processes and ensure timeliness of reporting. The CS Director and managers work closely to develop new processes that will bring efficiency to the process and strengthen accuracy.

Finding Number 2024-013 Assistance Listing Number 10.558 Program Name Child and Adult Care Food Program Federal Agency Department of Agriculture State Agency Department of Human Services Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Human Services did not establish effective internal controls to ensure the management and monitors properly documented subrecipient monitoring activities BACKGROUND The Child and Adult Care Food Program (CACFP) is a year-round food program for eligible participants at childcare centers, day care homes, after-school care programs, emergency shelters, and adult day care centers. CACFP is funded by the U.S. Department of Agriculture (USDA) and administered on the state level by the Department of Human Services (DHS). DHS contracts with these institutions, called subrecipients, who administer the program by providing meals. As a pass-through entity, DHS is responsible for ensuring that subrecipients are eligible to participate in the program and that the subrecipients comply with federal requirements. State Agency Monitoring Requirements To fulfill the federal monitoring requirements outlined in the USDA’s Monitoring Handbook for State Agencies: A Child and Adult Care Food Care Program Handbook (CACFP Monitoring Handbook), the department’s Division of Audit Services (division) is responsible for performing regular monitoring visits of participating subrecipients approximately every three years. If department management identified or became aware of problems related to a subrecipient, the division monitors the subrecipient more frequently. These visits occur during the award period and cover three components of monitoring: • ensuring subrecipients comply with federal program requirements; • ensuring subrecipients that receive $750,000 or more in federal awards receive a single audit as required by federal regulations; and • following up on previously reported issues. To document subrecipient monitoring work, division staff use Diligent, a third-party electronic audit management application. Within Diligent, Audit Services management requires working papers have three levels of documented review to ensure the work performed supports the monitoring report. Subrecipient Single Audit Requirements Pursuant to the Office of Management and Budget’s Uniform Grant Guidance and “Audit Requirements,” Title 2, Code of Federal Regulations (CFR), Part 200, Section 501, (a) Audit required.(21) A non-Federal entity [subrecipient] that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. See Schedule of Findings and Questioned Costs for footnote. Furthermore, as the pass-through entity, DHS is required by 2 CFR 200.332(f) to verify that all subrecipients that spend $750,000 or more obtain a single audit within 9 months after the subrecipient’s fiscal year-end. As part of that single audit, if a subrecipient receives an audit finding, the department must issue a management decision within six months of the audit report’s release, indicate if the department agreed with the finding, and describe any corrective action the subrecipient must take. Based on discussions with the Division of Audit Services’ management, division staff compiles subrecipient expenditure information from Edison, the state’s accounting system, to determine if the subrecipient received over $750,000 in federal funds. Once management identifies the subrecipients who meet the audit threshold, the Director of Audit Services creates a tracker spreadsheet using Microsoft Excel. The director tracks the receipt of required single audit reports throughout the fiscal year and notes on the tracker if the audit reports identified findings relevant to the federal program. If a subrecipient’s audit report identified findings, the Director of Audit Services notifies program management responsible for ensuring the subrecipient’s compliance with federal requirements. Program management must then obtain and review the subrecipient’s single audit findings and corrective actions and issue a management decision for any program-related findings. Current Audit Methodology From a population of 81 subrecipient monitoring reports the department issued from July 1, 2023, through June 30, 2024, we tested a nonstatistical random sample of 60 monitoring reports to determine if DHS management conducted subrecipient program monitoring in accordance with the CACFP Monitoring Handbook. We also tested the population of 36 subrecipients that received $750,000 or more in federal awards during the subrecipient’s fiscal year to determine if management obtained a single audit report. If applicable, we determined if DHS program management followed up on any findings in the subrecipient’s single audit and issued a management decision. CONDITION, CRITERIA, AND CAUSE Subrecipient’s Compliance with Household Contact Policy Not Documented Based on our testwork, we found that for 7 of 20(22) (35%) monitoring reports tested, the department’s monitors did not document their review of the subrecipient’s Household Contact Policy. Federal regulations define a household contact as an adult member in a household who has a child enrolled in childcare that the sponsoring organization or the state can contact “to verify the attendance and enrollment of the child and the specific meal service(s) which the child routinely receives while in care.”(23) According to 7 CFR 226.6(m)(5), “State agencies must establish a system for sponsoring organizations to use in making household contacts as part of their review and oversight of participating facilities.” Furthermore, in 7 CFR 226.6(m)(3)(x), the department is required to review the sponsoring organization’s implementation of the household contact system (policy) to assess its compliance with federal regulations. See Schedule of Findings and Questioned Costs for footnotes. Based on our review of the working papers in Diligent, the department’s internal procedure requires the monitor to document their review of the policy and upload it into the working papers to document their review. For all 7 subrecipients, the monitor did not upload the household contact policy into the working papers. For one subrecipient, although the monitor did not upload the policy in the working papers, the monitor indicated in the working papers that one existed. Because the policies were not uploaded, we could not determine if the monitor assessed whether the subrecipient’s household contact policy complied with federal regulations. In all 7 instances, three reviewers signed off on the monitor’s work related to the household contact policy even though the monitors’ documentation was incomplete. According to the Director of Audit Services, he agreed that monitors did not document the Household Contact Policy. He stated that he would identify the monitors who performed the work and provide training. Ineffective Internal Controls Related to Late Subrecipient Single Audit Reports Based on our review, we found that for 4 of 36 (11%) subrecipients that met the $750,000 threshold to obtain a single audit, DHS program management did not ensure that the subrecipients’ audits were released within the required 9-month timeframe. We noted that the subrecipients’ auditors released the reports between 3 to 10 months late. According to the Director of Operations for the Child and Adult Care Food Program and the Summer Food Service Program, they rely on regular communication as a control to ensure they obtain subrecipients’ single audits. According to the director, as of January 10, 2023, management regularly communicated with the subrecipients to complete their single audit reports; however, the director could not provide the evidence explaining why the audits were delayed. According to 2 CFR 200.332(f), DHS must “[v]erify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded [$750,000].” Subpart F(24) states that audit reports must be submitted within “. . . nine months after the end of the audit period.”(25) See Schedule of Findings and Questioned Costs for footnotes. No Management Decisions Issued According to 2 CFR 200.521(d), “The . . . pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by [the federal audit clearinghouse].” As noted above, the Director of Audit Services notifies program management that a subrecipient’s audit report identified findings, which is the control to ensure that program management reviews the findings and corrective actions and issues a management decision. The Director of Operations for the Child and Adult Care Food Program and the Summer Food Service Program is responsible for providing DHS subrecipients with a management decision related to the subrecipient’s corrective actions within six months of the audit report’s issuance. However, during our review of the three subrecipients whose audit reports included findings, the Director of Operations could not provide the management decisions when we requested them. The findings in question related to the lack of controls over both food programs’ meal counts, which is the supporting documentation for the program’s expenditures. Risk Assessment We reviewed the department’s 2023 Financial Integrity Act Risk Assessment and determined that management did not identify the risks of noncompliance identified in this finding. As such, management did not establish control activities to ensure compliance with CACFP’s subrecipient monitoring requirements. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, “Identify, Analyze, and Respond to Risks,” Identification of Risks, 7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. EFFECT When management does not document that program monitors verify that subrecipients met program requirements, ensure subrecipients obtain a single audit when required, or issue management decisions, DHS management increases the risk that their subrecipients may use federal grant funds for unauthorized purposes and fail to comply with federal statutes and regulations. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. Specifically, the Director of Audit Services should ensure that program monitors adequately document and assess whether subrecipients comply with program requirements that are subject to program monitoring. The Director of Operations for the for the Child and Adult Care Food Program and the Summer Food Service Program should maintain documentation of communication with subrecipients who do not obtain a single audit within the required timeframe. In addition, when independent audits identify findings in the audit reports, the Director of Operations should issue timely management decisions in response to the subrecipients’ corrective action plans as required by federal regulations. MANAGEMENT’S COMMENT Subrecipient’s Compliance with Household Contact Policy Not Documented We concur. We agree that few of the Sponsoring Organizations Household Contact policy were not uploaded into the working papers within the audit software. In October 2024, we created a permanent folder within the audit software to upload and maintain all Sponsoring Organizations Household Contact policy. Ineffective Internal Controls Related to Late Subrecipient Single Audit Reports We concur. Food program is implementing a tracking system to specifically identify subrecipients who do not obtain a single audit within the required timeframe. Food program will specifically maintain documentation of communication with subrecipients identified with this tool. This tool will be implemented by April 1, 2025. No Management Decisions Issued We concur. Food program will use the tracking system identified above to identify the required timelines for issuing management decisions in response to the subrecipients’ corrective action plans. Food program will issue timely management decisions. This tool will be implemented by April 1, 2025. Risk Assessment We concur. Food program will update the risk assessment to include risk of noncompliance with CACFP’s subrecipient monitoring requirements.

Finding Number 2024-013 Assistance Listing Number 10.558 Program Name Child and Adult Care Food Program Federal Agency Department of Agriculture State Agency Department of Human Services Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Human Services did not establish effective internal controls to ensure the management and monitors properly documented subrecipient monitoring activities BACKGROUND The Child and Adult Care Food Program (CACFP) is a year-round food program for eligible participants at childcare centers, day care homes, after-school care programs, emergency shelters, and adult day care centers. CACFP is funded by the U.S. Department of Agriculture (USDA) and administered on the state level by the Department of Human Services (DHS). DHS contracts with these institutions, called subrecipients, who administer the program by providing meals. As a pass-through entity, DHS is responsible for ensuring that subrecipients are eligible to participate in the program and that the subrecipients comply with federal requirements. State Agency Monitoring Requirements To fulfill the federal monitoring requirements outlined in the USDA’s Monitoring Handbook for State Agencies: A Child and Adult Care Food Care Program Handbook (CACFP Monitoring Handbook), the department’s Division of Audit Services (division) is responsible for performing regular monitoring visits of participating subrecipients approximately every three years. If department management identified or became aware of problems related to a subrecipient, the division monitors the subrecipient more frequently. These visits occur during the award period and cover three components of monitoring: • ensuring subrecipients comply with federal program requirements; • ensuring subrecipients that receive $750,000 or more in federal awards receive a single audit as required by federal regulations; and • following up on previously reported issues. To document subrecipient monitoring work, division staff use Diligent, a third-party electronic audit management application. Within Diligent, Audit Services management requires working papers have three levels of documented review to ensure the work performed supports the monitoring report. Subrecipient Single Audit Requirements Pursuant to the Office of Management and Budget’s Uniform Grant Guidance and “Audit Requirements,” Title 2, Code of Federal Regulations (CFR), Part 200, Section 501, (a) Audit required.(21) A non-Federal entity [subrecipient] that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. See Schedule of Findings and Questioned Costs for footnote. Furthermore, as the pass-through entity, DHS is required by 2 CFR 200.332(f) to verify that all subrecipients that spend $750,000 or more obtain a single audit within 9 months after the subrecipient’s fiscal year-end. As part of that single audit, if a subrecipient receives an audit finding, the department must issue a management decision within six months of the audit report’s release, indicate if the department agreed with the finding, and describe any corrective action the subrecipient must take. Based on discussions with the Division of Audit Services’ management, division staff compiles subrecipient expenditure information from Edison, the state’s accounting system, to determine if the subrecipient received over $750,000 in federal funds. Once management identifies the subrecipients who meet the audit threshold, the Director of Audit Services creates a tracker spreadsheet using Microsoft Excel. The director tracks the receipt of required single audit reports throughout the fiscal year and notes on the tracker if the audit reports identified findings relevant to the federal program. If a subrecipient’s audit report identified findings, the Director of Audit Services notifies program management responsible for ensuring the subrecipient’s compliance with federal requirements. Program management must then obtain and review the subrecipient’s single audit findings and corrective actions and issue a management decision for any program-related findings. Current Audit Methodology From a population of 81 subrecipient monitoring reports the department issued from July 1, 2023, through June 30, 2024, we tested a nonstatistical random sample of 60 monitoring reports to determine if DHS management conducted subrecipient program monitoring in accordance with the CACFP Monitoring Handbook. We also tested the population of 36 subrecipients that received $750,000 or more in federal awards during the subrecipient’s fiscal year to determine if management obtained a single audit report. If applicable, we determined if DHS program management followed up on any findings in the subrecipient’s single audit and issued a management decision. CONDITION, CRITERIA, AND CAUSE Subrecipient’s Compliance with Household Contact Policy Not Documented Based on our testwork, we found that for 7 of 20(22) (35%) monitoring reports tested, the department’s monitors did not document their review of the subrecipient’s Household Contact Policy. Federal regulations define a household contact as an adult member in a household who has a child enrolled in childcare that the sponsoring organization or the state can contact “to verify the attendance and enrollment of the child and the specific meal service(s) which the child routinely receives while in care.”(23) According to 7 CFR 226.6(m)(5), “State agencies must establish a system for sponsoring organizations to use in making household contacts as part of their review and oversight of participating facilities.” Furthermore, in 7 CFR 226.6(m)(3)(x), the department is required to review the sponsoring organization’s implementation of the household contact system (policy) to assess its compliance with federal regulations. See Schedule of Findings and Questioned Costs for footnotes. Based on our review of the working papers in Diligent, the department’s internal procedure requires the monitor to document their review of the policy and upload it into the working papers to document their review. For all 7 subrecipients, the monitor did not upload the household contact policy into the working papers. For one subrecipient, although the monitor did not upload the policy in the working papers, the monitor indicated in the working papers that one existed. Because the policies were not uploaded, we could not determine if the monitor assessed whether the subrecipient’s household contact policy complied with federal regulations. In all 7 instances, three reviewers signed off on the monitor’s work related to the household contact policy even though the monitors’ documentation was incomplete. According to the Director of Audit Services, he agreed that monitors did not document the Household Contact Policy. He stated that he would identify the monitors who performed the work and provide training. Ineffective Internal Controls Related to Late Subrecipient Single Audit Reports Based on our review, we found that for 4 of 36 (11%) subrecipients that met the $750,000 threshold to obtain a single audit, DHS program management did not ensure that the subrecipients’ audits were released within the required 9-month timeframe. We noted that the subrecipients’ auditors released the reports between 3 to 10 months late. According to the Director of Operations for the Child and Adult Care Food Program and the Summer Food Service Program, they rely on regular communication as a control to ensure they obtain subrecipients’ single audits. According to the director, as of January 10, 2023, management regularly communicated with the subrecipients to complete their single audit reports; however, the director could not provide the evidence explaining why the audits were delayed. According to 2 CFR 200.332(f), DHS must “[v]erify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded [$750,000].” Subpart F(24) states that audit reports must be submitted within “. . . nine months after the end of the audit period.”(25) See Schedule of Findings and Questioned Costs for footnotes. No Management Decisions Issued According to 2 CFR 200.521(d), “The . . . pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by [the federal audit clearinghouse].” As noted above, the Director of Audit Services notifies program management that a subrecipient’s audit report identified findings, which is the control to ensure that program management reviews the findings and corrective actions and issues a management decision. The Director of Operations for the Child and Adult Care Food Program and the Summer Food Service Program is responsible for providing DHS subrecipients with a management decision related to the subrecipient’s corrective actions within six months of the audit report’s issuance. However, during our review of the three subrecipients whose audit reports included findings, the Director of Operations could not provide the management decisions when we requested them. The findings in question related to the lack of controls over both food programs’ meal counts, which is the supporting documentation for the program’s expenditures. Risk Assessment We reviewed the department’s 2023 Financial Integrity Act Risk Assessment and determined that management did not identify the risks of noncompliance identified in this finding. As such, management did not establish control activities to ensure compliance with CACFP’s subrecipient monitoring requirements. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, “Identify, Analyze, and Respond to Risks,” Identification of Risks, 7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. EFFECT When management does not document that program monitors verify that subrecipients met program requirements, ensure subrecipients obtain a single audit when required, or issue management decisions, DHS management increases the risk that their subrecipients may use federal grant funds for unauthorized purposes and fail to comply with federal statutes and regulations. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. Specifically, the Director of Audit Services should ensure that program monitors adequately document and assess whether subrecipients comply with program requirements that are subject to program monitoring. The Director of Operations for the for the Child and Adult Care Food Program and the Summer Food Service Program should maintain documentation of communication with subrecipients who do not obtain a single audit within the required timeframe. In addition, when independent audits identify findings in the audit reports, the Director of Operations should issue timely management decisions in response to the subrecipients’ corrective action plans as required by federal regulations. MANAGEMENT’S COMMENT Subrecipient’s Compliance with Household Contact Policy Not Documented We concur. We agree that few of the Sponsoring Organizations Household Contact policy were not uploaded into the working papers within the audit software. In October 2024, we created a permanent folder within the audit software to upload and maintain all Sponsoring Organizations Household Contact policy. Ineffective Internal Controls Related to Late Subrecipient Single Audit Reports We concur. Food program is implementing a tracking system to specifically identify subrecipients who do not obtain a single audit within the required timeframe. Food program will specifically maintain documentation of communication with subrecipients identified with this tool. This tool will be implemented by April 1, 2025. No Management Decisions Issued We concur. Food program will use the tracking system identified above to identify the required timelines for issuing management decisions in response to the subrecipients’ corrective action plans. Food program will issue timely management decisions. This tool will be implemented by April 1, 2025. Risk Assessment We concur. Food program will update the risk assessment to include risk of noncompliance with CACFP’s subrecipient monitoring requirements.

Finding Number 2024-014 Assistance Listing Number 15.605 and 15.611 Program Name Fish and Wildlife Cluster Federal Agency Department of the Interior State Agency Tennessee Wildlife Resources Agency Federal Award Identification Number N/A Federal Award Year 2019 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding 2023-025 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior two audits, Tennessee Wildlife Resources Agency management did not fully implement controls to ensure that the agency complied with the federal requirements for subrecipient monitoring BACKGROUND The Tennessee Wildlife Resources Agency (TWRA) administers the Fish and Wildlife cluster of programs, which are federal programs under the oversight of the U.S. Fish and Wildlife Service. The Fish and Wildlife Cluster includes the following programs: • The Sport Fish Restoration program provides funds to restore, conserve, and enhance sport fish populations and to provide for public use and enjoyment of these fishery resources. • The Wildlife Restoration program provides funds to restore, rehabilitate, and improve wildlife populations and their habitats; to conduct wildlife management research, and wildlife population surveys and inventories; to acquire land; and to provide for public use of wildlife resources. • The Basic Hunter Education program provides training to hunters in the safe handling and use of firearms and archery equipment; hunter responsibilities and ethics; survival; construction, operation, and maintenance of public shooting ranges; and basic wildlife management and identification. • The Enhanced Hunter Education and Safety program provides funds to enhance programs for hunter education, recruitment, and safety; to increase interstate coordination of hunter education programs; to enhance programs for bow hunters and archers; to enhance construction and development of firearm and archery ranges; and to update safety features of firearm and archery ranges. For fiscal year 2024, TWRA awarded $4,784,164 in federal funds to 14 subrecipients, such as nonprofit foundations and universities, to carry out the activities of the Fish and Wildlife Cluster programs. Prior Audit Results Beginning in the 2022 Single Audit, we reported that TWRA management did not perform required subrecipient monitoring and did not obtain and review subrecipient Single Audits. Additionally, we reviewed the 2021 Financial Integrity Act Risk Assessment and determined that management did not identify risks related to failure to perform subrecipient monitoring and review Single Audit reports. Management concurred with the finding and stated that they would determine assignments to carry out effective monitoring and update their 2022 risk assessment. During the 2023 Single Audit, we again reported that management did not perform subrecipient monitoring and did not obtain and review subrecipients’ Single Audit reports. We also reported that although TWRA’s December 2022 Financial Integrity Act Risk Assessment identified risks associated with the lack of subrecipient monitoring and with the failure to review subrecipient Single Audit reports, management still did not fully design and implement controls to mitigate these risks. TWRA management concurred with the finding and stated that the agency did not perform subrecipient monitoring and did not obtain and review subrecipients’ Single Audit reports due to a lack of staff. TWRA management stated they developed the TWRA Federal Aid Procedures Manual and included chapters on subrecipient monitoring, procedures and risk assessments. They assigned responsibility for the subrecipient monitoring process to the TWRA Federal Aid Grants Manager (Grants Manager), TWRA Project Managers, the Department of Finance and Administration Controller for TWRA, and the TWRA Federal Aid and Real Estate Division. The agency also requires staff to attend annual update training, which includes the subrecipient monitoring process. They stated that they anticipated full implementation of the process by June 30, 2024. In the agency’s six-month follow-up report of corrective action, dated September 24, 2024, management stated that all corrective actions noted above and the hiring of a Grants Manager to oversee subrecipient monitoring activities were fully implemented as of June 30, 2024. Current Audit During the current audit and in response to the prior audit findings, TWRA management developed procedures for subrecipient monitoring in the October 2023 TWRA Federal Aid Procedures Manual. Also, management hired a Grants Manager in April 2024, exclusively dedicated to subrecipient monitoring, who has started implementing the new subrecipient monitoring procedures. Management also completed a risk assessment for each subrecipient and each project or grant award. These risk assessments evaluate the subrecipient’s previous compliance audit findings, prior experience, and new personnel or systems. Management’s assessed level of risk for the subrecipients determines the number of monitoring visits the project manager will conduct for each subrecipient project, which is documented in each project’s monitoring plan. Finally, management now requires project managers to sign the monitoring plan indicating completion of the plan and return it to the Grants Manager for review. Our goal was to focus on the agency implementing its corrective actions to address the prior finding. CONDITION, CRITERIA, AND CAUSE We met with management to understand TWRA management’s subrecipient monitoring procedures and reviewed the TWRA Federal Aid Procedures Manual. Based on our discussions and review, we determined that for fiscal year ended June 30, 2024, management still had not fully implemented the controls as described to ensure compliance with the subrecipient monitoring requirements and specifically did not perform subrecipient monitoring activities, including reviewing financial and performance reports as required by Title 2, Code of Federal Regulations (CFR), Part 200, Section 332(d): Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. Based on our review of the documentation, we found that TWRA management did not monitor subrecipients by performing complete monitoring reviews(26) to ensure the subrecipients were meeting both programmatic and financial expectations. According to the Assistant Chief of Federal Aid and Real Estate, staff performed only one partial review for one subrecipient out of 57(27) projects representing the 14 subrecipients that required complete reviews (programmatic and financial) for the period. In this one partial monitoring review, staff performed only the programmatic review of the subrecipient. Based on our follow-up discussions with management, management agreed with our conclusions and stated that the lack of subrecipient monitoring was due to a lack of staff. See Schedule of Findings and Questioned Costs for footnotes. EFFECT When TWRA management does not implement controls timely to ensure management and staff follow federal requirements to perform subrecipient monitoring, management cannot ensure subrecipients have reasonably complied with federal statutes, regulations, and terms and conditions of the grant award. This includes both programmatic and financial reviews. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Executive Director should address the root cause of any monitoring deficiencies and take the final action to fully implement the controls they created to guide agency staff tasked to perform subrecipient monitoring activities required by federal regulations and requirements. Specifically, management should ensure staff perform the complete monitoring reviews to ensure subrecipients are meeting both programmatic and financial expectations for the grant funds they receive. Management should take prompt action to identify any areas of subrecipient noncompliance with the grant regulations and follow up on required corrective action as needed. MANAGEMENT’S COMMENT We partially concur. The Agency appreciates and respects the Comptroller’s Office position, and while the Agency acknowledges that the Federal Aid and Real Estate team did not produce an adequate number of monitoring reviews, it is merely due to the control being implemented in FY 2024 and not having had adequate time to become fully operational rather than a process deficiency or lack of corrective actions taken by TWRA. Further, the corrective action to address this issue would not be to revise or create additions to the internal control, it is to allow adequate time for the internal control to operate. The position that further corrective actions are unnecessary is supported in communications subsequent to our recent Office of the Inspector General (OIG) U.S. Fish and Wildlife Service Grants for the period ended June 30, 2022, in which the OIG had “reviewed the (sub-recipient monitoring) procedures and found them to be adequate” albeit not fully implemented. Discussions with the Comptroller Auditors yielded similar agreement. The Agency believes that the corrective actions taken in and prior to FY 2024 listed in the Single Audit Report, coupled with the continued direct sub-recipient monitoring activities of Agency’s project managers, substantially mitigate both the risk of non-compliance with Title 2, Code of Federal Regulations (CFR) Part 200, Section 332(d) and the risk of potential adverse actions from the US Fish and Wildlife Service. TWRA will continue to support the internal control activities of the Federal Aid and Real Estate Division, and the project managers assigned to directly manage the sub-recipient activities. The Agency looks forward to a review of the complete process in FY 2025. AUDITOR’S COMMENT We have reviewed management’s comments, and the finding stands as written. We would like to note that while management had not performed all needed financial and programmatic monitoring reviews of subrecipients during the audit period, management did initiate corrective changes to the monitoring process to ensure financial and programmatic monitoring reviews will be performed in the future. We will follow up on the monitoring process changes in the next audit.

Finding Number 2024-014 Assistance Listing Number 15.605 and 15.611 Program Name Fish and Wildlife Cluster Federal Agency Department of the Interior State Agency Tennessee Wildlife Resources Agency Federal Award Identification Number N/A Federal Award Year 2019 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding 2023-025 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior two audits, Tennessee Wildlife Resources Agency management did not fully implement controls to ensure that the agency complied with the federal requirements for subrecipient monitoring BACKGROUND The Tennessee Wildlife Resources Agency (TWRA) administers the Fish and Wildlife cluster of programs, which are federal programs under the oversight of the U.S. Fish and Wildlife Service. The Fish and Wildlife Cluster includes the following programs: • The Sport Fish Restoration program provides funds to restore, conserve, and enhance sport fish populations and to provide for public use and enjoyment of these fishery resources. • The Wildlife Restoration program provides funds to restore, rehabilitate, and improve wildlife populations and their habitats; to conduct wildlife management research, and wildlife population surveys and inventories; to acquire land; and to provide for public use of wildlife resources. • The Basic Hunter Education program provides training to hunters in the safe handling and use of firearms and archery equipment; hunter responsibilities and ethics; survival; construction, operation, and maintenance of public shooting ranges; and basic wildlife management and identification. • The Enhanced Hunter Education and Safety program provides funds to enhance programs for hunter education, recruitment, and safety; to increase interstate coordination of hunter education programs; to enhance programs for bow hunters and archers; to enhance construction and development of firearm and archery ranges; and to update safety features of firearm and archery ranges. For fiscal year 2024, TWRA awarded $4,784,164 in federal funds to 14 subrecipients, such as nonprofit foundations and universities, to carry out the activities of the Fish and Wildlife Cluster programs. Prior Audit Results Beginning in the 2022 Single Audit, we reported that TWRA management did not perform required subrecipient monitoring and did not obtain and review subrecipient Single Audits. Additionally, we reviewed the 2021 Financial Integrity Act Risk Assessment and determined that management did not identify risks related to failure to perform subrecipient monitoring and review Single Audit reports. Management concurred with the finding and stated that they would determine assignments to carry out effective monitoring and update their 2022 risk assessment. During the 2023 Single Audit, we again reported that management did not perform subrecipient monitoring and did not obtain and review subrecipients’ Single Audit reports. We also reported that although TWRA’s December 2022 Financial Integrity Act Risk Assessment identified risks associated with the lack of subrecipient monitoring and with the failure to review subrecipient Single Audit reports, management still did not fully design and implement controls to mitigate these risks. TWRA management concurred with the finding and stated that the agency did not perform subrecipient monitoring and did not obtain and review subrecipients’ Single Audit reports due to a lack of staff. TWRA management stated they developed the TWRA Federal Aid Procedures Manual and included chapters on subrecipient monitoring, procedures and risk assessments. They assigned responsibility for the subrecipient monitoring process to the TWRA Federal Aid Grants Manager (Grants Manager), TWRA Project Managers, the Department of Finance and Administration Controller for TWRA, and the TWRA Federal Aid and Real Estate Division. The agency also requires staff to attend annual update training, which includes the subrecipient monitoring process. They stated that they anticipated full implementation of the process by June 30, 2024. In the agency’s six-month follow-up report of corrective action, dated September 24, 2024, management stated that all corrective actions noted above and the hiring of a Grants Manager to oversee subrecipient monitoring activities were fully implemented as of June 30, 2024. Current Audit During the current audit and in response to the prior audit findings, TWRA management developed procedures for subrecipient monitoring in the October 2023 TWRA Federal Aid Procedures Manual. Also, management hired a Grants Manager in April 2024, exclusively dedicated to subrecipient monitoring, who has started implementing the new subrecipient monitoring procedures. Management also completed a risk assessment for each subrecipient and each project or grant award. These risk assessments evaluate the subrecipient’s previous compliance audit findings, prior experience, and new personnel or systems. Management’s assessed level of risk for the subrecipients determines the number of monitoring visits the project manager will conduct for each subrecipient project, which is documented in each project’s monitoring plan. Finally, management now requires project managers to sign the monitoring plan indicating completion of the plan and return it to the Grants Manager for review. Our goal was to focus on the agency implementing its corrective actions to address the prior finding. CONDITION, CRITERIA, AND CAUSE We met with management to understand TWRA management’s subrecipient monitoring procedures and reviewed the TWRA Federal Aid Procedures Manual. Based on our discussions and review, we determined that for fiscal year ended June 30, 2024, management still had not fully implemented the controls as described to ensure compliance with the subrecipient monitoring requirements and specifically did not perform subrecipient monitoring activities, including reviewing financial and performance reports as required by Title 2, Code of Federal Regulations (CFR), Part 200, Section 332(d): Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. Based on our review of the documentation, we found that TWRA management did not monitor subrecipients by performing complete monitoring reviews(26) to ensure the subrecipients were meeting both programmatic and financial expectations. According to the Assistant Chief of Federal Aid and Real Estate, staff performed only one partial review for one subrecipient out of 57(27) projects representing the 14 subrecipients that required complete reviews (programmatic and financial) for the period. In this one partial monitoring review, staff performed only the programmatic review of the subrecipient. Based on our follow-up discussions with management, management agreed with our conclusions and stated that the lack of subrecipient monitoring was due to a lack of staff. See Schedule of Findings and Questioned Costs for footnotes. EFFECT When TWRA management does not implement controls timely to ensure management and staff follow federal requirements to perform subrecipient monitoring, management cannot ensure subrecipients have reasonably complied with federal statutes, regulations, and terms and conditions of the grant award. This includes both programmatic and financial reviews. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Executive Director should address the root cause of any monitoring deficiencies and take the final action to fully implement the controls they created to guide agency staff tasked to perform subrecipient monitoring activities required by federal regulations and requirements. Specifically, management should ensure staff perform the complete monitoring reviews to ensure subrecipients are meeting both programmatic and financial expectations for the grant funds they receive. Management should take prompt action to identify any areas of subrecipient noncompliance with the grant regulations and follow up on required corrective action as needed. MANAGEMENT’S COMMENT We partially concur. The Agency appreciates and respects the Comptroller’s Office position, and while the Agency acknowledges that the Federal Aid and Real Estate team did not produce an adequate number of monitoring reviews, it is merely due to the control being implemented in FY 2024 and not having had adequate time to become fully operational rather than a process deficiency or lack of corrective actions taken by TWRA. Further, the corrective action to address this issue would not be to revise or create additions to the internal control, it is to allow adequate time for the internal control to operate. The position that further corrective actions are unnecessary is supported in communications subsequent to our recent Office of the Inspector General (OIG) U.S. Fish and Wildlife Service Grants for the period ended June 30, 2022, in which the OIG had “reviewed the (sub-recipient monitoring) procedures and found them to be adequate” albeit not fully implemented. Discussions with the Comptroller Auditors yielded similar agreement. The Agency believes that the corrective actions taken in and prior to FY 2024 listed in the Single Audit Report, coupled with the continued direct sub-recipient monitoring activities of Agency’s project managers, substantially mitigate both the risk of non-compliance with Title 2, Code of Federal Regulations (CFR) Part 200, Section 332(d) and the risk of potential adverse actions from the US Fish and Wildlife Service. TWRA will continue to support the internal control activities of the Federal Aid and Real Estate Division, and the project managers assigned to directly manage the sub-recipient activities. The Agency looks forward to a review of the complete process in FY 2025. AUDITOR’S COMMENT We have reviewed management’s comments, and the finding stands as written. We would like to note that while management had not performed all needed financial and programmatic monitoring reviews of subrecipients during the audit period, management did initiate corrective changes to the monitoring process to ensure financial and programmatic monitoring reviews will be performed in the future. We will follow up on the monitoring process changes in the next audit.

Finding Number 2024-001 Assistance Listing Number 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Cash Management Repeat Finding 2023-002 Pass-Through Entity N/A Questioned Costs N/A Finding The financial aid office continued to not adequately reconcile its direct loan records to the Direct Loan Servicing System’s records, as required by federal regulations, and therefore could not resolve discrepancies timely Background The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for Student Financial Assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The United States Department of Education (ED) has established certain requirements for each school to participate in the Student Financial Assistance programs. For direct loans, ED requires schools to reconcile direct loan data monthly between the school’s financial aid office and business office, and between school data, ED’s Common Origination and Disbursement System, and ED’s Grants Management (G5) System. Condition As noted in the prior-year audit, the financial aid office at Tennessee State University could not provide adequate documentation showing that staff fully and timely reconciled the university’s direct loan financial records with the federal Direct Loan Servicing System monthly, as required. While the financial aid office was able to provide reconciliations, staff did not record documentation showing that the report was run timely, that unreconciled items were researched, and that the research was completed timely. The auditors reviewed the university’s procedures for the reconciliations and noted there were no instructions for documenting and signing off on the reconciliations. As a result, any discrepancies may not have been identified, investigated, and resolved timely. Management, as noted in the prior finding, created and filled the role of Assistant Director of Compliance; however, management did not hire an independent financial aid consultant until the end of the 2024 academic year. The partial action of creating and filling the new position did not correct the noncompliance during the period. Criteria Title 34, Code of Federal Regulations, Part 685, Section 300(b)(5), states that to participate in the Direct Loan program, a school must “on a monthly basis, reconcile institutional records with Direct Loan funds received from the Secretary and Direct Loan disbursement records submitted to and accepted by the Secretary.” The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 6, gives additional information regarding the reconciliation process: A school that participates in the Direct Loan Program is required to reconcile cash (funds it received from the G5 system to pay its students) with disbursements (actual disbursement records) it submitted to the Common Origination and Disbursement (COD) system monthly. In addition, Chapter 6 of the handbook goes on to state, A school has completed its monthly reconciliation when all differences between the Direct Loan SAS [Student Account Statement] and the school’s internal records (Direct Loan system, financial aid office, and business office system) have been resolved or documented and the school’s ending cash balance is zero. Schools should clearly outline their reconciliation process and documentation in both the business office and financial aid office procedures. Finally, while the handbook does not specify a particular format or reconciliation method, it does require that the school maintains “documented results of its monthly reconciliation to provide to auditors and reviewers at their request.” Cause The former Director of Financial Aid(1) stated that the financial aid office has differences from month to month because of the timing of funds being disbursed and drawn down, but these items will usually resolve themselves by the end of the award period. Because of these timing discrepancies, the university has not emphasized performing a complete reconciliation each month. Consequently, the university has not placed the same importance on the reconciliation process as ED. See Schedule of Findings and Questioned Costs for footnote. Effect When the university does not reconcile its financial aid records to the net cash drawdowns and net booked disbursements as reported to the federal government, there could be unresolved errors in either the federal government’s records or the university’s records. The university could draw too much cash from ED, resulting in questioned costs, or could underdraw, placing unnecessary financial stress on the institution. In addition, when the university does not fully reconcile direct loans each month, reconciling items and errors may be harder to identify over time, making the annual reconciliation more complex than necessary. Performing documented monthly reconciliations and retaining all supporting documentation ensures that financial aid staff will receive all direct loan funds from ED and will make timely and accurate disbursements to students. In addition, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate its participation in a Title IV program. These actions would negatively affect the university’s operations and the students impacted by the loss of Title IV aid. Recommendation The financial aid office and the business office should update policies and procedures for the reconciliation process. The Director of Financial Aid should ensure that staff prepare and document the required monthly reconciliations based on instructions in the Federal Student Aid Handbook. If any items in the School Account Statement do not agree with the institution’s financial records, financial aid staff should investigate, resolve, and record these differences promptly. The Director of Financial Aid and a member of the business office should review the reconciliation each month and at award year-end to ensure accuracy and completeness. The university should ensure reconciliations document the preparer and reviewers with the date each was completed. The reconciliation should contain sufficient information and documentation for identified differences and be completed within 30 days of the month's end. MANAGEMENT’S COMMENT We concur. TSU’s Financial Aid Office has updated its policies and procedures to comply with federal regulations. Our revised procedures outline a three-step process for monthly reconciliation. This process begins with the Loan Coordinator performing the initial reconciliation. The reconciliation will then be submitted to either the Assistant Director of Compliance or the Director of Financial Aid for further evaluation. Finally, the Director of Grants Accounting will conduct a comprehensive review. This structured approach ensures that the financial aid office completes the reconciliation efficiently with oversight from three distinct parties. All documentation related to the completed tasks, along with an accuracy checklist with signatures, will be maintained for future reference. The university is also committed to enhancing its financial aid operations by implementing the TSU Student Information System delivered processes to ensure thorough compliance with reconciliation standards. To support this initiative, we are collaborating with outside consultants, who bring valuable expertise to help us develop comprehensive, customized policies and procedures. We anticipate finalizing these documents by March 2025. To align with our goals, we have initiated job postings for two critical positions: the Loan Coordinator and the Assistant Director of Compliance. These roles are essential for driving our reconciliation efforts and ensuring optimal management of financial aid processes. Our primary objective is to achieve full reconciliation of the 2023-2024 Direct Loans by March 1, 2025. Additionally, we plan to start monthly reconciliations for the 2024-2025 loan disbursements in February 2025 to ensure accuracy and compliance. During the interim period, while we work to fill the Loan Coordinator and Assistant Director of Compliance positions, the Director of Financial Aid will actively oversee the reconciliation process. The Director will also receive initial support from our outside consultants to ensure that all reconciliation activities are conducted smoothly and meet compliance requirements. This collaborative approach fosters a more effective and accountable financial aid system within the university.

Finding Number 2024-001 Assistance Listing Number 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Cash Management Repeat Finding 2023-002 Pass-Through Entity N/A Questioned Costs N/A Finding The financial aid office continued to not adequately reconcile its direct loan records to the Direct Loan Servicing System’s records, as required by federal regulations, and therefore could not resolve discrepancies timely Background The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for Student Financial Assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The United States Department of Education (ED) has established certain requirements for each school to participate in the Student Financial Assistance programs. For direct loans, ED requires schools to reconcile direct loan data monthly between the school’s financial aid office and business office, and between school data, ED’s Common Origination and Disbursement System, and ED’s Grants Management (G5) System. Condition As noted in the prior-year audit, the financial aid office at Tennessee State University could not provide adequate documentation showing that staff fully and timely reconciled the university’s direct loan financial records with the federal Direct Loan Servicing System monthly, as required. While the financial aid office was able to provide reconciliations, staff did not record documentation showing that the report was run timely, that unreconciled items were researched, and that the research was completed timely. The auditors reviewed the university’s procedures for the reconciliations and noted there were no instructions for documenting and signing off on the reconciliations. As a result, any discrepancies may not have been identified, investigated, and resolved timely. Management, as noted in the prior finding, created and filled the role of Assistant Director of Compliance; however, management did not hire an independent financial aid consultant until the end of the 2024 academic year. The partial action of creating and filling the new position did not correct the noncompliance during the period. Criteria Title 34, Code of Federal Regulations, Part 685, Section 300(b)(5), states that to participate in the Direct Loan program, a school must “on a monthly basis, reconcile institutional records with Direct Loan funds received from the Secretary and Direct Loan disbursement records submitted to and accepted by the Secretary.” The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 6, gives additional information regarding the reconciliation process: A school that participates in the Direct Loan Program is required to reconcile cash (funds it received from the G5 system to pay its students) with disbursements (actual disbursement records) it submitted to the Common Origination and Disbursement (COD) system monthly. In addition, Chapter 6 of the handbook goes on to state, A school has completed its monthly reconciliation when all differences between the Direct Loan SAS [Student Account Statement] and the school’s internal records (Direct Loan system, financial aid office, and business office system) have been resolved or documented and the school’s ending cash balance is zero. Schools should clearly outline their reconciliation process and documentation in both the business office and financial aid office procedures. Finally, while the handbook does not specify a particular format or reconciliation method, it does require that the school maintains “documented results of its monthly reconciliation to provide to auditors and reviewers at their request.” Cause The former Director of Financial Aid(1) stated that the financial aid office has differences from month to month because of the timing of funds being disbursed and drawn down, but these items will usually resolve themselves by the end of the award period. Because of these timing discrepancies, the university has not emphasized performing a complete reconciliation each month. Consequently, the university has not placed the same importance on the reconciliation process as ED. See Schedule of Findings and Questioned Costs for footnote. Effect When the university does not reconcile its financial aid records to the net cash drawdowns and net booked disbursements as reported to the federal government, there could be unresolved errors in either the federal government’s records or the university’s records. The university could draw too much cash from ED, resulting in questioned costs, or could underdraw, placing unnecessary financial stress on the institution. In addition, when the university does not fully reconcile direct loans each month, reconciling items and errors may be harder to identify over time, making the annual reconciliation more complex than necessary. Performing documented monthly reconciliations and retaining all supporting documentation ensures that financial aid staff will receive all direct loan funds from ED and will make timely and accurate disbursements to students. In addition, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate its participation in a Title IV program. These actions would negatively affect the university’s operations and the students impacted by the loss of Title IV aid. Recommendation The financial aid office and the business office should update policies and procedures for the reconciliation process. The Director of Financial Aid should ensure that staff prepare and document the required monthly reconciliations based on instructions in the Federal Student Aid Handbook. If any items in the School Account Statement do not agree with the institution’s financial records, financial aid staff should investigate, resolve, and record these differences promptly. The Director of Financial Aid and a member of the business office should review the reconciliation each month and at award year-end to ensure accuracy and completeness. The university should ensure reconciliations document the preparer and reviewers with the date each was completed. The reconciliation should contain sufficient information and documentation for identified differences and be completed within 30 days of the month's end. MANAGEMENT’S COMMENT We concur. TSU’s Financial Aid Office has updated its policies and procedures to comply with federal regulations. Our revised procedures outline a three-step process for monthly reconciliation. This process begins with the Loan Coordinator performing the initial reconciliation. The reconciliation will then be submitted to either the Assistant Director of Compliance or the Director of Financial Aid for further evaluation. Finally, the Director of Grants Accounting will conduct a comprehensive review. This structured approach ensures that the financial aid office completes the reconciliation efficiently with oversight from three distinct parties. All documentation related to the completed tasks, along with an accuracy checklist with signatures, will be maintained for future reference. The university is also committed to enhancing its financial aid operations by implementing the TSU Student Information System delivered processes to ensure thorough compliance with reconciliation standards. To support this initiative, we are collaborating with outside consultants, who bring valuable expertise to help us develop comprehensive, customized policies and procedures. We anticipate finalizing these documents by March 2025. To align with our goals, we have initiated job postings for two critical positions: the Loan Coordinator and the Assistant Director of Compliance. These roles are essential for driving our reconciliation efforts and ensuring optimal management of financial aid processes. Our primary objective is to achieve full reconciliation of the 2023-2024 Direct Loans by March 1, 2025. Additionally, we plan to start monthly reconciliations for the 2024-2025 loan disbursements in February 2025 to ensure accuracy and compliance. During the interim period, while we work to fill the Loan Coordinator and Assistant Director of Compliance positions, the Director of Financial Aid will actively oversee the reconciliation process. The Director will also receive initial support from our outside consultants to ensure that all reconciliation activities are conducted smoothly and meet compliance requirements. This collaborative approach fosters a more effective and accountable financial aid system within the university.

Finding Number 2024-002 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-003 Pass-Through Entity N/A Questioned Costs N/A FINDING Tennessee State University continued to have inadequate procedures to ensure Title IV credits were refunded in accordance with federal guidelines BACKGROUND The student financial assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. These Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of the total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. As a condition of these programs, institutions must provide notifications of the amounts awarded and loans disbursed. In addition, institutions are required to refund credits to the student’s account within 14 days of posting the award to the student’s account. CONDITION In response to the prior finding, which noted compliance issues during the 2023 academic year, management restructured the Bursar’s office to include a Refund Analyst role, which reports to the new Account Manager. However, adding the new position and staff did not adequately address compliance issues for the 2024 academic year. In the current audit, we tested a sample of 15 Title IV recipients at Tennessee State University (TSU) to determine whether TSU met disbursement requirements and identified errors in 11 (73%) of the Title IV recipients. These requirements included disbursing the appropriate amount of Title IV aid in a timely manner, sending notices to students informing them of their awards and/or loan disbursements, and refunding any credits to student accounts created by Title IV aid within 14 days of disbursement. Refund Timeliness We noted that 2 of the 8 students (25%) in our testwork had Title IV credits that were not refunded within 14 days of the disbursement date. As noted in the table below, 3 separate refunds were not refunded timely, ranging from 3 to 88 days late. See Schedule of Findings and Questioned Costs for table. While conducting our testwork, we noted that 1 additional student also received a refund more than 14 days after the Title IV aid was disbursed to the student’s account. Because the student had a combination of federal and non-federal aid creating the credit, it did not meet the federal definition of a Title IV credit. However, the error is a further indication of TSU’s failure to process refunds in a timely manner. Disbursement Notifications We also tested our sample to determine whether 2 required notifications were sent to students. The first required letter notifies students of the amount and type of Title IV funds they are expected to receive, as well as how and when the disbursements will be made. We tested all items in our sample to determine whether this first notification was made. For 7 of the 15 students (47%) tested, the student did not receive the required notification. The second required letter is specific only to those students receiving direct loans or Teacher Education Assistance for College and Higher Education (TEACH) grants. The letter notifies students of 1) the date and amount of the disbursement, 2) the student’s or parent’s right to cancel, and 3) the procedure and time by which the student or parent must notify the institution that they wish to cancel. We noted that 11 students in our sample should have received the letter. However, 8 of these 11 students (73%) did not receive the required notification. CRITERIA The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 2, states: If FSA [federal student aid] disbursements to a student’s account at the school create a Title IV credit balance, the school must pay the credit balance directly to the student or parent as soon as possible but no later than 14 days after: [emphasis in original] • the first day of class of a payment period if the credit balance occurred on or before that day, or • the balance occurred if that was after the first day of class. In addition, Volume 4, Chapter 2, of the handbook states: A school must notify a student of the amount of funds the student and their parent can expect to receive from each FSA program, including FWS [Federal Work Study], and how and when those funds will be disbursed. This notification must be sent before any disbursements are made. Finally, Volume 4, Chapter 2, of the handbook also states: Except in the case of loan funds made as part of a post-withdrawal disbursement (see Volume 5 for notification requirements in such cases), when Direct Loan or TEACH funds are being credited to a student’s ledger account, the school must also notify the borrower in writing (paper or electronically) of the: • anticipated date and amount of the disbursement; • student’s or parent’s right to cancel all or a portion of a Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement and have the loan proceeds or TEACH Grant proceeds returned to the Department; and • procedures and deadlines by which the student or parent must notify the school that they wish to cancel the Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. CAUSE TSU management implemented a general refund policy outlining the timing of refunds, as well as the differences between automatic and manual refunds. However, management did not develop adequate procedures to ensure that all Title IV credits are refunded within the timeframes required by federal guidance. Per discussion with TSU management, employee shortages and turnover resulted in the process not always being performed as outlined in the policy. TSU management was uncertain as to the specific cause for unsent disbursement notifications as their financial aid system should automatically send out these notices. Based on these discussions, TSU management is overly reliant on automated processes, and they do not have verification or review processes to confirm that the processes occurred and were complete. EFFECT Timely refunding credits to students is essential to fulfilling the goals of Title IV programs. Students may depend on these refunds to pay for non-institutional charges, such as off-campus housing, transportation, or meals. Furthermore, if the university does not notify students of expected aid, this could impact decision-making for students and their families when determining whether to attend the university. Without these funds, students may not have the resources to pay for these potentially significant costs, which can be a barrier to a successful college career. In addition, failure to notify students of important deadlines and information regarding their direct loans or TEACH Grants could cause students to incur loans they wished to cancel, resulting in unwanted debt. Finally, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate TSU’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. RECOMMENDATION TSU management should revise and adequately document procedures to ensure that students receive the required disbursement notifications and to ensure that credits on student accounts are refunded within 14 days of Title IV aid being disbursed. In addition, leadership should take necessary steps to provide adequate staffing and training to ensure compliance. Finally, TSU management should establish additional review procedures to meet disbursement requirements. MANAGEMENT’S COMMENT We concur. The automatic refund process has been reactivated for spring 2025 as part of our pilot program to refine financial aid procedures. TSU’s consultants conducted a comprehensive review of the current detail codes in use, methodically analyzing their effectiveness and identifying areas for improvement. The recommendations that were made based on this assessment are anticipated to enhance both the efficiency and clarity of the payment process, allowing for a more straightforward identification of non-refundable amounts, which in turn will facilitate the more efficient allocation of funds for necessary financial aid adjustments. The revised procedures will be tested during the spring 2025 refund period to assess their effectiveness and reliability before implementing them on a larger scale. To further support students during this transition, TSU and its consultants will initiate a system of automatic notifications for all students receiving loan disbursements. This systematic communication will enhance transparency by providing information on the amounts disbursed and notifying students of their rights to cancel either part or all of their loans. Additionally, it will outline the specific steps students need to follow to initiate a cancellation. The notification system has been tested and is confirmed to work effectively for loan disbursements in spring 2025. Consequently, before each term, we will review all system parameters and then examine the output after the disbursements are run to ensure that all student notifications are issued correctly. In addition, TSU is taking proactive measures to inform students when their financial aid packages become available, ensuring that they are kept in the loop about their funding status. This process is confirmed to be operating smoothly for Spring 2025, ensuring students receive timely updates. TSU and its consultants will also check the job scheduling system regularly to verify that these processes are being carried out as intended. The completion of these initiatives are anticipated by July 2025, well ahead of the processing for fall 2025 refunds. This timeline will allow for the seamless integration of improvements and ensure that students benefit from the enhancements in the financial aid process moving forward. Lastly, to comply with university procedures and regulatory requirements, it is crucial to fill the Accounting Manager vacancy in the Bursar's office as soon as possible. The Accounting Manager will be vital in overseeing the reconciliation processes, managing refund operations, and improving our financial practices moving forward. This position is essential not only for ensuring accuracy in financial reporting but also for proactively addressing and resolving any discrepancies that may arise. The Vice President of Business and Finance will coordinate with the Bursar’s Office and the Human Resources Department to ensure the timely recruitment and hiring of a qualified candidate.

Finding Number 2024-002 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-003 Pass-Through Entity N/A Questioned Costs N/A FINDING Tennessee State University continued to have inadequate procedures to ensure Title IV credits were refunded in accordance with federal guidelines BACKGROUND The student financial assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. These Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of the total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. As a condition of these programs, institutions must provide notifications of the amounts awarded and loans disbursed. In addition, institutions are required to refund credits to the student’s account within 14 days of posting the award to the student’s account. CONDITION In response to the prior finding, which noted compliance issues during the 2023 academic year, management restructured the Bursar’s office to include a Refund Analyst role, which reports to the new Account Manager. However, adding the new position and staff did not adequately address compliance issues for the 2024 academic year. In the current audit, we tested a sample of 15 Title IV recipients at Tennessee State University (TSU) to determine whether TSU met disbursement requirements and identified errors in 11 (73%) of the Title IV recipients. These requirements included disbursing the appropriate amount of Title IV aid in a timely manner, sending notices to students informing them of their awards and/or loan disbursements, and refunding any credits to student accounts created by Title IV aid within 14 days of disbursement. Refund Timeliness We noted that 2 of the 8 students (25%) in our testwork had Title IV credits that were not refunded within 14 days of the disbursement date. As noted in the table below, 3 separate refunds were not refunded timely, ranging from 3 to 88 days late. See Schedule of Findings and Questioned Costs for table. While conducting our testwork, we noted that 1 additional student also received a refund more than 14 days after the Title IV aid was disbursed to the student’s account. Because the student had a combination of federal and non-federal aid creating the credit, it did not meet the federal definition of a Title IV credit. However, the error is a further indication of TSU’s failure to process refunds in a timely manner. Disbursement Notifications We also tested our sample to determine whether 2 required notifications were sent to students. The first required letter notifies students of the amount and type of Title IV funds they are expected to receive, as well as how and when the disbursements will be made. We tested all items in our sample to determine whether this first notification was made. For 7 of the 15 students (47%) tested, the student did not receive the required notification. The second required letter is specific only to those students receiving direct loans or Teacher Education Assistance for College and Higher Education (TEACH) grants. The letter notifies students of 1) the date and amount of the disbursement, 2) the student’s or parent’s right to cancel, and 3) the procedure and time by which the student or parent must notify the institution that they wish to cancel. We noted that 11 students in our sample should have received the letter. However, 8 of these 11 students (73%) did not receive the required notification. CRITERIA The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 2, states: If FSA [federal student aid] disbursements to a student’s account at the school create a Title IV credit balance, the school must pay the credit balance directly to the student or parent as soon as possible but no later than 14 days after: [emphasis in original] • the first day of class of a payment period if the credit balance occurred on or before that day, or • the balance occurred if that was after the first day of class. In addition, Volume 4, Chapter 2, of the handbook states: A school must notify a student of the amount of funds the student and their parent can expect to receive from each FSA program, including FWS [Federal Work Study], and how and when those funds will be disbursed. This notification must be sent before any disbursements are made. Finally, Volume 4, Chapter 2, of the handbook also states: Except in the case of loan funds made as part of a post-withdrawal disbursement (see Volume 5 for notification requirements in such cases), when Direct Loan or TEACH funds are being credited to a student’s ledger account, the school must also notify the borrower in writing (paper or electronically) of the: • anticipated date and amount of the disbursement; • student’s or parent’s right to cancel all or a portion of a Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement and have the loan proceeds or TEACH Grant proceeds returned to the Department; and • procedures and deadlines by which the student or parent must notify the school that they wish to cancel the Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. CAUSE TSU management implemented a general refund policy outlining the timing of refunds, as well as the differences between automatic and manual refunds. However, management did not develop adequate procedures to ensure that all Title IV credits are refunded within the timeframes required by federal guidance. Per discussion with TSU management, employee shortages and turnover resulted in the process not always being performed as outlined in the policy. TSU management was uncertain as to the specific cause for unsent disbursement notifications as their financial aid system should automatically send out these notices. Based on these discussions, TSU management is overly reliant on automated processes, and they do not have verification or review processes to confirm that the processes occurred and were complete. EFFECT Timely refunding credits to students is essential to fulfilling the goals of Title IV programs. Students may depend on these refunds to pay for non-institutional charges, such as off-campus housing, transportation, or meals. Furthermore, if the university does not notify students of expected aid, this could impact decision-making for students and their families when determining whether to attend the university. Without these funds, students may not have the resources to pay for these potentially significant costs, which can be a barrier to a successful college career. In addition, failure to notify students of important deadlines and information regarding their direct loans or TEACH Grants could cause students to incur loans they wished to cancel, resulting in unwanted debt. Finally, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate TSU’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. RECOMMENDATION TSU management should revise and adequately document procedures to ensure that students receive the required disbursement notifications and to ensure that credits on student accounts are refunded within 14 days of Title IV aid being disbursed. In addition, leadership should take necessary steps to provide adequate staffing and training to ensure compliance. Finally, TSU management should establish additional review procedures to meet disbursement requirements. MANAGEMENT’S COMMENT We concur. The automatic refund process has been reactivated for spring 2025 as part of our pilot program to refine financial aid procedures. TSU’s consultants conducted a comprehensive review of the current detail codes in use, methodically analyzing their effectiveness and identifying areas for improvement. The recommendations that were made based on this assessment are anticipated to enhance both the efficiency and clarity of the payment process, allowing for a more straightforward identification of non-refundable amounts, which in turn will facilitate the more efficient allocation of funds for necessary financial aid adjustments. The revised procedures will be tested during the spring 2025 refund period to assess their effectiveness and reliability before implementing them on a larger scale. To further support students during this transition, TSU and its consultants will initiate a system of automatic notifications for all students receiving loan disbursements. This systematic communication will enhance transparency by providing information on the amounts disbursed and notifying students of their rights to cancel either part or all of their loans. Additionally, it will outline the specific steps students need to follow to initiate a cancellation. The notification system has been tested and is confirmed to work effectively for loan disbursements in spring 2025. Consequently, before each term, we will review all system parameters and then examine the output after the disbursements are run to ensure that all student notifications are issued correctly. In addition, TSU is taking proactive measures to inform students when their financial aid packages become available, ensuring that they are kept in the loop about their funding status. This process is confirmed to be operating smoothly for Spring 2025, ensuring students receive timely updates. TSU and its consultants will also check the job scheduling system regularly to verify that these processes are being carried out as intended. The completion of these initiatives are anticipated by July 2025, well ahead of the processing for fall 2025 refunds. This timeline will allow for the seamless integration of improvements and ensure that students benefit from the enhancements in the financial aid process moving forward. Lastly, to comply with university procedures and regulatory requirements, it is crucial to fill the Accounting Manager vacancy in the Bursar's office as soon as possible. The Accounting Manager will be vital in overseeing the reconciliation processes, managing refund operations, and improving our financial practices moving forward. This position is essential not only for ensuring accuracy in financial reporting but also for proactively addressing and resolving any discrepancies that may arise. The Vice President of Business and Finance will coordinate with the Bursar’s Office and the Human Resources Department to ensure the timely recruitment and hiring of a qualified candidate.

Finding Number 2024-003 Assistance Listing Number 84.063 and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-004 Pass-Through Entity N/A Questioned Costs N/A FINDING For the federal Direct Loan and Pell Grant programs, Tennessee State University continued to not report timely and accurate information regarding students’ enrollment statuses BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For student recipients of Pell Grants or Direct Loans, ED requires institutions to report students’ enrollment statuses for each term to the National Student Loan Data System (NSLDS). The institution is also required to report changes to students’ enrollment, such as graduations, withdrawals, and transitions between full-time and part-time status. CONDITION Tennessee State University management, as noted in the prior finding, hired additional staff and communicated the withdrawal process in training and staff meetings. These corrections did not resolve the issues around enrollment reporting and withdrawal dates. We tested a sample of 60 Direct Loan borrowers and/or Pell Grant recipients at TSU. For these 60 students, TSU should have reported to NSLDS 75 separate incidents of an enrollment status change. As of November 8, 2024, the day of our testwork, we found that for 17 of 75 (23%) status changes tested, TSU either did not report any information, reported incorrect information, or did not timely report the status change to NSLDS. These errors impacted 16 of 60 (27%) students tested. Not Reported • For 3 students, management could not locate any record of enrollment history in NSLDS for some terms the students attended. Of the 3 students, management could not locate an NSLDS account for one student, indicating that TSU management did not report any information in NSLDS for the student. For the remaining 2 students, the enrollment history was missing for terms the student attended. The missing terms for these two students resulted in a combined 3 enrollment changes not being reported. • For 2 students, NSLDS showed a status of “No Record Found” for TSU’s enrollment records. This code should only be used if the school is closing, merging, or has become ineligible. TSU likely entered incorrect or inconsistent data, which can also generate the code. • The Enrollment Services Office did not properly enter a graduation for one student. The student completed the requirements for graduation on December 8, 2023. The failure to report the graduation likely occurred because the student had an account balance that was not paid off until December 9, 2023, the day after the graduation list would have been produced. However, as of the date of our testwork, November 8, 2024, the graduation had still not been reported to NSLDS. Reported Incorrectly • The Enrollment Services Office incorrectly reported enrollment status changes for 4 students during the summer semester. These students were purged during the summer semester due to failure to pay, reducing their hours enrolled to zero. The students were subsequently reported as withdrawn. However, when students reduce their course load below half-time during a summer term, they should maintain their spring status when half-time or greater. Therefore, the students should have been reported as full-time, rather than withdrawn. In addition, 2 of these 4 students had already completed and received grades for courses in Maymester, a month-long term within the summer semester, at the time they were purged. Despite completion, these classes were deleted from the system, including the grades and charges. • For one student, the Enrollment Services Office incorrectly reported the student as three-quarter time for the spring 2024 term despite the student’s attempting 13 hours during the term, which should have been reported as full-time. Reported Untimely • The Enrollment Services Office did not report the full-time status for one student until 80 days after the first day of the spring 2024 term, 20 days late. Students with Multiple Enrollment Reporting Issues • For one student, the Enrollment Services Office had not reported the student’s graduation on May 6, 2024, as of the date of our testwork, November 8, 2024. In addition, the student’s program in NSLDS recorded a major different from the university’s information system. • The Enrollment Services Office entered one student as less than half-time in the spring semester despite the student’s being enrolled in 9 hours, which should have been reported as three-quarter time. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. • The Enrollment Services Office entered one student as three-quarter time in the spring semester despite the student’s being enrolled in 12 hours, which should have been reported as full-time. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. • The Enrollment Services Office entered one graduate student as half-time in the spring semester despite the student’s being enrolled in 9 hours, which is considered full-time for graduate students. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. CRITERIA Federal Guidance The Federal Student Aid Handbook, Volume 2, Chapter 3, states that institutions “must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that file.” In the introduction to Chapter 1, the NSLDS Enrollment Reporting Guide states, “Accurate and timely Enrollment Reporting to NSLDS is essential to the Department of Education’s successful delivery of Title IV aid.” The requirements are established in Title 34, Code of Federal Regulations, Section 685.309(b). In Chapter 4, the NSLDS Enrollment Reporting Guide states . . . if the student enrolls in the summer term (or other non-required terms) at least half time, the student’s actual summer enrollment status is reported. If such a student subsequently withdraws from the summer term, the student’s most recent enrollment status of half time or greater should be reported throughout the remainder of the summer. In addition, Chapter 7 of the NSLDS Enrollment Reporting Guide states, “NSLDS records must be accurately matched with your enrollment records. You should review, update, or verify student enrollment statuses and other information with information that appears on the Enrollment Reporting Roster file.” CAUSE Management did not provide information to determine the cause or offer any possible explanations for the late status updates and the incorrect status reporting. Based on our review, TSU did not adequately review enrollment information in NSLDS to ensure changes were accurately reported. Adequately reviewing a sample of the information uploaded to NSLDS would have quickly determined the significant issues with the university enrollment reporting process. Furthermore, the Enrollment Services Office does not have sufficient knowledge or training on the specific summer reporting rules; instead, the office treats the summer term identically to the fall and spring terms. EFFECT Timely and accurate enrollment reporting is critical for effective management of ED programs. The accurate administration of the Title IV programs depends heavily on the accuracy of the enrollment information reported by schools. Accurate, timely, and complete enrollment data is also important to the students, who can view their current campus enrollment information and their program enrollment history. Also, if an individual no longer attends TSU but their lack of attendance is not reported, the individual’s loan repayment grace period could be improperly extended, resulting in the student’s loan repayments being improperly deferred. In addition, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate its participation in a Title IV program. These actions would negatively affect the university’s operations and the students impacted by the loss of Title IV aid. RECOMMENDATION TSU management should review and update its processes as necessary to ensure the Enrollment Services Office uploads and submits the correct information to NSLDS. In addition, the Assistant Vice President of Admissions and Records should ensure that staff know reporting deadlines, the importance of reporting enrollment status changes, and the summer reporting guidelines. The Assistant Vice President of Admissions and Records should also ensure that enrollment status changes are reported timely and the Financial Aid Office is promptly notified. TSU management should implement a review throughout each term to verify that the accurate information is reported in NSLDS. MANAGEMENT’S COMMENT We concur. TSU is firmly committed to ensuring accurate and timely reporting for the federal Direct Loan and Pell Grant programs, recognizing the importance of accurate data in supporting student financing and institutional integrity. To enhance the effectiveness of this process, the university has hired a Data Analyst whose primary responsibility is to manage and oversee enrollment reporting processes. The Office of Admissions and Records has also undertaken a review and update of its operational procedures with an outside consultant. This enhancement aims to ensure that the Enrollment Services Office uploads and submits the correct, up-to-date information to the National Student Clearinghouse (NSLDS), thereby minimizing the risk of discrepancies and ensuring compliance with federal guidelines. Updates to the NSLDS will be conducted following the census date, with a consistent reporting schedule planned for every 30 to 45 days thereafter, in addition to comprehensive submissions at the end of each academic term. This structured approach ensures that all enrollment changes, including withdrawals and adjustments in student status, are communicated promptly and accurately. If any errors are identified during these reporting processes, corrective measures will be initiated within a timeframe of 5 to 7 business days to rectify the issues, maintaining the integrity of the data reported. To improve clarity and ensure the successful implementation of these updates, the withdrawal process was thoroughly communicated to staff through dedicated training sessions and regular staff meetings. The combination of staff meetings and targeted training initiatives will ensure that all team members are thoroughly prepared to uphold the university's commitment to accurate reporting and strong student support.

Finding Number 2024-003 Assistance Listing Number 84.063 and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-004 Pass-Through Entity N/A Questioned Costs N/A FINDING For the federal Direct Loan and Pell Grant programs, Tennessee State University continued to not report timely and accurate information regarding students’ enrollment statuses BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For student recipients of Pell Grants or Direct Loans, ED requires institutions to report students’ enrollment statuses for each term to the National Student Loan Data System (NSLDS). The institution is also required to report changes to students’ enrollment, such as graduations, withdrawals, and transitions between full-time and part-time status. CONDITION Tennessee State University management, as noted in the prior finding, hired additional staff and communicated the withdrawal process in training and staff meetings. These corrections did not resolve the issues around enrollment reporting and withdrawal dates. We tested a sample of 60 Direct Loan borrowers and/or Pell Grant recipients at TSU. For these 60 students, TSU should have reported to NSLDS 75 separate incidents of an enrollment status change. As of November 8, 2024, the day of our testwork, we found that for 17 of 75 (23%) status changes tested, TSU either did not report any information, reported incorrect information, or did not timely report the status change to NSLDS. These errors impacted 16 of 60 (27%) students tested. Not Reported • For 3 students, management could not locate any record of enrollment history in NSLDS for some terms the students attended. Of the 3 students, management could not locate an NSLDS account for one student, indicating that TSU management did not report any information in NSLDS for the student. For the remaining 2 students, the enrollment history was missing for terms the student attended. The missing terms for these two students resulted in a combined 3 enrollment changes not being reported. • For 2 students, NSLDS showed a status of “No Record Found” for TSU’s enrollment records. This code should only be used if the school is closing, merging, or has become ineligible. TSU likely entered incorrect or inconsistent data, which can also generate the code. • The Enrollment Services Office did not properly enter a graduation for one student. The student completed the requirements for graduation on December 8, 2023. The failure to report the graduation likely occurred because the student had an account balance that was not paid off until December 9, 2023, the day after the graduation list would have been produced. However, as of the date of our testwork, November 8, 2024, the graduation had still not been reported to NSLDS. Reported Incorrectly • The Enrollment Services Office incorrectly reported enrollment status changes for 4 students during the summer semester. These students were purged during the summer semester due to failure to pay, reducing their hours enrolled to zero. The students were subsequently reported as withdrawn. However, when students reduce their course load below half-time during a summer term, they should maintain their spring status when half-time or greater. Therefore, the students should have been reported as full-time, rather than withdrawn. In addition, 2 of these 4 students had already completed and received grades for courses in Maymester, a month-long term within the summer semester, at the time they were purged. Despite completion, these classes were deleted from the system, including the grades and charges. • For one student, the Enrollment Services Office incorrectly reported the student as three-quarter time for the spring 2024 term despite the student’s attempting 13 hours during the term, which should have been reported as full-time. Reported Untimely • The Enrollment Services Office did not report the full-time status for one student until 80 days after the first day of the spring 2024 term, 20 days late. Students with Multiple Enrollment Reporting Issues • For one student, the Enrollment Services Office had not reported the student’s graduation on May 6, 2024, as of the date of our testwork, November 8, 2024. In addition, the student’s program in NSLDS recorded a major different from the university’s information system. • The Enrollment Services Office entered one student as less than half-time in the spring semester despite the student’s being enrolled in 9 hours, which should have been reported as three-quarter time. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. • The Enrollment Services Office entered one student as three-quarter time in the spring semester despite the student’s being enrolled in 12 hours, which should have been reported as full-time. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. • The Enrollment Services Office entered one graduate student as half-time in the spring semester despite the student’s being enrolled in 9 hours, which is considered full-time for graduate students. In addition, this status was not entered until May 22, 2024, 127 days after the semester start date, or 67 days late. CRITERIA Federal Guidance The Federal Student Aid Handbook, Volume 2, Chapter 3, states that institutions “must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that file.” In the introduction to Chapter 1, the NSLDS Enrollment Reporting Guide states, “Accurate and timely Enrollment Reporting to NSLDS is essential to the Department of Education’s successful delivery of Title IV aid.” The requirements are established in Title 34, Code of Federal Regulations, Section 685.309(b). In Chapter 4, the NSLDS Enrollment Reporting Guide states . . . if the student enrolls in the summer term (or other non-required terms) at least half time, the student’s actual summer enrollment status is reported. If such a student subsequently withdraws from the summer term, the student’s most recent enrollment status of half time or greater should be reported throughout the remainder of the summer. In addition, Chapter 7 of the NSLDS Enrollment Reporting Guide states, “NSLDS records must be accurately matched with your enrollment records. You should review, update, or verify student enrollment statuses and other information with information that appears on the Enrollment Reporting Roster file.” CAUSE Management did not provide information to determine the cause or offer any possible explanations for the late status updates and the incorrect status reporting. Based on our review, TSU did not adequately review enrollment information in NSLDS to ensure changes were accurately reported. Adequately reviewing a sample of the information uploaded to NSLDS would have quickly determined the significant issues with the university enrollment reporting process. Furthermore, the Enrollment Services Office does not have sufficient knowledge or training on the specific summer reporting rules; instead, the office treats the summer term identically to the fall and spring terms. EFFECT Timely and accurate enrollment reporting is critical for effective management of ED programs. The accurate administration of the Title IV programs depends heavily on the accuracy of the enrollment information reported by schools. Accurate, timely, and complete enrollment data is also important to the students, who can view their current campus enrollment information and their program enrollment history. Also, if an individual no longer attends TSU but their lack of attendance is not reported, the individual’s loan repayment grace period could be improperly extended, resulting in the student’s loan repayments being improperly deferred. In addition, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate its participation in a Title IV program. These actions would negatively affect the university’s operations and the students impacted by the loss of Title IV aid. RECOMMENDATION TSU management should review and update its processes as necessary to ensure the Enrollment Services Office uploads and submits the correct information to NSLDS. In addition, the Assistant Vice President of Admissions and Records should ensure that staff know reporting deadlines, the importance of reporting enrollment status changes, and the summer reporting guidelines. The Assistant Vice President of Admissions and Records should also ensure that enrollment status changes are reported timely and the Financial Aid Office is promptly notified. TSU management should implement a review throughout each term to verify that the accurate information is reported in NSLDS. MANAGEMENT’S COMMENT We concur. TSU is firmly committed to ensuring accurate and timely reporting for the federal Direct Loan and Pell Grant programs, recognizing the importance of accurate data in supporting student financing and institutional integrity. To enhance the effectiveness of this process, the university has hired a Data Analyst whose primary responsibility is to manage and oversee enrollment reporting processes. The Office of Admissions and Records has also undertaken a review and update of its operational procedures with an outside consultant. This enhancement aims to ensure that the Enrollment Services Office uploads and submits the correct, up-to-date information to the National Student Clearinghouse (NSLDS), thereby minimizing the risk of discrepancies and ensuring compliance with federal guidelines. Updates to the NSLDS will be conducted following the census date, with a consistent reporting schedule planned for every 30 to 45 days thereafter, in addition to comprehensive submissions at the end of each academic term. This structured approach ensures that all enrollment changes, including withdrawals and adjustments in student status, are communicated promptly and accurately. If any errors are identified during these reporting processes, corrective measures will be initiated within a timeframe of 5 to 7 business days to rectify the issues, maintaining the integrity of the data reported. To improve clarity and ensure the successful implementation of these updates, the withdrawal process was thoroughly communicated to staff through dedicated training sessions and regular staff meetings. The combination of staff meetings and targeted training initiatives will ensure that all team members are thoroughly prepared to uphold the university's commitment to accurate reporting and strong student support.

Finding Number 2024-004 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-005 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.007 Federal Award Identification Number P007A073927 Amount $239 Assistance Listing Number 84.063 Federal Award Identification Number P063P070381 Amount $4,754 FINDING Tennessee State University continued not to return Title IV funds in compliance with federal regulations BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For Title IV recipients who did not complete at least 60% of the semester, the school is required to perform a calculation to determine the amount of unearned aid that it must return to ED. CONDITION In response to the prior audit finding, management stated the university created and hired an Assistant Director of Compliance. Management also stated they would implement a daily review of the Return to Title IV report by both the Financial Aid and Records office. These updates were insufficient in addressing the ongoing compliance issues. We tested two groups of students who officially or unofficially withdrew from classes at Tennessee State University (TSU) during the 2023–2024 award year. First, we selected 15 student withdrawals from a population of 43 students who had an official or unofficial withdrawal before the 60% completion date. We tested these withdrawn students to ensure that withdrawal dates were accurate, that calculations were performed correctly, and that amounts were returned to ED within the required timeframes. Of the 15 student withdrawals, we noted 13 (87%) contained errors. Of the 13 errors, TSU did not return the Title IV funds to ED within the required timeframe for two students, and TSU did not calculate the correct return of the Title IV funds to ED for eight students. For the remaining three students, TSU did not calculate the correct return of the Title IV funds and did not return the funds within the required timeframes. In addition to the above errors, TSU management was not able to provide withdrawal forms for 2 of the 15 students (13%). We tested these students based on the date of withdrawal noted in the university’s information system; however, we were unable to verify this date. One of the student withdrawals was otherwise correct, while the other is included as an error below. Of the 15 errors, 11 were the result of incorrect calculation of return of funds. Specifically, • For 5 students, TSU calculated the returns with withdrawal dates 7-35 days after the students signed and submitted their withdrawal documentation. This resulted in questioned costs of $1,959. • For 1 student, TSU did not return the full amount of Title IV funds to ED even though the student submitted withdrawal documentation before the start of the semester. TSU returned $1,453; however, the full amount of $2,773 should have been considered an overaward and fully returned. This led to questioned costs of $1,320. • For 1 student, TSU did not enter the correct amount of the student’s Pell disbursement in the return calculation. This led to TSU calculating and returning from university funds $3,272, which was $1,276 more than necessary. • For 3 students, TSU did not enter the correct institutional charges in the return calculation but instead used cost of attendance. This led to TSU calculating and returning $8,328 more than necessary from university funds. • For 1 student, TSU calculated the return based on an end of attendance that was three days before the student signed their withdrawal form. This led to TSU calculating and returning from university funds $2,638, which was $165 more than necessary In addition to the above, we noted that for 5 of the 15 student withdrawals tested (33%), TSU did not return the Title IV funds within the applicable timeframes. The timeframes are 30 days after the school becomes aware of the withdrawal if the student never began attendance for the semester and 45 days if the student withdrew during the semester. Of the 5 students, 3 were included above due to also having calculation errors, while TSU correctly calculated the return for the remaining two students. • For two students, TSU returned funds 139 and 259 days after TSU processed the students’ withdrawal forms. As these withdrawals occurred during the semester, the 45-day timeframe was applicable, resulting in the returns being between 94 and 214 days late. • For two students, the school applied charges and Title IV aid to the students’ accounts for the fall 2023 semester based on information from the FAFSA; however, both submitted withdrawal forms before the start of the semester. Despite receiving the forms before the semester, TSU did not process the withdrawals until October 9, 2023, while the return of funds was not completed until October 31, 2023, for one student and June 11, 2024, for the other student. ED specifies that awards to students who never begin attendance are overawards and must be returned within 30 days after the school has determined the student did not begin attendance. For these 2 students, TSU returned funds 74 and 258 days after the student made TSU aware of their withdrawal, or 44 and 228 days late. • For the remaining student, TSU initially processed a return of Title IV funds on October 31, 2023, after the student had notified TSU of their withdrawal for the fall 2023 semester on October 4, 2023. However, when the student registered for spring 2024 classes, federal direct loans were added, and the original return of Title IV funds was reversed. The incorrect reversal and posting of additional funds were not corrected until June 19, 2024, when the return of Title IV funds calculation was recomputed. The corrections were made 259 days after the date of withdrawal, 214 days late. We also selected a sample of 15 from a population of 21 students who completed over 60% of the semester in which they withdrew to ensure that TSU recorded the withdrawal dates correctly, had adequate attendance records to support the withdrawal date, and did not remove Title IV funds from the account. Of the original 15 sample items, we noted 1 (6.7%) error. For this 1 student, TSU entered a withdrawal date beyond the 60% point of the semester; however, the student signed their withdrawal form 7 days before the 60% point. This resulted in $1,714 in questioned costs. Due to the high number of errors and the significant percentage of the overall withdrawal population tested, 30 of 64, or 47%, we determined that additional testwork was not required. CRITERIA The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 1, page 3, states, A pro rata schedule is used to determine the amount of FSA [Federal Student Aid] funds the student has earned at the time of withdrawal up through the 60% point in each payment period or period of enrollment. After the 60% point in the payment period or period of enrollment, a student has earned 100% of the FSA funds the student received and was scheduled to receive during the period. The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 2, page 92, states, • Student’s Withdrawal Date Official notification – The date the student begins the school’s withdrawal process, or the date that the student otherwise provides notification (If both circumstances occur, use the earlier withdrawal date) • Official notification not provided – The date that the school determines is related to the circumstance beyond the student’s control, or the midpoint of the payment period or period of enrollment, as applicable • Alternative approach – In place of the dates listed, a school may always use, as a student’s withdrawal date, the student’s last date of attendance at an academically related activity if the school documents that the activity is academically related and that the student attended the activity. The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 3, page 3, states, Schools must return funds disbursed to a student who failed to begin attendance as soon as possible but no later than 30 days after the date they become aware that the student has not begun and will not begin attendance [emphasis in original]. The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 2, page 39, states, An institution is not required to return the inadvertent overpayment immediately but must return it within 45 days of the date of the institution’s determination that the student withdrew (the time frame for an institution’s return of Title IV funds under 34 CFR 668.22(j)(1)). An institution must return an inadvertent overpayment in accordance with the applicable regulations for returning overpayments. Please see Volume 4, Chapter 3 for more information on overpayment procedures [emphasis in original]. CAUSE Based on our review, it appears that TSU management did not have proper oversight and review procedures over the return of Title IV funds, as we noted multiple issues regarding both the calculation itself as well as the timing. Specifically, TSU performed the Title IV return calculation using cost of attendance instead of institutional charges and entered the withdrawal date as the date the withdrawal was processed instead of the last date the student attended or the date on the signed withdrawal forms. In addition, TSU did not have a system in place to ensure all withdrawals and returns were processed timely. EFFECT For the 30 students tested, TSU calculated a total return of $39,133 in Title IV funds. The corrected total after adjustment for the errors we noted in our testwork was $34,361. TSU overreturned funds to students by $9,769 and underreturned funds to other students by a total of $4,993. The $4,993 was identified as questioned costs. Violations of the federal requirement to timely return Title IV funds to ED could result in ED imposing a fine on TSU and/or limiting, suspending, or terminating TSU’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. In addition, incorrect return calculations and/or withdrawal dates can negatively impact students. If TSU incorrectly calculates and returns the amount of unearned aid to ED, it could impact the amount of aid the student is eligible to receive in future terms or result in a student having an account balance in error. RECOMMENDATION The Registrar’s Office and the Financial Aid Office should follow federal regulations. Management should ensure that the Financial Aid Office reperforms all return of Title IV funds calculations and makes necessary corrections to student and federal fund accounts for the 2023–2024 academic year. Finally, TSU should ensure that the Registrar’s Office communicates any withdrawals to the Financial Aid Office in a timely manner. MANAGEMENT’S COMMENT We concur. The Office of Financial Aid is set to conduct a comprehensive review of the Title IV funds for the 2023-2024 academic year in February 2025, with the review anticipated to be completed by the end of April 2025. The communication process between the Registrar’s Office and Financial Aid begins with a detailed examination of the daily Withdrawal Report generated by the Registrar’s Office. Upon receiving this report, an acknowledgment email will be sent to confirm its review. To facilitate accurate calculations regarding the return of funds, specific parameters will be established within the Banner system. These parameters will support the Funds Calculation process in determining the correct return amounts owed. Our team is actively working with outside consultants to restructure and enhance our financial aid processes. This collaboration aims to significantly update our existing policies and procedures, preventing compliance issues in the future while fostering a more efficient system. An important aspect of this process is how the effective date of withdrawals is determined. The Registrar’s Office must use the date on which the student submitted their withdrawal form as the official effective date. By accurately recording this date in the Student Course Registration system, we can ensure that the student’s information is correctly reflected on the Withdrawal Report. Having the right effective date is crucial for maintaining accurate academic records and complying with federal regulations. TSU, in conjunction with its consultant, will help identify students with the correct withdrawal dates in the Registrar’s Office and will also work with Student Accounts to ensure that the appropriate institutional charges are used in all calculations. Finally, the Withdrawal Report can be scheduled within the job scheduler to run automatically and on time each day. This scheduling will contribute to a smoother workflow, allowing for any necessary adjustments to be made efficiently. By employing the Banner-delivered process for funds calculation, we will ensure that the actual charges incurred by the student are used in the calculation of returns instead of the predetermined cost of attendance, leading to more accurate financial assessments.

Finding Number 2024-004 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2023-005 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.007 Federal Award Identification Number P007A073927 Amount $239 Assistance Listing Number 84.063 Federal Award Identification Number P063P070381 Amount $4,754 FINDING Tennessee State University continued not to return Title IV funds in compliance with federal regulations BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For Title IV recipients who did not complete at least 60% of the semester, the school is required to perform a calculation to determine the amount of unearned aid that it must return to ED. CONDITION In response to the prior audit finding, management stated the university created and hired an Assistant Director of Compliance. Management also stated they would implement a daily review of the Return to Title IV report by both the Financial Aid and Records office. These updates were insufficient in addressing the ongoing compliance issues. We tested two groups of students who officially or unofficially withdrew from classes at Tennessee State University (TSU) during the 2023–2024 award year. First, we selected 15 student withdrawals from a population of 43 students who had an official or unofficial withdrawal before the 60% completion date. We tested these withdrawn students to ensure that withdrawal dates were accurate, that calculations were performed correctly, and that amounts were returned to ED within the required timeframes. Of the 15 student withdrawals, we noted 13 (87%) contained errors. Of the 13 errors, TSU did not return the Title IV funds to ED within the required timeframe for two students, and TSU did not calculate the correct return of the Title IV funds to ED for eight students. For the remaining three students, TSU did not calculate the correct return of the Title IV funds and did not return the funds within the required timeframes. In addition to the above errors, TSU management was not able to provide withdrawal forms for 2 of the 15 students (13%). We tested these students based on the date of withdrawal noted in the university’s information system; however, we were unable to verify this date. One of the student withdrawals was otherwise correct, while the other is included as an error below. Of the 15 errors, 11 were the result of incorrect calculation of return of funds. Specifically, • For 5 students, TSU calculated the returns with withdrawal dates 7-35 days after the students signed and submitted their withdrawal documentation. This resulted in questioned costs of $1,959. • For 1 student, TSU did not return the full amount of Title IV funds to ED even though the student submitted withdrawal documentation before the start of the semester. TSU returned $1,453; however, the full amount of $2,773 should have been considered an overaward and fully returned. This led to questioned costs of $1,320. • For 1 student, TSU did not enter the correct amount of the student’s Pell disbursement in the return calculation. This led to TSU calculating and returning from university funds $3,272, which was $1,276 more than necessary. • For 3 students, TSU did not enter the correct institutional charges in the return calculation but instead used cost of attendance. This led to TSU calculating and returning $8,328 more than necessary from university funds. • For 1 student, TSU calculated the return based on an end of attendance that was three days before the student signed their withdrawal form. This led to TSU calculating and returning from university funds $2,638, which was $165 more than necessary In addition to the above, we noted that for 5 of the 15 student withdrawals tested (33%), TSU did not return the Title IV funds within the applicable timeframes. The timeframes are 30 days after the school becomes aware of the withdrawal if the student never began attendance for the semester and 45 days if the student withdrew during the semester. Of the 5 students, 3 were included above due to also having calculation errors, while TSU correctly calculated the return for the remaining two students. • For two students, TSU returned funds 139 and 259 days after TSU processed the students’ withdrawal forms. As these withdrawals occurred during the semester, the 45-day timeframe was applicable, resulting in the returns being between 94 and 214 days late. • For two students, the school applied charges and Title IV aid to the students’ accounts for the fall 2023 semester based on information from the FAFSA; however, both submitted withdrawal forms before the start of the semester. Despite receiving the forms before the semester, TSU did not process the withdrawals until October 9, 2023, while the return of funds was not completed until October 31, 2023, for one student and June 11, 2024, for the other student. ED specifies that awards to students who never begin attendance are overawards and must be returned within 30 days after the school has determined the student did not begin attendance. For these 2 students, TSU returned funds 74 and 258 days after the student made TSU aware of their withdrawal, or 44 and 228 days late. • For the remaining student, TSU initially processed a return of Title IV funds on October 31, 2023, after the student had notified TSU of their withdrawal for the fall 2023 semester on October 4, 2023. However, when the student registered for spring 2024 classes, federal direct loans were added, and the original return of Title IV funds was reversed. The incorrect reversal and posting of additional funds were not corrected until June 19, 2024, when the return of Title IV funds calculation was recomputed. The corrections were made 259 days after the date of withdrawal, 214 days late. We also selected a sample of 15 from a population of 21 students who completed over 60% of the semester in which they withdrew to ensure that TSU recorded the withdrawal dates correctly, had adequate attendance records to support the withdrawal date, and did not remove Title IV funds from the account. Of the original 15 sample items, we noted 1 (6.7%) error. For this 1 student, TSU entered a withdrawal date beyond the 60% point of the semester; however, the student signed their withdrawal form 7 days before the 60% point. This resulted in $1,714 in questioned costs. Due to the high number of errors and the significant percentage of the overall withdrawal population tested, 30 of 64, or 47%, we determined that additional testwork was not required. CRITERIA The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 1, page 3, states, A pro rata schedule is used to determine the amount of FSA [Federal Student Aid] funds the student has earned at the time of withdrawal up through the 60% point in each payment period or period of enrollment. After the 60% point in the payment period or period of enrollment, a student has earned 100% of the FSA funds the student received and was scheduled to receive during the period. The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 2, page 92, states, • Student’s Withdrawal Date Official notification – The date the student begins the school’s withdrawal process, or the date that the student otherwise provides notification (If both circumstances occur, use the earlier withdrawal date) • Official notification not provided – The date that the school determines is related to the circumstance beyond the student’s control, or the midpoint of the payment period or period of enrollment, as applicable • Alternative approach – In place of the dates listed, a school may always use, as a student’s withdrawal date, the student’s last date of attendance at an academically related activity if the school documents that the activity is academically related and that the student attended the activity. The 2023–2024 Federal Student Aid Handbook, Volume 4, Chapter 3, page 3, states, Schools must return funds disbursed to a student who failed to begin attendance as soon as possible but no later than 30 days after the date they become aware that the student has not begun and will not begin attendance [emphasis in original]. The 2023–2024 Federal Student Aid Handbook, Volume 5, Chapter 2, page 39, states, An institution is not required to return the inadvertent overpayment immediately but must return it within 45 days of the date of the institution’s determination that the student withdrew (the time frame for an institution’s return of Title IV funds under 34 CFR 668.22(j)(1)). An institution must return an inadvertent overpayment in accordance with the applicable regulations for returning overpayments. Please see Volume 4, Chapter 3 for more information on overpayment procedures [emphasis in original]. CAUSE Based on our review, it appears that TSU management did not have proper oversight and review procedures over the return of Title IV funds, as we noted multiple issues regarding both the calculation itself as well as the timing. Specifically, TSU performed the Title IV return calculation using cost of attendance instead of institutional charges and entered the withdrawal date as the date the withdrawal was processed instead of the last date the student attended or the date on the signed withdrawal forms. In addition, TSU did not have a system in place to ensure all withdrawals and returns were processed timely. EFFECT For the 30 students tested, TSU calculated a total return of $39,133 in Title IV funds. The corrected total after adjustment for the errors we noted in our testwork was $34,361. TSU overreturned funds to students by $9,769 and underreturned funds to other students by a total of $4,993. The $4,993 was identified as questioned costs. Violations of the federal requirement to timely return Title IV funds to ED could result in ED imposing a fine on TSU and/or limiting, suspending, or terminating TSU’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. In addition, incorrect return calculations and/or withdrawal dates can negatively impact students. If TSU incorrectly calculates and returns the amount of unearned aid to ED, it could impact the amount of aid the student is eligible to receive in future terms or result in a student having an account balance in error. RECOMMENDATION The Registrar’s Office and the Financial Aid Office should follow federal regulations. Management should ensure that the Financial Aid Office reperforms all return of Title IV funds calculations and makes necessary corrections to student and federal fund accounts for the 2023–2024 academic year. Finally, TSU should ensure that the Registrar’s Office communicates any withdrawals to the Financial Aid Office in a timely manner. MANAGEMENT’S COMMENT We concur. The Office of Financial Aid is set to conduct a comprehensive review of the Title IV funds for the 2023-2024 academic year in February 2025, with the review anticipated to be completed by the end of April 2025. The communication process between the Registrar’s Office and Financial Aid begins with a detailed examination of the daily Withdrawal Report generated by the Registrar’s Office. Upon receiving this report, an acknowledgment email will be sent to confirm its review. To facilitate accurate calculations regarding the return of funds, specific parameters will be established within the Banner system. These parameters will support the Funds Calculation process in determining the correct return amounts owed. Our team is actively working with outside consultants to restructure and enhance our financial aid processes. This collaboration aims to significantly update our existing policies and procedures, preventing compliance issues in the future while fostering a more efficient system. An important aspect of this process is how the effective date of withdrawals is determined. The Registrar’s Office must use the date on which the student submitted their withdrawal form as the official effective date. By accurately recording this date in the Student Course Registration system, we can ensure that the student’s information is correctly reflected on the Withdrawal Report. Having the right effective date is crucial for maintaining accurate academic records and complying with federal regulations. TSU, in conjunction with its consultant, will help identify students with the correct withdrawal dates in the Registrar’s Office and will also work with Student Accounts to ensure that the appropriate institutional charges are used in all calculations. Finally, the Withdrawal Report can be scheduled within the job scheduler to run automatically and on time each day. This scheduling will contribute to a smoother workflow, allowing for any necessary adjustments to be made efficiently. By employing the Banner-delivered process for funds calculation, we will ensure that the actual charges incurred by the student are used in the calculation of returns instead of the predetermined cost of attendance, leading to more accurate financial assessments.

Finding Number 2024-005 Assistance Listing Number 10.553, 10.555, 10.556, and 10.582 Program Name Child Nutrition Cluster Federal Agency Department of Agriculture State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Education did not comply with Federal Funding Accountability and Transparency Act reporting requirements for the Child Nutrition Cluster and did not implement the designed internal control over the reporting requirements BACKGROUND The Department of Education (the department) is the pass-through entity for the Child Nutrition Cluster,(2) which is administered by the Food and Nutrition Service of the U.S. Department of Agriculture. The Child Nutrition Cluster is a cluster of federal programs to provide healthful, nutritious meals and snacks to eligible children in public schools and nonprofit private schools, residential childcare institutions, and summer recreation programs. See Schedule of Findings and Questioned Costs for footnote. For the School Breakfast Program, the National School Lunch Program, and the Special Milk Program for Children, the department enters into agreements with subrecipient organizations, known as School Food Authorities (SFAs), for local-level program operation and the delivery of program services to eligible children. The department reimburses SFAs for each meal or snack served based on the rates established by the U.S. Department of Agriculture. Each month, the SFAs claim the number of meals or snacks served using the department’s Tennessee: Meals, Accounting, and Claiming (TMAC) system. For the Fresh Fruit and Vegetable Program(3), the department enters into additional agreements with approved SFAs for eligible elementary schools within those SFAs for local-level program operation and the delivery of program services to eligible children. The department awards a grant amount for each elementary school based on a rate set per child by the department. Each month, the SFAs claim the costs from procurement, operations, and administration using the department’s TMAC system. See Schedule of Findings and Questioned Costs for footnote. The Federal Funding and Accountability Transparency Act (FFATA) requires the department to report subrecipient subaward financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. According to federal regulations, reports are due “no later than the end of the month following the month in which the obligation was made.” The subaward information in FSRS is then available to the public on the USA Spending website for transparency. CONDITION AND CAUSE Based on our discussion with management, because management had not implemented cross-training for backups as outlined in their designed internal controls for succession planning, staff was not aware of the requirement and therefore, did not complete any FFATA reporting for the Child Nutrition Cluster for the entire fiscal year. Based on our review of the claim information for the year, staff did not report 189 SFAs’ Child Nutrition subawards,(4) totaling $449,928,320 and 25 FFVP subawards, totaling $4,499,375. See Schedule of Findings and Questioned Costs for footnote. The former Federal Reporting Specialist who was responsible for FFATA reporting left the department in September 2023. At the time he left, he had not done any reporting for fiscal year 2024. When the current State Director of School Nutrition began in his role in March 2024, the Assistant Commissioner had not reassigned the FFATA reporting tasks and did not inform the newly hired State Director to reassign the FFATA reporting responsibilities thus the State Director was unaware of the reporting requirement. We first inquired about the department’s current FFATA reporting process on July 1, 2024. The Data Processing and Reporting Specialist(5) who is currently responsible for FFATA reporting took the role on July 8, 2024. She requested access to FSRS almost immediately and after following up, received access on September 4, 2024. See Schedule of Findings and Questioned Costs for footnote. On August 7, 2024, the current State Director of School Nutrition provided us the FFATA Reporting Process Plan, effective October 2022, that was maintained in the former Federal Reporting Specialist’s files. The process plan includes the owner of the process, a description of the process, the statute or regulation that requires it, the team members associated with the process as well as their role, and risks associated with the process. While the process plan lists the team member responsible for reporting as well as a backup; neither one submitted the required reports. We also reviewed the Department of Education’s 2024 Financial Integrity Act Risk Assessment and determined that despite the fact that management’s documented process plan and risk assessment identified the risks, management did not include all mitigating controls and did not follow through with effective implementation of all the mitigating controls and, as such, the backup was not trained and was unaware of the FFATA responsibilities and requirements. When we brought the FFATA reporting deficiency to management’s attention, management stated that they had begun creating and implementing a standard operating procedure and are in the process of uploading the FFATA reports for fiscal year 2024. We will audit the FFATA reporting requirements for the Child Nutrition Cluster during the next audit. CRITERIA FFATA Reporting Appendix A to “Reporting Subaward and Executive Compensation Information,” Title 2, Code of Federal Regulations (CFR), Part 170, states: a. Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. EFFECT Not meeting the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner should work with staff to ensure that when turnover occurs, new staff are fully informed about the scope of their responsibilities and have access to the resources needed to perform them, such as FSRS access and the newly developed standard operating procedures. Management should evaluate the identified mitigating controls for risks associated with the conditions identified in this finding to ensure they are appropriately designed, assigned, and that they are implemented. Management should update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need to ensure that new staff are fully informed about the scope of their responsibilities and have access to essential resources, such as FSRS access and the newly developed standard operating procedures. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Onboarding and Resource Access: • The Division of Human Resources will work closely with management to ensure each office and division maintains a robust onboarding process, ensuring that new employees are fully informed about their responsibilities and have access to all necessary resources. • The Deputy Commissioner will designate a single point of contact for FSRS reporting coordination within the agency and ensure standard operating procedures are updated accordingly to reflect onboarding requirements of new staff with FSRS reporting responsibilities. • Regular training sessions will be conducted to keep new and existing staff up to date with any changes in procedures and responsibilities. 2. Evaluation of Mitigating Controls: • Management will carefully evaluate the identified mitigating controls for the risks associated with the conditions mentioned in the audit finding. • We will ensure that these controls are appropriately designed, assigned, and effectively implemented to mitigate any potential risks. 3. Risk Assessment Updates: • The risk assessment will be updated regularly to reflect any changes in the operational environment, identified risks, and the effectiveness of mitigating controls. • This process will involve continuous monitoring and review to ensure that the risk assessment remains relevant and effective. 4. Ongoing Monitoring and Accountability: • The Deputy Commissioner will assign the Chief Operating Officer to continually monitor risks and assess the effectiveness of mitigating controls. • Clear protocols will be established for timely corrective actions if any deficiencies are identified, ensuring that any issues are promptly addressed and resolved. The department is fully committed to ensuring that staff have the necessary resources and support to perform their roles effectively. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment, minimize risks, and ensure the continued success of our operations. We appreciate the audit team's insights and recommendations and are dedicated to demonstrating progress in these areas.

Finding Number 2024-005 Assistance Listing Number 10.553, 10.555, 10.556, and 10.582 Program Name Child Nutrition Cluster Federal Agency Department of Agriculture State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Education did not comply with Federal Funding Accountability and Transparency Act reporting requirements for the Child Nutrition Cluster and did not implement the designed internal control over the reporting requirements BACKGROUND The Department of Education (the department) is the pass-through entity for the Child Nutrition Cluster,(2) which is administered by the Food and Nutrition Service of the U.S. Department of Agriculture. The Child Nutrition Cluster is a cluster of federal programs to provide healthful, nutritious meals and snacks to eligible children in public schools and nonprofit private schools, residential childcare institutions, and summer recreation programs. See Schedule of Findings and Questioned Costs for footnote. For the School Breakfast Program, the National School Lunch Program, and the Special Milk Program for Children, the department enters into agreements with subrecipient organizations, known as School Food Authorities (SFAs), for local-level program operation and the delivery of program services to eligible children. The department reimburses SFAs for each meal or snack served based on the rates established by the U.S. Department of Agriculture. Each month, the SFAs claim the number of meals or snacks served using the department’s Tennessee: Meals, Accounting, and Claiming (TMAC) system. For the Fresh Fruit and Vegetable Program(3), the department enters into additional agreements with approved SFAs for eligible elementary schools within those SFAs for local-level program operation and the delivery of program services to eligible children. The department awards a grant amount for each elementary school based on a rate set per child by the department. Each month, the SFAs claim the costs from procurement, operations, and administration using the department’s TMAC system. See Schedule of Findings and Questioned Costs for footnote. The Federal Funding and Accountability Transparency Act (FFATA) requires the department to report subrecipient subaward financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. According to federal regulations, reports are due “no later than the end of the month following the month in which the obligation was made.” The subaward information in FSRS is then available to the public on the USA Spending website for transparency. CONDITION AND CAUSE Based on our discussion with management, because management had not implemented cross-training for backups as outlined in their designed internal controls for succession planning, staff was not aware of the requirement and therefore, did not complete any FFATA reporting for the Child Nutrition Cluster for the entire fiscal year. Based on our review of the claim information for the year, staff did not report 189 SFAs’ Child Nutrition subawards,(4) totaling $449,928,320 and 25 FFVP subawards, totaling $4,499,375. See Schedule of Findings and Questioned Costs for footnote. The former Federal Reporting Specialist who was responsible for FFATA reporting left the department in September 2023. At the time he left, he had not done any reporting for fiscal year 2024. When the current State Director of School Nutrition began in his role in March 2024, the Assistant Commissioner had not reassigned the FFATA reporting tasks and did not inform the newly hired State Director to reassign the FFATA reporting responsibilities thus the State Director was unaware of the reporting requirement. We first inquired about the department’s current FFATA reporting process on July 1, 2024. The Data Processing and Reporting Specialist(5) who is currently responsible for FFATA reporting took the role on July 8, 2024. She requested access to FSRS almost immediately and after following up, received access on September 4, 2024. See Schedule of Findings and Questioned Costs for footnote. On August 7, 2024, the current State Director of School Nutrition provided us the FFATA Reporting Process Plan, effective October 2022, that was maintained in the former Federal Reporting Specialist’s files. The process plan includes the owner of the process, a description of the process, the statute or regulation that requires it, the team members associated with the process as well as their role, and risks associated with the process. While the process plan lists the team member responsible for reporting as well as a backup; neither one submitted the required reports. We also reviewed the Department of Education’s 2024 Financial Integrity Act Risk Assessment and determined that despite the fact that management’s documented process plan and risk assessment identified the risks, management did not include all mitigating controls and did not follow through with effective implementation of all the mitigating controls and, as such, the backup was not trained and was unaware of the FFATA responsibilities and requirements. When we brought the FFATA reporting deficiency to management’s attention, management stated that they had begun creating and implementing a standard operating procedure and are in the process of uploading the FFATA reports for fiscal year 2024. We will audit the FFATA reporting requirements for the Child Nutrition Cluster during the next audit. CRITERIA FFATA Reporting Appendix A to “Reporting Subaward and Executive Compensation Information,” Title 2, Code of Federal Regulations (CFR), Part 170, states: a. Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. EFFECT Not meeting the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner should work with staff to ensure that when turnover occurs, new staff are fully informed about the scope of their responsibilities and have access to the resources needed to perform them, such as FSRS access and the newly developed standard operating procedures. Management should evaluate the identified mitigating controls for risks associated with the conditions identified in this finding to ensure they are appropriately designed, assigned, and that they are implemented. Management should update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need to ensure that new staff are fully informed about the scope of their responsibilities and have access to essential resources, such as FSRS access and the newly developed standard operating procedures. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Onboarding and Resource Access: • The Division of Human Resources will work closely with management to ensure each office and division maintains a robust onboarding process, ensuring that new employees are fully informed about their responsibilities and have access to all necessary resources. • The Deputy Commissioner will designate a single point of contact for FSRS reporting coordination within the agency and ensure standard operating procedures are updated accordingly to reflect onboarding requirements of new staff with FSRS reporting responsibilities. • Regular training sessions will be conducted to keep new and existing staff up to date with any changes in procedures and responsibilities. 2. Evaluation of Mitigating Controls: • Management will carefully evaluate the identified mitigating controls for the risks associated with the conditions mentioned in the audit finding. • We will ensure that these controls are appropriately designed, assigned, and effectively implemented to mitigate any potential risks. 3. Risk Assessment Updates: • The risk assessment will be updated regularly to reflect any changes in the operational environment, identified risks, and the effectiveness of mitigating controls. • This process will involve continuous monitoring and review to ensure that the risk assessment remains relevant and effective. 4. Ongoing Monitoring and Accountability: • The Deputy Commissioner will assign the Chief Operating Officer to continually monitor risks and assess the effectiveness of mitigating controls. • Clear protocols will be established for timely corrective actions if any deficiencies are identified, ensuring that any issues are promptly addressed and resolved. The department is fully committed to ensuring that staff have the necessary resources and support to perform their roles effectively. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment, minimize risks, and ensure the continued success of our operations. We appreciate the audit team's insights and recommendations and are dedicated to demonstrating progress in these areas.

Finding Number 2024-006 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Matching, Level of Effort, Earmarking Repeat Finding 2023-011 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior audit, Department of Education management did not have effective internal controls over matching, maintenance of effort, and earmarking requirements and could not provide evidence of compliance with requirements BACKGROUND AND COMPLIANCE CRITERIA The US Department of Education (ED) provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006, which was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act (Perkins V). Perkins V provides grants to states to develop the academic knowledge and technical and employability skills of secondary students and postsecondary students. The Tennessee Department of Education (the department) is the pass-through entity for Perkins funds and disburses those funds to local education agencies (LEAs) within the state and the Tennessee Board of Regents. As a recipient of federal funding, the department is subject to federal matching, level of effort – maintenance of effort (MOE), and earmarking requirements.(6) Section 211(b) of the Perkins Act mandates that the department maintain its fiscal effort from state appropriations for CTE when compared with the preceding years; for example, the department must allocate state resources in fiscal year 2024 that meet or exceed the allocated state resources for fiscal year 2023. Per Section 112(a) of the Perkins Act, the department must also allocate CTE funds received for specific activities in keeping with the following requirements: • not less than 85 percent to Secondary and Postsecondary Career and Technical Education Programs; • not more than 10 percent to State Leadership Activities; and • not more than 5 percent or $250,000, whichever is greater, to State Administration. See Schedule of Findings and Questioned Costs for footnote. In addition, Section 112(b) of the Perkins Act requires the department to match federal funds reserved for State Administration with non-federal funds, such as state appropriations, on a dollar-for-dollar basis. Annually, ED requires Perkins recipients to submit financial and performance data via the Consolidated Annual Report (CAR). The CAR contains CTE programmatic and financial information and includes the department’s demonstrated compliance with maintenance of effort and matching requirements. Department staff completes the CAR in December using the two most recent fiscal years’ financial data—for example, the CAR submitted in December 2023 included data from state fiscal years 2022 and 2023. PRIOR AUDIT RESULTS In the prior audit, we reported a finding related to the Matching, Level of Effort – Maintenance of Effort, and Earmarking compliance requirement. We reported that management had not developed and implemented policies and procedures to ensure that the department complied with these requirements and the lack of policies and procedures, combined with turnover, led to management’s inability to provide documentation to demonstrate compliance. Due to the lack of internal controls, we reported the following conditions related to compliance: • Department management was unable to provide any documentary evidence of the department’s compliance with matching requirements, • Department management was unable to provide documentation for adjustments or final amounts reported in the CAR, and • Department management was unable to provide key earmarking documentation to ensure correct earmarking amounts were calculated. Department management concurred with the prior audit finding and stated they would collaborate to create sufficient controls for the calculation of MOE, including a complete supervisory review, and the department’s Office of Finance would serve as a secondary internal check. Additionally, department management stated they would create a process to ensure documents are maintained and are not tied to a specific employee’s hardware, including but not limited to data stored on a physical storage device. CONDITION, CRITERIA, AND CAUSE CURRENT AUDIT RESULTS In the current audit, we found that management did not take corrective action to address the prior audit finding regarding development and implementation of policies and procedures to ensure matching, MOE, and earmarking compliance requirements were met. Management also did not take corrective action to address the lack of documentation as evidence of matching and MOE compliance and did not maintain documentation of management’s review of their required earmarking calculations. Ultimately, we were only able to determine that management met earmarking requirements. We provide specific details of our results below. Insufficient Internal Controls and Lack of Evidence of Compliance Due to the condition above, we noted the following: Matching Because management has still not developed policies and procedures, they were unable to describe the process used for determining compliance with matching requirements during the audit period or provide any documentary evidence of the department’s compliance with matching requirements. As a result, we were unable to perform any procedures to verify if the department met the matching requirements independently. Maintenance of Effort As reported in the prior audit, department management was unable to provide supporting documentation for the final MOE amounts reported in the CAR for state fiscal year 2023. We attempted to verify the amounts reported in the CAR, but without sufficient support for those calculations, we were unable to independently verify that the reported MOE numbers were accurate; therefore, we were unable to determine that management met MOE compliance requirements. Additionally, in the prior audit, management stated that although they reviewed the MOE calculation, the review was not documented. In the current audit, management stated that they did not perform a supervisory review of the calculations submitted in the CAR. Earmarking Although department management provided key earmarking documentation that demonstrated compliance requirements were met and stated they reviewed the calculations, management could not provide any evidence of this review. Department management explained that due to turnover and staffing challenges, appropriate staff were not assigned control and compliance tasks to ensure that the CTE fiscal requirements were met; however, they have hired more staff to be responsible for performing the work and ensuring that requirements are met in the future. Additionally, management stated that standard operating procedures would be created and implemented to document the matching, maintenance of effort, and earmarking processes. Current Risk Assessment and Internal Control Criteria We reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risks to identify or meet matching requirements for external grants, meet overall maintenance of effort requirements, and meet minimum or maximum set-aside limits (earmarking requirements). Management identified scheduled reviews as a control to mitigate these risks; however, based on the results of our audit work, management stated they did not conduct a review of the CAR calculations and did not document other reviews to ensure they are occurring and operating as intended. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303, a non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. . . . (c) Evaluate and monitor the non-Federal entity’s compliance with statutes, regulations, and the terms and conditions of Federal awards. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government, Principle 10.03, “Design of Appropriate Types of Control Activities,” states, Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. . . . Also, Principle 12.03, “Documentation of Responsibilities through Policies,” states, Management documents in policies for each unit its responsibility for an operational process’s objectives and related risks, and control activity design, implementation, and operating effectiveness. . . . Additionally, Principle 12.04, “Documentation of Responsibilities through Policies,” states, . . . Management communicates to personnel the policies and procedures so that personnel can implement the control activities for their assigned responsibilities. EFFECT Without appropriate internal controls over matching, MOE, and earmarking requirements, there is a risk that the department will not comply with all related federal requirements and potentially miscalculate the state’s matching, MOE, and earmarking amounts. If a miscalculation results in the state’s noncompliance, the department risks a reduction of federal funding for CTE activities in subsequent award years, which may impact the department’s ability to provide services to students at Tennessee’s schools. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies.   RECOMMENDATION Department management should design and implement sufficient controls for matching, MOE, and earmarking compliance requirements, which includes assigning responsibility for control activities and compliance, and developing policies and procedures and documenting key processes to ensure ongoing compliance. Management should also ensure that the agency maintains supporting documentation, including documentation of review activities, to monitor ongoing compliance. Management should evaluate the effectiveness of the control activities for the risks identified in this finding and update the department’s annual risk assessment to reflect any new controls management implements. MANAGEMENT’S COMMENT The department concurs with this finding and is committed to addressing the identified compliance requirements and enhancing our control environment. Action Plan: 1. Assignment of Responsibilities: • Management will assign clear responsibility for control activities and compliance related to matching, Maintenance of Effort (MOE), and earmarking requirements. This will ensure accountability and enhance our ability to meet compliance requirements. 2. Policy and Procedure Development: • Policies: We will develop comprehensive policies that define the expectations for compliance with matching, MOE, and earmarking requirements. • Procedures: We will document key processes to ensure these policies are consistently applied. This will include specific steps for maintaining compliance and addressing any potential issues promptly. 3. Documentation and Review Activities: • We will maintain detailed supporting documentation to demonstrate compliance with matching, MOE, and earmarking requirements. • We will also document review activities to monitor ongoing compliance. This documentation will be regularly reviewed and updated as needed. 4. Risk Assessment and Control Evaluation: • Management will evaluate the effectiveness of current control activities for the risks identified in this finding. • We will update the department’s annual risk assessment to reflect any new controls implemented. This will ensure that our risk management approach remains robust and responsive to emerging compliance risks. 5. Monitoring and Continuous Improvement: • We will establish a monitoring plan to ensure ongoing compliance with matching, MOE, and earmarking requirements. This plan will include regular review and evaluation of control activities. • Management is committed to continuous improvement and will regularly review and update our policies, procedures, and control activities to address any new compliance requirements or risks. We anticipate an estimated completion date of 9/30/2025. Thank you for highlighting these areas for improvement. We believe that the actions outlined above will strengthen our compliance framework and ensure that we meet the necessary requirements.

Finding Number 2024-006 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Matching, Level of Effort, Earmarking Repeat Finding 2023-011 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior audit, Department of Education management did not have effective internal controls over matching, maintenance of effort, and earmarking requirements and could not provide evidence of compliance with requirements BACKGROUND AND COMPLIANCE CRITERIA The US Department of Education (ED) provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006, which was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act (Perkins V). Perkins V provides grants to states to develop the academic knowledge and technical and employability skills of secondary students and postsecondary students. The Tennessee Department of Education (the department) is the pass-through entity for Perkins funds and disburses those funds to local education agencies (LEAs) within the state and the Tennessee Board of Regents. As a recipient of federal funding, the department is subject to federal matching, level of effort – maintenance of effort (MOE), and earmarking requirements.(6) Section 211(b) of the Perkins Act mandates that the department maintain its fiscal effort from state appropriations for CTE when compared with the preceding years; for example, the department must allocate state resources in fiscal year 2024 that meet or exceed the allocated state resources for fiscal year 2023. Per Section 112(a) of the Perkins Act, the department must also allocate CTE funds received for specific activities in keeping with the following requirements: • not less than 85 percent to Secondary and Postsecondary Career and Technical Education Programs; • not more than 10 percent to State Leadership Activities; and • not more than 5 percent or $250,000, whichever is greater, to State Administration. See Schedule of Findings and Questioned Costs for footnote. In addition, Section 112(b) of the Perkins Act requires the department to match federal funds reserved for State Administration with non-federal funds, such as state appropriations, on a dollar-for-dollar basis. Annually, ED requires Perkins recipients to submit financial and performance data via the Consolidated Annual Report (CAR). The CAR contains CTE programmatic and financial information and includes the department’s demonstrated compliance with maintenance of effort and matching requirements. Department staff completes the CAR in December using the two most recent fiscal years’ financial data—for example, the CAR submitted in December 2023 included data from state fiscal years 2022 and 2023. PRIOR AUDIT RESULTS In the prior audit, we reported a finding related to the Matching, Level of Effort – Maintenance of Effort, and Earmarking compliance requirement. We reported that management had not developed and implemented policies and procedures to ensure that the department complied with these requirements and the lack of policies and procedures, combined with turnover, led to management’s inability to provide documentation to demonstrate compliance. Due to the lack of internal controls, we reported the following conditions related to compliance: • Department management was unable to provide any documentary evidence of the department’s compliance with matching requirements, • Department management was unable to provide documentation for adjustments or final amounts reported in the CAR, and • Department management was unable to provide key earmarking documentation to ensure correct earmarking amounts were calculated. Department management concurred with the prior audit finding and stated they would collaborate to create sufficient controls for the calculation of MOE, including a complete supervisory review, and the department’s Office of Finance would serve as a secondary internal check. Additionally, department management stated they would create a process to ensure documents are maintained and are not tied to a specific employee’s hardware, including but not limited to data stored on a physical storage device. CONDITION, CRITERIA, AND CAUSE CURRENT AUDIT RESULTS In the current audit, we found that management did not take corrective action to address the prior audit finding regarding development and implementation of policies and procedures to ensure matching, MOE, and earmarking compliance requirements were met. Management also did not take corrective action to address the lack of documentation as evidence of matching and MOE compliance and did not maintain documentation of management’s review of their required earmarking calculations. Ultimately, we were only able to determine that management met earmarking requirements. We provide specific details of our results below. Insufficient Internal Controls and Lack of Evidence of Compliance Due to the condition above, we noted the following: Matching Because management has still not developed policies and procedures, they were unable to describe the process used for determining compliance with matching requirements during the audit period or provide any documentary evidence of the department’s compliance with matching requirements. As a result, we were unable to perform any procedures to verify if the department met the matching requirements independently. Maintenance of Effort As reported in the prior audit, department management was unable to provide supporting documentation for the final MOE amounts reported in the CAR for state fiscal year 2023. We attempted to verify the amounts reported in the CAR, but without sufficient support for those calculations, we were unable to independently verify that the reported MOE numbers were accurate; therefore, we were unable to determine that management met MOE compliance requirements. Additionally, in the prior audit, management stated that although they reviewed the MOE calculation, the review was not documented. In the current audit, management stated that they did not perform a supervisory review of the calculations submitted in the CAR. Earmarking Although department management provided key earmarking documentation that demonstrated compliance requirements were met and stated they reviewed the calculations, management could not provide any evidence of this review. Department management explained that due to turnover and staffing challenges, appropriate staff were not assigned control and compliance tasks to ensure that the CTE fiscal requirements were met; however, they have hired more staff to be responsible for performing the work and ensuring that requirements are met in the future. Additionally, management stated that standard operating procedures would be created and implemented to document the matching, maintenance of effort, and earmarking processes. Current Risk Assessment and Internal Control Criteria We reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risks to identify or meet matching requirements for external grants, meet overall maintenance of effort requirements, and meet minimum or maximum set-aside limits (earmarking requirements). Management identified scheduled reviews as a control to mitigate these risks; however, based on the results of our audit work, management stated they did not conduct a review of the CAR calculations and did not document other reviews to ensure they are occurring and operating as intended. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303, a non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. . . . (c) Evaluate and monitor the non-Federal entity’s compliance with statutes, regulations, and the terms and conditions of Federal awards. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government, Principle 10.03, “Design of Appropriate Types of Control Activities,” states, Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. . . . Also, Principle 12.03, “Documentation of Responsibilities through Policies,” states, Management documents in policies for each unit its responsibility for an operational process’s objectives and related risks, and control activity design, implementation, and operating effectiveness. . . . Additionally, Principle 12.04, “Documentation of Responsibilities through Policies,” states, . . . Management communicates to personnel the policies and procedures so that personnel can implement the control activities for their assigned responsibilities. EFFECT Without appropriate internal controls over matching, MOE, and earmarking requirements, there is a risk that the department will not comply with all related federal requirements and potentially miscalculate the state’s matching, MOE, and earmarking amounts. If a miscalculation results in the state’s noncompliance, the department risks a reduction of federal funding for CTE activities in subsequent award years, which may impact the department’s ability to provide services to students at Tennessee’s schools. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies.   RECOMMENDATION Department management should design and implement sufficient controls for matching, MOE, and earmarking compliance requirements, which includes assigning responsibility for control activities and compliance, and developing policies and procedures and documenting key processes to ensure ongoing compliance. Management should also ensure that the agency maintains supporting documentation, including documentation of review activities, to monitor ongoing compliance. Management should evaluate the effectiveness of the control activities for the risks identified in this finding and update the department’s annual risk assessment to reflect any new controls management implements. MANAGEMENT’S COMMENT The department concurs with this finding and is committed to addressing the identified compliance requirements and enhancing our control environment. Action Plan: 1. Assignment of Responsibilities: • Management will assign clear responsibility for control activities and compliance related to matching, Maintenance of Effort (MOE), and earmarking requirements. This will ensure accountability and enhance our ability to meet compliance requirements. 2. Policy and Procedure Development: • Policies: We will develop comprehensive policies that define the expectations for compliance with matching, MOE, and earmarking requirements. • Procedures: We will document key processes to ensure these policies are consistently applied. This will include specific steps for maintaining compliance and addressing any potential issues promptly. 3. Documentation and Review Activities: • We will maintain detailed supporting documentation to demonstrate compliance with matching, MOE, and earmarking requirements. • We will also document review activities to monitor ongoing compliance. This documentation will be regularly reviewed and updated as needed. 4. Risk Assessment and Control Evaluation: • Management will evaluate the effectiveness of current control activities for the risks identified in this finding. • We will update the department’s annual risk assessment to reflect any new controls implemented. This will ensure that our risk management approach remains robust and responsive to emerging compliance risks. 5. Monitoring and Continuous Improvement: • We will establish a monitoring plan to ensure ongoing compliance with matching, MOE, and earmarking requirements. This plan will include regular review and evaluation of control activities. • Management is committed to continuous improvement and will regularly review and update our policies, procedures, and control activities to address any new compliance requirements or risks. We anticipate an estimated completion date of 9/30/2025. Thank you for highlighting these areas for improvement. We believe that the actions outlined above will strengthen our compliance framework and ensure that we meet the necessary requirements.

Finding Number 2024-007 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-012 Pass-Through Entity N/A Questioned Costs 154,392 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures outside of the Career and Technical Education Program grant’s period of performance BACKGROUND The U.S. Department of Education provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006, which was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act (Perkins V). Perkins V provides grants to states to develop the academic knowledge, technical skills, and employment readiness skills of secondary students and postsecondary students. The Tennessee Department of Education (the department) is the pass-through entity for CTE-Perkins funds and disburses those funds to local education agencies within the state and the Tennessee Board of Regents.(7) Federal funding for CTE is only available to the department and its subrecipients for a limited time (referred to as the grant’s period of performance).(8) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the CTE award amount and the period of performance (budget period).(9) The department has 15 months to charge expenditures to each grant award based on the budget period; however, CTE is governed by the requirements of the Tydings Amendment,(10) which extends the period of performance 12 additional months, for a total of 27 months. According to 2 CFR 200.344, the department must liquidate all financial obligations incurred under the federal award within 120 days of the end of the period of performance. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management incurred administrative expenditures outside of the CTE grant’s period of performance and that internal controls were not effective in ensuring compliance with the grant’s period of performance. Management concurred with the prior finding and stated they would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls implemented, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. In response to the prior audit finding, department management created period of performance operating procedures, implemented professional development for staff, and updated the annual risk assessment. However, management’s actions did not prevent the errors noted below from occurring. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the CTE grants for fiscal year ended June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates to the grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis of payroll expenditures for fiscal year ended June 30, 2024, totaling $2,511,558, we found department management charged payroll expenditures in the amount of $154,289 to the CTE grant award V048A210042 that were obligated after the grant’s period of performance. In addition, based on our analysis, we identified 433 expenditures charged to CTE grant award V048A210042, totaling $2,587,293, occurring on or after July 1, 2023. We tested a nonstatistical, random sample of 60 of these expenditure transactions, totaling $298,666, to determine if the non-payroll administrative transactions were obligated within the grant’s period of performance. Based on our testwork, we found that for 2 of 60 (3%) expenditure transactions tested, the department paid expenses totaling $103 that were obligated after the grant’s period of performance, resulting in a total of $154,392 known questioned costs for the compliance requirement. Management explained that insufficient training and a lack of instruction from management, along with employee turnover and staffing challenges, caused department staff to mistakenly approve payments for expenses that were obligated after the grant’s period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance requirement and identified the review of charges to federal grants and training staff as controls to mitigate the risk. According to management, program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment; however, based on the results of our review, staff’s review and training was not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should develop effective control procedures to ensure that expenditures occurred during the grant award’s period of performance. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-007 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-012 Pass-Through Entity N/A Questioned Costs 154,392 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures outside of the Career and Technical Education Program grant’s period of performance BACKGROUND The U.S. Department of Education provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006, which was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act (Perkins V). Perkins V provides grants to states to develop the academic knowledge, technical skills, and employment readiness skills of secondary students and postsecondary students. The Tennessee Department of Education (the department) is the pass-through entity for CTE-Perkins funds and disburses those funds to local education agencies within the state and the Tennessee Board of Regents.(7) Federal funding for CTE is only available to the department and its subrecipients for a limited time (referred to as the grant’s period of performance).(8) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the CTE award amount and the period of performance (budget period).(9) The department has 15 months to charge expenditures to each grant award based on the budget period; however, CTE is governed by the requirements of the Tydings Amendment,(10) which extends the period of performance 12 additional months, for a total of 27 months. According to 2 CFR 200.344, the department must liquidate all financial obligations incurred under the federal award within 120 days of the end of the period of performance. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management incurred administrative expenditures outside of the CTE grant’s period of performance and that internal controls were not effective in ensuring compliance with the grant’s period of performance. Management concurred with the prior finding and stated they would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls implemented, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. In response to the prior audit finding, department management created period of performance operating procedures, implemented professional development for staff, and updated the annual risk assessment. However, management’s actions did not prevent the errors noted below from occurring. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the CTE grants for fiscal year ended June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates to the grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis of payroll expenditures for fiscal year ended June 30, 2024, totaling $2,511,558, we found department management charged payroll expenditures in the amount of $154,289 to the CTE grant award V048A210042 that were obligated after the grant’s period of performance. In addition, based on our analysis, we identified 433 expenditures charged to CTE grant award V048A210042, totaling $2,587,293, occurring on or after July 1, 2023. We tested a nonstatistical, random sample of 60 of these expenditure transactions, totaling $298,666, to determine if the non-payroll administrative transactions were obligated within the grant’s period of performance. Based on our testwork, we found that for 2 of 60 (3%) expenditure transactions tested, the department paid expenses totaling $103 that were obligated after the grant’s period of performance, resulting in a total of $154,392 known questioned costs for the compliance requirement. Management explained that insufficient training and a lack of instruction from management, along with employee turnover and staffing challenges, caused department staff to mistakenly approve payments for expenses that were obligated after the grant’s period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance requirement and identified the review of charges to federal grants and training staff as controls to mitigate the risk. According to management, program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment; however, based on the results of our review, staff’s review and training was not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should develop effective control procedures to ensure that expenditures occurred during the grant award’s period of performance. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-008 Assistance Listing Number 84.424 Program Name Student Support and Academic Enrichment Program Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-008 Pass-Through Entity N/A Questioned Costs 37,860 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures and reimbursed local educational agencies for expenditures that occurred outside of the Student Support and Academic Enrichment Program grant’s period of performance BACKGROUND The Title IV, Part A, Student Support and Academic Enrichment Program (Title IV) is a federal program to improve students’ academic achievement by providing all students with access to a well-rounded education, improving school conditions for student learning, and improving the use of technology in order to improve the academic achievement and digital literacy of all students. Federal funding for Title IV is only available to the Department of Education (the department) and its subrecipients for a limited time (referred to as the grant’s period of performance).(11) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the Title IV award amount and the period of performance (budget period).(12) The department has 15 months to charge expenditures to each grant award; however, Title IV is governed by the requirements of the Tydings Amendment,(13) which extends the period of performance 12 additional months, for a total of 27 months. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management reimbursed local educational agencies for expenditures that occurred outside of the grant’s period of performance and that internal controls were not effective in ensuring compliance with the grant’s period of performance. Management concurred with the prior finding and stated that management would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls management implements, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the Title IV grants for fiscal year ended June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates to the grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis, we identified and tested 62 expenditure transactions, totaling $1,425,557, that were charged to the Title IV grant award S424A210044 after June 30, 2023, to determine if the transactions were obligated within the grant’s period of performance. Based on our testwork, we found that for 5 of 62 expenditure transactions tested (8%), management reimbursed local educational agencies (LEAs) and paid administrative expenses that were obligated after the grant’s period of performance, resulting in $37,599 in known questioned costs. Management did reverse one of the five transactions, totaling $449, after we informed them of the results of our testwork; therefore, we did not include the $449 in the known questioned costs. Management stated that this transaction was accidentally charged to the wrong grant. Management also stated that in January 2024, they found the other 4 transactions that were obligated after the grant’s period of performance; however, the transactions were accidentally left off the adjustment to correct the transactions. In addition, based on our analysis, we identified 1,868 adjusting entry expenditure transactions, totaling $2,615,473, that were charged to the Title IV grants during fiscal year ended June 30, 2024. We tested a nonstatistical, random sample of 60 adjusting entry expenditure transactions, totaling $1,976,846, to determine if the transactions were obligated within the grants’ period of performance. Based on our testwork, we found that for 3 of 60 adjusting entry expenditure transactions tested (5%), management paid $261 in administrative expenses that were obligated after grant award S424A210044 period of performance, resulting in a total of $37,860 in known questioned costs for the compliance requirement. Management stated that they accidentally charged these 3 transactions to the grant after it ended. Management stated that program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment. Additionally, according to department management, between October 1 and January 30 of each year, the department reviews all LEA reimbursement requests to determine if the reimbursement request is charged to a grant that ended on September 30 of that year. If so, the department contacts the LEA to determine if the reimbursement request contains any expenditures that occurred after September 30. For those expenditures that occurred after September 30, the department sends the reimbursement request back to the LEA to remove those expenditures. If the reimbursement request contains no expenditures that occurred after September 30, the department approves the request and processes it for payment. Even though department management stated they had controls in place, we found that due to the volume of transactions included in the manual review, the controls were not effective to ensure compliance with the period of performance requirement. As a result, the department paid administrative expenses and reimbursed LEAs for costs that occurred outside the authorized period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance. Management identified the review of charges to federal grants and training staff as controls to mitigate the risk; however, based on the results of our review, management’s review and training was not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. According to the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should refine their current control procedures, including utilizing data analytics tools to assist in evaluating the large number of reimbursements and administrative expenditures and training staff, to ensure that expenditures occurred during the grant award’s period of performance. Procedures should be designed to ensure that all identified expenditures occurring outside the period of performance are included in any adjusting entries. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-008 Assistance Listing Number 84.424 Program Name Student Support and Academic Enrichment Program Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-008 Pass-Through Entity N/A Questioned Costs 37,860 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures and reimbursed local educational agencies for expenditures that occurred outside of the Student Support and Academic Enrichment Program grant’s period of performance BACKGROUND The Title IV, Part A, Student Support and Academic Enrichment Program (Title IV) is a federal program to improve students’ academic achievement by providing all students with access to a well-rounded education, improving school conditions for student learning, and improving the use of technology in order to improve the academic achievement and digital literacy of all students. Federal funding for Title IV is only available to the Department of Education (the department) and its subrecipients for a limited time (referred to as the grant’s period of performance).(11) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the Title IV award amount and the period of performance (budget period).(12) The department has 15 months to charge expenditures to each grant award; however, Title IV is governed by the requirements of the Tydings Amendment,(13) which extends the period of performance 12 additional months, for a total of 27 months. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management reimbursed local educational agencies for expenditures that occurred outside of the grant’s period of performance and that internal controls were not effective in ensuring compliance with the grant’s period of performance. Management concurred with the prior finding and stated that management would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls management implements, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the Title IV grants for fiscal year ended June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates to the grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis, we identified and tested 62 expenditure transactions, totaling $1,425,557, that were charged to the Title IV grant award S424A210044 after June 30, 2023, to determine if the transactions were obligated within the grant’s period of performance. Based on our testwork, we found that for 5 of 62 expenditure transactions tested (8%), management reimbursed local educational agencies (LEAs) and paid administrative expenses that were obligated after the grant’s period of performance, resulting in $37,599 in known questioned costs. Management did reverse one of the five transactions, totaling $449, after we informed them of the results of our testwork; therefore, we did not include the $449 in the known questioned costs. Management stated that this transaction was accidentally charged to the wrong grant. Management also stated that in January 2024, they found the other 4 transactions that were obligated after the grant’s period of performance; however, the transactions were accidentally left off the adjustment to correct the transactions. In addition, based on our analysis, we identified 1,868 adjusting entry expenditure transactions, totaling $2,615,473, that were charged to the Title IV grants during fiscal year ended June 30, 2024. We tested a nonstatistical, random sample of 60 adjusting entry expenditure transactions, totaling $1,976,846, to determine if the transactions were obligated within the grants’ period of performance. Based on our testwork, we found that for 3 of 60 adjusting entry expenditure transactions tested (5%), management paid $261 in administrative expenses that were obligated after grant award S424A210044 period of performance, resulting in a total of $37,860 in known questioned costs for the compliance requirement. Management stated that they accidentally charged these 3 transactions to the grant after it ended. Management stated that program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment. Additionally, according to department management, between October 1 and January 30 of each year, the department reviews all LEA reimbursement requests to determine if the reimbursement request is charged to a grant that ended on September 30 of that year. If so, the department contacts the LEA to determine if the reimbursement request contains any expenditures that occurred after September 30. For those expenditures that occurred after September 30, the department sends the reimbursement request back to the LEA to remove those expenditures. If the reimbursement request contains no expenditures that occurred after September 30, the department approves the request and processes it for payment. Even though department management stated they had controls in place, we found that due to the volume of transactions included in the manual review, the controls were not effective to ensure compliance with the period of performance requirement. As a result, the department paid administrative expenses and reimbursed LEAs for costs that occurred outside the authorized period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance. Management identified the review of charges to federal grants and training staff as controls to mitigate the risk; however, based on the results of our review, management’s review and training was not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. According to the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should refine their current control procedures, including utilizing data analytics tools to assist in evaluating the large number of reimbursements and administrative expenditures and training staff, to ensure that expenditures occurred during the grant award’s period of performance. Procedures should be designed to ensure that all identified expenditures occurring outside the period of performance are included in any adjusting entries. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-009 Assistance Listing Number 84.027 and 84.173 Program Name Special Education Cluster (IDEA) Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-010 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.027 Federal Award Identification Number H027A210052 Amount $40,355 Assistance Listing Number 84.173 Federal Award Identification Number H173A210095 Amount $22,675 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures and reimbursed local educational agencies for expenditures that occurred outside of the Special Education Cluster Program grants’ period of performance BACKGROUND The Individuals with Disabilities Education Act (IDEA) is a cluster of federal programs(14) to assist states in providing children with disabilities a free, appropriate public education. Federal funding for IDEA is only available to the Department of Education (the department) and its subrecipients for a limited time (referred to as the grants’ period of performance).(15) Each year, the department receives grant award notifications for each award from the U.S. Department of Education outlining the award amounts and the period of performance (budget period).(16) The department has 15 months to charge expenditures to each grant award; however, IDEA is governed by the requirements of the Tydings Amendment,(17) which extends the period of performance 12 additional months, for a total of 27 months. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 344, the department must liquidate all financial obligations incurred under the federal award within 120 days of the end of the period of performance. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management reimbursed local educational agencies for expenditures and incurred administrative expenditures outside of the grants’ period of performance and that internal controls were not effective in ensuring compliance with the grants’ period of performance. Management concurred with the prior finding and stated they would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls implemented, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. In response to the prior audit finding, department management created period of performance operating procedures, implemented professional development for staff, and updated the annual risk assessment. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the IDEA grants for the fiscal year ending June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates for each grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis of payroll expenditures for fiscal year 2024, totaling $5,011,056, we found that department management charged payroll expenditures to the IDEA grant award H027A210052 that were obligated after the grant’s period of performance, resulting in of $40,314 in known questioned costs. In addition, based on our analysis, we identified 1,028 IDEA grant expenditures totaling $15,091,866 occurring on or after July 1, 2023. We tested a nonstatistical, random sample of 60 of these expenditure transactions, totaling $9,970,590, to determine if the transactions were obligated within the applicable grant’s period of performance. Based on our testwork, we found that for 4 of 60 (7%) expenditure transactions tested, department management paid expenses, totaling $22,675, for IDEA grant award H173A210095 and $41 for IDEA grant award H027A210052 that were obligated after the grants’ periods of performance. These errors resulted in $22,716 in known questioned costs and $34,385 in likely questioned costs. Table 2 summarizes the questioned costs for this issue. See Schedule of Findings and Questioned Costs for table. Management explained that insufficient training and a lack of instruction from management, along with employee turnover and staffing challenges, caused department staff to mistakenly approve expenditures that were obligated after the grant’s period of performance. According to management, program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment. Additionally, according to department management, between October 1 and January 30 of each year, the department reviews all LEA reimbursement requests to determine if the reimbursement request is charged to a grant that ended on September 30 of that year. If so, the department contacts the LEA to determine if the reimbursement request contains any expenditures that occurred after September 30. For those expenditures that occurred after September 30, the department sends the reimbursement request back to the LEA to remove those expenditures. If the reimbursement request contains no expenditures that occurred after September 30, the department approves the request and processes it for payment. Even though department management stated they had controls in place, we found that, due to the volume of transactions included in the manual review, the controls were not effective to ensure compliance with the period of performance requirement. As a result, the department paid administrative expenses and reimbursed LEAs for costs that occurred outside the authorized period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance requirement and identified reviewing charges to federal grants and training staff as controls to mitigate the risk. However, based on the results of our review, staff’s review and training were not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. According to the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 7.09, “Response to Risk,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that the funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines that the state agency cannot remedy its noncompliance through the actions above, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should refine their current control procedures, including utilizing data analytics tools to assist in evaluating the large number of reimbursements and administrative expenditures and training staff, to ensure that expenditures occurred during the grant award’s period of performance. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-009 Assistance Listing Number 84.027 and 84.173 Program Name Special Education Cluster (IDEA) Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding 2023-010 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.027 Federal Award Identification Number H027A210052 Amount $40,355 Assistance Listing Number 84.173 Federal Award Identification Number H173A210095 Amount $22,675 FINDING As noted in the prior audit, Department of Education management did not implement effective internal controls to ensure compliance with federal period of performance requirements and thus incurred administrative expenditures and reimbursed local educational agencies for expenditures that occurred outside of the Special Education Cluster Program grants’ period of performance BACKGROUND The Individuals with Disabilities Education Act (IDEA) is a cluster of federal programs(14) to assist states in providing children with disabilities a free, appropriate public education. Federal funding for IDEA is only available to the Department of Education (the department) and its subrecipients for a limited time (referred to as the grants’ period of performance).(15) Each year, the department receives grant award notifications for each award from the U.S. Department of Education outlining the award amounts and the period of performance (budget period).(16) The department has 15 months to charge expenditures to each grant award; however, IDEA is governed by the requirements of the Tydings Amendment,(17) which extends the period of performance 12 additional months, for a total of 27 months. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 344, the department must liquidate all financial obligations incurred under the federal award within 120 days of the end of the period of performance. See Schedule of Findings and Questioned Costs for footnotes. PRIOR AUDIT RESULTS In the prior audit, we reported that management reimbursed local educational agencies for expenditures and incurred administrative expenditures outside of the grants’ period of performance and that internal controls were not effective in ensuring compliance with the grants’ period of performance. Management concurred with the prior finding and stated they would create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance, evaluate the effectiveness of the control activities for this risk, update the department’s annual risk assessment to reflect any new controls implemented, and create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements. In response to the prior audit finding, department management created period of performance operating procedures, implemented professional development for staff, and updated the annual risk assessment. CONDITION AND CAUSE For the current audit, we obtained the population of expenditures charged to the IDEA grants for the fiscal year ending June 30, 2024. We performed analytical procedures on the expenditures, comparing the accounting dates for each grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our analysis of payroll expenditures for fiscal year 2024, totaling $5,011,056, we found that department management charged payroll expenditures to the IDEA grant award H027A210052 that were obligated after the grant’s period of performance, resulting in of $40,314 in known questioned costs. In addition, based on our analysis, we identified 1,028 IDEA grant expenditures totaling $15,091,866 occurring on or after July 1, 2023. We tested a nonstatistical, random sample of 60 of these expenditure transactions, totaling $9,970,590, to determine if the transactions were obligated within the applicable grant’s period of performance. Based on our testwork, we found that for 4 of 60 (7%) expenditure transactions tested, department management paid expenses, totaling $22,675, for IDEA grant award H173A210095 and $41 for IDEA grant award H027A210052 that were obligated after the grants’ periods of performance. These errors resulted in $22,716 in known questioned costs and $34,385 in likely questioned costs. Table 2 summarizes the questioned costs for this issue. See Schedule of Findings and Questioned Costs for table. Management explained that insufficient training and a lack of instruction from management, along with employee turnover and staffing challenges, caused department staff to mistakenly approve expenditures that were obligated after the grant’s period of performance. According to management, program and fiscal staff are responsible for reviewing and approving administrative expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated within the period of performance before approving the expenditures for payment. Additionally, according to department management, between October 1 and January 30 of each year, the department reviews all LEA reimbursement requests to determine if the reimbursement request is charged to a grant that ended on September 30 of that year. If so, the department contacts the LEA to determine if the reimbursement request contains any expenditures that occurred after September 30. For those expenditures that occurred after September 30, the department sends the reimbursement request back to the LEA to remove those expenditures. If the reimbursement request contains no expenditures that occurred after September 30, the department approves the request and processes it for payment. Even though department management stated they had controls in place, we found that, due to the volume of transactions included in the manual review, the controls were not effective to ensure compliance with the period of performance requirement. As a result, the department paid administrative expenses and reimbursed LEAs for costs that occurred outside the authorized period of performance. We also reviewed the department’s December 2023 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance requirement and identified reviewing charges to federal grants and training staff as controls to mitigate the risk. However, based on the results of our review, staff’s review and training were not effective in mitigating the risks of noncompliance and the resulting questioned costs. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . . (h) Cost[s] must be incurred during the approved budget period. According to the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 7.09, “Response to Risk,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that the funds will be expended outside of the period of performance and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines that the state agency cannot remedy its noncompliance through the actions above, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should refine their current control procedures, including utilizing data analytics tools to assist in evaluating the large number of reimbursements and administrative expenditures and training staff, to ensure that expenditures occurred during the grant award’s period of performance. In addition, management should carefully evaluate and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding regarding the need for effective control procedures to ensure that expenditure occurs within the grant award’s period of performance. Management is committed to addressing this issue with a comprehensive and strategic approach. Action Plan: 1. Development of Control Procedures: • We will improve existing control procedures to ensure that all expenditures are properly monitored and documented within the specified period of performance for each grant award. • These procedures will include regular reviews to confirm adherence to the grant's timelines and budgetary constraints. 2. Risk Assessment Evaluation and Updates: • We will undertake a thorough evaluation of our current grant management process, identifying areas that require updates and improvements. • The grant management process and standard operating procedures will be updated regularly to reflect any changes in our operational environment, grant requirements, and identified risks. 3. Assignment of Responsibility: • Dedicated staff will be assigned the responsibility of ongoing monitoring of risks and mitigating controls related to grant expenditures. • Training and resources will be provided to ensure that responsible staff members have the necessary skills and knowledge to effectively carry out their duties. 4. Proactive Measures for Deficiencies: • Management will establish a clear protocol for addressing any deficiencies that occur, including timely corrective actions and continuous monitoring to prevent recurrence. • Regular reporting and communication channels will be maintained to ensure transparency and accountability throughout the process. The department is fully committed to ensuring compliance with grant requirements and safeguarding the integrity of our financial processes. We anticipate an estimated completion date of 9/30/2025. By implementing these measures, we aim to enhance our control environment and minimize any risks associated with grant expenditures. We appreciate the audit team’s insights and recommendations, and we look forward to demonstrating progress in these areas.

Finding Number 2024-010 Assistance Listing Number 10.568 and 10.569 Program Name Food Distribution Cluster Federal Agency Department of Agriculture State Agency Department of Agriculture Federal Award Identification Number N/A Federal Award Year 2023 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Subrecipient Monitoring Special Tests and Provisions Repeat Finding 2023-026 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the three prior audits, the Tennessee Department of Agriculture did not have effective internal controls over household eligibility determinations and inventory at storage locations for the Emergency Food Assistance Program BACKGROUND The Department of Agriculture (the department), in partnership with the U.S. Department of Agriculture (USDA) and local organizations, operates the Emergency Food Assistance Program (food program) to provide emergency food assistance to low-income households. USDA purchases a variety of food items and makes them available to state distributing agencies. During our audit period, the department contracted with 22 subrecipients(18) to administer the program. See Schedule of Findings and Questioned Costs for footnote. Food Inventory The department places food orders with USDA on behalf of the subrecipients, and USDA delivers the food directly to the subrecipients’ warehouses. USDA Policy FD-107 requires subrecipients to manage the inventory in their warehouses by tracking food receipts and food distributions, performing a physical food inventory count at least annually, and documenting adjustments to food inventory records, such as losses due to spoilage. Individual Eligibility The 22 subrecipients work with local partner agencies, such as soup kitchens and food pantries, to directly serve the public. Because partner agencies directly serve the public, they are responsible for determining the eligibility of individuals to receive food, either before or on the date of distribution, and maintaining supporting documentation. To qualify, an individual must be a resident of the State of Tennessee and may 1. show participation in a means-tested program such as the Supplemental Nutrition Assistance Program (food stamps), Families First, Supplemental Security Income, or Low-Income Home Energy Assistance Program; or 2. complete a signed self-declaration of income showing that the total amount of household income is below 185% of the current federal poverty income level. The department conducted desk reviews during our audit period to determine whether each subrecipient had a process to ensure compliance with both inventory and individual eligibility grant requirements. The desk reviews also ensured that subrecipients had a process to monitor partner agencies for compliance with these same requirements. Department management plans to schedule on-site monitoring of subrecipients in January 2025. We will audit the on-site monitoring activities in future audits. PRIOR AUDIT RESULTS In years before 2021, the department performed on-site subrecipient reviews to determine if subrecipients were accurately determining household eligibility and managing the inventory according to federal requirements. According to management, they stopped performing these reviews of subrecipients in March 2020 due to the effects of the COVID-19 pandemic. Without a federal waiver to alleviate the impacts of the health emergency, management was required to either continue their established control activities or implement alternative controls to ensure subrecipients complied with the federal requirements. In the 2021 Single Audit, we noted that management did not have controls in place for household eligibility determinations and food inventory. In addition, we also found noncompliance related to maintaining accurate inventory records and performing an annual inventory. In response to this finding, management stated they would develop a desk-based review monitoring plan and obtain USDA approval for the new plan. During the 2022 Single Audit, we reported that the department did not monitor its subrecipients because management was waiting for USDA to approve the department’s new monitoring plan. This resulted in a repeat finding because department management still did not have controls in place for household eligibility determinations. We also identified subrecipient noncompliance related to not performing annual inventory counts and inaccurate inventory records. Management concurred and stated it would implement the USDA-approved monitoring plan in April 2023 and complete the monitoring by September 2023 to coincide with the end of the federal fiscal year. The plan included conducting desk reviews during the federal fiscal year 2023 to serve as a baseline for annual reviews of 25% of subrecipients in subsequent years. During the 2023 Single Audit, we again reported that management had neither resumed their previous control activity of on-site reviews nor implemented other control activities to ensure subrecipients reasonably complied with the federal regulations. We also identified instances of noncompliance due to inaccurate inventory records and failures to perform the required annual inventory. Management concurred and stated that they had delayed the implementation of on-site reviews, but they had conducted desk reviews of all 22 subrecipients as required by the new plan. CONDITION AND CAUSE Monitoring Activities As part of our follow-up on management’s corrective actions, we found that management conducted desk reviews of the 22 subrecipients’ self-reported information, but based on our review of subrecipient compliance, these desk reviews(19) were not effective and did not detect errors in inventory records, annual inventory counts, and individual eligibility determination, as detailed below. Specifically, the desk reviews did not include evidence to support the subrecipients’ monitoring of their partnering agencies, which is necessary to ensure that the subrecipients and their partnering agencies are complying with the requirements. We also performed our own compliance testwork and found noncompliance with inventory management and individual eligibility, as detailed below. See Schedule of Findings and Questioned Costs for footnote. Inventory Management and Household Eligibility Based on our current compliance testwork and discussions with department and subrecipient management, we found that subrecipients did not maintain accurate monthly food inventory records, and the subrecipients who contract with a distributor did not conduct the required annual inventory. We also found that one subrecipient’s partner agency distributed food to ineligible individuals. Inaccurate Inventory Records We randomly selected 3 of 22 (14%) subrecipients to determine compliance with federal regulations for inventory records. For each subrecipient tested, we randomly sampled three months(20) of monthly inventory reports for each subrecipient during our scope period (July 1, 2023, through June 30, 2024) and recalculated the reports based on receipt, distribution, and food loss adjustments. We noted discrepancies at 2 of the 3 subrecipient agencies we visited: • For 1 subrecipient, we noted inaccurate food records and food counts. For example, based on the most recent monthly inventory report completed before our visit, we expected to find 9,012 bags of dry pinto beans but instead counted 17,592. We also expected to see 7,992 cans of sliced potatoes and counted 13,632 cans. The agency could not provide documentation, such as invoices, to support the difference for either item. • The second subrecipient lacked distribution documentation to support the data reported to the department for the 3 months tested. See Schedule of Findings and Questioned Costs for footnote. Annual Inventory Not Performed In the prior audit, we noted that 5 subrecipients, which use a centralized distributor to receive and store commodities received from the USDA, did not perform the required annual inventory. We identified during follow-up interviews that department management has not ensured corrective action. Specifically, according to department management, they are still using the distributor, and these 5 subrecipients relied solely on the weekly inventory report provided by the distributor and still did not conduct an annual inventory or request tracking documents, such as bills of lading, receipts for received food, or documents showing food distributed to corroborate the amount reported on the food program’s monthly inventory report provided to the department. Individual Eligibility To determine compliance with individual eligibility requirements, we randomly selected and reviewed 14 partner agencies from the 5 food banks contracted with the department between January 1, 2024, and March 31, 2024. For 1 of the 14 partner agencies tested (7%), we determined that the partner agency distributed commodities to 65 of 1,094 (6%) individuals who did not meet eligibility requirements. Once we informed the department of these issues, department management discussed with the subrecipient the eligibility requirements that all partner agencies should follow. In response, the subrecipient plans to retrain this partner agency’s staff. Additionally, the subrecipient’s Program Director will create a list of allowable and prohibited actions to email to all other partner agencies. CRITERIA Inventory Management and Household Eligibility According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, according to 7 CFR 251.10(e), (1) Each State agency must monitor the operation of the program to ensure that it is being administered in accordance with Federal and State requirements. State agencies may not delegate this responsibility. . . . (3) Each [subrecipient monitoring] review must encompass, as applicable, eligibility determinations, food ordering procedures, storage and warehousing practices, inventory controls, approval of distribution sites, reporting and recordkeeping requirements, and civil rights. Additionally, according to 7 CFR 251.5(b) (b) Criteria for determining recipient eligibility. Each State agency must establish uniform Statewide criteria for determining the eligibility of households to receive commodities provided under this part for home consumption. The criteria must: (1) Enable the State agency to ensure that only households which are in need of food assistance because of inadequate household income receive [Emergency Food Assistance Program] commodities; (2) Include income-based standards and the methods by which households may demonstrate eligibility under such standards; and (3) Include a requirement that the household reside in the geographic location served by the State agency at the time of applying for assistance, but length of residency shall not be used as an eligibility criterion. EFFECT The lack of sufficient monitoring controls over inventory management and individual eligibility increases the risk of noncompliance with federal requirements and fraud, waste, and abuse in this federal program. Without sufficient monitoring, department management cannot reasonably ensure that subrecipients fulfill federal requirements and meet the goals of this federal program. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of the Department of Agriculture should ensure staff members have the resources to establish internal controls to ensure staff and subrecipients comply with inventory and eligibility requirements, including designing and implementing a subrecipient monitoring process to effectively address the risks noted in this finding. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT We concur. To ensure effective internal controls over household eligibility determinations and inventory at storage locations for The Emergency Food Assistance Program (TEFAP), the department added three (3) mitigating controls to the enterprise risk management assessment. The controls added are as follows: • Monitoring will include on site reviews to ensure compliance at sites included in the monitoring plan. • Monitoring tools have been developed and will be reviewed annually and revised as needed to ensure all requirements are captured including inventory and eligibility. • Commodities staff will ensure annual inventory is performed as required. Furthermore, we have a new Commodity Distribution Administrator who has developed a monitoring plan for FY25 based on risk assessment. Risk assessments have identified three (3) agencies for monitoring in FY25 which will be completed on site to ensure proper assessment of eligibility and inventory at these locations. Inventory Controls The department has begun observing inventory. In FY24, the new Commodity Distribution Administrator observed inventory at the Chattanooga Area Food Bank and Second Harvest Food Bank of Middle TN. We have a plan in place to observe inventory at all five (5) food banks for FY25. In addition to the on-site inventory observation, internal monthly inventory monitoring has been bolstered and reconciled month to month with our subrecipients. Currently, Eligible Recipient Agency’s (ERA) monthly inventory reports for the previous months are due by the 10th day of each following month. ERA’s beginning monthly inventory in their reports must match the previous month’s reports generated by USDA’s online management site, WBSCM. Each agency’s inventory is fully reconciled no later than the end of the month. For example, January’s inventory report is due by February 10. By the end of February, the month of January’s inventory for each agency is reconciled. Eligibility Controls/ERA Training TN Commodity Distribution has also revised our State Plan to include updated eligibility guidelines including updating language in the plan and revising the intake form. Once approved by USDA, action will be taken so each ERA has a copy of the new State Plan, updated intake form, and daily roster. With a new Commodities Administrator and new guidance published by the USDA, measures will be taken and formally documented to ensure ERA compliance from not only those with direct agreements with TDA, but also those who have contractual agreements with TDA’s ERA’s. These new measures will include trainings (schedule TBD) in the form of recorded PowerPoint presentations sent out to ERAs with a formal signature page of those individuals working for ERAs to sign off attesting they watched the video in full and agree to implement new guidance henceforth in their daily responsibilities. Trainings will be required for all ERA staff that are responsible for working with TEFAP. These records will be collected by a prescribed due date and followed up on during on-site monitoring reviews. Lastly, all agencies identified with deficiencies in the audit will be required to complete a Corrective Action Plan and submit to us within 30 business days of receipt of the request. The Commodity Distribution Administrator will be responsible for ensuring corrective actions are implemented by the anticipated completion date of September 30, 2025.

Finding Number 2024-010 Assistance Listing Number 10.568 and 10.569 Program Name Food Distribution Cluster Federal Agency Department of Agriculture State Agency Department of Agriculture Federal Award Identification Number N/A Federal Award Year 2023 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Subrecipient Monitoring Special Tests and Provisions Repeat Finding 2023-026 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the three prior audits, the Tennessee Department of Agriculture did not have effective internal controls over household eligibility determinations and inventory at storage locations for the Emergency Food Assistance Program BACKGROUND The Department of Agriculture (the department), in partnership with the U.S. Department of Agriculture (USDA) and local organizations, operates the Emergency Food Assistance Program (food program) to provide emergency food assistance to low-income households. USDA purchases a variety of food items and makes them available to state distributing agencies. During our audit period, the department contracted with 22 subrecipients(18) to administer the program. See Schedule of Findings and Questioned Costs for footnote. Food Inventory The department places food orders with USDA on behalf of the subrecipients, and USDA delivers the food directly to the subrecipients’ warehouses. USDA Policy FD-107 requires subrecipients to manage the inventory in their warehouses by tracking food receipts and food distributions, performing a physical food inventory count at least annually, and documenting adjustments to food inventory records, such as losses due to spoilage. Individual Eligibility The 22 subrecipients work with local partner agencies, such as soup kitchens and food pantries, to directly serve the public. Because partner agencies directly serve the public, they are responsible for determining the eligibility of individuals to receive food, either before or on the date of distribution, and maintaining supporting documentation. To qualify, an individual must be a resident of the State of Tennessee and may 1. show participation in a means-tested program such as the Supplemental Nutrition Assistance Program (food stamps), Families First, Supplemental Security Income, or Low-Income Home Energy Assistance Program; or 2. complete a signed self-declaration of income showing that the total amount of household income is below 185% of the current federal poverty income level. The department conducted desk reviews during our audit period to determine whether each subrecipient had a process to ensure compliance with both inventory and individual eligibility grant requirements. The desk reviews also ensured that subrecipients had a process to monitor partner agencies for compliance with these same requirements. Department management plans to schedule on-site monitoring of subrecipients in January 2025. We will audit the on-site monitoring activities in future audits. PRIOR AUDIT RESULTS In years before 2021, the department performed on-site subrecipient reviews to determine if subrecipients were accurately determining household eligibility and managing the inventory according to federal requirements. According to management, they stopped performing these reviews of subrecipients in March 2020 due to the effects of the COVID-19 pandemic. Without a federal waiver to alleviate the impacts of the health emergency, management was required to either continue their established control activities or implement alternative controls to ensure subrecipients complied with the federal requirements. In the 2021 Single Audit, we noted that management did not have controls in place for household eligibility determinations and food inventory. In addition, we also found noncompliance related to maintaining accurate inventory records and performing an annual inventory. In response to this finding, management stated they would develop a desk-based review monitoring plan and obtain USDA approval for the new plan. During the 2022 Single Audit, we reported that the department did not monitor its subrecipients because management was waiting for USDA to approve the department’s new monitoring plan. This resulted in a repeat finding because department management still did not have controls in place for household eligibility determinations. We also identified subrecipient noncompliance related to not performing annual inventory counts and inaccurate inventory records. Management concurred and stated it would implement the USDA-approved monitoring plan in April 2023 and complete the monitoring by September 2023 to coincide with the end of the federal fiscal year. The plan included conducting desk reviews during the federal fiscal year 2023 to serve as a baseline for annual reviews of 25% of subrecipients in subsequent years. During the 2023 Single Audit, we again reported that management had neither resumed their previous control activity of on-site reviews nor implemented other control activities to ensure subrecipients reasonably complied with the federal regulations. We also identified instances of noncompliance due to inaccurate inventory records and failures to perform the required annual inventory. Management concurred and stated that they had delayed the implementation of on-site reviews, but they had conducted desk reviews of all 22 subrecipients as required by the new plan. CONDITION AND CAUSE Monitoring Activities As part of our follow-up on management’s corrective actions, we found that management conducted desk reviews of the 22 subrecipients’ self-reported information, but based on our review of subrecipient compliance, these desk reviews(19) were not effective and did not detect errors in inventory records, annual inventory counts, and individual eligibility determination, as detailed below. Specifically, the desk reviews did not include evidence to support the subrecipients’ monitoring of their partnering agencies, which is necessary to ensure that the subrecipients and their partnering agencies are complying with the requirements. We also performed our own compliance testwork and found noncompliance with inventory management and individual eligibility, as detailed below. See Schedule of Findings and Questioned Costs for footnote. Inventory Management and Household Eligibility Based on our current compliance testwork and discussions with department and subrecipient management, we found that subrecipients did not maintain accurate monthly food inventory records, and the subrecipients who contract with a distributor did not conduct the required annual inventory. We also found that one subrecipient’s partner agency distributed food to ineligible individuals. Inaccurate Inventory Records We randomly selected 3 of 22 (14%) subrecipients to determine compliance with federal regulations for inventory records. For each subrecipient tested, we randomly sampled three months(20) of monthly inventory reports for each subrecipient during our scope period (July 1, 2023, through June 30, 2024) and recalculated the reports based on receipt, distribution, and food loss adjustments. We noted discrepancies at 2 of the 3 subrecipient agencies we visited: • For 1 subrecipient, we noted inaccurate food records and food counts. For example, based on the most recent monthly inventory report completed before our visit, we expected to find 9,012 bags of dry pinto beans but instead counted 17,592. We also expected to see 7,992 cans of sliced potatoes and counted 13,632 cans. The agency could not provide documentation, such as invoices, to support the difference for either item. • The second subrecipient lacked distribution documentation to support the data reported to the department for the 3 months tested. See Schedule of Findings and Questioned Costs for footnote. Annual Inventory Not Performed In the prior audit, we noted that 5 subrecipients, which use a centralized distributor to receive and store commodities received from the USDA, did not perform the required annual inventory. We identified during follow-up interviews that department management has not ensured corrective action. Specifically, according to department management, they are still using the distributor, and these 5 subrecipients relied solely on the weekly inventory report provided by the distributor and still did not conduct an annual inventory or request tracking documents, such as bills of lading, receipts for received food, or documents showing food distributed to corroborate the amount reported on the food program’s monthly inventory report provided to the department. Individual Eligibility To determine compliance with individual eligibility requirements, we randomly selected and reviewed 14 partner agencies from the 5 food banks contracted with the department between January 1, 2024, and March 31, 2024. For 1 of the 14 partner agencies tested (7%), we determined that the partner agency distributed commodities to 65 of 1,094 (6%) individuals who did not meet eligibility requirements. Once we informed the department of these issues, department management discussed with the subrecipient the eligibility requirements that all partner agencies should follow. In response, the subrecipient plans to retrain this partner agency’s staff. Additionally, the subrecipient’s Program Director will create a list of allowable and prohibited actions to email to all other partner agencies. CRITERIA Inventory Management and Household Eligibility According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, according to 7 CFR 251.10(e), (1) Each State agency must monitor the operation of the program to ensure that it is being administered in accordance with Federal and State requirements. State agencies may not delegate this responsibility. . . . (3) Each [subrecipient monitoring] review must encompass, as applicable, eligibility determinations, food ordering procedures, storage and warehousing practices, inventory controls, approval of distribution sites, reporting and recordkeeping requirements, and civil rights. Additionally, according to 7 CFR 251.5(b) (b) Criteria for determining recipient eligibility. Each State agency must establish uniform Statewide criteria for determining the eligibility of households to receive commodities provided under this part for home consumption. The criteria must: (1) Enable the State agency to ensure that only households which are in need of food assistance because of inadequate household income receive [Emergency Food Assistance Program] commodities; (2) Include income-based standards and the methods by which households may demonstrate eligibility under such standards; and (3) Include a requirement that the household reside in the geographic location served by the State agency at the time of applying for assistance, but length of residency shall not be used as an eligibility criterion. EFFECT The lack of sufficient monitoring controls over inventory management and individual eligibility increases the risk of noncompliance with federal requirements and fraud, waste, and abuse in this federal program. Without sufficient monitoring, department management cannot reasonably ensure that subrecipients fulfill federal requirements and meet the goals of this federal program. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of the Department of Agriculture should ensure staff members have the resources to establish internal controls to ensure staff and subrecipients comply with inventory and eligibility requirements, including designing and implementing a subrecipient monitoring process to effectively address the risks noted in this finding. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT We concur. To ensure effective internal controls over household eligibility determinations and inventory at storage locations for The Emergency Food Assistance Program (TEFAP), the department added three (3) mitigating controls to the enterprise risk management assessment. The controls added are as follows: • Monitoring will include on site reviews to ensure compliance at sites included in the monitoring plan. • Monitoring tools have been developed and will be reviewed annually and revised as needed to ensure all requirements are captured including inventory and eligibility. • Commodities staff will ensure annual inventory is performed as required. Furthermore, we have a new Commodity Distribution Administrator who has developed a monitoring plan for FY25 based on risk assessment. Risk assessments have identified three (3) agencies for monitoring in FY25 which will be completed on site to ensure proper assessment of eligibility and inventory at these locations. Inventory Controls The department has begun observing inventory. In FY24, the new Commodity Distribution Administrator observed inventory at the Chattanooga Area Food Bank and Second Harvest Food Bank of Middle TN. We have a plan in place to observe inventory at all five (5) food banks for FY25. In addition to the on-site inventory observation, internal monthly inventory monitoring has been bolstered and reconciled month to month with our subrecipients. Currently, Eligible Recipient Agency’s (ERA) monthly inventory reports for the previous months are due by the 10th day of each following month. ERA’s beginning monthly inventory in their reports must match the previous month’s reports generated by USDA’s online management site, WBSCM. Each agency’s inventory is fully reconciled no later than the end of the month. For example, January’s inventory report is due by February 10. By the end of February, the month of January’s inventory for each agency is reconciled. Eligibility Controls/ERA Training TN Commodity Distribution has also revised our State Plan to include updated eligibility guidelines including updating language in the plan and revising the intake form. Once approved by USDA, action will be taken so each ERA has a copy of the new State Plan, updated intake form, and daily roster. With a new Commodities Administrator and new guidance published by the USDA, measures will be taken and formally documented to ensure ERA compliance from not only those with direct agreements with TDA, but also those who have contractual agreements with TDA’s ERA’s. These new measures will include trainings (schedule TBD) in the form of recorded PowerPoint presentations sent out to ERAs with a formal signature page of those individuals working for ERAs to sign off attesting they watched the video in full and agree to implement new guidance henceforth in their daily responsibilities. Trainings will be required for all ERA staff that are responsible for working with TEFAP. These records will be collected by a prescribed due date and followed up on during on-site monitoring reviews. Lastly, all agencies identified with deficiencies in the audit will be required to complete a Corrective Action Plan and submit to us within 30 business days of receipt of the request. The Commodity Distribution Administrator will be responsible for ensuring corrective actions are implemented by the anticipated completion date of September 30, 2025.

Finding Number 2024-011 Assistance Listing Number 93.917 Program Name HIV Care Formula Grants Federal Agency Department of Health and Human Services State Agency Department of Health Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Health does not have adequate procedures to ensure compliance with subrecipient monitoring requirements for the HIV Care Formula Grants program BACKGROUND The Department of Health as a pass-through entity administers the HIV Care Formula Grants program (HIV Program) and provides subawards to 20 subrecipients to plan, develop, and deliver healthcare and support services to low-income, uninsured, and underinsured individuals with Human Immunodeficiency Virus (HIV). Federal grantors require pass-through entities to monitor subrecipients’ activities to ensure subrecipients use grant funds for authorized purposes in compliance with statutes, regulations, and any applicable grant terms and conditions. Pass-through entity responsibilities include review of subrecipient single audit reports and the issuance of management decisions for findings related to the federal awards provided by the pass-through entity. Title 2, Code of Federal Regulations (CFR), Part 200, Section 1, states that management decisions are written determinations provided to the subrecipient by the pass-through entity of the sufficiency of the subrecipient’s proposed corrective actions to address the findings. CONDITION Management did not issue a management decision as required for one subrecipient that had a finding pertaining to the HIV program within the required timeframe. The other 19 of the program’s 20 subrecipients either did not require a single audit or the audit performed did not have a finding pertaining to the HIV program. The subrecipient’s single audit report that required the management decision was accepted by the Federal Audit Clearinghouse (FAC) on August 3, 2023; therefore, the department was required to issue a management decision by February 3, 2024. CRITERIA As a pass-through entity, the department is required by 2 CFR 200. 332(d) to Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. . . Pass through entity monitoring of the subrecipient must include . . . (3) Issuing a management decision for applicable audit findings. . . According to 2 CFR 200.521(d), the “. . . pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. . . .” CAUSE According to discussions with department management, a management decision related to the subrecipient’s audit finding was not issued due to the loss of key personnel and lack of communication between divisions. Subrecipient monitoring responsibilities for the HIV program are divided between various divisions, and there was a breakdown in communication between the divisions to ensure all subrecipient monitoring requirements were performed. Additionally, per management, the division does not have written procedures clearly assigning duties related to the verification of single audits and issuance of management decisions to specific personnel. EFFECT When management does not issue a decision within the required timeframe, management increases the risk that subrecipients will not correct problems related to internal controls or compliance with regulations in a timely manner. RECOMMENDATION Management should ensure subrecipient monitoring policies clearly assign responsibility of reviewing subrecipient single audit reports and issuing management decisions in a timely manner to specific personnel. MANAGEMENT’S COMMENT We concur with this finding. Tennessee Department of Health practice guided by written memorandum, Subject: Single Audit Requirements and Subrecipient Grant Contract Language, May 8, 2019, provides guidance for the following processes: 1.) Grant contract language stipulates that subrecipients meeting OMB 2 CFR 200. 332(d) criteria should engage a single audit and send a co+B3py to TDH at the same time they send a copy to the Federal Clearing House. 2.) TDH staff should review and evaluate the findings and corrective actions and communicate with the grantee within 30 days of receipt of the single audit report. 3.) Receipt of grantees’ reports and the program’s responses should be communicated to the TDH Office of Compliance and Ethics. Corrective action: CEDEP program and administrative staff working with HIV contracts will be retrained on these requirements by the HIV and Business and Grants Management section leaders. Current contracts will be reviewed to ensure inclusion of audit guidance. Ryan White Program Director and/or Deputy Director will be responsible to issue a management decision within thirty (30) days related to each audit finding from all auditable subrecipients’ reports. Retraining, contracts review, and process implementation will occur no later than March 31, 2025.

Finding Number 2024-011 Assistance Listing Number 93.917 Program Name HIV Care Formula Grants Federal Agency Department of Health and Human Services State Agency Department of Health Federal Award Identification Number N/A Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Health does not have adequate procedures to ensure compliance with subrecipient monitoring requirements for the HIV Care Formula Grants program BACKGROUND The Department of Health as a pass-through entity administers the HIV Care Formula Grants program (HIV Program) and provides subawards to 20 subrecipients to plan, develop, and deliver healthcare and support services to low-income, uninsured, and underinsured individuals with Human Immunodeficiency Virus (HIV). Federal grantors require pass-through entities to monitor subrecipients’ activities to ensure subrecipients use grant funds for authorized purposes in compliance with statutes, regulations, and any applicable grant terms and conditions. Pass-through entity responsibilities include review of subrecipient single audit reports and the issuance of management decisions for findings related to the federal awards provided by the pass-through entity. Title 2, Code of Federal Regulations (CFR), Part 200, Section 1, states that management decisions are written determinations provided to the subrecipient by the pass-through entity of the sufficiency of the subrecipient’s proposed corrective actions to address the findings. CONDITION Management did not issue a management decision as required for one subrecipient that had a finding pertaining to the HIV program within the required timeframe. The other 19 of the program’s 20 subrecipients either did not require a single audit or the audit performed did not have a finding pertaining to the HIV program. The subrecipient’s single audit report that required the management decision was accepted by the Federal Audit Clearinghouse (FAC) on August 3, 2023; therefore, the department was required to issue a management decision by February 3, 2024. CRITERIA As a pass-through entity, the department is required by 2 CFR 200. 332(d) to Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. . . Pass through entity monitoring of the subrecipient must include . . . (3) Issuing a management decision for applicable audit findings. . . According to 2 CFR 200.521(d), the “. . . pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. . . .” CAUSE According to discussions with department management, a management decision related to the subrecipient’s audit finding was not issued due to the loss of key personnel and lack of communication between divisions. Subrecipient monitoring responsibilities for the HIV program are divided between various divisions, and there was a breakdown in communication between the divisions to ensure all subrecipient monitoring requirements were performed. Additionally, per management, the division does not have written procedures clearly assigning duties related to the verification of single audits and issuance of management decisions to specific personnel. EFFECT When management does not issue a decision within the required timeframe, management increases the risk that subrecipients will not correct problems related to internal controls or compliance with regulations in a timely manner. RECOMMENDATION Management should ensure subrecipient monitoring policies clearly assign responsibility of reviewing subrecipient single audit reports and issuing management decisions in a timely manner to specific personnel. MANAGEMENT’S COMMENT We concur with this finding. Tennessee Department of Health practice guided by written memorandum, Subject: Single Audit Requirements and Subrecipient Grant Contract Language, May 8, 2019, provides guidance for the following processes: 1.) Grant contract language stipulates that subrecipients meeting OMB 2 CFR 200. 332(d) criteria should engage a single audit and send a co+B3py to TDH at the same time they send a copy to the Federal Clearing House. 2.) TDH staff should review and evaluate the findings and corrective actions and communicate with the grantee within 30 days of receipt of the single audit report. 3.) Receipt of grantees’ reports and the program’s responses should be communicated to the TDH Office of Compliance and Ethics. Corrective action: CEDEP program and administrative staff working with HIV contracts will be retrained on these requirements by the HIV and Business and Grants Management section leaders. Current contracts will be reviewed to ensure inclusion of audit guidance. Ryan White Program Director and/or Deputy Director will be responsible to issue a management decision within thirty (30) days related to each audit finding from all auditable subrecipients’ reports. Retraining, contracts review, and process implementation will occur no later than March 31, 2025.

Finding Number 2024-012 Assistance Listing Number 93.568 Program Name Low-Income Home Energy Assistance Federal Agency Department of Health and Human Services State Agency Tennessee Housing Development Agency Federal Award Identification Number N/A Federal Award Year 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Reporting Repeat Finding 2023-019 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior year, Tennessee Housing Development Agency management did not have effective internal controls over reporting for the Low-Income Home Energy Assistance Program BACKGROUND The U.S. Department of Health and Human Services (HHS) provides grant funding through the Low-Income Home Energy Assistance Program (LIHEAP) to the Tennessee Housing Development Agency (the agency). The objective of LIHEAP is to help low-income households meet the costs of home energy, increase their energy self-sufficiency, and reduce their vulnerability resulting from energy needs. As a condition of the grant, HHS requires the agency to report on the use of federal funds through financial, performance, and special reports. In addition to federal requirements in the Code of Federal Regulations, the HHS Office of Administration for Children and Families, Office of Community Services (OCS), provides guidance to LIHEAP recipients by issuing Action Transmittals. In response to the prior-year finding noting ineffective controls over reporting, management stated that they would implement a schedule of report due dates, along with periodic checkpoints between the preparer and the supervisor to address issues prior to the due dates. Management also stated that each federal report would be reviewed by a supervisor prior to its submission to confirm its accuracy. The supervisor position was vacant until November 2023. Although management implemented additional controls when the supervisor position was filled, controls were not adequate to ensure reports were submitted timely or accurately. CONDITION, CRITERIA, AND CAUSE As noted in the prior year, the agency did not have adequate internal controls to ensure it provided the federal grantor (HHS) with timely or accurate reports. The vacant supervisor position was the primary cause for the special and performance reporting deficiencies. THDA also did not assign a secondary reviewer to ensure the reporting was accurate prior to submission. Special Reporting Annual Report on Households Assisted by LIHEAP According to Title 45, Code of Federal Regulations (CFR), Part 96, Section 82(a), the agency is required to submit to HHS the Annual Report on Households Assisted by LIHEAP “for the 12-month period corresponding to the federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance.” We reviewed the 2023 Annual Report on Households Assisted by LIHEAP to ensure management submitted the report timely and reported line items accurately. We noted errors on two line items on the report. See Schedule of Findings and Questioned Costs for table. Quarterly Performance and Management Report LIHEAP Action Transmittal 2023-03 Quarterly Report Instructions Attachment 1 requires grant recipients to submit data and information about LIHEAP through the Quarterly Performance and Management Reports. The quarterly reports “focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility assistance programs, and training and technical assistance needs.” We reviewed the 2023 Quarterly Performance and Management Report for the fourth quarter of the fiscal year to ensure management submitted the report timely and reported line items accurately. We noted that the report was submitted on November 27, 2023, 27 days after the due date of October 31, 2023. FFATA Reporting The Federal Funding Accountability and Transparency Act (FFATA) and 2 CFR 170, Appendix A, require the agency to report subrecipient financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. Reports are due no later than the end of the month following the month when the obligation occurred. The subaward information in FSRS is then made available to the public on USAspending.gov for transparency. We reviewed FSRS to determine the agency’s compliance with FFATA reporting. Based on our review of the system and discussion with management, management did not report any of their 21 subawards within the required timeframe. Management stated that they are working to improve the reporting process. Performance Reporting LIHEAP Action Transmittal 2024-01 states that the LIHEAP Performance Data Form is an annual report in response to Title 42, United States Code, Section 8629(b), which requires the Secretary of the HHS to submit a report to Congress containing a detailed compilation of information on home energy consumption; the amount, cost, and type of fuels used for households eligible for assistance; the number and income levels of households assisted; and the number of households that received such assistance and include 1 or more individuals who are 60 years or older or disabled or include young children. We reviewed the LIHEAP Performance Data Form to ensure management submitted the report timely and reported line items accurately. We noted errors on two line items in the report. See Schedule of Findings and Questioned Costs for table. EFFECT When agency staff do not proactively perform procedures to ensure that reports generated are timely and adequately supported, management increases the risk of reporting inaccurate or untimely data to HHS. For the Quarterly Performance and Management Report, when obligations are understated, management runs the risk of obligating more funds than are available. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional program monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should continue to improve the reporting process by implementing additional controls, as necessary, to ensure timely and accurate reports. MANAGEMENT’S COMMENT We concur. Regarding the Annual Report on Households Assisted by LIHEAP the original submission did not include the Weatherization information and "any type" was under reported. After the new CS Director reviewed and gained some understanding of the report and data used to complete the report, the CS Director reached out to Apprise, Inc. - the data consultants for HHS, ACF - and met with an associate to gain a better understanding of where the errors where and how to correct them. Following this call, the CS Director was able to correct the original submission and gain clearance on the report. Regarding Quarterly Performance and Management Report for 2023, the Quarter 4 report was submitted late. During this period, the Community Services Division had vacancies in both the Director and LIHEAP Manager position requiring other staff to learn and handle the report preparation while also handling their main job functions. Both positions are now filled and a new obligation tracking document has been adopted and a new reporting deadline process put in place to ensure that a reporting preparation, multi-level review and submission process is complete in advance of any reporting deadline. FFATA Reporting continued to be a challenge in 2024, but a new process was adopted by the CS Division and implemented on January 1, 2025 that requires each manager to maintain a monthly FFATA tracking document. As contracts are executed and funding is obligated by our Legal team, a copy of the final contract is sent to the manager and for entry into the tracking document. The Finance team then accesses the tracking document monthly for entry into the federal system. Finally, the LIHEAP Performance Data report was submitted shortly after the CS Director began employment. Although the report was submitted on time, there were errors on the report that were later corrected with the assistance of Apprise, Inc. We do not anticipate the same issues with the 2024 LIHEAP Performance Data report. Overall, the CS Division is working to strengthen internal processes and ensure timeliness of reporting. The CS Director and managers work closely to develop new processes that will bring efficiency to the process and strengthen accuracy.

Finding Number 2024-012 Assistance Listing Number 93.568 Program Name Low-Income Home Energy Assistance Federal Agency Department of Health and Human Services State Agency Tennessee Housing Development Agency Federal Award Identification Number N/A Federal Award Year 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Reporting Repeat Finding 2023-019 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior year, Tennessee Housing Development Agency management did not have effective internal controls over reporting for the Low-Income Home Energy Assistance Program BACKGROUND The U.S. Department of Health and Human Services (HHS) provides grant funding through the Low-Income Home Energy Assistance Program (LIHEAP) to the Tennessee Housing Development Agency (the agency). The objective of LIHEAP is to help low-income households meet the costs of home energy, increase their energy self-sufficiency, and reduce their vulnerability resulting from energy needs. As a condition of the grant, HHS requires the agency to report on the use of federal funds through financial, performance, and special reports. In addition to federal requirements in the Code of Federal Regulations, the HHS Office of Administration for Children and Families, Office of Community Services (OCS), provides guidance to LIHEAP recipients by issuing Action Transmittals. In response to the prior-year finding noting ineffective controls over reporting, management stated that they would implement a schedule of report due dates, along with periodic checkpoints between the preparer and the supervisor to address issues prior to the due dates. Management also stated that each federal report would be reviewed by a supervisor prior to its submission to confirm its accuracy. The supervisor position was vacant until November 2023. Although management implemented additional controls when the supervisor position was filled, controls were not adequate to ensure reports were submitted timely or accurately. CONDITION, CRITERIA, AND CAUSE As noted in the prior year, the agency did not have adequate internal controls to ensure it provided the federal grantor (HHS) with timely or accurate reports. The vacant supervisor position was the primary cause for the special and performance reporting deficiencies. THDA also did not assign a secondary reviewer to ensure the reporting was accurate prior to submission. Special Reporting Annual Report on Households Assisted by LIHEAP According to Title 45, Code of Federal Regulations (CFR), Part 96, Section 82(a), the agency is required to submit to HHS the Annual Report on Households Assisted by LIHEAP “for the 12-month period corresponding to the federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance.” We reviewed the 2023 Annual Report on Households Assisted by LIHEAP to ensure management submitted the report timely and reported line items accurately. We noted errors on two line items on the report. See Schedule of Findings and Questioned Costs for table. Quarterly Performance and Management Report LIHEAP Action Transmittal 2023-03 Quarterly Report Instructions Attachment 1 requires grant recipients to submit data and information about LIHEAP through the Quarterly Performance and Management Reports. The quarterly reports “focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility assistance programs, and training and technical assistance needs.” We reviewed the 2023 Quarterly Performance and Management Report for the fourth quarter of the fiscal year to ensure management submitted the report timely and reported line items accurately. We noted that the report was submitted on November 27, 2023, 27 days after the due date of October 31, 2023. FFATA Reporting The Federal Funding Accountability and Transparency Act (FFATA) and 2 CFR 170, Appendix A, require the agency to report subrecipient financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. Reports are due no later than the end of the month following the month when the obligation occurred. The subaward information in FSRS is then made available to the public on USAspending.gov for transparency. We reviewed FSRS to determine the agency’s compliance with FFATA reporting. Based on our review of the system and discussion with management, management did not report any of their 21 subawards within the required timeframe. Management stated that they are working to improve the reporting process. Performance Reporting LIHEAP Action Transmittal 2024-01 states that the LIHEAP Performance Data Form is an annual report in response to Title 42, United States Code, Section 8629(b), which requires the Secretary of the HHS to submit a report to Congress containing a detailed compilation of information on home energy consumption; the amount, cost, and type of fuels used for households eligible for assistance; the number and income levels of households assisted; and the number of households that received such assistance and include 1 or more individuals who are 60 years or older or disabled or include young children. We reviewed the LIHEAP Performance Data Form to ensure management submitted the report timely and reported line items accurately. We noted errors on two line items in the report. See Schedule of Findings and Questioned Costs for table. EFFECT When agency staff do not proactively perform procedures to ensure that reports generated are timely and adequately supported, management increases the risk of reporting inaccurate or untimely data to HHS. For the Quarterly Performance and Management Report, when obligations are understated, management runs the risk of obligating more funds than are available. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional program monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should continue to improve the reporting process by implementing additional controls, as necessary, to ensure timely and accurate reports. MANAGEMENT’S COMMENT We concur. Regarding the Annual Report on Households Assisted by LIHEAP the original submission did not include the Weatherization information and "any type" was under reported. After the new CS Director reviewed and gained some understanding of the report and data used to complete the report, the CS Director reached out to Apprise, Inc. - the data consultants for HHS, ACF - and met with an associate to gain a better understanding of where the errors where and how to correct them. Following this call, the CS Director was able to correct the original submission and gain clearance on the report. Regarding Quarterly Performance and Management Report for 2023, the Quarter 4 report was submitted late. During this period, the Community Services Division had vacancies in both the Director and LIHEAP Manager position requiring other staff to learn and handle the report preparation while also handling their main job functions. Both positions are now filled and a new obligation tracking document has been adopted and a new reporting deadline process put in place to ensure that a reporting preparation, multi-level review and submission process is complete in advance of any reporting deadline. FFATA Reporting continued to be a challenge in 2024, but a new process was adopted by the CS Division and implemented on January 1, 2025 that requires each manager to maintain a monthly FFATA tracking document. As contracts are executed and funding is obligated by our Legal team, a copy of the final contract is sent to the manager and for entry into the tracking document. The Finance team then accesses the tracking document monthly for entry into the federal system. Finally, the LIHEAP Performance Data report was submitted shortly after the CS Director began employment. Although the report was submitted on time, there were errors on the report that were later corrected with the assistance of Apprise, Inc. We do not anticipate the same issues with the 2024 LIHEAP Performance Data report. Overall, the CS Division is working to strengthen internal processes and ensure timeliness of reporting. The CS Director and managers work closely to develop new processes that will bring efficiency to the process and strengthen accuracy.

Finding Number 2024-013 Assistance Listing Number 10.558 Program Name Child and Adult Care Food Program Federal Agency Department of Agriculture State Agency Department of Human Services Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Human Services did not establish effective internal controls to ensure the management and monitors properly documented subrecipient monitoring activities BACKGROUND The Child and Adult Care Food Program (CACFP) is a year-round food program for eligible participants at childcare centers, day care homes, after-school care programs, emergency shelters, and adult day care centers. CACFP is funded by the U.S. Department of Agriculture (USDA) and administered on the state level by the Department of Human Services (DHS). DHS contracts with these institutions, called subrecipients, who administer the program by providing meals. As a pass-through entity, DHS is responsible for ensuring that subrecipients are eligible to participate in the program and that the subrecipients comply with federal requirements. State Agency Monitoring Requirements To fulfill the federal monitoring requirements outlined in the USDA’s Monitoring Handbook for State Agencies: A Child and Adult Care Food Care Program Handbook (CACFP Monitoring Handbook), the department’s Division of Audit Services (division) is responsible for performing regular monitoring visits of participating subrecipients approximately every three years. If department management identified or became aware of problems related to a subrecipient, the division monitors the subrecipient more frequently. These visits occur during the award period and cover three components of monitoring: • ensuring subrecipients comply with federal program requirements; • ensuring subrecipients that receive $750,000 or more in federal awards receive a single audit as required by federal regulations; and • following up on previously reported issues. To document subrecipient monitoring work, division staff use Diligent, a third-party electronic audit management application. Within Diligent, Audit Services management requires working papers have three levels of documented review to ensure the work performed supports the monitoring report. Subrecipient Single Audit Requirements Pursuant to the Office of Management and Budget’s Uniform Grant Guidance and “Audit Requirements,” Title 2, Code of Federal Regulations (CFR), Part 200, Section 501, (a) Audit required.(21) A non-Federal entity [subrecipient] that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. See Schedule of Findings and Questioned Costs for footnote. Furthermore, as the pass-through entity, DHS is required by 2 CFR 200.332(f) to verify that all subrecipients that spend $750,000 or more obtain a single audit within 9 months after the subrecipient’s fiscal year-end. As part of that single audit, if a subrecipient receives an audit finding, the department must issue a management decision within six months of the audit report’s release, indicate if the department agreed with the finding, and describe any corrective action the subrecipient must take. Based on discussions with the Division of Audit Services’ management, division staff compiles subrecipient expenditure information from Edison, the state’s accounting system, to determine if the subrecipient received over $750,000 in federal funds. Once management identifies the subrecipients who meet the audit threshold, the Director of Audit Services creates a tracker spreadsheet using Microsoft Excel. The director tracks the receipt of required single audit reports throughout the fiscal year and notes on the tracker if the audit reports identified findings relevant to the federal program. If a subrecipient’s audit report identified findings, the Director of Audit Services notifies program management responsible for ensuring the subrecipient’s compliance with federal requirements. Program management must then obtain and review the subrecipient’s single audit findings and corrective actions and issue a management decision for any program-related findings. Current Audit Methodology From a population of 81 subrecipient monitoring reports the department issued from July 1, 2023, through June 30, 2024, we tested a nonstatistical random sample of 60 monitoring reports to determine if DHS management conducted subrecipient program monitoring in accordance with the CACFP Monitoring Handbook. We also tested the population of 36 subrecipients that received $750,000 or more in federal awards during the subrecipient’s fiscal year to determine if management obtained a single audit report. If applicable, we determined if DHS program management followed up on any findings in the subrecipient’s single audit and issued a management decision. CONDITION, CRITERIA, AND CAUSE Subrecipient’s Compliance with Household Contact Policy Not Documented Based on our testwork, we found that for 7 of 20(22) (35%) monitoring reports tested, the department’s monitors did not document their review of the subrecipient’s Household Contact Policy. Federal regulations define a household contact as an adult member in a household who has a child enrolled in childcare that the sponsoring organization or the state can contact “to verify the attendance and enrollment of the child and the specific meal service(s) which the child routinely receives while in care.”(23) According to 7 CFR 226.6(m)(5), “State agencies must establish a system for sponsoring organizations to use in making household contacts as part of their review and oversight of participating facilities.” Furthermore, in 7 CFR 226.6(m)(3)(x), the department is required to review the sponsoring organization’s implementation of the household contact system (policy) to assess its compliance with federal regulations. See Schedule of Findings and Questioned Costs for footnotes. Based on our review of the working papers in Diligent, the department’s internal procedure requires the monitor to document their review of the policy and upload it into the working papers to document their review. For all 7 subrecipients, the monitor did not upload the household contact policy into the working papers. For one subrecipient, although the monitor did not upload the policy in the working papers, the monitor indicated in the working papers that one existed. Because the policies were not uploaded, we could not determine if the monitor assessed whether the subrecipient’s household contact policy complied with federal regulations. In all 7 instances, three reviewers signed off on the monitor’s work related to the household contact policy even though the monitors’ documentation was incomplete. According to the Director of Audit Services, he agreed that monitors did not document the Household Contact Policy. He stated that he would identify the monitors who performed the work and provide training. Ineffective Internal Controls Related to Late Subrecipient Single Audit Reports Based on our review, we found that for 4 of 36 (11%) subrecipients that met the $750,000 threshold to obtain a single audit, DHS program management did not ensure that the subrecipients’ audits were released within the required 9-month timeframe. We noted that the subrecipients’ auditors released the reports between 3 to 10 months late. According to the Director of Operations for the Child and Adult Care Food Program and the Summer Food Service Program, they rely on regular communication as a control to ensure they obtain subrecipients’ single audits. According to the director, as of January 10, 2023, management regularly communicated with the subrecipients to complete their single audit reports; however, the director could not provide the evidence explaining why the audits were delayed. According to 2 CFR 200.332(f), DHS must “[v]erify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded [$750,000].” Subpart F(24) states that audit reports must be submitted within “. . . nine months after the end of the audit period.”(25) See Schedule of Findings and Questioned Costs for footnotes. No Management Decisions Issued According to 2 CFR 200.521(d), “The . . . pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by [the federal audit clearinghouse].” As noted above, the Director of Audit Services notifies program management that a subrecipient’s audit report identified findings, which is the control to ensure that program management reviews the findings and corrective actions and issues a management decision. The Director of Operations for the Child and Adult Care Food Program and the Summer Food Service Program is responsible for providing DHS subrecipients with a management decision related to the subrecipient’s corrective actions within six months of the audit report’s issuance. However, during our review of the three subrecipients whose audit reports included findings, the Director of Operations could not provide the management decisions when we requested them. The findings in question related to the lack of controls over both food programs’ meal counts, which is the supporting documentation for the program’s expenditures. Risk Assessment We reviewed the department’s 2023 Financial Integrity Act Risk Assessment and determined that management did not identify the risks of noncompliance identified in this finding. As such, management did not establish control activities to ensure compliance with CACFP’s subrecipient monitoring requirements. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, “Identify, Analyze, and Respond to Risks,” Identification of Risks, 7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. EFFECT When management does not document that program monitors verify that subrecipients met program requirements, ensure subrecipients obtain a single audit when required, or issue management decisions, DHS management increases the risk that their subrecipients may use federal grant funds for unauthorized purposes and fail to comply with federal statutes and regulations. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. Specifically, the Director of Audit Services should ensure that program monitors adequately document and assess whether subrecipients comply with program requirements that are subject to program monitoring. The Director of Operations for the for the Child and Adult Care Food Program and the Summer Food Service Program should maintain documentation of communication with subrecipients who do not obtain a single audit within the required timeframe. In addition, when independent audits identify findings in the audit reports, the Director of Operations should issue timely management decisions in response to the subrecipients’ corrective action plans as required by federal regulations. MANAGEMENT’S COMMENT Subrecipient’s Compliance with Household Contact Policy Not Documented We concur. We agree that few of the Sponsoring Organizations Household Contact policy were not uploaded into the working papers within the audit software. In October 2024, we created a permanent folder within the audit software to upload and maintain all Sponsoring Organizations Household Contact policy. Ineffective Internal Controls Related to Late Subrecipient Single Audit Reports We concur. Food program is implementing a tracking system to specifically identify subrecipients who do not obtain a single audit within the required timeframe. Food program will specifically maintain documentation of communication with subrecipients identified with this tool. This tool will be implemented by April 1, 2025. No Management Decisions Issued We concur. Food program will use the tracking system identified above to identify the required timelines for issuing management decisions in response to the subrecipients’ corrective action plans. Food program will issue timely management decisions. This tool will be implemented by April 1, 2025. Risk Assessment We concur. Food program will update the risk assessment to include risk of noncompliance with CACFP’s subrecipient monitoring requirements.

Finding Number 2024-013 Assistance Listing Number 10.558 Program Name Child and Adult Care Food Program Federal Agency Department of Agriculture State Agency Department of Human Services Federal Award Identification Number N/A Federal Award Year 2023 and 2024 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Human Services did not establish effective internal controls to ensure the management and monitors properly documented subrecipient monitoring activities BACKGROUND The Child and Adult Care Food Program (CACFP) is a year-round food program for eligible participants at childcare centers, day care homes, after-school care programs, emergency shelters, and adult day care centers. CACFP is funded by the U.S. Department of Agriculture (USDA) and administered on the state level by the Department of Human Services (DHS). DHS contracts with these institutions, called subrecipients, who administer the program by providing meals. As a pass-through entity, DHS is responsible for ensuring that subrecipients are eligible to participate in the program and that the subrecipients comply with federal requirements. State Agency Monitoring Requirements To fulfill the federal monitoring requirements outlined in the USDA’s Monitoring Handbook for State Agencies: A Child and Adult Care Food Care Program Handbook (CACFP Monitoring Handbook), the department’s Division of Audit Services (division) is responsible for performing regular monitoring visits of participating subrecipients approximately every three years. If department management identified or became aware of problems related to a subrecipient, the division monitors the subrecipient more frequently. These visits occur during the award period and cover three components of monitoring: • ensuring subrecipients comply with federal program requirements; • ensuring subrecipients that receive $750,000 or more in federal awards receive a single audit as required by federal regulations; and • following up on previously reported issues. To document subrecipient monitoring work, division staff use Diligent, a third-party electronic audit management application. Within Diligent, Audit Services management requires working papers have three levels of documented review to ensure the work performed supports the monitoring report. Subrecipient Single Audit Requirements Pursuant to the Office of Management and Budget’s Uniform Grant Guidance and “Audit Requirements,” Title 2, Code of Federal Regulations (CFR), Part 200, Section 501, (a) Audit required.(21) A non-Federal entity [subrecipient] that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. See Schedule of Findings and Questioned Costs for footnote. Furthermore, as the pass-through entity, DHS is required by 2 CFR 200.332(f) to verify that all subrecipients that spend $750,000 or more obtain a single audit within 9 months after the subrecipient’s fiscal year-end. As part of that single audit, if a subrecipient receives an audit finding, the department must issue a management decision within six months of the audit report’s release, indicate if the department agreed with the finding, and describe any corrective action the subrecipient must take. Based on discussions with the Division of Audit Services’ management, division staff compiles subrecipient expenditure information from Edison, the state’s accounting system, to determine if the subrecipient received over $750,000 in federal funds. Once management identifies the subrecipients who meet the audit threshold, the Director of Audit Services creates a tracker spreadsheet using Microsoft Excel. The director tracks the receipt of required single audit reports throughout the fiscal year and notes on the tracker if the audit reports identified findings relevant to the federal program. If a subrecipient’s audit report identified findings, the Director of Audit Services notifies program management responsible for ensuring the subrecipient’s compliance with federal requirements. Program management must then obtain and review the subrecipient’s single audit findings and corrective actions and issue a management decision for any program-related findings. Current Audit Methodology From a population of 81 subrecipient monitoring reports the department issued from July 1, 2023, through June 30, 2024, we tested a nonstatistical random sample of 60 monitoring reports to determine if DHS management conducted subrecipient program monitoring in accordance with the CACFP Monitoring Handbook. We also tested the population of 36 subrecipients that received $750,000 or more in federal awards during the subrecipient’s fiscal year to determine if management obtained a single audit report. If applicable, we determined if DHS program management followed up on any findings in the subrecipient’s single audit and issued a management decision. CONDITION, CRITERIA, AND CAUSE Subrecipient’s Compliance with Household Contact Policy Not Documented Based on our testwork, we found that for 7 of 20(22) (35%) monitoring reports tested, the department’s monitors did not document their review of the subrecipient’s Household Contact Policy. Federal regulations define a household contact as an adult member in a household who has a child enrolled in childcare that the sponsoring organization or the state can contact “to verify the attendance and enrollment of the child and the specific meal service(s) which the child routinely receives while in care.”(23) According to 7 CFR 226.6(m)(5), “State agencies must establish a system for sponsoring organizations to use in making household contacts as part of their review and oversight of participating facilities.” Furthermore, in 7 CFR 226.6(m)(3)(x), the department is required to review the sponsoring organization’s implementation of the household contact system (policy) to assess its compliance with federal regulations. See Schedule of Findings and Questioned Costs for footnotes. Based on our review of the working papers in Diligent, the department’s internal procedure requires the monitor to document their review of the policy and upload it into the working papers to document their review. For all 7 subrecipients, the monitor did not upload the household contact policy into the working papers. For one subrecipient, although the monitor did not upload the policy in the working papers, the monitor indicated in the working papers that one existed. Because the policies were not uploaded, we could not determine if the monitor assessed whether the subrecipient’s household contact policy complied with federal regulations. In all 7 instances, three reviewers signed off on the monitor’s work related to the household contact policy even though the monitors’ documentation was incomplete. According to the Director of Audit Services, he agreed that monitors did not document the Household Contact Policy. He stated that he would identify the monitors who performed the work and provide training. Ineffective Internal Controls Related to Late Subrecipient Single Audit Reports Based on our review, we found that for 4 of 36 (11%) subrecipients that met the $750,000 threshold to obtain a single audit, DHS program management did not ensure that the subrecipients’ audits were released within the required 9-month timeframe. We noted that the subrecipients’ auditors released the reports between 3 to 10 months late. According to the Director of Operations for the Child and Adult Care Food Program and the Summer Food Service Program, they rely on regular communication as a control to ensure they obtain subrecipients’ single audits. According to the director, as of January 10, 2023, management regularly communicated with the subrecipients to complete their single audit reports; however, the director could not provide the evidence explaining why the audits were delayed. According to 2 CFR 200.332(f), DHS must “[v]erify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded [$750,000].” Subpart F(24) states that audit reports must be submitted within “. . . nine months after the end of the audit period.”(25) See Schedule of Findings and Questioned Costs for footnotes. No Management Decisions Issued According to 2 CFR 200.521(d), “The . . . pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by [the federal audit clearinghouse].” As noted above, the Director of Audit Services notifies program management that a subrecipient’s audit report identified findings, which is the control to ensure that program management reviews the findings and corrective actions and issues a management decision. The Director of Operations for the Child and Adult Care Food Program and the Summer Food Service Program is responsible for providing DHS subrecipients with a management decision related to the subrecipient’s corrective actions within six months of the audit report’s issuance. However, during our review of the three subrecipients whose audit reports included findings, the Director of Operations could not provide the management decisions when we requested them. The findings in question related to the lack of controls over both food programs’ meal counts, which is the supporting documentation for the program’s expenditures. Risk Assessment We reviewed the department’s 2023 Financial Integrity Act Risk Assessment and determined that management did not identify the risks of noncompliance identified in this finding. As such, management did not establish control activities to ensure compliance with CACFP’s subrecipient monitoring requirements. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, “Identify, Analyze, and Respond to Risks,” Identification of Risks, 7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. EFFECT When management does not document that program monitors verify that subrecipients met program requirements, ensure subrecipients obtain a single audit when required, or issue management decisions, DHS management increases the risk that their subrecipients may use federal grant funds for unauthorized purposes and fail to comply with federal statutes and regulations. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. Specifically, the Director of Audit Services should ensure that program monitors adequately document and assess whether subrecipients comply with program requirements that are subject to program monitoring. The Director of Operations for the for the Child and Adult Care Food Program and the Summer Food Service Program should maintain documentation of communication with subrecipients who do not obtain a single audit within the required timeframe. In addition, when independent audits identify findings in the audit reports, the Director of Operations should issue timely management decisions in response to the subrecipients’ corrective action plans as required by federal regulations. MANAGEMENT’S COMMENT Subrecipient’s Compliance with Household Contact Policy Not Documented We concur. We agree that few of the Sponsoring Organizations Household Contact policy were not uploaded into the working papers within the audit software. In October 2024, we created a permanent folder within the audit software to upload and maintain all Sponsoring Organizations Household Contact policy. Ineffective Internal Controls Related to Late Subrecipient Single Audit Reports We concur. Food program is implementing a tracking system to specifically identify subrecipients who do not obtain a single audit within the required timeframe. Food program will specifically maintain documentation of communication with subrecipients identified with this tool. This tool will be implemented by April 1, 2025. No Management Decisions Issued We concur. Food program will use the tracking system identified above to identify the required timelines for issuing management decisions in response to the subrecipients’ corrective action plans. Food program will issue timely management decisions. This tool will be implemented by April 1, 2025. Risk Assessment We concur. Food program will update the risk assessment to include risk of noncompliance with CACFP’s subrecipient monitoring requirements.

Finding Number 2024-014 Assistance Listing Number 15.605 and 15.611 Program Name Fish and Wildlife Cluster Federal Agency Department of the Interior State Agency Tennessee Wildlife Resources Agency Federal Award Identification Number N/A Federal Award Year 2019 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding 2023-025 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior two audits, Tennessee Wildlife Resources Agency management did not fully implement controls to ensure that the agency complied with the federal requirements for subrecipient monitoring BACKGROUND The Tennessee Wildlife Resources Agency (TWRA) administers the Fish and Wildlife cluster of programs, which are federal programs under the oversight of the U.S. Fish and Wildlife Service. The Fish and Wildlife Cluster includes the following programs: • The Sport Fish Restoration program provides funds to restore, conserve, and enhance sport fish populations and to provide for public use and enjoyment of these fishery resources. • The Wildlife Restoration program provides funds to restore, rehabilitate, and improve wildlife populations and their habitats; to conduct wildlife management research, and wildlife population surveys and inventories; to acquire land; and to provide for public use of wildlife resources. • The Basic Hunter Education program provides training to hunters in the safe handling and use of firearms and archery equipment; hunter responsibilities and ethics; survival; construction, operation, and maintenance of public shooting ranges; and basic wildlife management and identification. • The Enhanced Hunter Education and Safety program provides funds to enhance programs for hunter education, recruitment, and safety; to increase interstate coordination of hunter education programs; to enhance programs for bow hunters and archers; to enhance construction and development of firearm and archery ranges; and to update safety features of firearm and archery ranges. For fiscal year 2024, TWRA awarded $4,784,164 in federal funds to 14 subrecipients, such as nonprofit foundations and universities, to carry out the activities of the Fish and Wildlife Cluster programs. Prior Audit Results Beginning in the 2022 Single Audit, we reported that TWRA management did not perform required subrecipient monitoring and did not obtain and review subrecipient Single Audits. Additionally, we reviewed the 2021 Financial Integrity Act Risk Assessment and determined that management did not identify risks related to failure to perform subrecipient monitoring and review Single Audit reports. Management concurred with the finding and stated that they would determine assignments to carry out effective monitoring and update their 2022 risk assessment. During the 2023 Single Audit, we again reported that management did not perform subrecipient monitoring and did not obtain and review subrecipients’ Single Audit reports. We also reported that although TWRA’s December 2022 Financial Integrity Act Risk Assessment identified risks associated with the lack of subrecipient monitoring and with the failure to review subrecipient Single Audit reports, management still did not fully design and implement controls to mitigate these risks. TWRA management concurred with the finding and stated that the agency did not perform subrecipient monitoring and did not obtain and review subrecipients’ Single Audit reports due to a lack of staff. TWRA management stated they developed the TWRA Federal Aid Procedures Manual and included chapters on subrecipient monitoring, procedures and risk assessments. They assigned responsibility for the subrecipient monitoring process to the TWRA Federal Aid Grants Manager (Grants Manager), TWRA Project Managers, the Department of Finance and Administration Controller for TWRA, and the TWRA Federal Aid and Real Estate Division. The agency also requires staff to attend annual update training, which includes the subrecipient monitoring process. They stated that they anticipated full implementation of the process by June 30, 2024. In the agency’s six-month follow-up report of corrective action, dated September 24, 2024, management stated that all corrective actions noted above and the hiring of a Grants Manager to oversee subrecipient monitoring activities were fully implemented as of June 30, 2024. Current Audit During the current audit and in response to the prior audit findings, TWRA management developed procedures for subrecipient monitoring in the October 2023 TWRA Federal Aid Procedures Manual. Also, management hired a Grants Manager in April 2024, exclusively dedicated to subrecipient monitoring, who has started implementing the new subrecipient monitoring procedures. Management also completed a risk assessment for each subrecipient and each project or grant award. These risk assessments evaluate the subrecipient’s previous compliance audit findings, prior experience, and new personnel or systems. Management’s assessed level of risk for the subrecipients determines the number of monitoring visits the project manager will conduct for each subrecipient project, which is documented in each project’s monitoring plan. Finally, management now requires project managers to sign the monitoring plan indicating completion of the plan and return it to the Grants Manager for review. Our goal was to focus on the agency implementing its corrective actions to address the prior finding. CONDITION, CRITERIA, AND CAUSE We met with management to understand TWRA management’s subrecipient monitoring procedures and reviewed the TWRA Federal Aid Procedures Manual. Based on our discussions and review, we determined that for fiscal year ended June 30, 2024, management still had not fully implemented the controls as described to ensure compliance with the subrecipient monitoring requirements and specifically did not perform subrecipient monitoring activities, including reviewing financial and performance reports as required by Title 2, Code of Federal Regulations (CFR), Part 200, Section 332(d): Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. Based on our review of the documentation, we found that TWRA management did not monitor subrecipients by performing complete monitoring reviews(26) to ensure the subrecipients were meeting both programmatic and financial expectations. According to the Assistant Chief of Federal Aid and Real Estate, staff performed only one partial review for one subrecipient out of 57(27) projects representing the 14 subrecipients that required complete reviews (programmatic and financial) for the period. In this one partial monitoring review, staff performed only the programmatic review of the subrecipient. Based on our follow-up discussions with management, management agreed with our conclusions and stated that the lack of subrecipient monitoring was due to a lack of staff. See Schedule of Findings and Questioned Costs for footnotes. EFFECT When TWRA management does not implement controls timely to ensure management and staff follow federal requirements to perform subrecipient monitoring, management cannot ensure subrecipients have reasonably complied with federal statutes, regulations, and terms and conditions of the grant award. This includes both programmatic and financial reviews. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Executive Director should address the root cause of any monitoring deficiencies and take the final action to fully implement the controls they created to guide agency staff tasked to perform subrecipient monitoring activities required by federal regulations and requirements. Specifically, management should ensure staff perform the complete monitoring reviews to ensure subrecipients are meeting both programmatic and financial expectations for the grant funds they receive. Management should take prompt action to identify any areas of subrecipient noncompliance with the grant regulations and follow up on required corrective action as needed. MANAGEMENT’S COMMENT We partially concur. The Agency appreciates and respects the Comptroller’s Office position, and while the Agency acknowledges that the Federal Aid and Real Estate team did not produce an adequate number of monitoring reviews, it is merely due to the control being implemented in FY 2024 and not having had adequate time to become fully operational rather than a process deficiency or lack of corrective actions taken by TWRA. Further, the corrective action to address this issue would not be to revise or create additions to the internal control, it is to allow adequate time for the internal control to operate. The position that further corrective actions are unnecessary is supported in communications subsequent to our recent Office of the Inspector General (OIG) U.S. Fish and Wildlife Service Grants for the period ended June 30, 2022, in which the OIG had “reviewed the (sub-recipient monitoring) procedures and found them to be adequate” albeit not fully implemented. Discussions with the Comptroller Auditors yielded similar agreement. The Agency believes that the corrective actions taken in and prior to FY 2024 listed in the Single Audit Report, coupled with the continued direct sub-recipient monitoring activities of Agency’s project managers, substantially mitigate both the risk of non-compliance with Title 2, Code of Federal Regulations (CFR) Part 200, Section 332(d) and the risk of potential adverse actions from the US Fish and Wildlife Service. TWRA will continue to support the internal control activities of the Federal Aid and Real Estate Division, and the project managers assigned to directly manage the sub-recipient activities. The Agency looks forward to a review of the complete process in FY 2025. AUDITOR’S COMMENT We have reviewed management’s comments, and the finding stands as written. We would like to note that while management had not performed all needed financial and programmatic monitoring reviews of subrecipients during the audit period, management did initiate corrective changes to the monitoring process to ensure financial and programmatic monitoring reviews will be performed in the future. We will follow up on the monitoring process changes in the next audit.

Finding Number 2024-014 Assistance Listing Number 15.605 and 15.611 Program Name Fish and Wildlife Cluster Federal Agency Department of the Interior State Agency Tennessee Wildlife Resources Agency Federal Award Identification Number N/A Federal Award Year 2019 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding 2023-025 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior two audits, Tennessee Wildlife Resources Agency management did not fully implement controls to ensure that the agency complied with the federal requirements for subrecipient monitoring BACKGROUND The Tennessee Wildlife Resources Agency (TWRA) administers the Fish and Wildlife cluster of programs, which are federal programs under the oversight of the U.S. Fish and Wildlife Service. The Fish and Wildlife Cluster includes the following programs: • The Sport Fish Restoration program provides funds to restore, conserve, and enhance sport fish populations and to provide for public use and enjoyment of these fishery resources. • The Wildlife Restoration program provides funds to restore, rehabilitate, and improve wildlife populations and their habitats; to conduct wildlife management research, and wildlife population surveys and inventories; to acquire land; and to provide for public use of wildlife resources. • The Basic Hunter Education program provides training to hunters in the safe handling and use of firearms and archery equipment; hunter responsibilities and ethics; survival; construction, operation, and maintenance of public shooting ranges; and basic wildlife management and identification. • The Enhanced Hunter Education and Safety program provides funds to enhance programs for hunter education, recruitment, and safety; to increase interstate coordination of hunter education programs; to enhance programs for bow hunters and archers; to enhance construction and development of firearm and archery ranges; and to update safety features of firearm and archery ranges. For fiscal year 2024, TWRA awarded $4,784,164 in federal funds to 14 subrecipients, such as nonprofit foundations and universities, to carry out the activities of the Fish and Wildlife Cluster programs. Prior Audit Results Beginning in the 2022 Single Audit, we reported that TWRA management did not perform required subrecipient monitoring and did not obtain and review subrecipient Single Audits. Additionally, we reviewed the 2021 Financial Integrity Act Risk Assessment and determined that management did not identify risks related to failure to perform subrecipient monitoring and review Single Audit reports. Management concurred with the finding and stated that they would determine assignments to carry out effective monitoring and update their 2022 risk assessment. During the 2023 Single Audit, we again reported that management did not perform subrecipient monitoring and did not obtain and review subrecipients’ Single Audit reports. We also reported that although TWRA’s December 2022 Financial Integrity Act Risk Assessment identified risks associated with the lack of subrecipient monitoring and with the failure to review subrecipient Single Audit reports, management still did not fully design and implement controls to mitigate these risks. TWRA management concurred with the finding and stated that the agency did not perform subrecipient monitoring and did not obtain and review subrecipients’ Single Audit reports due to a lack of staff. TWRA management stated they developed the TWRA Federal Aid Procedures Manual and included chapters on subrecipient monitoring, procedures and risk assessments. They assigned responsibility for the subrecipient monitoring process to the TWRA Federal Aid Grants Manager (Grants Manager), TWRA Project Managers, the Department of Finance and Administration Controller for TWRA, and the TWRA Federal Aid and Real Estate Division. The agency also requires staff to attend annual update training, which includes the subrecipient monitoring process. They stated that they anticipated full implementation of the process by June 30, 2024. In the agency’s six-month follow-up report of corrective action, dated September 24, 2024, management stated that all corrective actions noted above and the hiring of a Grants Manager to oversee subrecipient monitoring activities were fully implemented as of June 30, 2024. Current Audit During the current audit and in response to the prior audit findings, TWRA management developed procedures for subrecipient monitoring in the October 2023 TWRA Federal Aid Procedures Manual. Also, management hired a Grants Manager in April 2024, exclusively dedicated to subrecipient monitoring, who has started implementing the new subrecipient monitoring procedures. Management also completed a risk assessment for each subrecipient and each project or grant award. These risk assessments evaluate the subrecipient’s previous compliance audit findings, prior experience, and new personnel or systems. Management’s assessed level of risk for the subrecipients determines the number of monitoring visits the project manager will conduct for each subrecipient project, which is documented in each project’s monitoring plan. Finally, management now requires project managers to sign the monitoring plan indicating completion of the plan and return it to the Grants Manager for review. Our goal was to focus on the agency implementing its corrective actions to address the prior finding. CONDITION, CRITERIA, AND CAUSE We met with management to understand TWRA management’s subrecipient monitoring procedures and reviewed the TWRA Federal Aid Procedures Manual. Based on our discussions and review, we determined that for fiscal year ended June 30, 2024, management still had not fully implemented the controls as described to ensure compliance with the subrecipient monitoring requirements and specifically did not perform subrecipient monitoring activities, including reviewing financial and performance reports as required by Title 2, Code of Federal Regulations (CFR), Part 200, Section 332(d): Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. Based on our review of the documentation, we found that TWRA management did not monitor subrecipients by performing complete monitoring reviews(26) to ensure the subrecipients were meeting both programmatic and financial expectations. According to the Assistant Chief of Federal Aid and Real Estate, staff performed only one partial review for one subrecipient out of 57(27) projects representing the 14 subrecipients that required complete reviews (programmatic and financial) for the period. In this one partial monitoring review, staff performed only the programmatic review of the subrecipient. Based on our follow-up discussions with management, management agreed with our conclusions and stated that the lack of subrecipient monitoring was due to a lack of staff. See Schedule of Findings and Questioned Costs for footnotes. EFFECT When TWRA management does not implement controls timely to ensure management and staff follow federal requirements to perform subrecipient monitoring, management cannot ensure subrecipients have reasonably complied with federal statutes, regulations, and terms and conditions of the grant award. This includes both programmatic and financial reviews. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Executive Director should address the root cause of any monitoring deficiencies and take the final action to fully implement the controls they created to guide agency staff tasked to perform subrecipient monitoring activities required by federal regulations and requirements. Specifically, management should ensure staff perform the complete monitoring reviews to ensure subrecipients are meeting both programmatic and financial expectations for the grant funds they receive. Management should take prompt action to identify any areas of subrecipient noncompliance with the grant regulations and follow up on required corrective action as needed. MANAGEMENT’S COMMENT We partially concur. The Agency appreciates and respects the Comptroller’s Office position, and while the Agency acknowledges that the Federal Aid and Real Estate team did not produce an adequate number of monitoring reviews, it is merely due to the control being implemented in FY 2024 and not having had adequate time to become fully operational rather than a process deficiency or lack of corrective actions taken by TWRA. Further, the corrective action to address this issue would not be to revise or create additions to the internal control, it is to allow adequate time for the internal control to operate. The position that further corrective actions are unnecessary is supported in communications subsequent to our recent Office of the Inspector General (OIG) U.S. Fish and Wildlife Service Grants for the period ended June 30, 2022, in which the OIG had “reviewed the (sub-recipient monitoring) procedures and found them to be adequate” albeit not fully implemented. Discussions with the Comptroller Auditors yielded similar agreement. The Agency believes that the corrective actions taken in and prior to FY 2024 listed in the Single Audit Report, coupled with the continued direct sub-recipient monitoring activities of Agency’s project managers, substantially mitigate both the risk of non-compliance with Title 2, Code of Federal Regulations (CFR) Part 200, Section 332(d) and the risk of potential adverse actions from the US Fish and Wildlife Service. TWRA will continue to support the internal control activities of the Federal Aid and Real Estate Division, and the project managers assigned to directly manage the sub-recipient activities. The Agency looks forward to a review of the complete process in FY 2025. AUDITOR’S COMMENT We have reviewed management’s comments, and the finding stands as written. We would like to note that while management had not performed all needed financial and programmatic monitoring reviews of subrecipients during the audit period, management did initiate corrective changes to the monitoring process to ensure financial and programmatic monitoring reviews will be performed in the future. We will follow up on the monitoring process changes in the next audit.

Finding Number 2023-001 Assistance Listing Number 84.425E and 84.425J Program Name Education Stabilization Fund Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number P425E200897 - 20B and P425J200061 - 20B Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Activities Allowed or Unallowed Allowable Costs/Cost Principles Matching, Level of Effort, Earmarking (84.425J) Repeat Finding 2022-001 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.425E Federal Award Identification Number P425E200897 - 20B Amount $85,000 Assistance Listing Number 84.425J Federal Award Identification Number P425J200061 - 20B Amount $233,113 FINDING Tennessee State University continued not to follow federal guidance for the Higher Education Emergency Relief Fund BACKGROUND The Coronavirus Aid, Relief, and Economic Security Act established the Higher Education Emergency Relief Fund (HEERF) to provide relief to colleges and universities affected by the coronavirus pandemic. The Coronavirus Response and Relief Supplemental Appropriations Act and the American Rescue Plan (ARP) Act provided additional waves of funding for the program. Since the inception of HEERF, Tennessee State University (TSU) has been awarded $115,573,226 through three primary types of HEERF funds. The first type was student funds intended to be used for student emergency aid grants. The second type was institutional funds, which were allowed to be spent for certain things, such as additional emergency aid grants to students, including discharging student debt, supplies to combat the coronavirus, and lost revenue. The third type was supplemental funds dedicated for Historically Black Colleges and Universities (HBCUs). TSU was allowed to use its HBCU HEERF for additional institutional costs and to provide scholarships and grants to students. At the beginning of fiscal year 2023, TSU had used all of the institutional and HBCU HEERF funds awarded and had $4,622,145 of student funds remaining. Executive leadership decided to use the remaining student funds to cover emergency aid grants and persistence grants. During the current fiscal year, HBCU HEERF funds totaling $233,113 became available because of late adjustments to debt-discharged student accounts due to revised charges, payments received, and/or applied scholarships. The reclaimed HBCU funds were used to provide scholarships to students, called tuition assistance grants, which could cover any part of the student’s cost of attendance. To receive HEERF funds, TSU was required to follow federal regulations and additional federal guidance, such as Frequently Asked Questions (FAQs) published by the U.S. Department of Education (ED). Based on the work performed during our audit, we noted that TSU did not establish an adequate control structure for the HEERF award to ensure compliance with these federal guidelines. We noted issues in all three fund types of HEERF aid because of TSU’s lack of internal controls. Student Funds CONDITION AND CRITERIA Tennessee State University management did not follow federal guidance related to the student portion of HEERF. TSU used $85,000 of the student portion of its HEERF award on persistence grants rather than emergency aid grants. TSU’s persistence grants awarded $1,000 at the end of the academic year to freshman students who had maintained passing grades (a 2.0 GPA) and attended several student engagement events held throughout the year. These stipulations were not allowable under the student portion of the HEERF award. ED required the institutions to prioritize students with exceptional need, as noted in the ARP HEERF III FAQs Updates, Question 7, which states, institutions are directed with the ARP funds to prioritize students with exceptional need, such as students who receive Pell Grants or are undergraduates with extraordinary financial circumstances in awarding emergency financial aid grants to students. Question 12 of the ARP HEERF III FAQs Updates, published May 11, 2021, states, The Department will make an individualized determination about whether an institution failed to prioritize emergency financial aid grants to students with exceptional need. The Department may determine an institution has failed to do so if the institution established preconditions for students to receive emergency financial aid grants (e.g., (1) establishing a minimum GPA, (2) imposing other academic or athletic performance or good standing requirements, (3) requiring continued enrollment in the institution or (4) required the student to first pay any outstanding debt or balance) that results in failure to prioritize students with exceptional need. Since TSU only offered persistence grants to a small portion of students and imposed a minimum GPA and event attendance requirements, TSU did not clearly demonstrate that it prioritized students with exceptional need. The amount of these awards totaled $85,000, which we are identifying as questioned costs. CAUSE Based on discussions with TSU personnel, the President and the executive leadership team determined the conditions of the persistence grants. However, this upper management group did not ensure that the conditions met all federal requirements, which prohibited conditioning awards on certain student actions. EFFECT While the university used the $85,000 of the student portion of the HEERF award to benefit students, management inappropriately prioritized students who met the university’s pre-conditions rather than those with exceptional need. Students with exceptional need who did not meet the university-imposed GPA or campus engagement requirements might have missed vital financial help for their education. Because of management’s decision to screen students for criteria other than need, TSU may be required to repay the $85,000 to the U.S. Department of Education with other operational funds. Institutional Funds CONDITION AND CRITERIA TSU management did not comply with an earmarking requirement to conduct direct outreach to financial aid applicants about the opportunity to receive a financial aid adjustment due to the recent unemployment of a family member or independent student, or other circumstances. This requirement was related to the institutional portion of the funds and should have been completed by the last day of the grant period, June 30, 2023. According to Section 2003 of the American Rescue Plan Act: (5) . . . an institution shall use a portion of funds received under this section to — . . . (B) conduct direct outreach to financial aid applicants about the opportunity to receive a financial aid adjustment due to the recent unemployment of a family member or independent student, or other circumstances, described in section 479A of the Higher Education Act of 1965 (20 U.S.C. 1087tt). TSU did not meet the requirements of subsection (5)(B) to conduct direct outreach to students notifying them that financial aid adjustments were available if their circumstances had changed since completing the Free Application for Federal Student Aid (FAFSA). CAUSE Based on discussions with the Vice President of Business and Finance and the Associate Vice President of Business and Finance, TSU management was aware of the earmarking requirement for outreach. However, TSU management stated they misunderstood the requirement and believed providing the additional HEERF fund scholarships to students would satisfy the requirement. EFFECT By not meeting the federal award earmarking requirement and providing outreach to students, the university could not ensure it met the grant’s purpose of helping all eligible students, including those with financial hardships, pay for higher education. Supplemental Funds CONDITION AND CRITERIA As noted in the prior-year audit, Tennessee State University management continued to not comply with federal requirements regarding documenting how a student could receive the HBCU HEERF funds used for tuition assistance grants. This included failing to document the actual award decisions and how management determined the amount of each student’s award in accordance with federal requirements. According to the certification and agreement for the CARES Act a(2) funds, For grants made to students, the Recipient should maintain records on how grants were distributed to students, how the amount of each grant was calculated, and any instructions or directions given to students about the grants. TSU did not have HBCU HEERF money remaining at the beginning of fiscal year 2023, but late adjustments in student accounts resulted in prior-year debt discharges being reduced. The reduction in these debt discharges made $233,113 of HBCU HEERF funds available during the fiscal year. While we questioned these costs as part of the prior audit finding related to debt discharge, we are also questioning the $233,113 for the current fiscal year after the prior-year costs were reversed and then again spent in a similar fashion. CAUSE Per discussions with the former Assistant Vice President of Financial Aid, the executive leadership team provided an amount of tuition assistance grants that both Enrollment Reporting and Financial Aid could spend. However, the directive contained no further guidance about the dollar amount of individual awards, or reference to federal requirements on record-keeping, or award criteria. Per discussions with the Associate Vice President of Business and Finance, the procedures for providing tuition assistance grants did not change from the prior fiscal year to fiscal year 2023. Executive leadership did not establish clear policies, procedures, or controls around awarding HEERF scholarships. This lack of policies and procedures from upper management resulted in a failure to follow federal requirements for recording how grants were distributed or calculated. EFFECT U.S. Department of Education guidance for HEERF funds included elements to ensure ED’s ability to maintain adequate oversight of awards. TSU management’s failure to follow federal requirements resulted in the university management, auditors, and ED being unable to determine whether funds were used appropriately and distributed to students fairly. RECOMMENDATION Executive leadership should provide appropriate guidance and oversight when devising how to expend resources for a federal program, especially new programs with quickly evolving guidance and multiple programs providing similar types of funding. This should include creating documented policies, procedures, and controls for implementing those funds; these procedures should be guided by the corresponding federal authority. Management should also document reviews by knowledgeable employees throughout the implementation process to compare the implementation with federal guidance and university policy. MANAGEMENT’S COMMENT We do not concur with this finding. However, the executive leadership team will provide better guidance and better oversight if we ever receive funding of this type again. We will engage our grants accounting team to help develop policies and procedures and implement controls so that we stay compliant with any federal guidelines associated with such funds. In the event we are awarded funds of this nature again, we will develop a system to document reviews throughout the process. AUDITOR’S COMMENT We have reviewed management’s comments. We have not adjusted the finding since management did not provide an argument for or evidence of the university’s compliance with federal regulations, and management stated they will develop policies and procedures and will implement controls for future funding to ensure they are compliant.

Finding Number 2023-002 Assistance Listing Number 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number P268K230381 Federal Award Year 2022 and 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Cash Management Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The financial aid office did not adequately reconcile its direct loan records to the Direct Loan Servicing System’s records, as required by federal regulations, and therefore could not resolve discrepancies timely BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for Student Financial Assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The United States Department of Education (ED) has established certain requirements for each school to participate in the Student Financial Assistance programs. For direct loans, ED requires schools to reconcile direct loan data monthly between the school’s financial aid office and business office, and between school data, ED’s Common Origination and Disbursement System, and ED’s Grants Management (G5) System. CONDITION The financial aid office at Tennessee State University did not reconcile the university’s direct loan financial records with the federal Direct Loan Servicing System monthly, as required. While the financial aid office was able to provide reports needed to reconcile direct loans, there was no documentation indicating the reconciliation was actually performed. As a result, any discrepancies were not identified, investigated, and resolved timely. The Director of Financial Aid stated that the university usually does not perform a complete reconciliation each month as required by ED. Instead, TSU management waits until the year-end closeout is completed to resolve most reconciling items. As of September 25, 2023, the financial aid office had not completed this reconciliation for fiscal year 2023. CRITERIA Title 34, Code of Federal Regulations, Part 685, Section 300(b)(5), states that to participate in the Direct Loan program, a school must “on a monthly basis, reconcile institutional records with Direct Loan funds received from the Secretary and Direct Loan disbursement records submitted to and accepted by the secretary.” The 2022–2023 Federal Student Aid Handbook, Volume 4, Chapter 6, gives additional information regarding the reconciliation process: A school that participates in the Direct Loan Program is required to reconcile cash (funds it received from the G5 system to pay its students) with disbursements (actual disbursement records) it submitted to the Common Origination and Disbursement (COD) system monthly. In addition, Chapter 6 of the handbook goes on to state, A school has completed its monthly reconciliation when all differences between the Direct Loan SAS [Student Account Statement] and the school’s internal records (Direct Loan system, financial aid office, and business office system) have been resolved or documented and the school’s ending cash balance is zero. Schools should clearly outline their reconciliation process and document in both the business office and financial aid office procedures. Finally, while the handbook does not specify a particular format or reconciliation method, it does require that the school maintains “documented results of its monthly reconciliation to provide to auditors and reviewers at their request.” CAUSE The Director of Financial Aid stated that the financial aid office has differences from month to month because of the timing of funds being disbursed and drawn down, but these items will usually resolve themselves by the end of the award period. Because of these timing discrepancies, the university has not emphasized performing a complete reconciliation each month. In addition, the university did not have any policies or procedures outlining the direct loan reconciliation process. As previously stated, management had not provided the auditors with evidence of a complete reconciliation for any month of the fiscal year or the year-end closeout reconciliation as of September 25, 2023. EFFECT When the university does not reconcile its financial aid records to the net cash drawdowns and net booked disbursements as reported to the federal government, there could be unresolved errors in either the federal government’s records or the university’s records. The university could receive excess amounts from ED, which could result in questioned costs, or amounts could be due to the university if the funds are not being drawn down. In addition, when the university does not fully reconcile direct loans each month, reconciling items and errors may be harder to identify over time, making the annual reconciliation more complex than necessary. Performing documented monthly reconciliations and retaining all supporting documentation ensures that financial aid staff will receive all direct loan funds from ED and will make timely and accurate disbursements to students. RECOMMENDATION The financial aid office and the business office should develop policies and procedures for the reconciliation process. The Director of Financial Aid should ensure that the required monthly reconciliations are prepared and documented based on instructions in the Federal Student Aid Handbook and yearly training documents. If any items in the School Account Statement do not agree with the institution’s financial records, financial aid staff should investigate and resolve these differences promptly. The Director of Financial Aid and a member of the business office should review the reconciliation each month and at award year-end to ensure its accuracy and completeness. MANAGEMENT’S COMMENT Tennessee State University concurs; both the prior Assistant Vice President (AVP) and the Associate Director of Loans of Financial Aid are no longer with the university. Reporting to the prior AVP, the prior Associate Director of Loans had primary oversight/responsibilities of the administration of the Federal Direct Loan Program, return of Title IV, overawards, loan limit C-flags, and reconciliation of federal programs. The Office of Financial Aid has restructured this position and created an additional position, the Assistant Director of Compliance, and both positions report to the Director. Under prior leadership, monthly meetings with the business office were conducted with verbal reconciliation amounts; however, no supporting documentation of reconciliation was provided. The Office of Financial Aid is in the process of hiring an independent financial aid consultant to solely focus on Direct Loan reconciliation to bring the program in compliance. The Director will review monthly reconciliations performed by the Associate Director of Loans.

Finding Number 2023-003 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number P007A073927, P063P070381, and P268K230381 Federal Award Year 2022 and 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING Tennessee State University did not have adequate procedures to ensure Title IV credits were refunded timely per federal guidelines BACKGROUND The student financial assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. These Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of the total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. As a condition of these programs, institutions must provide notifications of the amounts awarded and loans disbursed. In addition, institutions are required to refund credits to the student’s account within 14 days of posting the award to the student’s account. CONDITION We tested a sample of 40 Title IV recipients at Tennessee State University (TSU) to determine whether TSU met disbursement requirements. These requirements included disbursing Title IV aid timely and in the appropriate amount, sending notices to students informing them of their awards and/or loan disbursements, and refunding within 14 days of disbursement any credits to student accounts created by Title IV aid. Based on this work, we noted that 5 of the 26 students in our testwork (19%) had Title IV credits that were not refunded within 14 days of the date of disbursement. As noted in the table below, 8 separate refunds were not refunded timely, ranging from 1 to 85 days late. See Schedule of Findings and Questioned Costs for table. While conducting our testwork, we noted that 4 additional students also received refunds more than 14 days after the Title IV aid was disbursed to each student’s account. Because each student had a combination of federal and non-federal aid creating the credit, it did not meet the federal definition of a Title IV credit. However, these errors are a further indication of TSU’s failure to process refunds in a timely manner. Errors Noted by Another State Entity In addition, the Tennessee Student Assistance Corporation (TSAC) reported similar errors in an October 11, 2023, Program Review Report of TSU’s procedures for administering state financial aid programs. In this report, TSAC noted that 103 of 589 students tested (17%) who received state aid had a credit balance on their student account for an extended period; these balances were not refunded to the students in accordance with the institution’s policy. Although TSAC tested students who received state aid, these errors could have also affected students who received Title IV aid. CRITERIA The 2022–2023 Federal Student Aid Handbook, Volume 4, Chapter 2, states: If FSA disbursements to a student’s account at the school create a Title IV credit balance, the school must pay the credit balance directly to the student or parent as soon as possible but no later than 14 days after: [emphasis in original] • the first day of class of a payment period if the credit balance occurred on or before that day, or • the balance occurred if that was after the first day of class. CAUSE TSU management implemented a general refund policy outlining the timing of refunds, as well as the differences between automatic and manual refunds. However, management did not develop adequate procedures to ensure that all Title IV credits are refunded within the timeframes required by federal guidance. Per discussion with TSU management, employee shortages and turnover resulted in the process not always being performed as outlined in the policy. EFFECT Refunding credits to students in a timely manner is essential to fulfilling the goals of Title IV programs. Students may depend on these refunds to pay for non-institutional charges, such as off-campus housing, transportation, or meals. Without these funds, students may not have the resources available to pay for these potentially significant costs, which can be a barrier to a successful college career. In addition, violations of federal requirements could result in ED imposing a fine on the university and/or limiting, suspending, or terminating TSU’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. RECOMMENDATION TSU management should revise and adequately document procedures to ensure that credits on student accounts are refunded within 14 days of Title IV aid being disbursed. In addition, leadership should take necessary steps to ensure that staffing is adequate to ensure compliance. Finally, TSU management should establish additional review procedures to identify credits that have not been refunded and ensure refunds are processed timely. MANAGEMENT’S COMMENT Tennessee State University concurs with the finding and has taken steps to strengthen processes around student refunds. The Bursar’s Office has undergone restructuring to build out a resolute accounting team, including a refund analyst reporting to the new Accounting Manager. Recruitment is underway for two additional analyst roles to complete the review team, who will monitor refund compliance daily. Interviews are currently in progress to fill these new positions. The university is committed to continuous improvement in this area and enhancing the capacity of the Bursar’s Office to provide timely and accurate refunds to students.

Finding Number 2023-004 Assistance Listing Number 84.063 and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number P063P070381 and P268K230381 Federal Award Year 2022 and 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING For the federal Direct Loan and Pell Grant programs, Tennessee State University did not report timely and accurate information regarding students’ enrollment statuses BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For student recipients of Pell Grants or Direct Loans, ED requires institutions to report students’ enrollment statuses for each term to the National Student Loan Data System (NSLDS). The institution is also required to report changes to students’ enrollment, such as graduations, withdrawals, and transitions between full- and part-time status. CONDITION We tested a sample of 42 Direct Loan borrowers and/or Pell Grant recipients at Tennessee State University (TSU). These 42 students had 54 separate instances where TSU should have reported an enrollment status change to NSLDS. As of August 17, 2023, the day of our testwork, we found that for 16 of 54 (30%) status changes tested, TSU either did not report any information or reported incorrect information to NSLDS. Not Reported • The enrollment services office had not reported May 2023 graduations for 5 former students at the time of our testing. • The enrollment services office had not reported 3 status change occurrences from the spring semester. This included 2 withdrawals and 1 situation where the student dropped courses, causing a change in their enrollment status. • For 2 students enrolled in the spring semester, there was no record of enrollment history in NSLDS. • Per discussion with the Assistant Vice President of Admissions and Records, TSU had not reported any student’s status for the summer 2023 term. This led to 4 students in our sample having statuses that TSU had not reported 79 days after the semester began on May 30, 2023. Reported Incorrectly • The enrollment services office incorrectly reported enrollment status changes for 2 students during the spring semester. These were full-time students but were reported as half-time and three-quarter time. Errors Noted by Another State Entity In addition, the Tennessee Student Assistance Corporation (TSAC) reported additional errors that could affect enrollment reporting in an October 11, 2023, Program Review Report of TSU’s procedures for administering state financial aid programs. In this report, TSAC noted that the institution updated the grading policy to add an “FA” grade; however, TSU staff described this grade as both an unofficial withdrawal and a failure. For students with this grade, the LDA [last day of attendance] was not documented in every case and there was no evidence of internal controls in place to monitor instructors who fail to use the grade properly or to evaluate the student’s enrollment to verify financial aid was correctly paid to the student. The TSAC review report also noted that “there was no evidence the institution monitors course engagement and enrollment changes for students participating in state programs, which led to incorrect awarding of state aid.” TSAC noted the following examples of inconsistencies in enrollment: • Course hours removed . . . due to a noted registration error • Withdrawals are processed retroactively and back dated prior to the start of class with some or all courses completely disappearing from the student’s enrollment . . . • Students receiving an “FA” grade without a last date of attendance. Although TSAC tested students who received state aid, these errors could have also affected students who received Title IV aid. CRITERIA Federal Guidance The Federal Student Aid Handbook, Volume 2, Chapter 3, states that institutions “must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that file.” In the introduction to Chapter 1, the NSLDS Enrollment Reporting Guide states, “Accurate and timely Enrollment Reporting to NSLDS is essential to the Department of Education’s successful delivery of Title IV aid.” The requirements are established in Title 34, Code of Federal Regulations, Section 309(b). CAUSE Per discussion with the Assistant Vice President of Admissions and Records, some graduates were late additions to the graduation list. These late additions were due to a variety of situations but were primarily related to students having to obtain approval to replace required courses for a degree with other courses. TSU did not report any additional graduations to NSLDS after the late additions were made. Based on our review, it does not appear that TSU management is ensuring changes in enrollment are being made timely. In addition, TSU is not adequately reviewing enrollment information in NSLDS to ensure changes are reported accurately. Management did not provide any additional information to help determine the cause, despite our multiple attempts to follow up on the issues. EFFECT Timely and accurate enrollment reporting is critical for effective management of ED programs. The accurate administration of the Title IV programs depends heavily on the accuracy of the enrollment information reported by schools. Accurate, timely, and complete enrollment data is also important to the students, who can view their current campus enrollment information and their program enrollment history. Also, if an individual graduated or no longer attends TSU but is not reported as such, the individual’s loan repayment grace period could be improperly extended, resulting in the student’s loan repayments being improperly deferred. RECOMMENDATION TSU management should review and update its processes as necessary to ensure the enrollment services office uploads and submits the correct information to NSLDS. In addition, the Assistant Vice President of Admissions and Records should ensure that staff know reporting deadlines and the importance of reporting enrollment status changes. The Assistant Vice President of Admissions and Records should also ensure that enrollment status changes are reported timely. MANAGEMENT’S COMMENT Tennessee State University concurs with the finding. Additional staff will be hired to oversee enrollment reporting. Updates to the National Student Clearinghouse will be reported on the census date, every 30–45 days thereafter (subsequent of term), and at the end of the term. Any errors will be corrected within 5–7 business days. The withdrawal process will be communicated to the staff during training sessions and staff meetings.

Finding Number 2023-005 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number P007A073927, P063P070381, and P268K230381 Federal Award Year 2022 and 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.007 Federal Award Identification Number P007A073927 Amount $46,352 Assistance Listing Number 84.063 Federal Award Identification Number P063P070381 Amount $2,563 Assistance Listing Number 84.268 Federal Award Identification Number P268K230381 Amount $71,344 FINDING Tennessee State University did not return Title IV funds in compliance with federal regulations BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For Title IV recipients who did not complete at least 60% of the semester, the school is required to perform a calculation to determine the amount of unearned aid that it must return to ED. CONDITION We selected 2 samples of 30 students who officially or unofficially withdrew from classes at Tennessee State University (TSU) during the 2021–2022 award year. We selected the first sample of 30 student withdrawals from a population of 164 students who had an official or unofficial withdrawal before the 60% completion date. We tested these items to ensure that withdrawal dates were accurate, that calculations were performed correctly, and that amounts were returned to ED within the required timeframes. Of the 30 withdrawals, we were not able to test 18 as these students were on the withdrawal list but never began classes and did not receive Title IV aid during the semester of the withdrawal. Of the remaining 12 withdrawals, we noted 7 (58.3%) errors. Of the 7 errors, 4 errors were for students who withdrew during the semester. Specifically, • For 1 student, TSU did not return the Title IV funds to ED even though the student withdrew on the second day of the fall 2022 term, resulting in questioned costs of $3,374. • For 1 student, TSU did not enter the correct amount of the student’s Pell disbursement in the return calculation. This led to TSU calculating and returning from university funds $8,083, which was $432 more than necessary. • For 1 student, TSU returned the correct portion of Direct Loans that the student received but did not return the applicable amount of the Pell Grant. This resulted in a return of $3,096 instead of the correct $6,309, a $3,213 shortfall. We identified this shortfall as questioned costs. • For 1 additional student, TSU management returned the Title IV funds 49 days after the student’s withdrawal date. This is 4 days later than the 45 days required for returning funds because of withdrawals. The remaining 3 errors were related to students who were initially charged tuition and had Title IV aid applied to their account but never began attendance. While the school applied charges and Title IV aid to these students’ accounts based on information from the FAFSA, we noted that these students had not registered for classes. ED specifies that awards to students who never begin attendance are overawards and must be returned within 30 days after the school has determined the student did not begin attendance. • For 2 of these students, TSU management returned the full amount of the Title IV overaward, but did so 37 and 42 days after the school determined the student did not begin attendance for the spring 2023 semester. These returns were 7 and 12 days late, respectively. • For 1 student, TSU performed a return of Title IV funds calculation based on an incorrect withdrawal date even though the student had never registered for the fall 2023 semester. TSU returned $2,761; however, the full amount of $5,240 should have been considered an overaward and fully returned. This led to questioned costs of $2,479. In addition, we selected a sample of 30 from a population of 75 students who completed over 60% of the semester in which they withdrew to ensure that TSU recorded the withdrawal dates correctly, had adequate attendance records to support the withdrawal date, and did not remove Title IV funds from the account. Of the original 30 sample items, we were not able to test 7 items as the student was on the withdrawal list but never began classes and never received Title IV aid during the semester of the withdrawal. Of the 23 remaining items, we noted 21 (91.3%) errors: • For 1 student, TSU entered a withdrawal date beyond the 60% point of the semester; however, the student never began attendance but did have Title IV aid of $4,446 applied to his account, which we have identified as questioned costs. • For 20 students, TSU entered a withdrawal date, but attendance records did not support the withdrawal date, and management could not provide any additional support for the withdrawal dates used upon further request. Questioned costs related to these items were $107,179. Due to the high number of errors in both samples, we determined that additional testwork was not required to replace the items for which testing was not applicable. Errors Noted by Another State Entity In addition, the Tennessee Student Assistance Corporation (TSAC) reported similar errors in an October 11, 2023, Program Review Report of TSU’s procedures for administering state financial aid programs. In this report, TSAC noted that the institution updated the grading policy to add an “FA” grade; however, TSU staff described this grade as both an unofficial withdrawal and a failure. For students with this grade, the LDA [last day of attendance] was not documented in every case and there was no evidence of internal controls in place to monitor instructors who fail to use the grade properly or to evaluate the student’s enrollment to verify financial aid was correctly paid to the student. The TSAC review report also noted that “there was no evidence that TSU monitors course engagement and enrollment changes for students participating in state programs, which led to incorrect awarding of state aid.” TSAC noted the following examples of inconsistencies in enrollment: • Course hours removed . . . due to a noted registration error • Withdrawals are processed retroactively and back dated prior to the start of class with some or all courses completely disappearing from the student’s enrollment . . . • Students receiving an “FA” grade without a last date of attendance. Although TSAC tested students who received state aid, these errors could have also affected students who received Title IV aid. CRITERIA The 2022–2023 Federal Student Aid Handbook, Volume 5, Chapter 1, states, Up through the 60% point in each payment period or period of enrollment, a pro rata schedule is used to determine the amount of Title IV funds the student has earned at the time of withdrawal. After the 60% point in the payment period or period of enrollment, a student has earned 100% of the Title IV funds the student received and was scheduled to receive during the period [emphasis in original]. Title 34, Code of Federal Regulations, Part 668, Section 22(b)(1), states, For purposes of this section, for a student who ceases attendance at an institution that is required to take attendance, . . . the student’s withdrawal date is the last date of academic attendance as determined by the institution from its attendance records. The 2022–2023 Federal Student Aid Handbook, Volume 4, Chapter 3, states, Schools must return funds disbursed to a student who failed to begin attendance as soon as possible but no later than 30 days after the date they become aware that the student has not begun and will not begin attendance [emphasis in original]. The 2022–2023 Federal Student Aid Handbook, Volume 5, Chapter 2, provides that A school must return unearned funds for which it is responsible as soon as possible but no later than 45 days after the date of determination of a student’s withdrawal [emphasis in original]. CAUSE Based on our review, it appears that staff do not always appropriately update Banner, TSU’s information system. Specifically, we noted that attendance records, withdrawal dates, and financial aid information were unsupported or incorrect in a majority of the errors. Management did not provide us with additional information related to the cause of these issues, despite our numerous requests. EFFECT For the 35 students tested, TSU calculated a total return of $38,053 in Title IV funds. The corrected total after adjustment for the errors we noted in our testwork was $51,133, which is $13,080 more than TSU returned to ED. In addition, we were unable to verify withdrawal dates for 20 students. The students for whom we could not determine withdrawal dates received $107,179 in Title IV funds. This resulted in total questioned costs of $120,259. Violations of the federal requirement to timely return Title IV funds to ED could result in ED imposing a fine on TSU and/or limiting, suspending, or terminating TSU’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. In addition, incorrect return calculations and/or withdrawal dates can negatively impact students. If TSU incorrectly calculates and returns the amount of unearned aid to ED, it could impact the amount of aid the student is eligible to receive in future terms. RECOMMENDATION The Registrar’s Office and the Financial Aid Office should follow federal regulations. Management should ensure that the Financial Aid Office reperforms all return of Title IV funds calculations and makes necessary corrections to student and federal fund accounts for the 2022–2023 academic year. Finally, TSU should ensure that the Registrar’s Office communicates any withdrawals to the Financial Aid Office in a timely manner. MANAGEMENT’S COMMENT Tennessee State University concurs; both the prior Assistant Vice President (AVP) and the Associate Director of Loans of Financial Aid are no longer with the university. Reporting to the prior AVP, the prior Associate Director of Loans had primary oversight/responsibilities of the administration of the Federal Direct Loan Program, return of Title IV, overawards, loan limit C-flags, and reconciliation of federal programs. The Office of Financial Aid has restructured this position and created an additional position, the Assistant Director of Compliance, and both positions report to the Director. The Office of Financial Aid will review 2022–2023 Title IV funds and make necessary corrections. Additionally, the Return of Title IV report will be reviewed daily by both the Financial and Records Office to ensure federal regulations are followed. The Registrar’s Office is in the process of developing internal automated withdrawal notices to ensure the respective departments are aware of withdrawals in real time.

Finding Number 2023-006 Assistance Listing Number 84.007, 84.033, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number P007A073927, P033A223927, P063P070381 and P268K30381 Federal Award Year 2022 and 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Eligibility Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.007 Federal Award Identification Number P007A073927 Amount $3,500 Assistance Listing Number 84.033 Federal Award Identification Number P033A223927 Amount $939 Assistance Listing Number 84.063 Federal Award Identification Number P063P070381 Amount $16,222 Assistance Listing Number 84.268 Federal Award Identification Number P268K230381 Amount $162,822 FINDING Tennessee State University’s Office of Financial Aid granted Title IV funds to ineligible students BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. These Title IV programs include assistance such as Pell Grants, Direct Loans, and Federal Work Study. To be eligible for student financial assistance, a student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. In order to participate, some of Tennessee State University’s (the university) responsibilities are to determine student eligibility, verify data for students selected for verification, and not exceed ED’s maximum assistance amounts either individually or as part of the total aid package. Title 34, Code of Federal Regulations (CFR), Part 668, Section 164(b)(3), states, “At the time a disbursement is made to a student for a payment period, an institution must confirm that the student is eligible for the type and amount of Title IV, HEA [Higher Education Act] program funds identified by that disbursement.” Students must also meet and maintain certain requirements, such as income levels and grade point averages (GPAs), to be eligible for Title IV assistance. CONDITION, CAUSE, AND CRITERIA The university’s Office of Financial Aid did not adequately verify whether student recipients were eligible for Title IV financial aid. We found that management lacked controls, and as a result, the university overpaid $183,483 to student recipients. We reviewed the entire population of 5,619 students enrolled at the university who received Title IV student financial assistance during the 2022–2023 award year. Of the 5,619 students, 30 students (0.53%) received excess financial aid based on their eligibility. Our results revealed the following: • The university awarded Title IV funds to 17 students that had already reached their aggregate loan limit and were ineligible for additional Title IV financial aid. 34 CFR 668.32 states that a student is eligible to receive Direct Loans, except as provided in 34 CFR 668.35(d), if the student has not obtained loan amounts in excess of the program’s annual or aggregate loan limits. 34 CFR 668.35(d) states that if a student has received loan funds exceeding the annual or aggregate loan limits, the student must either repay the excess amount in full or arrange with the lender to repay the excess loan amount before they may receive any further Title IV assistance, including Pell Grants. The university did not provide documentation that students had made these arrangements. Therefore, the university made awards in violation of federal regulations as shown in Table 1. See Schedule of Findings and Questioned Costs for table. • For six students, the university did not obtain the documentation to verify certain information on FAFSAs before awarding aid to the students, as required by ED. 34 CFR 668.60 (b)(1)(i) requires institutions to verify that applicants for financial aid provided documentation supporting their applications, and the institution may not award funds if the applicants do not provide the requested documentation. Additionally, 34 CFR 668.60(c)(2) states, “If the applicant does not provide to the institution the requested documentation and, if necessary, a valid SAR [Student Aid Report] or the institution does not receive a valid ISIR [Institutional Student Information Record], within the additional time period . . . the applicant—(i) Forfeits the Federal Pell Grant for the award year; and (ii) Must return any Federal Pell Grant payments previously received for that award year.” By awarding funds to students without receiving the necessary documentation, the university awarded the aid listed in Table 2 in violation of federal regulations. See Schedule of Findings and Questioned Costs for table. • For five students, the university awarded Title IV funds that, when combined with other sources of financial aid, exceeded the student’s cost of attendance. 34 CFR 685.203(j) prohibits Direct Subsidized, Direct Unsubsidized, or Direct PLUS loans from exceeding the student’s estimated cost of attendance minus other expected financial aid. Volume 6, Chapter 2 of the 2023–2024 Federal Student Aid Handbook further clarifies that “a financial aid administrator may not award [Federal Work Study] employment to a student if that award, when combined with all other resources, would exceed the student’s need.” Therefore, the university awarded the following aid in violation of federal regulations, as shown in Table 3. See Schedule of Findings and Questioned Costs for table. • The university awarded Pell and Direct Loan funds to one student without verifying that the student’s GPA met the criteria for satisfactory academic progress. 34 CFR 668.34(a) requires institutions that participate in Title IV programs to “establish a reasonable satisfactory academic progress policy for determining whether an otherwise eligible student is making satisfactory academic progress in his or her educational program and may receive assistance under the title IV, HEA programs.” While the university has a satisfactory academic progress policy in place, it did not adhere to the policy requirement to verify a readmitted student’s academic standing before awarding funds. Therefore, the university awarded the following aid to the student in violation of federal regulations, as shown in Table 4. See Schedule of Findings and Questioned Costs for table. • The university awarded one student $3,448 in Pell funds without verifying that the student had completed high school. 34 CFR 668.32(e)(j) requires students to have a high school diploma, its equivalent, or an approved alternative to receive Title IV funds. The university did not have the student’s diploma or equivalent on file. Therefore, the university awarded the aid in violation of federal regulations. Errors Noted by Another State Entity In addition, the Tennessee Student Assistance Corporation (TSAC) reported similar errors in an October 11, 2023, Program Review Report of the university’s procedures for administering state financial aid programs. In this report, TSAC noted 26 observations, warnings, and findings related to the university’s administration of state financial aid. These observations, warnings, and findings included issues such as not verifying the student was a high school graduate, not correctly administering satisfactory academic progress, not monitoring student attendance or enrollment changes, and awarding aid in excess of the student’s cost of attendance. Although TSAC tested students who received state aid, these errors could have also affected students who received Title IV aid. EFFECT Because Financial Aid staff did not properly monitor student eligibility and enter accurate student information, students received Title IV financial assistance for which they were not eligible. Because of the university’s errors, we are questioning a total of $183,483, broken down by program in Table 5. See Schedule of Findings and Questioned Costs for table. Furthermore, when the university grants students Title IV funds to which they are not entitled, ED could take adverse actions against the university, including a fine, suspension, or termination from the Title IV program. These actions would hurt the university and the students impacted by the loss of Title IV aid. RECOMMENDATION Tennessee State University should ensure that they properly confirm the eligibility of Title IV aid recipients before disbursing Title IV funds to students. The university should implement controls to ensure the appropriate staff confirm that students do not receive aid when they have already reached the loan limit or if the total funds would be greater than the cost of attendance. The controls should also ensure that staff verify required documents and monitor satisfactory academic progress. MANAGEMENT’S COMMENT Tennessee State University concurs; both the prior Assistant Vice President (AVP) and the Associate Director of Loans of Financial Aid are no longer with the university. Reporting to the prior AVP, the prior Associate Director of Loans had primary oversight/responsibilities of the administration of the Federal Direct Loan Program, return of Title IV, overawards, loan limit C-flags, and reconciliation of federal programs. The Office of Financial Aid has restructured this position and created an additional position, the Assistant Director of Compliance, and both positions report to the Director. The prior AVP of Financial Aid oversaw the review and eligibility of maximum timeframe satisfactory academic progress (SAP) for students; the Office of Financial Aid has created an additional internal control that prevents readmitted and transfer students from being included in the automation of evaluation until admission requirements are verified by Enrollment Services.

Finding Number 2023-007 Assistance Listing Number 84.010 and 84.424 Program Name Title I Grants to Local Educational Agencies Student Support and Academic Enrichment Program Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number S010A190042, S010A200042, S010A210042, S010A220042, S424A190044, S424A200044, S424A210044, and S424A220044 Federal Award Year 2019 through 2023 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Matching, Level of Effort, Earmarking Repeat Finding 2022-008 Pass-Through Entity N/A Questioned Costs N/A FINDING Because department management has been working with the U.S. Department of Education on a year-by-year basis to correct prior-year miscalculations, department management did not have approved, correct prior-year amounts on which to base the 2023 allocations, which caused the allocations to be incorrect for the third year in a row BACKGROUND The Tennessee Department of Education (the department) is the pass-through entity for federal programs and distributes funds to the state’s 146 local educational agencies (LEAs) under the following programs administered by the U.S. Department of Education (ED): Title I Grants to Local Educational Agencies(1) (Title I) and Student Support and Academic Enrichment Program Grant(2) (Title IV). (1)Title I Grants to Local Educational Agencies is a federal program to improve the teaching and learning of children who are at risk of not meeting challenging academic standards and who reside in areas with high concentrations of children from low-income families. (2)The Student Support and Academic Enrichment Program is a federal program to improve students’ academic achievement by providing all students with access to a well-rounded education, improving school conditions for student learning, and improving the use of technology to improve academic achievement and digital literacy of all students. The department received federal funding as presented in Table 1. See Schedule of Findings and Questioned Costs for table. Department’s Responsibilities as a Grant Administrator As outlined in Title 2, Code of Federal Regulations (CFR), Part 200, Section 303, as a grant administrator for federal funds, the department must (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. . . . (c) Evaluate and monitor the non-Federal entity’s compliance with statutes, regulations and the terms and conditions of Federal awards. . . . (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Overview of Allocation Distribution by Funding Source Title I Title I consists of four grant formulas: basic, concentration, targeted, and education finance incentive grants. ED determines the amount to allocate to each state and each LEA based on their formula children(3) counts. When applicable, the department must then adjust the ED allocation amounts for 1. when LEAs consolidate or separate, when area boundaries are redrawn, or when changes have occurred since the Census Bureau updated its list of LEAs(4); and 2. for special LEAs that are not on the list of traditional LEAs provided to the ED by the Census Bureau.(5) (3) According to 34 CFR 200.70, formula children include children ages 5 to 17 who are “(1) From families below the poverty level based on the most recent satisfactory data available from the Bureau of the Census; (2) From families above the poverty level receiving assistance under the Temporary Assistance for Needy Families program under Title IV of the Social Security Act; (3) Being supported in foster homes with public funds; and (4) Residing in local institutions for neglected children.” (4)For our audit period, this adjustment was not applicable. (5) The department’s special LEAs include the Achievement School District and the state’s special schools. Tennessee’s Special School Districts include the Tennessee School for the Blind, the Tennessee School for the Deaf, the West Tennessee School for the Deaf, and the Alvin C. York Institute. For all students enrolled in special LEAs, the department must determine under which traditional LEA the student is counted. The department uses this information to transfer funding from the traditional LEA to the special LEA based on the formula children criteria. Once the department adjusts the original ED allocation for the special LEAs, it must then further adjust the allocations to ensure each LEA receives at least its hold-harmless amount(6), which is calculated using the prior-year allocations. The department determines which LEA allocations do not meet the LEAs’ hold-harmless amount and proportionately reduces or raises allocations to meet the hold-harmless amount. (6) Hold-harmless requires the department to allocate to an LEA at least a certain percentage of its prior-year allocation—85%, 90%, or 95%, depending on the LEA’s proportion of formula children. Title IV The department uses Title I allocations to determine Title IV allocations to LEAs. Title IV allocations should be proportionate to the Title I allocations the LEA received in the preceding fiscal year. PRIOR AUDIT RESULTS Department’s Noncompliance and Inadequate Controls As we first reported in the 2021 State of Tennessee Single Audit Report (Finding 2021-015), in April 2021, the ED’s Office of Elementary and Secondary Education (OESE) conducted a performance monitoring review of multiple programs and found the department incorrectly calculated its funding allocations to LEAs under the Title I program. Because the department must use the Title I allocations to determine Title IV allocations to LEAs, the department also incorrectly allocated this program. OESE stated in the Tennessee Consolidated Performance Review Report #2 of 2 FY 2021,(7) dated November 30, 2021, that for the special LEAs, the department determines their allocations for [Title I] based on their enrollment. This approach is inconsistent with the requirements . . . for Title I, Part A because [the department] does not derive a Title I, Part A formula count for these LEAs or determine whether they meet the eligibility criteria under each formula. (7) Tennessee Consolidated Performance Review Reports can be found at https://oese.ed.gov/files/2021/11/TDOE-Performance-Review-Report-Part-1.pdf and https://oese.ed.gov/files/2021/11/TDOE-Performance-Monitoring-Review-Report-2.pdf. In 2021, OESE also found that the department failed to update its allocation methodology when the federal requirements changed in 2018; therefore, management did not correctly apply hold-harmless requirements for Title I for each of the four formula grants. The department instead determined if LEAs met hold-harmless requirements based on the total Title I allocations. In 2021 and 2022, management responded to the finding that they were continuing to work with the U.S. Department of Education on a corrective action plan for prior years, including determining whether any allocations should be adjusted retroactively. CURRENT CONDITION AND CAUSE Status of Corrective Action to Address Lack of Internal Control and Noncompliance Department management has been working with OESE to develop and implement corrective action, since late summer/fall of 2021. Management developed updated procedures to calculate Title I and Title IV allocations and obtained approval from OESE to continue with allocation corrections for fiscal years 2018 through 2022 using those procedures. Beginning in January 2022 and continuing through our audit period, management worked with OESE to review allocations and develop a plan to pay LEAs that were under-allocated using other available federal funds. In response to the repeat audit finding (2022 State of Tennessee Single Audit Finding 2022-008), management indicated that once OESE and the department agree on the allocation corrections and an appropriate repayment plan, management will document the details in a Memorandum of Agreement, which the department will implement upon signing. As of December 11, 2023, the department and OESE are working toward finalizing the corrective action in the Memorandum of Agreement. Given management’s ongoing involvement with OESE to recalculate and correct all affected years’ allocations, we are continuing to report this finding to fulfill our reporting responsibilities under the Office of Management and Budget’s Compliance Supplement and the requirement of 2 CFR 200. Current Risk Assessment Because of the issues we identified, we reviewed the department’s December 2022 Financial Integrity Act Risk Assessment and determined that management listed the risk of inadequate controls over the data and the funding calculation for Every Student Succeeds Act allocation for school districts. Management listed “experienced staff with detailed understanding of the mechanics” as a control to mitigate the risk; however, the control, as noted by management in our discussions, was adversely impacted due to turnover of experienced staff. Without having appropriate risk responses to identify, analyze, and respond to changes, management could not mitigate the identified risk, increasing the likelihood of error and noncompliance. EFFECT Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. CRITERIA Title I In its review report in 2021, OESE summarized 34 CFR 200.72 and stated that for each special LEA, management must estimate the number of Title I, Part A formula children for that LEA by deriving the equivalent of the most recently available poverty estimates from the U.S. Census Bureau’s Small Area and Income Population Estimates (SAIPE) branch, which the Department provides to each [state]. [A state] must then use the derived formula count to determine whether the LEA meets the eligibility criteria under each Title I, Part A formula. Title IV According to Section 4105(a)(1) of the Elementary and Secondary Education Act of 1965, as amended by the Every Student Succeeds Act, From the funds reserved by a State under section 4104(a)(1), the State shall allocate to each local educational agency in the State that has an application approved by the State educational agency under section 4106 an amount that bears the same relationship to the total amount of such reservation as the amount the local educational agency received under subpart 2 of part A of title I for the preceding fiscal year bears to the total amount received by all local educational agencies in the State under such subpart for the preceding fiscal year. Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, “Identify, Analyze, and Respond to Risks,” 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. According to Principle 9, “Identify, Analyze, and Respond to Change,” 9.03 Conditions affecting the entity and its environment continually change. Management can anticipate and plan for significant changes by using a forward-looking process for identifying change. Management identifies, on a timely basis, significant changes to internal and external conditions that have already occurred or are expected to occur. Changes in internal conditions include changes to the entity’s programs or activities, oversight structure, organizational structure, personnel, and technology. Changes in external conditions include changes in the governmental, economic, technological, legal, regulatory, and physical environments. Identified significant changes are communicated across the entity through established reporting lines to appropriate personnel. RECOMMENDATION Management should continue working with OESE to recalculate LEA allocations and make whole the underfunded LEAs. After management recalculates allocations and OESE approves the revisions, management should also finalize and implement their policies and procedures governing the allocations to ensure staff responsible for performing and reviewing federal award calculations are aware of current federal requirements. Management should identify all risks and implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding. The department’s Deputy Commissioner, Chief Operating Officer, Assistant Commissioner of Federal Programs and Oversight, and Chief Financial Officer worked with the U.S. Department of Education to finalize and obtain approval for a corrective action plan in December 2023. The corrective action plan will be implemented from state fiscal year 2024 to state fiscal year 2031. The department’s Division of Local Finance and Division of Federal Programs and Oversight will continue to implement revised controls to address the risks noted in this finding. This work will include updating the department’s risk assessment as necessary, professional development, and taking the necessary actions if deficiencies are identified. Internal controls will be developed to ensure that staff responsible for performing and reviewing federal award calculations are aware of current federal requirements. Moving forward, the department’s Office of Finance will serve as a secondary internal check before annual allocations are released.

Finding Number 2023-008 Assistance Listing Number 84.424 Program Name Student Support and Academic Enrichment Program Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number S424A200044 Federal Award Year 2020 through 2022 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding N/A Pass-Through Entity N/A Questioned Costs 47,303 FINDING The Department of Education management reimbursed local educational agencies for expenditures that occurred outside of the Student Support and Academic Enrichment Program grant’s period of performance BACKGROUND The Title IV, Part A, Student Support and Academic Enrichment Program (Title IV) is a federal program to improve students’ academic achievement by providing all students with access to a well-rounded education, improving school conditions for student learning, and improving the use of technology in order to improve the academic achievement and digital literacy of all students. Federal funding for Title IV is only available to the Department of Education (the department) and its subrecipients for a limited time (referred to as the grant’s period of performance).(8) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the Title IV award amount and the period of performance (budget period).(9) The department has 15 months to charge expenditures to each grant award; however, Title IV is governed by the requirements of the Tydings Amendment (Title 20, United States Code, Chapter 31, Section 1225[b]), which extends the period of performance 12 additional months, for a total of 27 months. (8) According to Title 2, Code of Federal Regulations (CFR), Part 200 Section1, “Period of performance means the total estimated time interval between the start of an initial Federal award and the planned end date, which may include one or more funded portions, or budget periods.” (9) According to 2 CFR 200.1, “Budget period means the time interval from the start date of a funded portion of an award to the end date of that funded portion during which recipients are authorized to expend the funds awarded, including any funds carried forward.” CONDITION AND CAUSE We tested a nonstatistical, random sample of 25 expenditure transactions, totaling $120,267, from a population of 44 expenditure transactions, totaling $164,532, that were charged to the Title IV grant award S424A200044 after September 30, 2022, to determine if the costs occurred during the grant’s period of performance, July 1, 2020, through September 30, 2022. For 15 of 25 expenditure transactions tested (60%), management did not ensure the costs reimbursed to the local educational agencies (LEAs) occurred within the period of performance, resulting in $47,303 in questioned costs. According to department management, between October 1 and January 30 of each year, the department reviews all LEA reimbursement requests to determine if the reimbursement request is charged to a grant that ended on September 30 of that year. If so, the department contacts the LEA to determine if the reimbursement request contains any expenditures that occurred after September 30. If expenditures occurred after September 30, the department sends the reimbursement request back to the LEA to remove those expenditures. If the reimbursement request contains no expenditures that occurred after September 30, the department approves the request and processes it for payment. Even though department management stated they had controls in place, we found that the controls were not effective to ensure compliance with the period of performance requirement; as such, the department reimbursed LEAs for costs that did not occur within the authorized period of performance. Per discussion with department management, human error was the cause of the errors noted in this finding. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . (h) Cost must be incurred during the approved budget period. Risk Assessment We reviewed the department’s December 2022 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance. Management identified the review of charges to federal grants as a control to mitigate the risk; however, based on the results of our review, management’s review was not effective in mitigating the risks of noncompliance and the resulting questioned costs. According to the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. According to Green Book Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that funds will be expended outside of the period of performance. The lack of mitigating controls increases the risk of noncompliance with the federal program requirements and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should develop effective control procedures to ensure that costs reimbursed to local educational agencies occurred during the grant award’s period of performance. In addition, management should carefully evaluate their risk assessments to ensure they include all risks and should implement effective controls to address the risks noted in this finding. Management should update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding. The Chief Financial Officer will collaborate with program teams to create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance. Management will evaluate the effectiveness of the control activities for this risk and update the department’s annual risk assessment to reflect any new controls management implements. The Chief Financial Officer will create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements.

Finding Number 2023-009 Assistance Listing Number 84.027 Program Name Special Education Cluster (IDEA) Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number H027A200052, H027A210052, and H027A220052 Federal Award Year 2020 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Activities Allowed or Unallowed Allowable Costs/Cost Principles Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.027 Federal Award Identification Number H027A200052 Amount $64,065 Assistance Listing Number 84.027 Federal Award Identification Number H027A210052 Amount $25,561 Assistance Listing Number 84.027 Federal Award Identification Number H027A220052 Amount $13,312 FINDING Department management reimbursed local education agencies and vendors for costs that were unallowable or not adequately supported, resulting in $102,938 in federal questioned costs BACKGROUND The Department of Education (the department) serves as the pass-through entity for the Special Education Cluster,(10) administered by the U.S. Department of Education. The department awards this federal program’s funds primarily to subrecipients, commonly known as the local educational agencies (LEAs); it also contracts with vendors. (10) Pursuant to the federal Individuals with Disabilities Education Act, Special Education Cluster grants ensure that all children with disabilities receive a free, appropriate public education that emphasizes special education and related services designed to meet their unique needs. The grants also ensure that the rights of children with disabilities and their parents are protected; help states, localities, educational service agencies, and federal agencies provide for the education of all children with disabilities; and assess and ensure the effectiveness of efforts to educate children with disabilities. LEA High-Cost Reimbursement Process According to the Individuals with Disabilities Act (IDEA), each state can reserve IDEA funds of up to 10% of the amount reserved for other state-level activities to address high-cost services to individuals with disabilities, including transportation to state special schools(11) and specialized equipment for students’ needs. For fiscal year 2023, the department reserved $16,148,134 for other state-level activities and $2,985,177 for high-cost funding. (11) A state special school is a school managed directly by the state. Some of these schools provide specialized academic instruction to students with specific disabilities. State special schools relevant to IDEA high-cost funding include the Tennessee School for the Deaf, the West Tennessee School for the Deaf, and the Tennessee School for the Blind. Throughout the year, LEAs incur expenses in providing special education and related services to high-need students. At the end of each fiscal year, LEAs can submit high-cost reimbursement requests for individual students to the department via ePlan.(12) After LEAs submit high-cost reimbursement requests, an IDEA Grants Management Consultant reviews each request to ensure that all expenses are allowable and adequately supported. The department categorizes high-cost students into three categories: • Priority 1 – Students who attend a state special school, but their local LEA is responsible for costs related to transporting the student to school. • Priority 2 – Students who were placed into an LEA by a state agency(13) for their first academic year and, as a result, were not included on the census and did not generate funds for that LEA. • Priority 3 – Students who require extensive and costly special education and related services for their LEA to provide a free, appropriate public education. Per federal and state requirements, these students must have eligible high-cost expenses greater than three times the state’s average per-pupil expenditures in order to be eligible for reimbursement. (12) ePlan is the department’s grants management system. (13) These state agencies include the Tennessee Department of Human Services, the Department of Mental Health and Substance Abuse Services, the Department of Children’s Services, and the Department of Health. After reviewing each student’s request, the IDEA Grants Management Consultant either approves an LEA’s reimbursement request for payment or sends the request back to the LEA for correction. If allowable, the department will reimburse LEAs in the fiscal year following the one in which the expenses were incurred. In fiscal year 2023, the department paid out $4,723,016 in high-cost funding to LEAs for expenses incurred in fiscal year 2022. IDEA Service Contract Reimbursement Process According to the Individuals with Disabilities Education Act, the department may use funding reserved under state-level activities to fund resources and initiatives that support the education of students with disabilities. To administer this funding, the department contracts the services of public and private vendors, which receive IDEA funding as reimbursement for providing services that support special education initiatives. To receive reimbursement for their services, vendors submit invoices with appropriate documentation of expenditures to their contract manager(14) at the department. During the majority of our audit period, the contract manager initially reviewed the invoice and documentation. After this initial review, the invoice and documentation were given to the Assistant Commissioner of Special Education and Intervention Programs for final review and signature before being sent to accounting staff for processing and payment. If issues are noted at any of the review levels, the invoice is returned to the vendor for corrections. In spring 2023, management revised their review process and included an additional level of review. (14) Contract managers are department employees who are primarily responsible for a given contract with a vendor. These managers possess specialized knowledge of their vendor’s subject matter and serve as the vendor’s main point of contact. CONDITIONS AND CAUSE The Department Reimbursed Subrecipients From the High-Cost Fund for Unallowable and Unsupported Expenditures Management’s review of LEA reimbursement requests did not prevent various instances of reimbursement for unallowable or inadequately supported expenditures. We tested a nonstatistical, random sample of 6 high-cost reimbursement transactions paid in fiscal year 2023, totaling $993,113, from a population of 59 high-cost reimbursement transactions, totaling $4,850,728. We found that for 2 high-cost reimbursements (33%), the LEA was reimbursed in part for inadequately supported or unallowable expenses, resulting in questioned costs of $57,709. The questioned cost details are as follows: • $28,219 for fuel and maintenance costs for student transportation vehicles, in addition to a mileage rate intended to be inherently inclusive of all fuel and maintenance costs, resulting in double payment for those expenditures; • $31 for unsupported expenditures; and • $29,459 for students with total eligible high-cost expenses that were less than the required threshold of three times the state average per-pupil expenditure. Management cited multiple factors that led to questioned costs for the high-cost fund. Although the process includes a secondary review, management noted that during our audit period, staffing levels were not sufficient to perform the secondary review. Additionally, because the IDEA Grants Management Consultant who performed the initial high-cost review was out on leave following an injury, the former Elementary and Secondary Education Act Grants Manager was asked to perform the initial high-cost review during our audit and may not have understood all of the requirements. Lastly, management noted that fiscal year 2023 was the first year that the department had used ePlan to facilitate the high-cost review and reimbursement process. Management stated that this resulted in technical issues that complicated the review. We performed a walkthrough of management’s new review process implemented in fiscal year 2024, and it appears to address the conditions noted in this finding. We will follow up on this finding and evaluate the control’s effectiveness in the 2024 Single Audit. The Department Reimbursed Vendors for Expenditures That Were Not Properly Supported Management did not ensure that vendors submitted adequate documentation for expenditures invoiced to the department. We tested a nonstatistical, random sample of 17 vendor reimbursements paid in fiscal year 2023, totaling $1,103,230, from a population of 167 vendor reimbursements, totaling $10,879,926, and found that for 6 reimbursements (35%), the department and vendors were unable to provide adequate supporting documentation for the full reimbursement amount, resulting in questioned costs of $45,229. Following the 2022 Single Audit work, management identified risks related to vendor payments as a result of our audit inquiries. Specifically, management identified the risk that the department would reimburse unsupported expenditures because contract managers may not identify issues with the documentation in their review. To address this risk, in spring 2023, management started providing additional training to contract managers to ensure they knew how to evaluate documentation of expenditures for reimbursement. Additionally, in spring 2023, the Senior Director of Special Education Operations and Oversight began performing a secondary review of all vendor reimbursement requests utilizing IDEA funding before the request goes to the Assistant Commissioner of Special Education and Intervention Programs, who does a final, high-level review before payment. Of the 17 items in our sample, 4 occurred after management revised their process, and we did not note any issues with these 4 reimbursements. Risk Assessment We reviewed the department’s December 2022 Financial Integrity Act Risk Assessment and determined that management listed the risk of charging unallowable costs to a federal program. Management listed the following controls to mitigate the risk: • Maintain a library of resources within ePlan for stakeholders and TDOE staff to use, including on allowable uses. • Regular technical assistance training on internal controls and program rules. • The [Consolidated Funding Application] undergoes multiple levels of review from the [Federal Programs and Oversight] divisional coordinators to the appropriate program manager. • Experienced staff familiar with specific grant rules. • Provide specific technical assistance and written corrective actions to correct the misuse of funds. • Focus monitoring of systemic and/or egregious misuse of funds by an LEA. • Require payback for misuse of funds. • Apply grant conditions to LEAs that misused funds. Additionally, management listed the risk that costs charged to a federal program are not adequately documented at the subrecipient level. Management listed the following controls to mitigate the risk: • Maintain a library of resources within ePlan for stakeholders and TDOE staff to use, including on allowable uses. • Regular technical assistance trainings on internal controls and program rules. • Annual risk based monitoring for both programmatic and fiscal requirements. • Provide specific technical assistance and written corrective actions to correct non-compliance. • Focus monitoring of systemic and/or egregious misuse of funds by an LEA. • Apply grant conditions to LEAs that had systemic/egregious non-compliance. We were able to view materials the department made available on allowable uses and documentation requirements for IDEA expenditures. We determined that these resources did assist subrecipients in allocating IDEA funding appropriately; however, based on the results of our review, the resources and other control activities were not sufficient to fully mitigate the risks of noncompliance. CRITERIA Allowable Costs Compliance According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 403, Except for where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards . . . (g) Be adequately documented. According to 34 CFR 300.704(c)(3)(i)(A)(2), the state must develop a plan for the high-cost fund. As part of that plan, the state is required to create a definition of a “high need child” that ensures that the cost of the high need child with a disability is greater than 3 times the average per pupil expenditure . . . in that State. According to 2 CFR 200.302(b), The financial management system of each non-Federal entity must provide for the following . . . (3) Records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Additionally, the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 10.03, states, Effective management of an entity’s workforce, its human capital, is essential to achieving results and an important part of internal control. Only when the right personnel for the job are on board and are provided the right training, tools, structure, incentives, and responsibilities is operational success possible. Management continually assesses the knowledge, skills, and ability needs of the entity so that the entity is able to obtain a workforce that has the required knowledge, skills, and abilities to achieve organizational goals. Training is aimed at developing and retaining employee knowledge, skills, and abilities to meet changing organizational needs. Risk Assessment According to Green Book Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. According to Green Book Principle 9.03, “Identification of Change,” Conditions affecting the entity and its environment continually change. Management can anticipate and plan for significant changes by using a forward-looking process for identifying change. Management identifies, on a timely basis, significant changes to internal and external conditions that have already occurred or are expected to occur. Changes in internal conditions include changes to the entity’s programs or activities, oversight structure, organizational structure, personnel, and technology. Changes in external conditions include changes in the governmental, economic, technological, legal, regulatory, and physical environments. Identified significant changes are communicated across the entity through established reporting lines to appropriate personnel. EFFECT Without an effective internal control system, the department risks paying LEAs or vendors for unallowable or ineligible expenses. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should design, implement, and monitor the effectiveness of internal controls over the high-cost reimbursement process to address the risks noted in this finding. Additionally, management should cross-train employees on the requirements of high-cost reimbursements to ensure a knowledgeable person is available to perform primary and secondary reviews, regardless of turnover and leave status. Management should continue to monitor the effectiveness of the service contract reimbursement review process to ensure that all invoices are supported by adequate documentation that fully details the expenditures for which the vendor is seeking reimbursement. MANAGEMENT’S COMMENT The department concurs with this finding. The Chief Academic Officer in conjunction with the Chief Operating Officer will oversee a collaborative process led by the Assistant Commissioner of Student Services & Supports and Chief Financial Officer to design, implement, and monitor the effectiveness of internal controls over the high-cost reimbursement process to address the risks noted in this finding. Additionally, the Assistant Commissioner of Student Services will be responsible for cross-training employees on the requirements of high-cost reimbursements to ensure knowledgeable staff are available to perform primary and secondary reviews, regardless of turnover and leave status. The Office of Academics and the Division of Student Services & Supports should continue to monitor the effectiveness of the service contract reimbursement review process to ensure that all invoices are supported by adequate documentation that fully details the expenditures for which the vendor is seeking reimbursement.

Finding Number 2023-010 Assistance Listing Number 84.027 and 84.173 Program Name Special Education Cluster (IDEA) Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number H027A200052, H027A220052, and H173A200095 Federal Award Year 2020 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.027 Federal Award Identification Number H027A200052 Amount $4,730 Assistance Listing Number 84.027 Federal Award Identification Number H027A220052 Amount $1,500 Assistance Listing Number 84.173 Federal Award Identification Number H173A200095 Amount $7,743 FINDING Department of Education management incurred expenditures, liquidated funds, and reimbursed local educational agencies for expenditures that occurred outside of the Special Education grants’ periods of performance BACKGROUND AND CRITERIA The Individuals with Disabilities Education Act (IDEA) is a federal program to assist states in providing children with disabilities a free, appropriate public education. Federal funding for IDEA is only available to the Department of Education (department) and its subrecipients for a limited time (referred to as the grant’s period of performance).(15) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the IDEA award amount and the period of performance (budget period).(16) The department has 15 months to charge expenditures to each grant award; however, IDEA is governed by the requirements of the Tydings Amendment (Title 20, United States Code, Chapter 31, Section 1225[b]), which extends the period of performance 12 additional months, for a total of 27 months. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 344, the department must liquidate all financial obligations incurred under the federal award within 120 days of the end of the period of performance. (15) According to 2 CFR 200.1, “Period of performance means the total estimated time interval between the start of an initial Federal award and the planned end date, which may include one or more funded portions, or budget periods.” (16) According to 2 CFR 200.1, “Budget period means the time interval from the start date of a funded portion of an award to the end date of that funded portion during which recipients are authorized to expend the funds awarded, including any funds carried forward. . . .” According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards . . . (h) Cost must be incurred during the approved budget period. CONDITION We obtained the population of expenditures charged to the IDEA grants for fiscal year ended June 30, 2023. We performed analytical procedures on the expenditures, comparing the accounting dates to the grant’s period of performance to determine if the expenditures were within each grant’s period of performance. Based on our initial analysis, we noted the following. See Schedule of Findings and Questioned Costs for table. Expenditures Obligated After Period of Performance We identified 233 expenditure transactions totaling $5,111,341 that were charged to IDEA grant awards H173A200095 and H027A200052 that, based on the accounting date, were obligated after the grants’ period of performance. We further tested a nonstatistical, random sample of 25 expenditure transactions from the 233 transactions, totaling $430,967, to determine if the transactions were obligated within the period of performance. Based on a review of supporting documentation, we found that for 16 of 25 expenditure transactions tested (64%), management reimbursed local educational agencies (LEAs) and paid administrative expenses that were obligated after the grants’ period of performance, resulting in $12,377 of known questioned costs and likely questioned costs of $96,986. Expenditure Obligated and Liquidated Outside of Grant’s Period of Performance Based on our initial analysis and inquiry with management, we identified one transaction charged to IDEA grant award H027A200052 for which management had both obligated and liquidated the expenditure transaction outside of the period of performance and approved liquidation date, resulting in $96 in questioned costs. The expenditure was obligated and liquidated in May 2023. Unsupported Adjusting Entry Based on our initial analysis, we identified 8,350 adjusting entry expenditure transactions totaling $14,086,520 that were charged to the IDEA grants during fiscal year 2023. We tested a nonstatistical, random sample of 40 adjusting entry expenditure transactions, totaling $3,659,863 to determine if the original expenditure transaction was obligated within the grants’ period of performance. Based on testwork, we found that for 1 of 40 adjusting entries tested (3%), management did not provide documentation of the original expenditure; therefore, we could not determine if the original expenditure occurred within the grant’s period of performance. As a result, we questioned $1,500 for the unsupported expenditure transaction charged to grant award H027A220052, and likely questioned costs totaled $5,773. Summary of Questioned Costs See Schedule of Findings and Questioned Costs for table. Risk Assessment and Internal Control Criteria We reviewed the department’s December 2022 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with period of performance. Management identified the review of charges to federal grants as a control to mitigate the risk; however, based on the results of our review, the review was not effective in mitigating the risks of noncompliance and resulting questioned costs. According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. According to Green Book Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. CAUSE Management stated that program and fiscal staff are responsible for reviewing and approving expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated and liquidated within the period of performance before approving the expenditures for payment. According to department management, between October 1 and January 30 of each year, the department reviews all LEA reimbursement requests to determine if they are charged to a grant that ended on September 30 of that year. If so, the department contacts the LEA to determine if the reimbursement request contains any expenditures that were incurred after September 30. If there are expenditures incurred after September 30, the department sends the reimbursement request back to the LEA to remove those expenditures. If the reimbursement request contains no expenditures that were incurred after September 30, the department approves the request and processes it for payment. Even though the department management stated they had review procedures in place, we found that the control was not effective in ensuring compliance with the period of performance requirement, and as such, the department paid for expenditures and reimbursed local educational agencies for costs that were not incurred within the authorized period of performance. Per discussion with department management, human error was the cause of the errors noted in this finding. We also identified staff’s inexperience with program requirements due to staff turnover at the department as a potential cause for the human errors management noted. EFFECT When the department does not have adequate internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award and increases the risk that funds will be expended outside of the period of performance. The lack of mitigating controls increases the risk of noncompliance with the federal program requirements and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should design and implement effective control activities to ensure before they reimburse local educational agencies that the agencies incurred the costs during the grant award’s period of performance. In addition, management should carefully evaluate their risk assessments to ensure they include all risks and should implement effective controls to address the risks noted in this finding. Management should update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding. The Chief Financial Officer will collaborate with program teams to create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance. Management will evaluate the effectiveness of the control activities for this risk and update the department’s annual risk assessment to reflect any new controls management implements. The Chief Financial Officer will create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements.

Finding Number 2023-011 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number V048A210042 and V048A220042 Federal Award Year 2021 through 2023 Finding Type Material Weakness and Noncompliance Compliance Requirement Matching, Level of Effort, Earmarking Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING Department of Education management did not have effective internal controls over matching, maintenance of effort, and earmarking requirements and, due to turnover and poor records management, could not provide evidence of compliance BACKGROUND AND COMPLIANCE CRITERIA The U.S. Department of Education (ED) provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006, which was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act (Perkins V). Perkins V provides grants to states to develop the academic knowledge and technical and employability skills of secondary students and postsecondary students. The Tennessee Department of Education (the department) is the pass-through entity for Perkins funds and disburses those funds to local education agencies (LEAs) within the state and the Tennessee Board of Regents. As a recipient of federal funding, the department is subject to federal matching, level of effort – maintenance of effort (MOE), and earmarking requirements.(17) These requirements mandate that the department maintain its fiscal effort from state appropriations for CTE when compared with the preceding years; for example, the department must allocate state resources in fiscal year 2023 that meet or exceed the allocated state resources for fiscal year 2022. The department must also allocate CTE funds received for specific activities in keeping with the following requirements: • not less than 85 percent to Secondary and Postsecondary Career and Technical Education Programs; • not more than 10 percent to State Leadership Activities; and • not more than 5 percent or $250,000, whichever is greater, to State Administration. (17) Federal matching, level of effort, and earmarking requirements for this award are found in Title 20, United States Code, Sections 2391 and 2322. In addition, the department is required to match federal funds reserved for State Administration with non-federal funds, such as state appropriations, on a dollar-for-dollar basis. Annually, ED requires Perkins recipients to submit financial and performance data via the Consolidated Annual Report (CAR). The CAR contains CTE programmatic and financial information and includes the department’s demonstrated compliance with maintenance of effort requirements. Department staff complete the CAR in December using the two most recent fiscal years’ financial data—for example, the CAR submitted in December 2022 included data from state fiscal years 2021 and 2022. CONDITION AND CAUSE Insufficient Internal Controls and Lack of Evidence of Compliance Department management has not developed and implemented policies and procedures to ensure that matching, MOE, and earmarking requirements are met. Management also did not ensure that the former Grants Manager carried out procedures to confirm the department’s compliance with these requirements and did not maintain key documentation as evidence of compliance. There was significant turnover in the department’s staff, and, without documented policies and procedures, management was unable to locate and provide documentation related to supporting calculations that demonstrated the department’s compliance with these requirements. Due to the condition above, we noted the following: Maintenance of Effort According to department management, the former Grants Manager calculated the CTE MOE amounts reported in the CAR for state fiscal year 2023. Due to the employee’s separation and poor records management, department management was unable to locate and provide supporting documentation for adjustments and the final amounts reported in the CAR. We attempted to verify the amounts reported in the CAR, but without sufficient support for those calculations, including adjustments, we were unable to independently verify that the reported MOE numbers were accurate; therefore, we were unable to determine if the department met MOE compliance requirements. Additionally, although management stated they reviewed the calculation at the time it was completed, there was no evidence of the review. Earmarking According to department management, the former Grants Manager accidentally overwrote key earmarking documentation for fiscal year 2023 when working on calculations related to the fiscal year 2024 award. Staff were able to recreate the documentation, and the department complied with earmarking requirements; however, staff were unable to provide the documentation that was originally used to calculate the figures. While management stated they reviewed the calculation, there was no evidence of this review. Matching Because of the department’s lack of policies and procedures and due to the former Grants Manager’s separation, management was not able to describe the process the former Grants Manager used for determining compliance with matching requirements during the audit period. Additionally, because management did not have adequate records management processes in place to ensure continued access to the former Grants Manager’s documentation, department management was unable to provide us with any documentary evidence of the department’s compliance with matching requirements. As a result, we were unable to perform any procedures to independently verify if the department met matching compliance requirements. Current Risk Assessment and Internal Control Criteria Because of the issues we identified, we reviewed the department’s December 2022 Financial Integrity Act Risk Assessment. The department’s risk assessment for CTE states that the risk of the loss of institutional knowledge due to turnover and resulting potential understaffing is mitigated in part by process documentation, including templates, timelines, and historical records; however, based on our work, we found that this control was not operating effectively. Management also identified the risk of noncompliance with federal program regulations and requirements. The controls listed to mitigate this risk include training, assignment of responsibility for each grant to a Grants Manager, and “procedures in place to appropriately monitor and document all grant and subgrant activities”; however, this control activity was not operating effectively. Without having appropriate risk responses to identify, analyze, and respond to changes, management fails to mitigate the risk and increases the likelihood of error and noncompliance. According to “Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,” Title 2, Code of Federal Regulations, Part 200, Section 303, the non-federal entity must establish and maintain effective internal controls over the federal award that provide reasonable assurance that the entity is managing the award in compliance with federal statutes, regulations, and the terms and conditions of the award. The entity must also evaluate and monitor its compliance with statutes, regulations, and the terms and conditions. In addition, Part 200, Section 508, explains that the auditee must provide the auditor with access to personnel, accounts, books, records, supporting documentation, and other information as needed for the auditor to perform the audit required by this part. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government, Principle 10.03, “Design of Appropriate Types of Control Activities,” states, Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. . . . Documentation and records are properly managed and maintained. Also, Principle 12.03, “Documentation of Responsibilities through Policies,” states, Management documents in policies for each unit its responsibility for an operational process’s objectives and related risks, and control activity design, implementation, and operating effectiveness. . . . Additionally, Principle 12.04, “Documentation of Responsibilities through Policies,” states, . . . Management communicates to personnel the policies and procedures so that personnel can implement the control activities for their assigned responsibilities. EFFECT Without appropriate internal controls over matching, MOE, and earmarking requirements, there is a risk that department staff will not comply with all related federal requirements and potentially miscalculate the state’s matching, MOE, and earmarking amounts. If a miscalculation results in the state’s noncompliance, the department risks a reduction of federal funding for CTE activities in subsequent award years, which may impact the department’s ability to provide services to students at Tennessee’s schools. RECOMMENDATION The Commissioner should work with appropriate program and fiscal staff to design and implement sufficient controls for matching, MOE, and earmarking compliance requirements, which includes developing and documenting key processes to ensure ongoing compliance during periods of high turnover. Management should also ensure that the agency maintains supporting documentation, including documentation of review activities, to monitor ongoing compliance. Management should evaluate the effectiveness of the control activities for the risks identified in this finding and update the department’s annual risk assessment to reflect any new controls management implements. MANAGEMENT’S COMMENT The department concurs with this finding. The Assistant Commissioner of CCTE and the Chief Financial Officer will collaborate to create sufficient controls for the calculation of MOE, including a complete supervisory review of their MOE calculations to ensure compliance. Management will evaluate the effectiveness of the control activities for this risk and update the department’s annual risk assessment to reflect any new controls management implements. Internal controls will be developed to ensure that staff responsible for performing and reviewing federal award calculations are aware of current federal requirements. The department’s Office of Finance will serve as a secondary internal check before MOE is submitted. Further, the Chief Operations Officer, Chief Information Officer, and Director of Human Resources will create a process to ensure documents are maintained and are not tied to a specific employee’s hardware, including but not limited to data stored on a physical storage device.

Finding Number 2023-012 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number V048A180042 and V048A200042 Federal Award Year 2018 through 2022 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.048 Federal Award Identification Number V048A180042 Amount $1,619,984 Assistance Listing Number 84.048 Federal Award Identification Number V048A200042 Amount $1,322 FINDING The Department of Education management paid for administrative expenditures that occurred outside of the Career and Technical Education program’s period of performance BACKGROUND The U.S. Department of Education provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006, which was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act (Perkins V). Perkins V provides grants to states to develop the academic knowledge, technical skills, and employment readiness skills of secondary students and postsecondary students. The Tennessee Department of Education (the department) is the pass-through entity for CTE-Perkins funds and disburses those funds to local education agencies within the state and the Tennessee Board of Regents.(18) Federal funding for CTE is only available to the department and its subrecipients for a limited time (referred to as the grant’s period of performance.)(19) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the CTE award amount and the period of performance (budget period.)(20) The department has 15 months to charge expenditures to each grant award based on the budget period; however, CTE is governed by the requirements of the Tydings Amendment (Title 20, United States Code, Chapter 31, Section 1225[b]), which extends the period of performance 12 additional months, for a total of 27 months. According to 2 CFR 200.344, the department must liquidate all financial obligations incurred under the federal award within 120 days of the end of the period of performance. (18) The Tennessee Board of Regents awards CTE funds to eligible community colleges and colleges of applied technology to meet the program objectives for postsecondary students. (19) According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 1, “Period of performance means the total estimated time interval between the start of an initial Federal award and the planned end date, which may include one or more funded portions, or budget periods.” (20) According to 2 CFR 200.1, “Budget period means the time interval from the start date of a funded portion of an award to the end date of that funded portion during which recipients are authorized to expend the funds awarded, including any funds carried forward.” CONDITION AND CAUSE Period of Performance We obtained a population of 10,843 expenditures charged to the CTE grants for the fiscal year ended June 30, 2023. We analyzed the expenditures, comparing the accounting dates to the grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our initial analysis, we found 17 expenditure transactions charged to CTE grant award V048A180042 that were outside the grant’s period of performance. We reviewed the supporting documentation for each transaction and determined that for all 17 transactions, department fiscal staff paid for expenditures that were obligated and liquidated outside the grant’s period of performance, resulting in $1,619,984 in federal questioned costs. In addition, based on our initial analysis, we found 259 travel expenditure transactions, totaling $17,317, that were charged to grant award V048A200042 outside the grant’s period of performance. We tested a nonstatistical, random sample of 25 expenditure transactions, totaling $1,322, from the population to determine if the costs were obligated and liquidated during the grant’s period of performance. Based on our testwork, we found that for 25 of 25 expenditure transactions tested (100%), management reimbursed for travel expenses that were outside of the grant’s period of performance, resulting in $1,322 in known questioned costs and $17,317 in likely questioned costs. Management stated that program and fiscal staff are responsible for reviewing and approving expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated and liquidated within the period of performance before approving the expenditures for payment. Even though department management stated they had controls in place, we found that the review controls were not effective to ensure compliance with the period of performance requirements. As such, the department paid for expenditures that did not occur within the authorized period of performance. Per our discussion with department management, human error caused the errors noted in this finding. We also identified staff turnover, and resulting inexperience with program requirements, as a potential cause for the human errors that management noted. Risk Assessment We reviewed the department’s December 2022 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with period of performance. Management identified the review of charges to federal grants as a control to mitigate the risk; however, based on the results of our review, this review was not effective in mitigating the risks of noncompliance and resulting questioned costs. CRITERIA Period of Performance According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . (h) Cost must be incurred during the approved budget period. Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to the Green Book, Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. According to Green Book Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have adequate internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures will be charged to the appropriate grant award, which increases the risk that funds will be expended outside of the period of performance. The lack of mitigating controls increases the risk of noncompliance with the federal program requirements and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208 (c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should develop adequate control procedures to ensure that expenditures occurred during the grant award’s period of performance. In addition, management should carefully evaluate their risk assessments to ensure they include all risks and should implement effective controls to address the risks noted in this finding. Management should update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding. The Chief Financial Officer will collaborate with program teams to create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance. Management will evaluate the effectiveness of the control activities for this risk and update the department’s annual risk assessment to reflect any new controls management implements. The Chief Financial Officer will create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements.

Finding Number 2023-013 Assistance Listing Number 84.126, 93.575, and 93.667 Program Name Rehabilitation Services Vocational Rehabilitation Grants to States Child Care and Development Fund (CCDF) Cluster Social Servies Block Grant Federal Agency Department of Education Department of Health and Human Services State Agency Department of Human Services Federal Award Identification Number H126A230063, 2301TNCCDD, and 2301TNSOSR Federal Award Year 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.126 Federal Award Identification Number H126A230063 Amount $5,601 Assistance Listing Number 93.575 Federal Award Identification Number 2301TNCCDD Amount $291,339 Assistance Listing Number 93.667 Federal Award Identification Number 2301TNSOSR Amount $33,651 FINDING For three federal programs, Department of Human Services management obligated expenditures outside the period of performance BACKGROUND Federal funding for the Department of Human Services’ (the department) federal programs is only available to the department for a limited time (referred to as the grant’s period of performance). Each year, the department receives grant award notifications from federal agencies, such as the U.S. Department of Health and Human Services and the U.S. Department of Education, which outline the federal grant award amount and the period of performance. The department administers its grants using the federal fiscal year, which is from October 1 through September 30.(21) (21) Our audit period is from July 1, 2022, through June 30, 2023. Child Care and Development Fund The Child Care and Development Fund (CCDF) is a federal program that provides childcare subsidies to low-income families to allow parents to work or attend educational or training programs. The program also promotes overall childcare quality for all children. As of July 18, 2023, the department received $214,056,377 in grant funds for award number 2301TNCCDD,(22) which had a period of performance beginning October 1, 2022. (22) This is a three-year grant and will end on September 30, 2025. Social Services Block Grant The Social Services Block Grant (SSBG) provides funds to states to help families, individuals, or groups of individuals achieve or maintain economic self-sufficiency; prevent or remedy the neglect, abuse, or exploitation of children and adults who cannot protect their own interests; preserve, rehabilitate, and reunite families; and provide community- or home-based care, other forms of intensive care, or when necessary, assist with institutional care. As of June 30, 2023, the department received $33,727,138 in SSBG grant funds for award number 2301TNSOSR,(23) which had a period of performance beginning October 1, 2022. (23) This is a two-year grant and will end on September 30, 2024. Rehabilitation Services Vocational Rehabilitation Grants to States The Rehabilitation Services Vocational Rehabilitation Grants to States (VR) program assists states with operating a comprehensive, statewide program to provide services that help individuals with disabilities prepare for and engage in gainful employment. During fiscal year ended June 30, 2023, the department received a $62,120,561 grant, award number H126A230063, which had a period of performance beginning October 1, 2022. Edison Projects When a new grant is received, the department’s fiscal staff establishes the grant in Edison, the state’s accounting system, with corresponding project IDs, which identify the federal grant program and grant funding period. Project IDs are used to track expenditures by grant program. Department’s Expenditure Approval Process Department programs are responsible for reviewing and approving program expenditures, including the invoices, accounting data, and any other supporting documentation, to ensure the expenditures are accurate and allowable under the federal program. To complete the process, fiscal staff process payments with related supporting documentation through Edison, verifying the service date (the date the expenditure was incurred). Fiscal Management’s Process to Ensure Period of Performance Compliance Fiscal management meets quarterly with program management to discuss the federal requirements and review period of performance as fiscal staff complete federal reporting requirements. In the meetings, fiscal and program management discuss whether the department is complying with all federal requirements, including period of performance, relative to the beginning and end of the grant period. When preparing federal reports, fiscal staff initiate an Edison query, called the General Ledger Expenditure query, to evaluate expenditures for period of performance compliance. Staff analyze the query’s data and enter the data into the required federal report. CONDITION, CRITERIA, AND CAUSE To determine if fiscal management properly recorded federal program expenditures during the grant’s period of performance, we analyzed all expenditures charged to the 2023 federal fiscal year CCDF, SSBG, and VR grants from October 1, 2022, through June 30, 2023 (see Table 1). See Schedule of Findings and Questioned Costs for table. Based on our analysis of expenditures charged to the 2023 CCDF, SSBG, and VR grants, we determined that the key control to ensure that management complied with each grant’s period of performance requirement was not sufficient to prevent the department from charging expenditures obligated outside of a grant’s period of performance. Results of Analysis Based on our expenditure analysis, which included the service date, we found that the department’s fiscal staff charged expenditures to the 2023 CCDF, SSBG, and VR grants that were actually incurred before October 1, 2022, the start date for each grant’s period of performance; therefore, these expenditures should have been charged to earlier grants. See Table 2. See Schedule of Findings and Questioned Costs for table. Title 2, Code of Federal Regulations (CFR), Part 200, Section 1, defines period of performance as “the total estimated time interval between the start of an initial Federal award and the planned end date.” According to federal regulations, the department may charge costs related to the federal grant award if the expenditure was obligated during the grant awards’ period of performance.(24) (24) The requirements set forth in 45 CFR 75.309(a) apply to CCDF and SSBG. 2 CFR 200.211, which applies to VR, requires federal awarding agencies to provide the period of performance start and end date in their grant award notifications. According to the Fiscal Director, management agreed with the errors noted and stated that the Edison General Ledger Expenditure query, which management uses to monitor period of performance compliance, was not sufficient because it does not include the service date. To correct this issue in the future, the Fiscal Director stated that fiscal services will reconcile the General Ledger Expenditure query to another Edison query—the Edison Federal Project query—which includes the expenditures’ service date, at least monthly for the first quarter of each federal fiscal year and quarterly after that, as part of their monitoring process. During fieldwork, we verified that fiscal management had corrected the errors noted in Table 2. See Schedule of Findings and Questioned Costs for table. Risk Assessment In the department’s 2022 Financial Integrity Act risk assessment, the department identified the risk of expenditures being charged to grants that are outside the period of performance and identified three controls to mitigate the risk: 1. Fiscal staff review of items charged to federal grant projects; 2. Fiscal management review of trends in actual results period over period; and 3. Close projects to procurement and accounts payable. However, based on the results of our review, the controls in place did not identify the condition noted in this finding. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, “Identify, Analyze, and Respond to Risks,” 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have sufficient internal controls in place to ensure expenditures occur within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award, and the department increases the risk that funds will be expended outside of the period of performance in violation of federal requirements. The lack of sufficient mitigating controls increases the risk of noncompliance with the federal program requirements and may require the state to return these funds to the federal granting agency. Additionally, federal regulations address actions that the U.S. Department of Health and Human Services (HHS) may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 45 CFR 75.207(b),(25) “Specific award conditions,” These additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 45 CFR 75.371,(26) “Remedies for noncompliance,” outlines additional actions HHS may take. Depending on the circumstances, these actions may include • withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the award, • initiating suspension or debarment, • withholding awards, or • pursuing other legal remedies. (25) For non-HHS programs, language comparable to 45 CFR 75.207(b) can be found in 2 CFR 200.208(c). (26) For non-HHS programs, language comparable to 45 CFR 75.371 can be found in 2 CFR 200.339. RECOMMENDATION The department’s fiscal management should actively monitor the most recent corrective action they put in place to address the condition noted in this finding to ensure expenditures are charged to the correct federal grant awards. If management identifies expenditures charged to the wrong grant awards, management should take immediate action to correct the errors. MANAGEMENT’S COMMENT We Concur. The Department of Finance and Administration, which staffs the Department of Human Services accounting office, monitors the Department of Human Services’ period of performance compliance requirements. Unfortunately, the Edison query used to perform the review only included the accounting date, not the service date. Once discovered, fiscal management immediately corrected the monitoring deficiency by reconciling two Edison queries to capture both the accounting and service dates. Correcting journals were posted and verified by the auditors during their field work. The Department’s 2024 Financial Integrity Act risk assessment has been updated to include this review process as a control performed during our month-end close process.

Finding Number 2023-014 Assistance Listing Number 93.575 and 93.596 Program Name Child Care and Development Fund (CCDF) Cluster Federal Agency Department of Health and Human Services State Agency Department of Human Services Federal Award Identification Number 2201TNCCDM, 2301TNCCDD, and 2301TNCCDF Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Allowable Costs/Cost Principles Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 93.575 Federal Award Identification Number 2301TNCCDD Amount $22,489 Assistance Listing Number 93.596 Federal Award Identification Number 2201TNCCDM Amount $17,114 Assistance Listing Number 93.596 Federal Award Identification Number 2301TNCCDF Amount $32,563 FINDING The Department of Human Services management did not follow their established process to ensure expenditures complied with Child Care and Development Fund program requirements, resulting in $91,199 in federal and state questioned costs BACKGROUND The Tennessee Department of Human Services (the department) administers the Child Care and Development Fund (CCDF), a federal program that provides subsidies for child care. CCDF funds the state’s Child Care Certificate Program, which helps Families First(27) participants, parents transitioning from the Families First program, teen parents, and other individuals obtain child care. To participate in the Child Care Certificate Program, children must be declared eligible by department staff or, for children in foster care or protective services, by Department of Children’s Services staff. Guardians receiving assistance through the Child Care Certificate Program may enroll their children in any child care provider of their choice. In order to receive payments for child care services through the Child Care Certificate Program, the department maintains a contract with each provider that includes payment terms and the program’s requirements. (27) The federal Temporary Assistance for Needy Families program. Child Care Assistance Payments To receive payment for services, child care providers must submit Enrollment Attendance Verification (EAV) forms electronically through the department’s Provider Portal. An EAV form is the provider’s record of each child’s attendance at the child care facility. The department pays providers weekly. The department also pays providers the full cost of a child’s care when the child is absent as long as the child has not been absent for more than 20 consecutive days. Once the child exceeds the absence allowance, department management continues paying the provider while they follow up with the child’s family to determine whether the child should be disenrolled from the provider’s care. Child Care Assistance EAV Review During our scope period, department staff relied on a manual EAV review process from July through March and changed to an automated EAV review process starting in April. Beginning in April 2022, providers submit attendance information and EAVs every Friday in the Provider Portal. The EAVs are then electronically transferred to NextGen, the department’s system of record for child care assistance payments, where the attendance information is analyzed for discrepancies. Child Care staff run an EAV report in NextGen that is used to create an EAV exception report. EAV Exception Review Prior to January 2023 (Manual Process) The EAV exception report shows what the provider reported for child care attendance and notes any providers with discrepancies between attendance information and payments for the child, such as if a child has been absent for more than 20 consecutive days but the provider still received payment. Once the EAV exception report is created, department management upload it into a shared Google document, which regional supervisors use to contact the child’s guardian and/or provider within 7 days after the child’s 20th day absent. If the regional employee receives no response from both the provider and guardian, then the regional employee manually disenrolls the child from the provider in the Tennessee Child Care Management System (TCCMS), the child care assistance eligibility system. When a child is disenrolled, the provider can no longer claim the child on an EAV. EAV Exception Review After January 2023 (Automated Process) In January 2023, management implemented an automated follow-up process. If the provider and guardian consent to receive electronic communications, TCCMS sends an automated notification to the provider and guardian at the 24- and 48-hour mark after the child reaches 20 consecutive absences. Beginning in April 2023, TCCMS automatically disenrolls the child and transfers the disenrollment to NextGen to prevent the provider from claiming the child on an EAV. If the provider or guardian did not consent to receive electronic communications, or the child is eligible through Families First or the Department of Children’s Services, department staff must manually follow up with the provider and guardian. EAV Payment Process When providers submit EAV forms, NextGen processes them for accuracy and then transmits correct EAV invoices to Edison, the state’s accounting system, to process the payments. If the EAV has an error, NextGen places the EAV in pending or special handling status. An account technician reviews it in NextGen and works with program management and the provider to make corrections. NextGen then reprocesses the EAV and sends it to Edison for payment. CONDITION AND CAUSE From a population of 183,540 expenditure transactions, totaling $161,010,079, charged to the CCDF program for child care assistance, we selected a sample of 60 providers that the department paid a total of $20,669,599 for child care assistance for the fiscal year to determine if the department complied with the CCDF program requirements. Based on our review of all 60 providers’ weekly EAVs for the fiscal year, we found that the department overpaid child care assistance to 11 of the 60 providers for 34 children who were absent for more than 20 consecutive days. These overpayment errors occurred for providers under the department’s manual EAV review process. We did not find any issues involving provider payments that were subject to EAVs processed through the department’s automated EAV review process. As a result of our review and the errors noted, we identified a total of $91,199 in federal and state questioned costs ($72,166 in federal questioned costs and $19,033 in state matching funds). Based on our discussion with the department’s Director of Compliance, although management had a control in place to prevent overpayments, the high number of EAV exceptions impeded management’s implementation of the control. With the implementation of the automated process in April, the Compliance Director believes this will no longer be an issue. We will examine the automated EAV review process during the next audit. CRITERIA According to Title 45, Code of Federal Regulations, Part 98, Section 21(a), A Lead Agency shall re-determine a child's eligibility for child care services no sooner than 12 months following the initial determination or most recent redetermination, subject to the following . . . (5) Notwithstanding paragraph (a)(1), the Lead Agency may discontinue assistance prior to the next re-determination in limited circumstances where there have been: (i) Excessive unexplained absences despite multiple attempts by the Lead Agency or designated entity to contact the family and provider, including prior notification of possible discontinuation of assistance; (A) If the Lead Agency chooses this option, it shall define the number of unexplained absences that shall be considered excessive. The Child Care and Development Fund (CCDF) Plan for Tennessee, which applies to federal fiscal years 2022 through 2024, states, Absences would not impact payment for a given child unless the child was absent for more than 20 days in a row. After an absence of 20 consecutive days, the Lead Agency would reach out to the family to confirm that the child was not returning to care before stopping the payments to the provider. EFFECT When department management and staff do not ensure internal controls are implemented and operating as intended, management increases the risk of continuing to pay child care providers for children who are no longer attending. They also increase the risk of errors, fraud, waste, and abuse. Additionally, federal regulations address actions that the U.S. Department of Health and Human Services (HHS) may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 45 CFR 75.207(b), “Specific award conditions,” These additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 45 CFR 75.371, “Remedies for noncompliance,” outlines additional actions HHS may take. Depending on the circumstances, these actions may include • withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the award, • initiating suspension or debarment, • withholding awards, or • pursuing other legal remedies. RECOMMENDATION Department management should ensure that the internal controls related to the new automated EAV exception review process are effective to timely identify and address children with 20 consecutive absences. Management should seek other alternatives to address high volumes of system exceptions when necessary. Finally, management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, obtain documentation for deficiencies noted, and seek to recover any funds paid out on behalf of children who were ineligible for the program. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT We concur. The Department concurs with the finding that management did not follow their established process to manage extended absences, resulting in federal and state questioned costs. Since April 2023, absences over twenty consecutive days have moved to an automated process. The Department will continue with the automated process to ensure extended absences and child enrollments are managed properly. The NextGen System sends EAV exception files on all weekdays to TCCMS. If the file has one of the exceptions for 20 days consecutive absences, TCCMS will send the first notice to the parent/guardian on the day it is received for the child, then sends a 2nd notice, and after 48 hours terminates the child’s enrollment with the provider, so long as the parent did not contact the Child Care Specialist. The timeframe for this process related to twenty consecutive days absences is established by Tennessee’s program policies and is not federally mandated. The Department is reviewing each child on the excessive absences report from the audit to determine the overpayment amount and has started the process to recoup payment. The Department’s 2024 Financial Integrity Act risk assessment will be updated to include establishing and strengthening internal controls for risks identified in the finding.

Finding Number 2023-015 CFDA Number 84.002 Program Name Adult Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Labor and Workforce Development Federal Award Identification Number V002A200043, V002A210043, and V002A220043 Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING Adult Education management did not obtain and review subrecipients’ single audits to ensure programmatic monitoring requirements were met BACKGROUND The Adult Education – Basic Grants to States program administered by the Division of Adult Education (the division) within the Department of Labor and Workforce Development (the department) provides grants to 14 eligible agencies (subrecipients) to provide adult education and literacy services. These grants help adults become literate and obtain the knowledge and skills necessary for employment, obtain the educational skills necessary to become full partners in the educational development of their children, and complete secondary school education. Federal grantors and the state’s Central Procurement Office (CPO)(28) require agencies that distribute grant funds to monitor the grantees’ activities as necessary to ensure they use grant funds for authorized purposes in compliance with federal and state statutes, regulations, and any applicable terms and conditions. State regulations also require the department to provide sufficient oversight of their subrecipients to ensure they are complying with all grant funding requirements. (28) CPO is administratively attached to the state’s Department of General Services and is responsible for the state’s procurement and contracting processes, for which CPO circulates guidance and additional resources to the state’s various entities. To ensure state agencies comply with both federal and state monitoring requirements for grantees, CPO Policy 2013-007, “Grant Management and Subrecipient Monitoring Policy and Procedures,” established guidelines for grantor state agencies. The policy requires each state agency to develop and submit the annual monitoring plan to CPO for review by October 1 of each year. The monitoring plan is a summary of the grantor state agency’s planned monitoring activities for the upcoming annual monitoring cycle. The plan must include all awards of state and federal funds and non-cash assistance, and the agency must also evaluate each grantee’s risk of noncompliance based on the following factors: • the grantee’s prior grant experience; • the results of prior audits and federal monitoring, including single audits; and • new personnel or new or significantly modified information systems. The department’s responsibility for monitoring includes both program and fiscal activities. For the Adult Education program, division staff are responsible for monitoring the subrecipients’ programmatic activities, and the department’s Performance Accountability Review (PAR) Unit staff are responsible for monitoring fiscal-related activities. During our audit we found that division staff and PAR staff completed subrecipient monitoring of each subrecipient; however, the division’s subrecipient monitoring did not include reviewing the subrecipient’s single audit. CRITERIA, CONDITION, AND CAUSE As the pass-through entity, the department is required by 2 CFR 200.332 to verify that all subrecipients that spend $750,000 or more in federal, state, and/or federal/state combined obtain a single audit within nine months after the subrecipient’s fiscal year-end. When the subrecipient’s single audit includes audit findings, the department must issue a management decision within six months of the audit report’s release, indicate if the subrecipient agreed with the finding, and describe any corrective action the subrecipient must take. To obtain an understanding of management’s subrecipient monitoring procedures, we met with management, and based on our discussions, we determined that for fiscal year ended June 30, 2023, management did not • obtain and review subrecipients’ single audit reports and issue management decisions on findings as required by 2 CFR 200.332, and • assess subrecipients’ single audits as part of their risk-based monitoring plan in accordance with CPO Policy 2013-007. While the PAR unit did obtain and review subrecipients’ single audit reports for those subrecipients that were monitored through fiscal-related activities, according to the division’s Assistant Commissioner, no one was assigned the responsibility for reviewing the subrecipients’ single audits for the programmatic activities or issuing management decisions. As of October 31, 2023, the division has designated a new point of contact for receiving single audit reports. The new point of contact will work with the Adult Education program to develop a process to obtain and review the single audit reports for programmatic requirements. Risk Assessment We reviewed the department’s 2022 Financial Integrity Act Risk Assessment and noted that management identified risks associated with the failure to review subrecipient single audit reports, but management failed to implement controls to mitigate these risks. Green Book Principle 7.09 states that management may conduct periodic risk assessments to evaluate the effectiveness of their actions to address the risk. When necessary, management should update their mitigating controls based on those periodic risk assessments if the effectiveness of their internal control is no longer valid or insufficient. EFFECT When programmatic program management does not obtain and review subrecipients’ single audit results as required by federal regulations and state policy, management increases the risk that it will not promptly identify subrecipients’ noncompliance and/or control deficiencies that require subrecipients’ corrective action. Additionally, failure of the programmatic monitors to review the single audits reduces the effectiveness of management’s risk assessments for each subrecipient, increasing the risk that a higher-risk subrecipient is not identified and monitored. RECOMMENDATION The Commissioner should ensure that programmatic program personnel are aware of all required monitoring responsibilities, including reviewing subrecipients’ single audit reports, issuing management decisions, and obtaining subrecipients’ corrective action plans when necessary. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT We concur. We have assigned our administrator over grants and budgets to begin receiving subrecipients’ single audit reports and to involve our Adult Education management in reviewing audit findings and issuing management decisions, when applicable. We have revised our subrecipient risk assessment to include single audits as one of the risk factors. In addition, we have developed standard operating procedures concerning receiving and reviewing subrecipient audit reports. Management has added this SOP to the department’s internal risk assessment. Also, management will monitor the procedures to ensure that the process is functioning properly.

Finding Number 2023-016 Assistance Listing Number 17.258, 17.259, and 17.278 Program Name Workforce Innovation and Opportunity Act (WIOA) Cluster Federal Agency Department of Labor State Agency Department of Labor and Workforce Development Federal Award Identification Number 23A55AY000009, AA-28344-16-55-A-47, AA-30740-17-55-A-47, AA-32192-18-55-A-47, AA-33257-19-55-A-47, AA-34796-20-55-A-47, AA-36347-21-55-A-47, and AA-38557-22-55-A-47 Federal Award Year 2017 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding 2022-005 Pass-Through Entity N/A Questioned Costs N/A FINDING For the third year in a row, the Workforce Services Division management did not ensure that program staff performed required programmatic subrecipient monitoring BACKGROUND The Workforce Innovation and Opportunity Act (WIOA) cluster of federal programs helps participants overcome barriers to obtaining employment by providing education, training, job search, and other support services. The WIOA cluster consists of three core programs: Adult, Dislocated Worker, and Youth. The U.S. Department of Labor (USDOL) awards funding for these programs through formula grants to states. In Tennessee, the Workforce Services Division (the division) within the Tennessee Department of Labor and Workforce Development (the department) administers WIOA programs. American Job Centers The WIOA cluster of programs provides employment services to individuals through a network of American Job Centers (job centers).(29) Individuals may visit a job center to determine whether they are eligible to receive services and, if so, obtain free employment assistance. The division awards grants to nine subrecipients, known as Local Workforce Development Boards (development boards),(30) to oversee the job centers in their Local Workforce Development Area (local area). Each development board serves multiple counties, contracts with a One-Stop Operator to manage the operations of the job centers, and appoints a Fiscal Agent who is responsible for the accounting and finances for the job centers. (29) The Workforce Investment Act of 1998 established One-Stop centers, which were physical locations where individuals may visit and determine if they are eligible for employment assistance from a variety of federal programs. When WIOA repealed and replaced the Workforce Investment Act, it changed the name of One-Stop centers to American Job Centers. (30) According to 20 CFR 679.300, the Local Workforce Development Board “is to serve as a strategic leader and convener of local workforce development system stakeholders.” For fiscal year 2023, the department’s expenditures for the WIOA Cluster totaled $43,639,761. The expenditures for each program are outlined in Table 1. See Schedule of Findings and Questioned Costs for table. Monitoring Requirements Federal grantors and the state’s Central Procurement Office (CPO)(31) require agencies that distribute grant funds to monitor grantees’ activities as necessary to ensure they use grant funds for authorized purposes in compliance with federal and state statutes, regulations, and any applicable terms and conditions. State regulations require the department to provide sufficient oversight of their subrecipients to ensure they are complying with all grant funding requirements. Specifically, Title 29, United States Code, Chapter 32, Section 3244(a)(4), “Monitoring,” states, “Each Governor of a State shall conduct on an annual basis onsite monitoring of each local area within the State to ensure compliance with the uniform administrative requirements.” (31) CPO, administratively attached to the state’s Department of General Services, is responsible for the state’s procurement and contracting processes and provides guidance and additional resources to the state’s entities. For the WIOA cluster of programs, the department divides its responsibility for monitoring between program and fiscal activities (discussed next). Workforce Services Division staff are responsible for monitoring the subrecipients’ programmatic activities, and the department’s Program Accountability Review (PAR) Unit staff are responsible for monitoring fiscal-related activities. Quarterly Desktop Program Monitoring Division staff perform programmatic monitoring through two methods: quarterly desktop reviews and annual on-site reviews. Desktop reviews include reviewing participant eligibility determinations, which are used to support the required annual on-site reviews. Division staff document monitoring review results and instances of noncompliance by generating quarterly monitoring reports that detail any identified issues classified as either a finding, observation, or concern. After the division’s Program Integrity Unit (PIU) reviews the quarterly reports, division staff send the reports to the subrecipients to notify them of the deficiencies and to set expectations for corrective action. Subrecipients communicate with PIU staff to follow up on findings identified in their quarterly monitoring reports and submit corrective action plans for the identified deficiencies. Joint Annual On-site Monitoring Reviews Program On-site Monitoring Activities During the annual joint on-site visit, the division staff follow a checklist to ensure that each job center has all required items available. These items include Equal Opportunity posters, Comptroller fraud hotline posters, and Adult Education posters. Additionally, the PIU monitors observe job center staff performing the daily processes, and then the monitors document the effectiveness of the center’s operation on the monitoring checklist. Fiscal On-site Monitoring Activities PAR Unit staff are responsible for monitoring fiscal-related activities. For example, PAR staff review the allowability of the expenditures included in the subrecipients’ fund reimbursement requests. PAR compiles a list of expenditures for each subrecipient to be monitored to select a random sample to test during the visit. Because it can take time to obtain the documentation, management notifies the subrecipient of the sample expenditures selected and encourages the subrecipient to provide the information before the on-site visit. Once the PIU and the PAR Unit have completed the annual on-site review, the results of the review are combined into a monitoring report for each subrecipient. The annual monitoring reports are approved by the Program Integrity Director and then issued to the subrecipients. All corrective action follow-ups are performed by the division’s PIU staff. PRIOR AUDIT RESULTS Our prior audit reported a finding related to the WIOA subrecipient monitoring, which included the following conditions: • division staff did not conduct on-site programmatic monitoring of subrecipients for the Adult, Youth, or Dislocated Worker programs; • division staff did not conduct any desktop programmatic reviews during three quarters and only conducted a desktop programmatic review for one of nine subrecipients in quarter 4 for the Adult, Youth, or Dislocated Worker programs; and • division staff did not follow the ETA’s Core Monitoring Guide for all reviews and as such did not adequately monitor relevant program requirements such as participant eligibility. Management concurred with the prior finding and stated the development board’s single audit reports will be reviewed by September 2023, and a review will occur from both a programmatic and fiscal perspective. Management also stated the development boards will be notified of any need for corrective action, and Internal Audit will be notified of actions taken by the division and the department’s Finance and Administration staff. Management also noted in their six-month follow-up on the finding that subrecipient monitoring would be conducted through desktop file reviews and annual on-site reviews. CURRENT AUDIT RESULTS As part of our current audit and based on discussions with management and our review of current policies and procedures, we determined that the department developed a tracking system to document when subrecipient single audit reports were received and reviewed. Additionally, we determined that management implemented programmatic monitoring procedures to ensure subrecipients were monitored based on federal and state compliance requirements; however, we still identified the following monitoring deficiencies. CONDITION, CRITERIA, AND CAUSE Management Failed to Develop Controls to Ensure Documentation for Monitoring Was Maintained According to management, during the scope of our audit, PIU monitors were able to complete annual on-site reviews(32) for three subrecipients; however, PIU staff did not maintain monitoring working papers for these reviews. Therefore, we were not able to determine whether these on-site reviews occurred and/or whether the monitoring reviews were adequate. Additionally, management stated that PIU monitors did quarterly desktop programmatic monitoring for all nine subrecipients. Once again, management was not able to provide monitoring working papers for the desktop programmatic review, so we were not able to determine whether the monitoring occurred or that the monitoring activities were adequate. See Monitoring Requirements section above for specific monitoring criteria. (32) The other six subrecipients’ annual on-site monitoring reviews were ongoing during our audit. According to division management, the on-site programmatic monitoring was documented manually on paper copies; however, these copies could not be located and were never uploaded into the system because management had not developed a process to collect and upload these documents into the department’s shared network. We did note that the PAR Unit did have working papers for fiscal monitoring of all nine subrecipients. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) offers guidance to management for developing internal controls and maintaining documentation. Principle 10, “Design Control Activities,” 10.03, “Design of appropriate types of control activities,” establishes, Management designs appropriate types of control activities for the entity’s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system. Principle 10 further describes in “Appropriate documentation of transactions and internal control,” Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. The documentation may appear in management directives, administrative policies, or operating manuals, in either paper or electronic form. Documentation and records are properly managed and maintained. Management Failed to Develop Controls to Ensure Subrecipients Submitted Corrective Action Plans and That the Department’s Program Monitors Issued Corrective Action Resolution Letters According to management, the PIU monitors are responsible for ensuring subrecipients take corrective action for all findings identified in the subrecipient monitoring reports, both program and fiscal. Based on our audit work, management could not provide us with corrective action plans or management’s resolution letters for two of three subrecipients (66%) that had findings as part of their on-site and quarterly monitoring results. Title 29, United States Code, Chapter 32, Section 3244(a)(5), states that when a state determines a local area is not in compliance, the state must require corrective action to ensure the local area is in compliance. Division management stated that specific staff within the PIU conduct corrective action follow-ups for both on-site and desktop reviews. We found, however, that staff did not have a process in place for documenting and tracking subrecipient follow-ups. Management noted that, moving forward, a tracking tool has been created that will document all monitoring efforts, including both annual on-site and quarterly desktop reviews. The new tracking method will also enable the Workforce Services Division to keep track of deficiencies noted during monitoring and will alert staff when corrective actions are due. Additionally, management is in the process of finalizing the Standard Operating Procedure for the quarterly monitoring to establish a uniform approach in distinguishing findings, concerns, and observations. Risk Assessment We reviewed the department’s 2022 Financial Integrity Act Risk Assessment and noted that the program management did not identify any risks related to subrecipient monitoring for programmatic activities and, as such, did not design and implement effective controls. Green Book Principle 7, “Identify, Analyze, and Respond to Risks,” 7.02, “Identification of Risks” states, “Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.” EFFECT When program management does not maintain appropriate and sufficient monitoring documentation, it increases the risk that management may be unaware of deficiencies identified at the subrecipient level and may not ensure that each subrecipient’s management takes action to correct any noncompliance or areas for improvement identified in the subrecipient monitoring reports. RECOMMENDATION The Commissioner should ensure the Workforce Services Division develops adequate procedures to maintain subrecipient monitoring documentation, including working papers. MANAGEMENT’S COMMENT We concur. Prior findings indicated a lack of on-site and virtual monitoring of Workforce Services programs. Those findings have been resolved as monitoring both on-site and virtual have been and are being conducted. However, due to a lack of work paper management, proof of all reviews was not able to be demonstrated. To resolve this finding, accountability controls have been put in place to allow management to track progress on monitoring conducted and to ensure work papers are maintained. Standard Operating Procedures, effective January 1, 2024, have been developed for both on-site monitoring and case file (i.e., desktop) reviews which include instructions on where we are currently saving working papers. Tracker spreadsheets, effective January 1, 2024, have been developed to track every step in the monitoring process including the submission of reviews conducted by each program. Virtual tools, effective January 1, 2024, have been revised to allow for ease of use and submission upon completion of reviews. Monitoring training was conducted in January 2024 with program units by Program Integrity to ensure new processes are understood and expectations are clearly defined. An Assistant Director position has been hired, effective January 28, 2024, to oversee the monitoring team. This will add a level of management needed to ensure the organization of all divisional monitoring is being conducted, communicated, and tracked. The Workforce Services Risk Assessment has been updated to include a high inherent risk of subrecipient monitoring to include controls to mitigate that risk. The controls to mitigate this risk will be monitored quarterly by reports submitted to Workforce Services management. These reports will show progress on monitoring to include supporting work papers.

Finding Number 2023-017 Assistance Listing Number 17.225 Program Name Unemployment Insurance Federal Agency Department of Labor State Agency Department of Labor and Workforce Development Federal Award Identification Number CARES Act Federal Award Year 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Eligibility Repeat Finding 2022-006 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 17.225 Federal Award Identification Number CARES Act Description Mixed Earner Unemployment Compensation Amount $9,110 Description Pandemic Unemployment Assistance Amount $100 FINDING As noted in the four prior single audits, the Department of Labor and Workforce Development paid Unemployment Insurance benefits to ineligible claimants due to ineffective internal controls BACKGROUND The Unemployment Insurance (UI) program is a federal-state partnership designed to ensure the economic security of workers who lose their jobs through no fault of their own. The U.S. Department of Labor provides grant funding for each state to design and administer its own UI program within federal requirements. In Tennessee, the Department of Labor and Workforce Development (the department) operates the state’s UI program to process claims and issue direct benefit payments to individuals during times of involuntary unemployment. Pandemic Programs On top of its regular(33) and temporary disaster relief programs, the department implemented four programs, listed below, to provide relief in response to the COVID-19 pandemic. The federal government reimburses the department for 100% of the benefits it pays to pandemic program claimants. (33) Regular programs include Tennessee Unemployment Compensation (TUC), Unemployment Compensation for Ex-Servicemembers (UCX), Unemployment Compensation for Ex-Federal Employees (UCFE), and Trade Adjustment Assistance (TAA). Pandemic Unemployment Assistance From January 27, 2020, through July 3, 2021, the Pandemic Unemployment Assistance (Pandemic) program provided temporary benefits to workers who had exhausted or were ineligible for regular Unemployment Insurance (such as part-time workers, the self-employed, and contractors) who lost work for certain COVID-19-related reasons. Pandemic Emergency Unemployment Compensation Pandemic Emergency Unemployment Compensation provided a maximum of 53 additional weeks of benefits to individuals who had exhausted their rights to regular Unemployment Insurance for weeks of unemployment through July 3, 2021. Federal Pandemic Unemployment Compensation Federal Pandemic Unemployment Compensation provided a supplemental weekly payment to individuals who received at least $1 in benefits from another UI subprogram. The weekly supplement was $600 (in addition to the claimant’s other benefits) for weeks of unemployment ending April 4, 2020, through July 25, 2020, and $300 for weeks of unemployment ending January 2, 2021, through July 3, 2021. Mixed Earner Unemployment Compensation Mixed Earner Unemployment Compensation (Mixed Earner) provided a supplemental weekly payment of $100 to individuals receiving benefits other than Pandemic Unemployment Assistance. Their prior earnings had to have included both wages from traditional employment and at least $5,000 from self-employment. Under federal law, all four pandemic programs expired on September 6, 2021. Governor Bill Lee opted to terminate Tennessee’s participation in these programs early, effective July 3, 2021. Throughout fiscal year 2023, the department followed federal guidance by continuing to process and pay backlogged benefits to eligible pandemic claimants for weeks of unemployment ending on or before the program’s termination date. General Eligibility Criteria and Determination Processes for Unemployment Claims The department uses the Geographic Solutions Unemployment System (GUS) application to process eligibility determinations for unemployment claims. Claimants submit an initial application for unemployment benefits in the system via the jobs4tn.gov website, which interfaces directly with GUS. GUS initiates various automated processes to help the department determine the claimant’s eligibility for benefits. If these processes yield information that could potentially disqualify a claimant’s eligibility, GUS flags the claim with an issue and attaches a work item. The work item triggers department personnel to review and resolve the issue on the claim manually. Management has configured business rules(34) in GUS to prevent claims with significant issues from paying benefits until department personnel have reviewed the claims to determine the claimants’ eligibility. (34) Business rules are instructions programmed into GUS directing the system how to process claims in accordance with state and federal eligibility requirements. Weekly Certifications After filing an initial claim for benefits, claimants must file weekly certifications via jobs4tn.gov to attest to their continued ability to work and availability for work, disclose income earned during the week, and report on work search activities. GUS automatically disqualifies the week as ineligible for payments if a claimant certifies no longer being unemployed, earning excess income, or not actively searching for and available to accept suitable work. PRIOR AUDIT RESULTS Our prior audit reported a finding, with multiple deficiencies, related to UI eligibility. Management concurred with the prior finding and attributed the conditions to the impact of the COVID-19 pandemic on claims volume and system issues. See Table 1 for a list of finding conditions identified in our prior audit and their disposition in the current audit. See Schedule of Findings and Questioned Costs for table. CURRENT AUDIT RESULTS We provide the results of our current audit below. As a result of our review, we identified $9,210 in federal questioned costs for the Mixed Earner and Pandemic programs. In addition, we identified $798 in state questioned costs for improper benefits paid from the unemployment trust fund to ineligible Tennessee claimants. For major programs such as the UI program, Title 2, Code of Federal Regulations (CFR), Part 200, Section 516(a)(3), “Audit findings,” requires us to report known and likely questioned costs greater than $25,000 for a type of compliance requirement for a major program. While cumulative known questioned costs for all errors did not exceed $25,000, we determined that likely questioned costs exceeded $25,000. CONDITIONS, CRITERIA, AND CAUSE Claimants Received Mixed Earner Benefits Without Providing Evidence of Past Earnings From Self-Employment (Repeat Condition) The U.S. Department of Labor issued operating guidance for the Mixed Earner program in Unemployment Insurance Program Letter No. 15-20, Change 3, which states, Individuals who apply for MEUC [the Mixed Earner program] are required to submit documentation substantiating their self-employment income for purposes of the state determining their eligibility for MEUC. . . . Individuals may submit this documentation at any time while the MEUC program is in effect. . . . However, until the individual provides the documentation and the state can determine that it substantiates that the amount of self-employment income meets MEUC eligibility requirements, MEUC payments may not begin. The federal guidance further established that claimants should provide a copy of their income tax return for the most recently completed tax year prior to application for regular unemployment benefits. Acceptable documentation also includes pay stubs, bank receipts, business records, accounting ledgers, invoices, and billing statements that substantiate self-employment income of at least $5,000 for the most recent tax year. As noted in our prior audit findings related to UI eligibility, department management did not design and implement internal controls, including controls integrated in its information systems, that ensured compliance with federal regulations. The existing control structure did not address the risks associated with the number, timing, nature, complexity, and volume of applicants for the federal programs that the department oversees. Specifically, the internal control structure was not designed to manage the number of temporary programs implemented due to the pandemic and natural disasters, in addition to changes in federal guidance for regular programs. While pandemic programs expired in the first week of fiscal year 2022, department management was challenged with continuing to process and pay backlogged claims throughout the year. We obtained the population of 30 claimants who received a total of 264 Mixed Earner payments, totaling $26,310, that the department issued in fiscal year 2023. We tested all 30 claimants for compliance with Mixed Earner eligibility requirements. Based on our testwork, the department issued Mixed Earner benefits without verifying evidence of self-employment earnings for 16 of 30 (53%) claimants tested. We identified a total of $9,110 in known federal questioned costs for improper Mixed Earner payments. Department Staff Paid Unemployment Insurance to a Claimant Who Had Not Contacted Three Separate Employers (New Condition) From the population of 608,685 regular, Pandemic, Trade Adjustment Act, Ex-Federal, and Ex-Service payments, totaling $148,557,672, that the department issued in fiscal year 2023, we selected a proportional sample of 75 benefit payments, to determine compliance with non-monetary eligibility requirements. In general, non-monetary eligibility requires the department to establish that a claimant has lost their most recent employment due to no fault of their own. See Table 2 for our testwork. See Schedule of Findings and Questioned Costs for table. Based on our review, we found for 1 claimant, the department issued benefits totaling $100 when the claimant had used the same 3 job contacts for 5 weeks over the period covered by the claim. This is not allowed under Section 50-7-302(a)(4), Tennessee Code Annotated, and thus results in federal questioned costs. According to management, even though the system should have prevented the payment, management had to assess and respond to the risk of providing benefits to ineligible claimants against the risk of not providing timely benefits to eligible claimants. To help control the volume of new and continuing claims for benefits, management relied on GUS tools designed to reduce manual claims handling. Management stated that these tools, however, did not always work as intended and resulted in unintentionally issuing benefits to ineligible claimants. These tools also did not address the root cause of system incidents, so management encountered recurring problems in GUS that the vendor had previously told management were fixed. EFFECT Without internal control processes designed to address and adapt to periods of high unemployment, the department increases the risk of improper payments to ineligible claimants. By not ensuring the vendor identifies and takes corrective action to fix claims processing errors within GUS, department management increases the risk of information systems controls not operating as designed or achieving the desired result. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of Labor and Workforce Development should work with UI program management to implement internal controls to mitigate the risks of improperly paying ineligible claimants. Management should review the exceptions we identified and, when appropriate, disqualify ineligible claimants and work to recover improper payments. MANAGEMENT’S COMMENT We concur. The department acknowledges that management and the vendor could not design and implement timely internal controls, due to the need to adjudicate pandemic claims quickly while ensuring compliance with all the federal pandemic programs. Regular Tennessee Unemployment Compensation controls could not encompass new federal programs never administered by State Unemployment Insurance within the compliance timeline. However, during and even after the pandemic, the department continued to work through its historic claim load and adjudicate pandemic-related claims as accurately and as timely as possible. The department worked with our vendor to ensure as much integrity as possible during these times. All efforts to alleviate recurring system problems and adjudicate the volume of claims filed during the pandemic were the priority of the division; however, these factors combined led to agency errors. The Assistant Administrator monitors MEUC payments through the daily payment register with a specific line item for MEUC payments. Excerpt of daily email received: There were no claimants with “Stimulus-MEUC” for today. In each case examined by the Comptroller’s Office, the claimant stated they earned $5,000 in self-employment in the prior calendar year. Once the claim was reviewed by staff and proof was not submitted by the claimant, staff denied the MEUC payments, and the claimant was advised of the potential overpayment of benefits of MEUC payments. Management gave claims staff a reference guide to resolving mixed earnings unemployment compensation. Staff was advised they must adjudicate these issues with a determination. The ones that paid in error were incorrectly resolved by staff. Usually, this would be acceptable as erroneous issues are resolved this way, but due to the complexity of this issue it did not resolve in that manner, equating to an approval for MEUC. To prevent payment on MEUC, the non-monetary issue must be denied with a determination. The department worked diligently to correct issues as they arose. The UI program continues to monitor and address risks of improperly paying claimants regardless of the program. Eight claimants received erroneous MEUC payments in 2022, eight in 2023, and only three of those sixteen claimants received MEUC payments after the single audit report was received in 2023. As stated in the finding, the MEUC overpayments did not reach the 25,000-dollar threshold. Minimizing the overpayments was due to the department’s efforts to reduce the payment errors made on this program.

Finding Number 2023-018 Assistance Listing Number 93.568 Program Name Low-Income Home Energy Assistance Federal Agency Department of Health and Human Services State Agency Tennessee Housing Development Agency Federal Award Identification Number 2202TNLIEA and 2102TNE5C6 Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Tennessee Housing Development Agency did not have adequate internal controls to ensure subrecipients obtained a unique entity identifier before the agency awarded federal funds BACKGROUND The U.S. Department of Health and Human Services provides grant funding under the Low-Income Home Energy Assistance Program (LIHEAP) to the Tennessee Housing Development Agency (the agency). The objective of LIHEAP is to help low-income households meet the costs of home energy, increase their energy self-sufficiency, and reduce their vulnerability resulting from energy needs. The agency makes subawards to subrecipients to fulfill the objectives of LIHEAP. CONDITION, CRITERIA, AND CAUSE Management did not have adequate internal controls to prevent the agency from making subawards to subrecipients without obtaining the subrecipients’ unique entity identifier (UEI). As a result, 15 of 19 (79%) LIHEAP subrecipients were not eligible to receive federal funds. Title 2, Code of Federal Regulations (CFR), Part 25, Section 300, states that “a recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier.” Management stated they incorrectly made the subawards because they were not aware of this requirement. In addition, the Federal Award ID sheet, which is part of the contract template, had a spot for the Data Universal Numbering System (DUNS) number, rather than the UEI. Because the agency obtained the UEI from each subrecipient after the audit period, we did not question the costs the agency paid to the subrecipients during the year. EFFECT Because the agency made unauthorized payments to subrecipients without a UEI, management was unable to comply with Federal Funding Accountability and Transparency Act requirements to report subrecipient information. The Act’s subaward reporting system requires a UEI in the subrecipient information. See Finding 2023-019. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • withholding further awards for the project or program, or • pursuing other available legal remedies. Granting subawards to subrecipients who have not obtained a UEI could result in questioned costs. RECOMMENDATION Management should develop procedures to ensure that all subrecipients have obtained a UEI before the agency makes a subaward. Management should also update the Federal Award ID sheet to include the UEI. MANAGEMENT’S COMMENT We concur. As noted in the report, THDA has collected all of the UEI numbers associated with LIHEAP grantees. Because THDA contracts with the same entities annually to administer LIHEAP, this issue is resolved. However, THDA is updating its applications associated with all other federal grant programs to obtain the UEI number at time of application. Program staff will also transmit the UEI numbers to THDA’s accounting team at time of funding the award. Additionally, should a LIHEAP grantee change in future years, THDA will ensure collection of the information prior to entering into the grant award for LIHEAP funds.

Finding Number 2023-019 Assistance Listing Number 93.568 Program Name Low-Income Home Energy Assistance Federal Agency Department of Health and Human Services State Agency Tennessee Housing Development Agency Federal Award Identification Number 2202TNLIEA and 2102TNE5C6 Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entit N/A Questioned Costs N/A FINDING Tennessee Housing Development Agency management did not have effective internal controls over reporting for the Low-Income Home Energy Assistance Program BACKGROUND The U.S. Department of Health and Human Services (HHS) provides grant funding through the Low-Income Home Energy Assistance Program (LIHEAP) to the Tennessee Housing Development Agency (the agency). The objective of LIHEAP is to help low-income households meet the costs of home energy, increase their energy self-sufficiency, and reduce their vulnerability resulting from energy needs. As a condition of the grant, HHS requires the agency to report on the use of federal funds through financial, performance, and special reports. In addition to federal requirements in the Code of Federal Regulations, the HHS Office of Administration for Children and Families, Office of Community Services (OCS), provides guidance to LIHEAP recipients by issuing Action Transmittals. CONDITION, CRITERIA, AND CAUSE The agency did not have adequate internal controls to ensure it provided the federal grantor (HHS) with timely or accurate reports. In addition, management was unable to provide the underlying documentation to support all amounts reported. Management was unable to determine why reports were submitted late or contained errors since the former program director left before we identified the errors. Special Reporting LIHEAP Carryover and Reallotment Report According to Title 45, Code of Federal Regulations (CFR), Part 96, Section 81(b), “Each grantee must submit a [carryover and reallotment] report to [HHS] by August 1 of each year.” The OCS LIHEAP Action Transmittal 2022-05 extended the deadline to submit the report to December 30, 2022. We reviewed the 2022 LIHEAP Carryover and Reallotment Report to ensure management submitted the report timely and reported key line items accurately. We noted that management submitted the report 90 days after the due date. Annual Report on Households Assisted by LIHEAP According to 45 CFR 96.82(a), the agency is required to submit to HHS the Annual Report on Households Assisted by LIHEAP “for the 12-month period corresponding to the Federal fiscal year (October 1–September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance.” Per the OCS LIHEAP Action Transmittal 2023-01, the final data for the Annual Report on Households Assisted by LIHEAP was due on December 30, 2022. We reviewed the 2022 Annual Report on Households Assisted by LIHEAP to ensure management submitted the report timely and reported key line items accurately. We noted that management submitted the report 90 days late. We also noted errors for 14 key line items. In addition, management could not provide support for the number of households reported on the Weatherization Line in Section IV. Management stated that the Energy Housing Program Manager responsible for the report left in September 2023, and management no longer has access to the files she used to prepare the report. See Schedule of Findings and Questioned Costs for table. Quarterly Performance and Management Report LIHEAP Action Transmittal 2022-03 Quarterly Report Instructions Attachment 1 requires grant recipients to submit data and information about LIHEAP through the Quarterly Performance and Management Reports. The quarterly reports “focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility assistance programs, and training and technical assistance needs.” We reviewed the 2022 Quarterly Performance and Management Report for the fourth quarter of the fiscal year to ensure management submitted the report timely and reported key line items accurately. We noted errors for four key line items on the report. See Schedule of Findings and Questioned Costs for table. FFATA Reporting The Federal Funding Accountability and Transparency Act (FFATA) and 2 CFR 170, Appendix A, require the agency to report subrecipient financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. Reports are due no later than the end of the month following the month when the obligation occurred. The subaward information in FSRS is then made available to the public on USAspending.gov for transparency. We reviewed FSRS to determine the agency’s compliance with FFATA reporting. Based on our review of the system and discussion with management, management did not report any of their 19 subawards in FSRS. Management did not report 15 of the 19 subrecipients’ information because management violated 2 CFR 25.300 by making subawards to subrecipients who did not have a unique entity identifier; this number is required to enter subrecipient information into FSRS. See Finding 2023-018. Management stated that the other 4 subrecipients were not entered because of management oversight. Performance Reporting OCS LIHEAP Action Transmittal 2023-02 states that the LIHEAP Performance Data Form is an annual report in response to Title 42, United States Code, Section 8629(b), which requires the Secretary of the HHS to submit a report to Congress containing a detailed compilation of information on home energy consumption; the amount, cost, and type of fuels used for households eligible for assistance; the number and income levels of households assisted; and the number of households that received such assistance and include 1 or more individuals who are 60 years or older or disabled or include young children. We reviewed the LIHEAP Performance Data Form to ensure management submitted the report timely and reported key line items accurately. We noted that management submitted the required report on March 20, 2023, 48 days after the January 31, 2023, due date. We also noted errors on 3 key line items. See Schedule of Findings and Questioned Costs for table. EFFECT When agency staff do not proactively perform procedures to ensure that reports generated are timely and adequately supported, management increases the risk of reporting inaccurate or untimely data to HHS. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • withholding further awards for the project or program, or • pursuing other available legal remedies. RECOMMENDATION Management should implement a system of internal controls that will allow staff to submit required reports to the federal grantor accurately and timely. Management should ensure all reports are reviewed for accuracy by a supervisor prior to submission to the federal grantor. Management should maintain access to former employees’ work files until management can review the files to determine what files should be maintained. MANAGEMENT’S COMMENT We concur. Management is putting into place a reporting schedule of all LIHEAP reports due, with periodic checkpoints between the preparer and supervisor to determine progress and address issues prior to the due dates. Additionally, all documentation (emails, system reports, etc.) supporting the report and values included is required to be stored at the same location as the final report on THDA’s shared drive. Finally, each federal report will be reviewed by a supervisor prior to its submission in order to confirm accuracy of data values and narrative and ensure that supporting documentation is on file.

Finding Number 2023-020 Assistance Listing Number 93.568 Program Name Low-Income Home Energy Assistance Federal Agency Department of Health and Human Services State Agency Tennessee Housing Development Agency Federal Award Identification Number 2202TNLIEA, 2102TNE5C6, 2202TNLIEE, 2302TNLIEA and 2302TNLIEE Federal Award Year 2021 through 2024 Finding Type Material Weakness Compliance Requirement Other Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING Agency management did not establish a key process to ensure that internal controls related to the vendor-hosted THO application were appropriately designed and operating effectively BACKGROUND The Tennessee Housing Development Agency contracted with an information technology (IT) vendor, THO Software Solutions, to develop and maintain a web-based system to administer the Low-Income Home Energy Assistance Program (LIHEAP). THDA also contracts with human resource agencies as the vehicle to provide federal assistance to eligible households through the LIHEAP program. According to THDA’s contract with the vendor, the THO application provides human resource agencies the ability to enter and process LIHEAP applications and generate reports. More specifically, the contract requires that THO • Track duplication of services based on social security numbers and process applications based on THDA specifications if duplicate is found • Allow agencies to update household and LIHEAP application data for households already existing and previously served in the statewide database • Allow agencies to enter new household and LIHEAP application data for households applying for service for the first time • Flag each application with the appropriate agency ID • Provide agencies with the ability to process and pay their own agency LIHEAP applications • Provide the ability to receive LIHEAP regular assistance online applications for households which received a LIHEAP benefit within the past 2 years • Provide LIHEAP agencies with the required reports and reporting ability to successfully create payments, process refunds, and void payments as appropriate • Provide THDA with access to a statewide database for its own reporting requirements. CONDITION AND CAUSE THDA did not evaluate whether the IT contractor implemented relevant internal controls over the processing and storage of agency program data within the THO application or whether the controls implemented were in place and operating effectively to ensure THDA could properly administer the LIHEAP program. While THDA management and internal audit obtained a self-assessment of THO’s controls provided by the vendor and assessed THO as being a critical vendor with moderate risk, THDA did not conduct any specific assessments of THO’s controls. Additionally, when THDA management renewed the contract with THO in 2019, management did not ensure that the contract required THO to provide any type of independent assurance report, such as a System and Organization Controls (SOC) report. According to THDA management, the vendor did not have a SOC report or another equivalent assessment available at the time of our audit. Because the current contract with the IT vendor does not require an independent examination of internal controls, THDA management was unable to obtain assurance of controls by reviewing an independent examination report, such as a SOC report, that described the IT contractor’s internal controls and the auditor’s opinion regarding the effectiveness of controls. Because the current contract with THO expires in September 2024, THDA is currently in the process of creating a Request for Proposal (RFP) to acquire a new contract for an information system to support the LIHEAP program. THDA stated the RFP will include a clause that requires the contractor to provide a SOC 2 Type 2 report for their information system services and to comply with all relevant state security policies. A SOC 2 Type 2 report provides management and other auditors with information regarding the design and effectiveness of internal controls and focuses on data security, availability, processing integrity, confidentiality, and/or privacy. EFFECT Failure to provide an independent audit of internal controls over THO or otherwise obtaining assurance of internal controls prevents agency management from obtaining assurance that the awards were processed and information was collected to comply with the federal requirements. Without an assurance report, we were unable to determine whether THO implemented relevant internal controls and whether those controls operated effectively. Because THO does not have a SOC report available, and since agency management has not gained additional visibility into THO’s relevant internal control environment by other means, the agency may not design and implement appropriate safeguards to address the risks of using THO’s services to support the federal program. SOC audit reports also identify any complementary user entity controls that a service organization, such as THO, would expect its customers to implement to achieve the control objectives specified in the SOC report. Consequently, the agency using the services offered by the information system provider may not have adequate internal controls implemented over its business processes if the agency is not made aware of complementary user entity controls. CRITERIA The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to “Documentation of the Internal Control System,” Sections 3.09 through 3.11 of the Green Book, Management develops and maintains documentation of its internal control system. Effective documentation assists in management’s design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. . . . Management documents internal control to meet operational needs. Documentation of controls, including changes to controls, is evidence that controls are identified, capable of being communicated to those responsible for their performance, and capable of being monitored and evaluated by the entity. “Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,” Title 2, Code of Federal Regulations, Part 200, Section 1, states, Internal controls for non-Federal entities means: (1) Processes designed and implemented by non-Federal entities to provide reasonable assurance regarding the achievement of objectives in the following categories: i. Effectiveness and efficiency of operations; ii. Reliability of reporting of internal and external use; and iii. Compliance with applicable laws and regulations. Best practices in the National Institute of Standards and Technology’s Special Publication 800-53 (Rev. 5), Security and Privacy Controls for Information Systems and Organizations, Section SA-9, “External System Services,” states that “the responsibility for managing risks from the use of external system services remains with the authorizing officials.” Additionally, Section RA-3, “Risk Assessment,” states that risk assessments consider threats, vulnerabilities, likelihood, and impact to organizational operations and assets, individuals, other organizations, and the Nation. Risk assessments also consider risk from external parties, including contractors who operate systems on behalf of the organization, individuals who access organizational systems, service providers, and outsourcing entities. As another source of guidance on best practices, the Center for Internet Security’s CIS Critical Security Controls, Version 8, Control 15, “Service Provider Management,” 15.5, “Assess Service Providers,” recommends that an organization “Assess service providers consistent with the enterprise’s service provider management policy. Assessment scope may vary based on classification(s), and may include review of standardized assessment reports, such as Service Organization Control 2 (SOC 2) and Payment Card Industry (PCI) Attestation of Compliance (AoC), customized questionnaires, or other appropriately rigorous processes. Reassess service providers annually, at a minimum, or with new and renewed contracts.” RECOMMENDATION While management continues the process of procuring a new information system vendor to support the LIHEAP program, management should ensure that internal controls related to their applications are appropriately designed and operating effectively. When management establishes the new contract, they should ensure that the contract requires independent reviews of internal controls, such as SOC 2 Type 2 examinations. As part of its risk assessment, management should review these SOC examinations annually. MANAGEMENT’S COMMENT We concur. In 2020, THDA made changes to the contract procurement process to include IT as an approver for all contracts being processed through the contract approval software system. The THO contract extension was processed in December of 2019 solely by program staff. The contract extension also included the addition of new services. At the time of the contract extension, IT was unaware of the amount and type of data to be stored/collected in the system. IT leadership did meet with THO late in 2023 to express concerns around security, and the fact that they had no SOC II Type 2, nor did they have anything in the works to obtain one. As a result, THO did configure and add multi-factor authentication to the system in January of 2024. A Request for Proposal is being developed to be issued in the second quarter of 2024 which should allow for a new system by the second quarter of 2025. THDA is in the midst of drafting its RFP to secure a software vendor to administer select federal programs, including LIHEAP. THDA has included in this RFP the following mandatory requirement: “For cloud-based software, provide a copy of a valid and current SOC 2 Type 2 certification for the system itself, not just the hosting platform such as Azure or AWS.”

Finding Number 2023-021 Assistance Listing Number 93.788 and 93.959 Program Name Opioid STR Block Grants for Prevention and Treatment of Substance Abuse Federal Agency Department of Health and Human Services State Agency Department of Mental Health and Substance Abuse Services Federal Award Identification Numbers H79TI083307, H79TI085738, B08TI083477-01, B08TI083515, B08TI084672-01, and B08TI085834 Federal Award Year 2021 through 2023 Finding Type Noncompliance Compliance Requirement Activities Allowed or Unallowed Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 93.788 Federal Award Identification Number H79TI083307, H79TI085738 Amount $80,275 Assistance Listing Number 93.959 Federal Award Identification Number B08TI083477-01, B08TI083515, B08TI084672-01, B08TI085834 Amount $80,000 FINDING The Department of Mental Health and Substance Abuse Services reimbursed subrecipients for potentially unallowed activities, resulting in questioned costs totaling $160,275 BACKGROUND The Substance Abuse Prevention and Treatment Block Grant (block grant) and State Opioid Response (opioid) programs are administered by the state to help prevent and treat substance abuse and are funded by the U.S. Department of Health and Human Services. The federal department’s Substance Abuse and Mental Health Services Administration (SAMHSA) division administers the block grant and opioid programs at the federal level, and the Tennessee Department of Mental Health and Substance Abuse Services (the department) administers the programs at the state level. The block grant allows for activities that address the use and/or abuse of both licit and illicit drugs, alcohol, and tobacco, which includes alcohol and drug treatment and rehabilitation, as well as activities such as education and counseling designed to reduce the risk of substance abuse. The opioid program is specifically for the prevention and treatment of opioid usage. The department administers the block grant and the opioid programs by partnering with subrecipient entities across the state that are responsible for local-level program administration. The department accepts applications from prospective subrecipients and uses interviews and site visits to select and approve subrecipients. Once a subrecipient is approved, the department program staff work closely with the subrecipient to determine which program services the subrecipient will provide. The department staff list and define allowable activities in each subrecipient’s contract and establish the related reimbursement rate for all subrecipients. Subrecipients are responsible for invoicing the department monthly through the Tennessee Web-based Information Technology System (TN-WITS), and the department subsequently reimburses the subrecipients through Edison based on the department’s invoice approval process. The block grant and opioid funds may be used for a broad range of substance abuse prevention, treatment, and recovery activities; however, Title 42, Code of Federal Regulations (CFR), specifically states that SAMHSA funds cannot be used for inherently religious activities, such as worship, religious instruction, or proselytization.(35) (35) Proselytization is defined as the process to induce someone to convert to one’s faith. CONDITION AND CRITERIA Methodology For our block grant program testwork, we selected a nonstatistical, random sample of 40 expenditures, and 1 additional significant expenditure, from a population of 2,266 expenditures, totaling $35,253,875, paid in fiscal year 2023. For our opioid program testwork, we selected a nonstatistical, random sample of 40 expenditures, and 2 additional significant expenditures, from a population of 1,189 expenditures, totaling $30,631,119, paid in state fiscal year 2023. Results Based on our testwork, we found that the department reimbursed block grant subrecipients $660 for pastoral/spiritual support for 4 of 41 items tested (10%). In addition, we found that the department paid an opioid subrecipient $4,680 for pastoral/spiritual support for 1 of 42 items tested (2%). Because the pastoral/spiritual support activity did not apply to all subrecipient invoices, we decided to inquire with management about the total amount paid to the subrecipients for pastoral/spiritual support instead of projecting the errors to the expenditure population. Based on further discussion with department staff and a review of all transactions recorded as pastoral/spiritual support services in TN-WITS, we determined that the department paid block grant subrecipients a total of $80,000 and opioid subrecipients $80,275 in the fiscal year ended June 30, 2023, for the potentially unallowed activity. The subrecipients’ contracts provide that pastoral/spiritual support may include services that incorporate faith and religious beliefs in the recovery process, including helping service recipients develop their spirituality and religious practices. Furthermore, the contracts state that services could include practices such as prayer and scripture; one example of such services includes studying the application of religious beliefs with a spiritual leader. While faith-based organizations are eligible subrecipients of SAMHSA funds, the subrecipients cannot be reimbursed by the state for any inherently religious activities using either block grant or opioid federal program funds. CAUSE Based on our discussion with management, they do not interpret the pastoral services offered under the subrecipients’ contracts as the same activities unallowed under the “inherently religious activities” described under 42 CFR 54.4. Management stated that faith-based organizations are valuable partners, particularly in rural areas where there are fewer substance abuse services available. We requested clarifying guidance from SAMHSA regarding whether the pastoral/spiritual support services the department offers are prohibited under the federal regulations; however, at the time of this report, SAMHSA had not provided any additional guidance. EFFECT Without clarifying guidance from the federal grantor for proper grant administration, there is an increased risk of management’s noncompliance with the grant award and terms. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION We recommend that the Commissioner and staff obtain clarifying guidance from SAMHSA regarding whether the pastoral/spiritual support services that the department offers are allowable under federal regulations for the block grant and opioid programs. MANAGEMENT’S COMMENT TDMHSAS partially concurs as our proposal to SAMHSA included the Pastoral/Spiritual Services referenced and was accepted. Additionally, according to 42 CFR § 54.4, examples of inherently religious activities include “worship, religious instruction, or proselytization”. TDMHSAS would draw a distinction of these inherently religious activities from the activities funded through ARP, as the latter are not centered on attempting to convert an ARP recipient from one religion to another. Rather, ARP Pastoral/Spiritual Support Services are built on the premise that recovery from substance use disorder, as defined by SAMHSA, is “holistic, addressing not just a person’s substance use problems but also their physical, emotional, social, and spiritual wellness”. TDMHSAS ARP Pastoral/Spiritual Support Services are focused on assisting one in developing his/her spirituality and religious practices of their choosing. The individual’s right to choose is further ensured through Charitable Choice Regulations set forth in 42 CFR §§ 54.1e and referenced in each ARP grant contract. In addition, SAMHSA approved its COVID Emergency Relief Funding Proposal which references “pastoral/spiritual support” in the recovery services TDMHAS proposed to use funding for. With this said, TDMHSAS recognizes that the current service definition for ARP Pastoral/Spiritual Support references terms “scripture”, “religious beliefs”, and “religious practices”. In that these terms could misconstrue relevance to inherently religious activities, TDMHSAS will remove these terms from its service definition. AUDITOR’S COMMENT We have reviewed management’s comments and maintain our finding to seek federal grantor guidance.

Finding Number 2023-022 Assistance Listing Number 93.788, 93.958, and 93.959 Program Name Opioid STR Block Grants for Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse Federal Agency Department of Health and Human Services State Agency Department of Mental Health and Substance Abuse Services Federal Award Identification Number H79TI083307, H79TI085738, B09SM083790-01, B09SM083949-01, 1B09SM085345-01, B09SM085873-01, B09SM085993-01, B09SM087344-01, B08T1083477-01, B08TI083515, B08TI084672-01, and B08TI085834 Federal Award Year 2021 through 2023 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Mental Health and Substance Abuse Services did not comply with Federal Funding Accountability and Transparency Act reporting requirements BACKGROUND The Department of Mental Health and Substance Abuse Services (the department) is the pass-through entity for the following programs administered by the Substance Abuse and Mental Health Services Administration (SAMHSA), a division of the Department of Health and Human Services: • the Block Grants for Community Mental Health Services (mental health block grant), which provides states funds to help them provide community-based mental health services to adults with mental illness and children with serious emotional disturbances; • the Block Grants for the Prevention and Treatment of Substance Abuse (substance abuse block grant), which helps states prevent and treat abuse of substances such as licit and illicit drugs, alcohol, and tobacco; and • the Opioid State Targeted Response (opioid) program, which is specifically for prevention and treatment of opioid usage. The Coronavirus Response and Relief Supplement Appropriations Act and the American Rescue Plan Act (collectively referred to as the COVID funds) provided the department with additional funds for the mental health and substance abuse block grants for state fiscal year 2023. The acts required the department to adhere to Federal Funding Accountability and Transparency Act (FFATA) reporting requirements for the COVID funds. Beginning in fiscal year 2021, SAMHSA also required the department to comply with FFATA reporting requirements for non-COVID funds in the mental health and substance abuse block grants as well as the opioid program. FFATA Reporting The FFATA requires the department to report subrecipient subaward financial information through the FFATA Subaward Reporting System (FSRS) for all subawards $30,000 and over. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 170(a)(2)(ii), reports are due “no later than the end of the month following the month in which the obligation was made.” For public transparency, the subaward information in FSRS is then available to the public on the USA Spending website. The report includes key data elements such as the awardee name, award amount, the unique entity identifier, and the subaward obligation/action date. The department uses its Budget Contract Monitoring System (BCMS) to track federal grants and subsequent subawards of the grants that require reporting under FFATA. Department staff also use an internal spreadsheet to track subaward information, including cumulative subaward amounts. Monthly, department staff generate the BCMS FFATA Contract report, which lists all grant awards that require FFATA reporting. Staff compare the report and internal spreadsheet to determine if subawards require initial reporting or if staff need to adjust previously reported subaward information. Staff report the transactions by the end of the following month of the initial subaward or adjustment. CONDITION A AND CAUSE Staff Did Not Report Non-COVID Subawards for the Mental Health and Substance Abuse Block Grants as Required by FFATA Based on inquiries with the department’s fiscal team, we found that for fiscal year ended June 30, 2023, department staff did not report non-COVID subawards for the mental health and substance abuse block grants under the FFATA requirements. Further discussion with department staff revealed that department staff did not report any non-COVID subawards since the reporting requirement for the mental health and substance abuse grants became effective in 2021. According to department staff, when they developed BCMS in 2015, FFATA reporting did not apply to the mental health and substance abuse block grants; thus, management did not design the information system to track whether those grants required FFATA reporting. When the department received the COVID funds, they adjusted BCMS to account for the FFATA reporting requirement for those grants; however, staff did not adjust the system to account for FFATA reporting requirements for the non-COVID funds. As a result, management did not design a mitigating control to ensure the non-COVID mental health block grant, substance abuse block grant, and the opioid program and subsequent subawards were included in the BCMS FFATA Contracts report that staff used to comply with FFATA reporting. In summary, for fiscal year 2023, the department expended $16,526,780 for non-COVID mental health and $33,036,585 for non-COVID substance abuse block grants. However, without reviewing all contracts and amendments, department staff could not provide us the number and amount of subawards that were not reported under FFATA for these two block grants. CONDITION B AND CAUSE Department Staff Reported Subawards Late Based on FFATA Requirements We obtained a population of 61 mental health block grant COVID subawards, 42 substance abuse block grant COVID subawards, and 160 opioid subawards $30,000 and over that were obligated during fiscal year ended June 30, 2023. We selected a nonstatistical, random sample of 43 subawards across the 3 programs to determine if the department complied with FFATA reporting requirements. See Table 1 for a breakdown for each program. See Schedule of Findings and Questioned Costs for table. Based on our work on the 43-item sample, we noted that fiscal staff did not report the following by the end of the month following the month management obligated the funds: • 8 of 10 mental health block grant COVID subawards tested (80%), • 5 of 7 substance abuse block grant COVID subawards tested (71%), and • 10 of 26 opioid subawards tested (38%). Staff reported the subawards to FSRS between 27 and 112 days late. See Table 2 for a breakdown of the department’s noncompliance by program. See Schedule of Findings and Questioned Costs for table. Department management stated that the subawards were reported late because the fiscal accountant who handled the FFATA reporting during fiscal year 2023 was out on extended leave, and fiscal staff who assumed the FFATA reporting responsibilities required time to learn the FFATA reporting requirements and the department’s process. Risk Assessment We reviewed the department’s December 2022 Financial Integrity Act Risk Assessment and determined that management included that fiscal staff could be out for an extended period of time, causing FFATA subawards to not be reported timely. Management also identified a mitigating control to address this risk, which included a back-up employee with access to FSRS to ensure timely FFATA reporting. We found, however, that management did not implement this mitigating control and did not assign a back-up employee with FFATA reporting responsibilities and access to the FSRS until the fiscal accountant was already on extended leave. As such, staff failed to meet reporting deadlines required by FFATA regulations. Additionally, the department’s risk assessment did not identify the risk of failing to report all FFATA contracts and did not develop a mitigating control to address the risk; thus, they did not ensure all subawards were properly reported. CRITERIA Condition A and Condition B Appendix A to “Reporting Subaward and Executive Compensation Information,” 2 CFR 200.170, states: a. Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency. . . . 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2010.) Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to the Green Book, Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. According to Green Book Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT Not meeting the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of the Department of Mental Health and Substance Abuse Services should ensure staff are aware of the FFATA reporting requirements for all applicable grants and ensure any system used to determine appropriate reporting is complete and accurate. Management should implement a contingency plan to ensure FFATA reporting continues if staff take extended leave or separate from the department. MANAGEMENT’S COMMENT We concur. This finding was corrected during the audit. A new report was created in BCMS to provide a listing of new contracts and contract amendments related to the federal block grants and was tested and implemented during the audit. In addition, a detective control has been created to identify any contracts with payments posted to the Edison accounting system not only for the federal block grants but for any federal discretionary grants as well. This Edison query will be run monthly and reviewed to ensure that all new contracts with payment activity have had FFATA reports prepared and submitted to fsrs.gov. This new mitigating control will be added to the department’s Financial Integrity Act Risk Assessment. During the audit, the responsibility for FFATA reporting was split between two staff members; one staff member prepares and submits the FFATA reports for the non-discretionary federal grants while the other staff member prepares and submits the FFATA reports for the federal block grants. The responsibility for the sign off on the Month-end Closing Checklist ensuring that FFATA reporting has been completed was also reassigned to the Accounting Manager supervising these two staff members. So, currently, we have three staff members familiar with FFATA reporting.

Finding Number 2023-023 Assistance Listing Number 93.767 Program Name Children’s Health Insurance Program Federal Agency Department of Health and Human Services State Agency Department of Finance and Administration Federal Award Identification Number 2205TN5021 and 2305TN3002 Federal Award Year 2022 and 2023 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Repeat Finding 2022-007 Pass-Through Entity N/A Questioned Costs $25,294 FINDING As noted in the prior two audits, management did not address the division’s CoverKids eligibility process deficiencies, resulting in $31,499 in federal and state questioned costs BACKGROUND The Division of TennCare (the division) oversees CoverKids, Tennessee’s Children’s Health Insurance Program. Funded at both the federal and state levels, the program provides health insurance coverage to uninsured, low-income children and pregnant women not otherwise eligible for Medicaid. From July 1, 2022, through June 30, 2023, the division made two types of payments on behalf of CoverKids members: • monthly capitation payments to the managed care organizations;(36) and • reimbursements to benefit managers for services, such as pharmacy and dental services. (36) The division contracts with three managed care organizations and only pays them a capitation rate per member per month to provide services to CoverKids members. According to the Centers for Medicare and Medicaid Services, capitation is a way of paying organizations a set amount of money to cover the predicted cost of all or some health care services. The Division’s Eligibility Determination Process for CoverKids Applicants and Members Initial Eligibility Process CoverKids applicants apply for eligibility using TennCare Connect, the public-facing web portal of the division’s Tennessee Eligibility Determination System (TEDS). In addition to TennCare Connect, the division continues to accept applications through each of following methods: • by phone or online through the Federally Facilitated Marketplace;(37) • by phone or a paper application; • online through the TennCare Access partner portal;(38) or • by visiting a Department of Human Services office for in-person assistance with applying online, by paper, or by phone. (37) The U.S. Department of Health and Human Services operates the Federally Facilitated Marketplace, an organized marketplace of health insurance plans where individuals can apply for health insurance, including Medicaid and CoverKids. (38) The division partners with the Department of Health, certain hospitals, and certain long-term care providers to assist an individual in the application process. Generally, staff manually enter information received from phone and paper applications into TEDS, while information from online applications automatically uploads into the system. TEDS then automatically processes and verifies the applicant’s demographic, income, and household information against multiple state and federal databases to determine if the applicant is eligible for any available TennCare or CoverKids eligibility category, thereby removing the need for human intervention in many cases. If the applicant’s eligibility determination requires human intervention, such as when the system identifies discrepancies in application information or cannot verify information, the system automatically assigns an eligibility caseworker to process the application manually in TEDS.(39) (39) According to division management, TEDS is a task-based system where an eligibility caseworker may have to manually verify an applicant’s information (such as Social Security Administration payment history or family composition) to continue processing eligibility. Eligibility Renewals Begin April 1, 2023 Pursuant to the Families First Coronavirus Response Act, the division was not permitted to terminate members who were enrolled when the federal COVID-19 public health emergency (PHE) period began, with limited exceptions. As such, the division paused CoverKids eligibility renewals, eligibility category changes, and terminations from March 18, 2020, until March 30, 2023.(40) During the pause, the division could only terminate CoverKids coverage for existing members who died; voluntarily terminated coverage; became residents of another state; or, for members with pregnancy coverage, when the member’s postpartum period ended. The division began performing the Children’s Health Insurance Program (CHIP) eligibility renewals on April 1, 2023. (40) The federal government extended the PHE through January 11, 2023. CMS instructed states to begin redeterminations as early as February 1, 2023, and to complete all redeterminations by May 31, 2024. PRIOR AUDIT RESULTS In the prior audit, we determined that division management attempted to address the TEDS system error that allowed ineligible members to continue with coverage after their postpartum period had ended, but this attempt was unsuccessful. Additionally, we identified an instance in which staff members incorrectly determined a member for CoverKids when he did not meet the residency requirement and an instance in which TEDS prohibited the termination of coverage for an individual who aged out of CoverKids. Management concurred and stated that the division has dedicated staff monitoring documented risk assessment mitigation strategies to limit the number of eligibility errors in the program. Management stated that they also continually monitor both the TEDS system and the division’s manual eligibility process. CONDITION, CRITERIA, AND CAUSE For the current audit, we determined that management decided to achieve corrective action through the unwinding renewal process, which started in April 2023. Additionally, we identified instances in which staff members and TEDS did not calculate the household income correctly, income was not verified, or the individual was over the income limit. Noncompliance With CMS Guidelines and Eligibility Process Deficiencies To determine whether management made capitation payments on behalf of eligible CoverKids members, we tested a random, nonstatistical sample of 60 capitation payments made between July 1, 2022, and June 30, 2023, totaling $14,387. The sample was selected from a population of 491,621 capitation payments totaling $114,412,773. From our capitation sample, we identified questioned costs of $1,591 in federal and $382 in state. We expanded our review of the members’ benefits and identified additional known questioned costs of $22,109 in federal and $5,419 in state related to capitation payments and claims payments during the period of ineligibility. Based on our review, for 12 of 60 payments tested (20%), eligibility caseworkers and TEDS did not verify the members’ eligibility. • For 9 of the 12, TEDS did not terminate coverage for pregnant women members’ after their postpartum period ended. According to management, these issues occurred in part due to the division’s misunderstanding of the Centers for Medicare and Medicaid Services (CMS) guidelines. Also, management did not communicate a request to its system vendor to remove this category from the monthly unwinding renewal process, allowing the members to keep benefits until they completed the renewal process. As a result of these nine errors, we identified $17,928 in federal questioned costs and an additional $4,401 in state questioned costs. CMS published guidance through a January 6, 2021, Frequently Asked Questions (FAQ) for the Family First Coronavirus Response Act. This FAQ clarified that agencies should terminate CoverKids coverage for members who qualified for the program due to their pregnancy status at the conclusion of their postpartum period, provided they do not qualify for another program. • For 2 of the 12, the member was over the income for CoverKids benefits or their income was not verified. According to management, these issues occurred due to a caseworker not verifying the income. As a result of these two errors, we identified $5,772 in federal questioned costs and an additional $1,400 in state questioned costs. Title 42, Code of Federal Regulations, Part 457, Section 380(d), “Eligibility verification,” instructs that if a state “does not accept self-attestation of income, the State must verify the income of an individual by using the data sources and following standards and procedures for verification of financial eligibility. . . .” According to the division’s Policy 200.035, “Verification,” the division must verify and document all of the member’s financial and non-financial information. • For 1 of the 12, the member showed no household income reported; however, the individual was approved for CoverKids benefits instead of properly approved for the Medicaid program. According to management, this error occurred due to a system issue involving the income record. There were no questioned costs related to this error since the individual was still eligible for benefits; however, due to the other system issues we identified through our audit, we are including this system error description so that management is aware of all the system issues which should be addressed. Section 1200-13-13-.02 of the Rules of the Tennessee Department Finance and Administration Bureau of TennCare, “TennCare Medicaid,” requires enrollees to meet all technical and financial requirements applicable to their category of medical assistance. Noncompliance With CMS Guidelines and Renewal Process Deficiencies To determine whether management conducted and documented CoverKids renewals appropriately, we tested a random, nonstatistical sample of 60 renewals occurring between April 1, 2023, and June 30, 2023. The sample was selected from a population of 5,134 renewal packets that were sent to CoverKids members. Based on our review, for 2 of 60 renewals tested (3%), we determined that division staff or TEDS did not terminate or renew the members eligibility correctly. Specifically, • For 1 of the 2, TEDS did not terminate coverage for a pregnant woman after their postpartum period ended. According to management, the member never responded to their pre-termination notice, and coverage was scheduled to end on June 13, 2023. Management stated that on June 29, 2023, a data fix was implemented to reinstate her benefits because the coverage was terminated prior to the pre-termination due date. Ultimately, management did not communicate a request to its system vendor to remove this category from the monthly unwinding renewal process, allowing the member to keep benefits until the renewal process was complete. As a result of this error, we identified $376 in federal questioned costs and an additional $95 in state questioned costs. • For the remaining error, the individual was approved for continued benefits without division staff or TEDS verifying the household income. According to management, this error occurred due to a system issue in TEDS that prevented interfaces from running to verify the income. As a result of this error, we identified $1,218 in federal questioned costs and an additional $309 in state questioned costs. For these 2 errors, the division’s Policy 200.035, “Verification,” identifies that the division must verify and document all of the member’s financial and non-financial information. In total, we questioned the costs associated with these eligibility and renewal process deficiencies totaling $31,499 ($25,294 of which were federal and $6,205 of which were state questioned costs). Risk Assessment We reviewed the Division of TennCare’s December 2022 Financial Integrity Act Risk Assessment and determined that management listed the risk of an eligibility caseworker or TEDS performing inaccurate eligibility determinations for which they designed appropriate controls; however, the controls as designed were not effective to prevent or identify the noncompliance errors we found. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, “Identify, Analyze, and Respond to Risks,” 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When division staff and TEDS do not process CoverKids eligibility determinations, renewals, and terminations correctly, the division increases the risk of keeping ineligible individuals on its membership rolls, thereby allowing them to receive CoverKids benefits to which they are not entitled, resulting in costs not allowable under the federal Children’s Health Insurance Program. Additionally, federal regulations address actions that the U.S. Department of Health and Human Services (HHS) may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 45 CFR 75.207(b), “Specific award conditions,” These additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 45 CFR 75.371, “Remedies for noncompliance,” outlines additional actions HHS may take. Depending on the circumstances, these actions may include • withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the award, • initiating suspension or debarment, • withholding awards, or • pursuing other legal remedies. RECOMMENDATION The Deputy Commissioner should ensure that the Assistant Commissioner works with the TEDS contractor to verify that all system changes are operating to align with the program’s rules and regulations. In addition, the Assistant Commissioner should ensure that eligibility caseworkers are fully trained so that they understand their responsibilities relating to CHIP eligibility and renewals and can properly determine if members are eligible for CoverKids benefits. Furthermore, the division should determine any additional unallowable payments made on behalf of members whose postpartum eligibility period has ended. Management should evaluate the effectiveness of control activities for the risks identified in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT TennCare agrees that a portion of CoverKids members who reached the end of the postpartum period were not terminated as quickly as they could have been. Each issue identified by the auditors will be addressed below. For 9 of the 12, TEDS did not terminate coverage for pregnant women members’ after their postpartum period ended. TennCare concurs. Some CoverKids pregnant women did not begin the eligibility review and potential termination process immediately upon the end of their postpartum period in error. Instead, they were queued for the Unwinding renewal process to ensure a full review would be completed prior to loss of benefits. As noted during the previous audit, during the Public Health Emergency TennCare misinterpreted CMS guidance to require states to continue eligibility for this population until the formal Unwinding renewals began in 2023. Although that understanding was corrected in early 2023 and TennCare began taking steps to close coverage for many CoverKids women whose eligibility continued to remain open in February and March 2023, during the massive undertaking of restarting renewals after a three-year pause, TennCare staff failed to communicate a change order to its system vendor to remove this category from the monthly Unwinding renewal process. The impact was that coverage remained open pending the outcome of the renewal if both the change termination process and the renewal process occurred simultaneously. TennCare has now implemented a change to the Unwinding process to remove CoverKids pregnant women from the formal renewal process. For 2 of the 12, the member was over the income for CoverKids benefits or their income was not verified. TennCare concurs. Targeted coaching has been completed with the staff who incorrectly processed these cases. For 1 of the 12, the member showed no household income reported; however, the individual was approved for CoverKids benefits instead of properly approved for the Medicaid program. TennCare concurs. The system was updated in April 2022 to prevent this issue moving forward. A query was performed to identify similar cases and none were found. For 1 of the 2, TEDS did not terminate coverage for a pregnant woman after their postpartum period ended. TennCare concurs. The reason why the coverage remained open after the pre-termination notice was not returned was initially due to a defect and the need to reinstate to provide proper due process. Ultimately, however, the member was scheduled for a future renewal, as discussed in the issue with the 9 cases above. For the remaining error, the individual was approved for continued benefits without division staff or TEDS verifying the household income. TennCare concurs. The issue was corrected in April 2023. TennCare will continue its extensive training for eligibility staff. The previously described monthly case reading process will also continue with a special focus on entry and processing of income data.

Finding Number 2023-024 CFDA Number 21.027 Program Name Coronavirus State and Local Fiscal Recovery Funds Federal Agency Department of the Treasury State Agency Department of Economic and Community Development  Federal Award Identification Number SLFRP5534 Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Economic and Community Development management did not ensure that subrecipient contracts contained all the required subaward information at the time of the subaward BACKGROUND The American Rescue Plan Act of 2021 established the Coronavirus State and Local Fiscal Recovery Funds (the Fund) to provide state, local, and tribal governments with the resources needed to respond to the pandemic and its economic effects and to build a stronger, more equitable economy during the recovery. The U.S. Department of the Treasury issued an interim final rule implementing the Fund’s program on May 10, 2021, and has since disbursed over $240 billion to state, local, and tribal governments and received over 1,500 public comments on the interim final rule. Tennessee has received $3.7 billion from the Fund. State agencies submitted proposals to state leadership through the Governor’s Financial Stimulus Accountability Group (FSAG),(41) which issued the Tennessee Resiliency Plan to summarize selected projects. (41) On April 16, 2020, the Governor created the FSAG to aid in the proper fiscal management of stimulus funds. The FSAG allocated $500 million to the Department of Economic and Community Development (the department) to continue its work on the Tennessee Emergency Broadband Fund. The purpose of this fund is to provide non-recurring funding to internet service providers (subrecipients) to facilitate broadband access to all Tennesseans and promote programs that encourage broadband adoption and use. CONDITION AND CRITERIA In awarding these federal funds to subrecipients, the department was required by “Requirements for pass-through entities,” Title 2, Code of Federal Regulations (CFR), Part 200, Section 332, to include specific award information to subrecipients at the time of the award. This information includes (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient’s unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date . . . of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D [Research and Development]; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged). As required by the Department of Finance and Administration, the department attested to its responsibilities to comply with pass-through entity requirements stated in 2 CFR 200.332. Department management informed us that the required information is listed in the Federal Award Identification Worksheet, Attachment B of each subrecipient’s contract. Of 65 total executed contracts with subrecipients between July 1, 2022, and September 30, 2023, we tested a sample of 25 subrecipient contracts. We found that for all contracts tested (100%), the department did not inform the subrecipients of the following required information: • the Federal Award Identification Number (iii); • the date of the federal award (iv); and • the amount of federal funding obligated to the subrecipient by the pass-through entity (viii). We also found that, in 5 of the 25 contracts (20%), the department listed the incorrect unique entity identifier (ii). The unique entity identifiers did belong to other subrecipients of the Emergency Broadband Fund, but they were not the correct identifiers for these 5 subrecipients. CAUSE According to our discussions with department management, a former employee was responsible for entering the required federal award information into the subrecipient contracts. This employee entered the information available to them at the time; however, apparently because they lacked some of the federal information, they omitted required information at the time of the subaward. Management believed that all required information was already included because they were using the Central Procurement Office(42) contract template; therefore, management did not perform a subsequent review. (42) The Central Procurement Office is responsible for managing centralized procurement of goods and services for use by state departments and agencies and is responsible for vendor relations and contract management. EFFECT Management’s inability to include the required grant award information at the time of the subaward increases the risk that the subrecipients may not possess all pertinent federal award information to achieve compliance with all federal grant requirements. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: • Requiring payments as reimbursements rather than advance payments; • Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; • Requiring additional, detailed financial reports; • Requiring additional project monitoring; • Requiring the non-Federal entity to obtain technical or management assistance; or • Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner should ensure that management is aware of the requirements listed in 2 CFR 200.332. Management and staff should properly communicate federal award information when making subawards to subrecipients. Additionally, the Commissioner should ensure management designs and implements internal controls around such communication. MANAGEMENT’S COMMENT We concur with the finding. Title 2, Code of Federal Regulations, Section 200.332 (a) says that subaward identification “includes the following information at the time of subaward” and furthermore “when some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward at the time of the award.” As mentioned above, staff completed the provided Central Procurement Office (CPO) template with the information and guidance available at the time. The template provided has since been updated by CPO and no longer refers to DUNS and CFDA numbers, which are now defunct identifiers. Since the execution of these contracts, the broadband team has grown to include seven full-time employees and an outside contractor to assist with the workload to help us better address grants management going forward. Now that all information is available, management has a plan to both update/alert current subrecipients with missing or dated information and to prevent this finding from recurring. First, management is updating the information on the federal award identification worksheet and will provide an updated form to all current subrecipients in compliance with guidance from CPO. CPO guidance from contract template: Option: Federal Award Identification Worksheet If the Grantee is a subrecipient and the Grant Agreement involves any federal funds, the Grantor State Agency must complete the federal award identification worksheet on the following page and reference the worksheet by adding the following section. Include the worksheet as an attachment to the Grant Agreement. If some federal award identification worksheet information is not available, provide as much information as is available. Grantor State Agencies should update the worksheet no more than once every six (6) months to reflect any changes. Grantor State Agencies should also send the updated worksheet to the Grantee and upload a copy into Edison. Second, TNECD uses a standard contracting template spreadsheet to develop contracts. Prior to the TEBF-ARP contracts, the items for the FAIN were not included as a part of our spreadsheet. As a result of this finding, management has worked with our legal and contracting team and CPO to ensure each of these line items is added as a column on the spreadsheet. This will streamline the inclusion of this information. Furthermore, the two primary grants managers on the broadband team have completed three Management Concept courses covering Grants Management for Pass Through Entities (PTEs), with plans to complete more in pursuit of a certification. This ensures that relevant staff are receiving extensive training on compliance with federal funds.

Finding Number 2023-025 Assistance Listing Number 15.605, 15.611, and 15.626 Program Name Fish and Wildlife Cluster Federal Agency Department of the Interior State Agency Tennessee Wildlife Resources Agency Federal Award Identification Number F16AF00250, F16AF00736, F17AF00625, F18AF00534, TNW-F18AF00054, F19AF00465, F19AF00527, F19AF00545, F19AF01174, F19AF01175, F19AF01176, F19AF01177, F20AF00301, F21AF00850, F21AF01215, F21AF02151, F21AF03909, F22AF00573, F22AF02144, and F23AF00751 Federal Award Year 2016 through 2023 Finding Type Material Weakness and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding 2022-014 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior audit, Tennessee Wildlife Resources Agency management did not perform required subrecipient monitoring and did not obtain and review subrecipients’ Single Audits BACKGROUND The Tennessee Wildlife Resources Agency (TWRA) administers the Fish and Wildlife cluster of programs, which are federal programs under the oversight of the U.S. Fish and Wildlife Service. The Fish and Wildlife Cluster includes the following programs: • The Sport Fish Restoration program provides funds to restore, conserve, and enhance sport fish populations and to provide for public use and enjoyment of these fishery resources. • The Wildlife Restoration program provides funds to restore, rehabilitate, and improve wildlife populations and their habitats; to conduct wildlife management research, and wildlife population surveys and inventories; to acquire land; and to provide for public use of wildlife resources. • The Basic Hunter Education program provides training to hunters in the safe handling and use of firearms and archery equipment; hunter responsibilities and ethics; survival; construction, operation, and maintenance of public shooting ranges; and basic wildlife management and identification. • The Enhanced Hunter Education and Safety program provides funds to enhance programs for hunter education, recruitment, and safety; to increase interstate coordination of hunter education programs; to enhance programs for bow hunters and archers; to enhance construction and development of firearm and archery ranges; and to update safety features of firearm and archery ranges. For fiscal year 2023, TWRA awarded a total of $3,183,825 in federal funds to 14 subrecipients, such as nonprofit foundations and universities, to carry out the activities of the Fish and Wildlife Cluster programs. PRIOR AUDIT RESULTS In the prior audit, we reported that management did not perform subrecipient monitoring and did not obtain and review subrecipients’ Single Audit reports. We also reported that TWRA management’s December 2021 Financial Integrity Act Risk Assessment did not identify risks related to the failure to perform subrecipient monitoring activities and the failure to obtain and review subrecipients’ Single Audit reports and, as such, did not identify control activities to mitigate these risks and ensure compliance with federal requirements. TWRA management concurred with the finding and stated that the agency did not perform subrecipient monitoring and did not obtain and review subrecipients’ Single Audit reports due to a lack of staff. TWRA management stated they would create a program monitoring guide and update the current risk assessment by July 31, 2023. In the agency’s six-month follow-up report of corrective action, dated September 21, 2023, management stated they updated the risk assessment in relation to the subrecipient monitoring finding and updated the related policy; however, management did not implement the updated policy because they were considering contracting with an outside agency for assistance with grants management. To improve compliance with grant requirements, management created a new training presentation for all agency staff who manage grants. Additionally, the Executive Director approved a new position to serve as a grant monitor, but the agency has not filled the position as of November 29, 2023. CONDITION, CRITERIA, AND CAUSE To obtain an understanding of TWRA management’s subrecipient monitoring procedures, we met with management, and based on our discussions, we determined that for fiscal year ended June 30, 2023, management still did not • perform subrecipient monitoring as required by Title 2, Code of Federal Regulations (CFR), Part 200, Section 332(d); and • obtain and review subrecipients’ Single Audit reports and issue management decisions on findings as required by 2 CFR 200.332. According to 2 CFR 200.332(d), management must Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. As the pass-through entity, TWRA is required by 2 CFR 200.332 to verify that all subrecipients that spend $750,000 or more obtain a Single Audit within nine months after the subrecipient’s fiscal year-end. When the subrecipient’s Single Audit includes audit findings, TWRA must issue a management decision within six months of the audit report’s release, indicate if the subrecipient agency agreed with the finding, and describe any corrective action the subrecipient must take. TWRA management stated that they did not monitor any subrecipients and did not obtain and review subrecipients’ Single Audit reports because of a lack of staff. Management also stated that in response to the prior audit finding, they developed procedures for subrecipient monitoring; however, they have not put these procedures into practice. Management created a subrecipient risk assessment monitoring document in June 2023 as a part of the procedures developed to document risks noted as they monitor subrecipients but have not started using this form. The Chief of Real Estate and Federal Aid stated that they were waiting to hire an internal audit director who would be the one to monitor the subrecipients using this form. Risk Assessment We reviewed TWRA’s 2022 Financial Integrity Act Risk Assessment and noted that management identified risks associated with the lack of subrecipient monitoring and with the failure to review subrecipient Single Audit reports, but management failed to implement controls to mitigate these risks. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 10.02, “Response to Objectives and Risks,” Management designs control activities in response to the entity’s objectives and risks to achieve an effective internal control system. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives to achieve the entity’s objectives and address related risks. EFFECT When TWRA management does not follow federal requirements to perform subrecipient monitoring, management cannot ensure subrecipients have reasonably complied with federal statutes, regulations, and terms and conditions of the grant award. Also, when management does not obtain and review subrecipients’ Single Audit results as required by federal regulations, including Single Audit findings, management increases the risk that it will not promptly identify subrecipients’ noncompliance and control deficiencies so that corrective action can be achieved. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” these actions may include • requiring payments as reimbursements rather than advance payments; • withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; • requiring additional, more detailed financial reports; • requiring additional project monitoring; • requiring the non-federal entity to obtain technical or management assistance; or • establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • withholding further awards for the project or program, or • pursuing other available legal remedies. RECOMMENDATION The Executive Director should ensure management and staff comply with federal regulations and requirements related to subrecipient monitoring and should ensure management implements policies and procedures to guide agency staff tasked to perform subrecipient monitoring activities. Management should take prompt action to initiate monitoring activities to identify areas of subrecipient noncompliance and follow up on required corrective action as needed. Management should also ensure key personnel are aware of all required monitoring responsibilities, including reviewing subrecipients’ Single Audit reports, issuing management decisions, and obtaining subrecipient corrective action plans when necessary. Management should implement effective controls to address the risks noted in this finding and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT We concur. The Tennessee Wildlife Resources Agency continues to progress toward full implementation of our sub-recipient monitoring process. Several key elements of the process have been implemented to date. First, we have developed the Federal Aid Procedures Manual. Included in the manual are chapters on Sub-recipient Monitoring and Procedures and a subrecipient risk assessment process, complete with risk assessment templates. Second, we have assigned responsibility for the process with the TWRA Project Manager, Tennessee Finance and Administration Controller for TWRA, and the TWRA Federal Aid and Real Estate Division jointly responsible for monitoring of each Federal subaward throughout the life of the award. Lastly, our staff have attended training and are now required to attend annual update trainings. Direct subrecipient monitoring activities will be split between the TWRA Federal Aid and Real Estate Division and the TWRA Project Manager. The TWRA Federal Aid and Real Estate Division, with the assistance of the Grant Monitor, is responsible for macro‐ (institutional) level monitoring processes while the TWRA Project Manager is responsible for micro‐ (project) level monitoring. Macro-level monitoring processes include advising the subrecipient of requirements imposed on them by federal laws, regulations, and the provisions of the subaward agreement; review of the single audit as required; and conducting periodic spot checks of reports to ensure the award is being carried out according to the terms and conditions of the agreement. Micro‐level monitoring, conducted by the Project Manager, should involve regular (at semi‐annual) communication between TWRA and the subrecipient organization to ensure the project is being carried out as proposed and according to schedule. Of note, our recent Office of Inspector General (OIG) audit of U.S. Fish and Wildlife Service Grants resulted in a similar finding. During that audit, the OIG “reviewed the (sub-recipient monitoring) procedures and found them to be adequate” and acknowledged that the process was being implemented, albeit outside of the timing of their audit. We anticipate full implementation of this process by June 30, 2024.

Finding Number 2023-026 Assistance Listing Number 10.568 and 10.569 Program Name Food Distribution Cluster Federal Agency Department of Agriculture State Agency Department of Agriculture Federal Award Identification Number 225TN813P1103, 225TN817Y8105, and 235TN817Y8105 Federal Award Year 2022 and 2023 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Subrecipient Monitoring Special Tests and Provisions Repeat Finding 2022-013 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the two prior audits, the Tennessee Department of Agriculture did not have internal controls over household eligibility determinations and annual inventory counts at storage locations for the Emergency Food Assistance Program BACKGROUND The Department of Agriculture (the department), in partnership with the U.S. Department of Agriculture (USDA) and local organizations, operates the Emergency Food Assistance Program (food program) to provide low-income households emergency food assistance. USDA purchases a variety of food items and makes them available to state distributing agencies. On behalf of the department, subrecipients on contract with the department administer the program in compliance with the grant award. The department places food orders with USDA on behalf of the subrecipients, and USDA delivers the food directly to the subrecipients’ warehouses. The subrecipients must manage the inventory in their warehouses by tracking food receipts and food distributions, performing a physical food inventory count at least annually, and documenting adjustments to food inventory records, such as losses due to spoilage. Also, the subrecipients determine whether applicants meet income requirements and are residents of the state of Tennessee, and they provide food to households deemed eligible. The department reimburses the subrecipients for administrative costs, such as payroll costs associated with operating the food program. During our audit period, the department contracted with 22 subrecipients for the purpose of administering the program. PRIOR AUDIT RESULTS In the 2021 Single Audit, we noted that management did not have controls in place for household eligibility determinations and food inventory. In prior years, the department performed on-site subrecipient reviews to determine if subrecipients were accurately determining household eligibility and managing the inventory according to federal requirements. According to management, they stopped performing the on-site reviews in March 2020 because of the COVID-19 pandemic. Management concurred with the prior finding and stated the following: The department will establish control activities (review process) to ensure and document subrecipient compliance with inventory and eligibility requirements. If deficiencies are disclosed, the department will submit a report of findings to the subrecipient and ensure corrective action is taken. . . . Monitoring activity will transition to a desk audit format with virtual visits incorporated as needed to maximize safety protocols and minimize disruption of the monitoring schedule due to public health or other emergency situations. If deficiencies are disclosed, the department will submit a report of findings to the subrecipient and ensure corrective action is taken. The commodity administrator will be responsible for monitoring risks and assessing controls. During the 2022 Single Audit, management explained in their six-month follow-up for the 2021 audit finding “that upon approval by the USDA Southeast Regional Office, management will conduct desk audit reviews of all 22 eligible recipient agencies (ERAs) during Federal Fiscal Year 2023. In November 2022, the UDSA approved the department’s plan to begin reviews of subrecipients.” Because the department was waiting for USDA to approve the department’s plan, it did not monitor its subrecipients, resulting in a repeat finding in the 2022 Single Audit. Department management still did not have controls in place for household eligibility determinations and food inventory. Additionally, the 2022 Single Audit identified subrecipient noncompliance related to nonperformance of annual inventory counts and inaccurate inventory records at three of the four sites visited. Management concurred and stated it would implement the USDA-approved monitoring plan in April 2023 and complete the monitoring by September 2023 to coincide with the end of the federal fiscal year. However, in management’s six-month follow-up for the 2022 audit finding, the department’s plan to conduct desk audit reviews of all 22 ERAs during federal fiscal year 2023 was delayed with a new completion date of December 15, 2023. After completing the initial desk reviews, the department will move to a 4-year cycle where they will examine 25% of all ERAs and will ensure that no subrecipient goes 4 years without a review. The department will also review the lesser of one-tenth or 20 subrecipients that receive food pursuant to an agreement with another ERA, using a risk-based and random sampling approach. CONDITION AND CAUSE Inventory Management and Household Eligibility As noted in the prior audit finding, department management did not implement monitoring controls to ensure compliance with the food program’s inventory and eligibility requirements. Based on our discussions with department management, during fiscal year ended June 30, 2023, management had neither resumed their previous control activity of on-site reviews nor implemented other control activities to ensure subrecipients reasonably complied with the federal regulations. In the absence of management controls, we performed compliance testwork to determine whether three subrecipients complied with federal regulations for inventory records and household eligibility determinations. Based on our compliance testwork and discussions with department and subrecipient management, we found that two of the subrecipients had not maintained accurate food commodity inventory records, and one did not perform the annual inventory as required. Inaccurate Inventory Records At two of the three subrecipients we visited, we noted inaccurate food records and inaccurate food distribution counts. We performed very limited counts and still noted discrepancies: • During our inventory count for 1 subrecipient, we expected to find only 56 pouches of chili, but we found the subrecipient had 220 pouches of chili in stock. • During our review of 1 subrecipient’s records to support accurate reporting of distributed items, we noted a significant difference in the number of items reported on the October 2022 and January 2023 monthly inventory reports submitted to the Department of Agriculture. The documentation provided to show the number of items distributed failed to match the monthly inventory reports for all 10 items randomly selected for testing. The range in discrepancies varied from underreporting 12,360 items to overreporting 5,616 items. Based on the documentation provided by the subrecipient, we were unable to support that the agency accurately reported the number of items distributed on the monthly inventory reports. Annual Inventory Not Performed Regarding the subrecipient that did not perform the required annual inventory, we had previously identified this same subrecipient in the prior audit for failing to conduct the inventory count, and we determined through our current testwork that management has not ensured corrective action during the current audit. Specifically, according to subrecipient management and their food distributor,(43) this subrecipient (along with four other subrecipients under the same food distributor also reported in the prior audit) still did not conduct an annual inventory count or request tracking documents, such as bills of lading, receipts for received food, or documents showing food distributed, and relied solely on the information provided by the distributor. (43) A food distributor stores the subrecipient’s food items until the subrecipient requests the distributor to deliver the food items to locations and in the quantities directed by the subrecipient. Risk Assessment We reviewed the Department of Agriculture’s 2022 Financial Integrity Act Risk Assessment for department operations and determined that management did not identify the risk of the department’s or their subrecipients’ noncompliance with federal inventory and eligibility requirements and, as such, did not identify or implement control activities to ensure compliance with these requirements. CRITERIA Inventory Management and Household Eligibility According to Title 2, Code of Federal Regulations, Part 200, Section 303(a), a non-federal agency must Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, according to Title 7, CFR, Part 251, Section 10(e), (1) Each State agency must monitor the operation of the program to ensure that it is being administered in accordance with Federal and State requirements. State agencies may not delegate this responsibility. . . . (3) Each [subrecipient monitoring] review must encompass, as applicable, eligibility determinations, food ordering procedures, storage and warehousing practices, inventory controls, approval of distribution sites, reporting and recordkeeping requirements, and civil rights. According to Title 7, CFR, Part 250, Section 12(b), “Inventory Management,” On an annual basis, the distributing agency must conduct a physical review of donated food inventories at all storage facilities used by the distributing agency (or by a subdistributing agency) and must reconcile physical and book inventories of donated foods. According to the department’s The Emergency Food Assistance Program Manual for subrecipients, Required Records: Each RA [Recipient Agency] or other entity which has an agreement with the RA is required to keep accurate and complete records associated with the receipt, storage, distribution, disposal, and inventory of TEFAP [the Emergency Food Assistance Program] foods as well as any funding received under the TDA [Tennessee Department of Agriculture] grant contract. Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Additionally, Principle 9.04, “Analysis of and Response to Change,” states As part of risk assessment or a similar process, management analyzes and responds to identified changes and related risks in order to maintain an effective internal control system. Changes in conditions affecting the entity and its environment often require changes to the entity’s internal control system, as existing controls may not be effective for meeting objectives or addressing risks under changed conditions. Management analyzes the effect of identified changes on the internal control system and responds by revising the internal control system on a timely basis, when necessary, to maintain its effectiveness. EFFECT The lack of sufficient monitoring controls over inventory management and household eligibility determinations increases the risk of noncompliance with federal requirements and fraud, waste, and abuse in this federal program. Without sufficient monitoring, department management cannot reasonably ensure that subrecipients fulfill federal requirements and meet the goals of this federal program. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR, Part 200, Section 208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, Title 2, CFR, Part 200, Section 339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of the Department of Agriculture should ensure staff members have the resources to establish internal controls to ensure staff and subrecipients comply with inventory and eligibility requirements. Management should take prompt action to implement the USDA-approved monitoring plan to identify areas of subrecipient noncompliance and follow up on required corrective action as needed. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT We concur. To ensure and document effective internal controls, the department has implemented the USDA-approved monitoring plan to identify areas of subrecipient noncompliance and will follow up on required corrective action as needed. The approved monitoring plan establishes controls to address the risks noted in the finding. Although delayed per our response to the 2022 single audit, the department has now completed desk audit reviews of all 22 subrecipients, which will serve as a baseline for subsequent years’ reviews. Each subrecipient completed a self-assessment document, which has been used to identify areas where technical assistance is needed and which will be used for comparison as the department conducts future monitoring activities following the USDA-prescribed four-year review cycle. Additionally, the following was added to the 2023 Departmental Risk Assessment (Form 3): Risk: TEFAP subrecipients are not monitored in accordance with USDA inventory and eligibility requirements. Controls: 1. The Administration and Grants Division ensures the TEFAP monitoring plan filed with the CPO meets all current USDA requirements for a state monitoring system. (Annually) 2. The monitoring plan is monitored internally to ensure the monitoring plan is completed within the timeline. (Regularly throughout the year.) The commodity administrator will be responsible for monitoring risks and assessing controls.

Finding Number 2023-027 Assistance Listing Number 97.036 Program Name Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Agency Department of Homeland Security State Agency Department of Military Federal Award Identification Number FEMA-4427-DR, FEMA-4476-DR, FEMA-4514-DR, FEMA-4541-DR, FEMA-4550-DR, FEMA-4594-DR, FEMA-4601-DR, and FEMA-4609-DR Federal Award Year2019 through 2021 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Military does not have adequate procedures for subrecipient monitoring, resulting in noncompliance BACKGROUND The Federal Emergency Management Agency (FEMA), which is part of the Department of Homeland Security, provides grant funding to the Tennessee Emergency Management Agency (TEMA) within the Tennessee Department of Military (Military) to help TEMA fulfill its mission “to coordinate preparedness, response, and recovery from man-made, natural, and technological hazards in a professional and efficient manner in concert with our stakeholders.” When a disaster occurs, Military (the recipient) obtains a prime award with FEMA. Using this award, applicants (for example, counties, cities, and nonprofits) apply directly with FEMA to obtain approval for projects supporting the disaster. Military or another state agency may also be an applicant in situations where Military or the state agency uses its own staff and resources to perform project activities. After reviewing the request, FEMA approves the applicant for the requested project. Once FEMA approves the project, Military then develops and obtains an agreement with the applicant. After the agreement between Military and the applicant is in place, applicants bill Military for allowable costs incurred. Military then pays the applicant and ultimately bills FEMA for the costs paid for all approved projects. Applicants other than Military or other state agencies are considered subrecipients of the awards. As such, FEMA requires Military to perform subrecipient monitoring procedures. As part of the subrecipient monitoring, Military is required to ensure subrecipients submit single audits to the Federal Audit Clearinghouse (FAC) within either 30 calendar days after receiving the reports or 9 months after the end of the subrecipient’s year-end, whichever is earlier. If the subrecipient’s single audit includes a finding for the subaward, Military then has 6 months to issue a management decision to the subrecipient. To comply with these requirements, Military must have sound procedures to routinely search for single audits, identify and document subrecipients who should and should not receive an audit, and follow up with subrecipients when audits are not submitted timely. During the audit period, staff used a list of all open and executed Military agreements with applicants to create a list of all subrecipients to use as a basis for monitoring audits. Staff then searched for single audits or other audits on the Tennessee Comptroller of the Treasury’s website for each subrecipient included on the list. Staff reviewed the audit results and documented the total federal expenditures reported in the audit on the list. In addition to the audit report monitoring, Military also performs more detailed monitoring, such as reviewing documentation to ensure funds were used for allowable purposes for a portion of the program’s subrecipients. Management selects subrecipients based on a risk assessment. The risk assessment includes several factors, such as subrecipient experience with similar subawards and prior audit results. Management’s review of subrecipient single audit reports is an important part of overall subrecipient monitoring. It allows management to leverage work performed by the subrecipients’ external auditors to help management ensure subawards are used for authorized purposes. CONDITION AND CAUSE From the list of subrecipients with detailed monitoring, we selected a sample of 40 subrecipients to determine if Military had fulfilled its subrecipient monitoring responsibilities. Through our gaining an understanding of the subrecipient monitoring process and our testwork, we determined that Military’s subrecipient monitoring process was not adequate to ensure it met the federal requirements regarding subrecipient single audits. We noted the following six specific internal control weaknesses in Military’s procedures. • Military used an incorrect website to confirm compliance with audit requirements. • Military did not have adequate procedures to determine if a subrecipient was required to have an audit. • Military’s procedures used to identify subrecipients did not identify all subrecipients. • Management does not have a process to perform routine searches for audit reports. • Management could not provide complete documentation of its audit report review. • Management did not adequately document its review of subrecipients included in parent entity single audits. Military Used an Incorrect Website to Confirm Compliance With Audit Requirements Management used the Comptroller’s website to confirm that subrecipients submitted audits, but management should have verified this information on the FAC’s website. While the Comptroller’s website is a tool for gathering information about subrecipients, the federal requirements described in this finding require the subrecipients to submit audit reports to the FAC. Because subrecipients may have an audit on the Comptroller’s website but not on the FAC’s website, Military was unable to determine compliance. Military Did Not Have Adequate Procedures to Determine if a Subrecipient Was Required to Have an Audit Military did not determine if all identified subrecipients on the list of all subrecipients were required to have a single audit. Instead, if staff could not locate a single audit, they did not update the “Date of Audit Monitoring” column. Our testwork revealed that monitoring procedures for 10 of 40 subrecipients (25%) tested were not adequate: • For 7 of the subrecipients tested, the “Date of Audit Monitoring” field was not updated, and there was no evidence that management had determined if the lack of an audit was due to the subrecipient’s failure to obtain an audit or if the subrecipient was not required to have an audit because they did not exceed $750,000 of federal award expenditures. Five subrecipients had blank entries in the “$750K verification” column and the other two had amounts exceeding $750,000, but these amounts were for old single audits. None of the 7 had current audits in the FAC. • For an additional 3 subrecipients tested, the “Date of Audit Monitoring” field included a date for a current period review, but the subrecipient did not have a current audit in the FAC. Since there were no current audits in the FAC, we were not able to determine which audits management reviewed. Additionally, for 2 of the subrecipients, management recorded expenditures exceeding $750,000 in the “$750K verification” column, suggesting that an audit of the subrecipient may be required. Military’s Procedures Used to Identify Subrecipients Did Not Identify All Subrecipients As noted above, an applicant applies for a subaward from FEMA before entering into an agreement with Military, which could be months later. This process may result in an applicant reporting expenses in the fiscal year before the Military agreement is in place. Because Military creates its audit report monitoring list based on its open and executed agreements, not a list of FEMA awards, Military may not recognize all applicants as subrecipients. By searching the FAC for entities in Tennessee with findings pertaining to this program, we found one subrecipient that Military had not identified. FEMA approved the applicant’s award in April 2020, but Military did not have an agreement with the applicant until the following fiscal year in December 2021. We noted two instances of noncompliance because Military did not identify this applicant as a subrecipient: • Military had not issued a management decision on the subrecipient’s audit finding as of October 23, 2023, almost five months late. • FAC did not receive the subrecipient’s June 30, 2021, single audit report until November 28, 2022, almost eight months after the due date. During fieldwork, we became aware of two additional subrecipients not included on the audit report monitoring list. Management could not explain why the two subrecipients were not on the monitoring list. Management Does Not Have a Process to Perform Routine Searches for Audit Reports According to the list of all subrecipients, most of the audit reports were reviewed in April, May, and June, although subrecipients submit reports to the FAC throughout the year. Our testwork revealed that Military did not review two subrecipients’ audit reports timely. One subrecipient’s June 30, 2022, single audit was released to the FAC on October 13, 2022, but Military did not review the report until June 5, 2023. If the audit had contained findings, management would not have been able to issue a management decision within the required timeframe. In the other instance, Military did not ensure that one subrecipient’s June 30, 2021, single audit was submitted timely. The audit report was due on March 31, 2022, but was not released to FAC until November 4, 2022. Management Could Not Provide Complete Documentation of Its Audit Report Review Military either did not document or update the date the audit report was reviewed for 12 of the 40 subrecipients (30%) tested. Since management included total Schedule of Expenditures of Federal Awards amounts that matched the current year’s single audit report on the list, we determined there was evidence that Military completed the audit report monitoring for these subrecipients, but we were not able to ascertain when the review occurred. The Program Monitor did not know why dates were not included or were not updated. Management Did Not Adequately Document Its Review of Subrecipients Included in Parent Entity Single Audits Two of the subrecipients in our sample of 40 were utility departments for a local government. These entities’ activities were included in the local government’s audit instead of a separate audit of the utility department. Military reviewed the audit report for the parent for one of the local governments; however, Military did not review the other local government report. In both instances, management did not document which parent entity’s audit report was reviewed. CRITERIA As the pass-through entity, Military is required by Title 2, Code of Federal Regulations (CFR), Part 200, Section 332(f), to verify that all subrecipients that spend $750,000 or more of federal awards obtain a single audit. According to 2 CFR 200.512(a)(1), the audit must be submitted to the FAC within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. 2 CFR 200.521(d) states that The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. EFFECT When management does not obtain and review subrecipients’ single audit results as required by federal regulations, including single audit findings, the risk increases that management will not promptly identify subrecipients’ noncompliance and control deficiencies so that corrective action can be achieved. When management does not track subrecipients for exceeding the single audit threshold, has procedures that do not identify all subrecipients, or does not perform routine searches of single audits, management is hindered in issuing timely management decisions when necessary and in its ability to timely identify and follow up with subrecipients that fail to submit audits timely. In addition, not updating the date of the audit report review creates questions about whether management completed the audit report monitoring for the subrecipient. For subrecipients included in parent governments’ single audits, not documenting or understanding the inclusion of those subrecipients in larger government single audits increases the risk that management will not become aware of findings related to the subrecipient and will not be able to issue management decisions timely. When staff do not use the FAC to confirm audits are submitted, the risk increases that Military will not timely detect subrecipients that have not submitted to the FAC. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” these actions may include the following: • not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; • requiring additional, more detailed financial reports or additional project monitoring; • requiring the agency to obtain technical or management assistance; or • establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include the following: • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • withholding further awards for the project or program, or • pursuing other available legal remedies. RECOMMENDATION Management should update the process to identify subrecipients to ensure the audit report monitoring list includes all subrecipients for the monitoring cycle. Management should develop a procedure for tracking subrecipients’ expenditures to evaluate whether they exceed the single audit threshold requiring an audit. Additionally, the tracking should include determining the financial relationship between the entities since some applicants are audited as a part of a local government. Management should improve the audit monitoring process by adequately documenting the date a single audit is reviewed. The monitoring should include a search for single audits in the Federal Audit Clearinghouse and a monthly or quarterly search for the released single audits to ensure timeliness in audit releases and any possible management decisions. The monitoring should reference the tracking of subrecipients’ expenditures for identification of the subrecipients who are required to have a single audit. MANAGEMENT’S COMMENT We concur. Our team is developing written procedures for evaluating the website to determine if a single audit is required. These procedures will outline the criteria for conducting the evaluation, the individuals responsible for performing the assessment, and the frequency of the evaluation. Written procedures will include bookmarking the correct website for all future evaluations. Management is researching training capabilities with outside resources to gain more extensive knowledge about the audit criteria requirements and how to evaluate the Federal Audit Clearinghouse website. We will provide training to relevant staff members on the newly established procedures to ensure they understand their roles and responsibilities in evaluating the website for single audit requirements. We will conduct a review of the website in accordance with the new procedures to determine if a single audit is required for the current fiscal year and document the results of this evaluation for audit trail purposes. Program Monitoring management will work with the Tennessee Emergency Management Agency (TEMA) on gaining proper reporting criteria within the Federal award scope versus state agreement elements. In addition, we will work internally to build a parent/child relationship hierarchy for the federal awards to ensure thresholds are properly evaluated. Finally, we will implement a process for regular review and update of the procedures to ensure they remain relevant and effective in identifying the need for a single audit. We are committed to improving our internal controls and procedures to ensure compliance with audit requirements.

Finding Number 2023-028 Assistance Listing Number 84.007, 84.033, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency University of Tennessee Federal Award Identification Number 23P007A223937, P033A223937, P063P222250, and P268K23250 Federal Award Year 2022 and 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The university’s Knoxville campus did not perform a risk assessment for its information security program as required by the Gramm-Leach-Bliley Act CONDITION AND CAUSE The Standards for Safeguarding Customer Information, established by the Gramm-Leach-Bliley Act (GLBA), requires institutions to safeguard sensitive data, which includes information obtained in support of the administration of the federal financial assistance programs. While management at the university’s Knoxville campus has taken steps to comply with the GLBA, management did not conduct a written risk assessment to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of students’ information, as required by GLBA. Campus management has purchased a risk assessment software solution, and they plan to complete a written risk assessment in early 2024. Because the current Chief Information Security Officer began employment subsequent to the audit period, he was unable to determine why former leadership did not conduct this risk assessment. CRITERIA According to the “Standards for Safeguarding Customer Information,” Title 16, Code of Federal Regulations, Part 314, Section 3(a), “you shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts.” Additionally, according to 16 CFR 314.4(b), the institution must Base your information security program on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks. (1) The risk assessment shall be written and shall include: (i) Criteria for the evaluation and categorization of identified security risks or threats you face; (ii) Criteria for the assessment of the confidentiality, integrity, and availability of your information systems and customer information, including the adequacy of the existing controls in the context of the identified risks or threats you face; and (iii) Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the information security program will address the risks. (2) You shall periodically perform additional risk assessments that reexamine the reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and reassess the sufficiency of any safeguards in place to control these risks. EFFECT Not performing a risk assessment for its information security program as required by the GLBA increases the risk that the campus’s information technology safeguards may not align with the risks the campus faces. As a result, students’ financial information could be more susceptible to unauthorized disclosure, misuse, alteration, destruction, or other compromise. Risk assessments are essential to designing and implementing appropriate safeguards that address internal and external threats to the campus’s information technology resources. RECOMMENDATION Management should develop, implement, and maintain a comprehensive information security program based on a documented risk assessment. The risk assessment should identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of student information, as required by the Gramm-Leach-Bliley Act. MANAGEMENT’S COMMENT Management concurs that the Knoxville campus did not perform a formal written risk assessment of the controls related to financial aid systems, as required by the Gramm-Leach-Bliley Act. As noted in the audit finding, management at the Knoxville campus has taken significant steps to comply with the GLBA. Additionally, Knoxville campus management performed a non-documented risk assessment which complied with GLBA.

Finding Number 2023-029 Assistance Listing Number 84.063 and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency University of Tennessee Federal Award Identification Number P063P222250 and P268K23250 Federal Award Year 2022 and 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Eligibility Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.063 Federal Award Identification Number P063P222250 Amount $4,821 Assistance Listing Number 84.268 Federal Award Identification Number P268K23250 Amount $136,014 FINDING The University of Tennessee – Knoxville Office of Financial Aid and Scholarships did not adequately monitor the eligibility of Title IV financial aid recipients BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending eligible institutions of postsecondary education. The programs include assistance such as Pell Grants, Direct Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. Each school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. Some of the responsibilities of the school are to determine student eligibility, verify data for students selected for verification by the Secretary, and ensure maximum assistance amounts established by ED are not exceeded individually or as part of the total aid package. Title 34, Code of Federal Regulations (CFR), Part 668, Section 164(b)(3), states, “At the time a disbursement is made to a student for a payment period, an institution must confirm that the student is eligible for the type and amount of Title IV, HEA program funds identified by that disbursement.” Students must also meet certain requirements, such as certain income levels and maintaining a certain grade point average, to be eligible for Title IV assistance. CONDITION, CAUSE, AND CRITERIA The University of Tennessee’s Office of Financial Aid and Scholarships did not adequately monitor the eligibility of Title IV financial aid recipients. We reviewed the entire population of 14,260 students enrolled at The University of Tennessee – Knoxville who received Title IV student financial assistance during the 2022–2023 award year. Of the 14,260 students, 17 students (0.12%) received excess financial aid based on their eligibility, resulting in overpayments totaling $140,835. • The university provided Title IV funding to 5 students enrolled in ineligible programs. Three of the 5 students had completed 60 hours in an eligible non-degree-seeking program and had not transferred to a degree-seeking or other eligible program. The remaining 2 students did not complete the required “non-degree” appeal form in order to receive Title IV funds while enrolled in an Advanced Transition program. According to management, students are allowed to be enrolled in a University Early Transition program up to 60 hours before being required to declare a major. If the student reaches 60 hours before declaring a major, that student is moved to the Advanced Transition program and is no longer eligible for Title IV funds. These errors occurred because the university had not configured its Banner system to verify the number of completed hours before payment, and management did not properly monitor the students’ accounts. Additionally, the Advanced Transition program for the remaining 2 students does not qualify for Title IV funds without a “non-degree” waiver in place. Financial aid staff instructed students to complete the form, but staff did not verify that students completed the form before awarding funds. Therefore, staff incorrectly awarded the following funds: See Schedule of Findings and Questioned Costs for table. • The university awarded Subsidized Direct Loans and Unsubsidized Direct Loans to five ineligible students because management incorrectly classified their grade levels in the Banner system. 34 CFR 668.203 sets the annual Direct Loan limits based on the student’s dependency status and grade level. Volume 3, Chapter 5, of the Federal Student Aid Handbook states that it is the responsibility of the university to verify that the student’s information is accurate before disbursing Title IV funds. Financial aid staff did not properly verify the information in Banner before disbursing funds; therefore, staff incorrectly awarded the following funds: See Schedule of Findings and Questioned Costs for table. • The university awarded $66,017 of Unsubsidized Direct Loan funds to six students even though the students had already reached their aggregate loan limit. 34 CFR 668.32 states that a student is eligible to receive Direct Loans, except as provided in 34 CFR 668.35(d), if the student has not obtained loan amounts in excess of the program’s annual or aggregate loan limits. 34 CFR 668.35(d) states that a student who has received loan funds exceeding the annual or aggregate loan limits must either repay the excess amount in full or arrange with the lender to repay the excess loan amount before they may receive any further Title IV assistance, including Pell grants. The university did not provide documentation that payment arrangements had been made that would permit the students to regain eligibility for Title IV loans. These errors occurred because financial aid staff did not properly monitor the outstanding loan amounts previously awarded to the student. • The university awarded $20,284 in Unsubsidized Direct Loans to one student although the student was in default on previous Title IV financial aid. 34 CFR 668.19(a)(d) states that if the student previously attended another institution, the institution must determine if the student is in default on any Title IV loan. This error occurred because financial aid staff did not properly monitor the status of outstanding loans previously awarded to the student. EFFECT Because financial aid staff did not properly monitor student eligibility and enter student information correctly, students received Title IV assistance for which they were not eligible. Pell Grant overpayments of $4,821 and Direct Loan overpayments of $136,014 will be questioned. When the university disburses Title IV funds to which students were not entitled, ED could take adverse actions against the university. See Schedule of Findings and Questioned Costs for table. RECOMMENDATION Office of Financial Aid and Scholarships management should ensure staff and student advisors properly confirm the eligibility of Title IV recipients prior to the awarding and disbursement of Title IV funds. The university should implement controls to ensure appropriate staff monitor recipients’ enrollment in eligible programs, adherence to annual and aggregate loan limits, and whether students are in default on previous loans. MANAGEMENT’S COMMENT Management concurs. The UTK Office of Financial Aid & Scholarships experienced significant administrative staffing transitions related to the areas of eligibility noted in the finding. The staffing changes, combined with the manual nature of the noted processes, resulted in eligibility errors related to enrollment, grade level, loan status, and aid disbursement. Additional staff training and automated processes in the Banner Financial Aid System are being implemented to provide greater quality controls to review aid eligibility prior to and following aid disbursement. The Financial Aid review process for academic changes for non-degree status and degree major changes administered by the academic colleges is also being automated and reviewed periodically throughout each semester to ensure proper disbursement of aid. Management notes the total over award of $140,835 represents a fractional 0.08% of the total Title IV funds awarded of $173,771,469 by the institution.

Finding Number 2023-030 Assistance Listing Number84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency University of Tennessee Federal Award Identification Number P268K232842 Federal Award Year 2022 and 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Eligibility Repeat Finding N/A Pass-Through Entity N/A Questioned Costs $75,092 FINDING The University of Tennessee Health Science Center Financial Aid Office did not adequately monitor the eligibility of Title IV financial aid recipients BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The programs include assistance such as Pell Grants, Direct Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. Some of the responsibilities of the school are to determine student eligibility, verify data for students selected for verification by the Secretary, and ensure maximum assistance amounts established by ED are not exceeded individually or as part of the total aid package. Title 34, Code of Federal Regulations (CFR), Part 668, Section 164(b)(3), states, “At the time a disbursement is made to a student for a payment period, an institution must confirm that the student is eligible for the type and amount of Title IV, HEA program funds identified by that disbursement.” Students must also meet certain requirements, such as certain income levels and maintaining a certain grade point average, to be eligible for Title IV assistance. CONDITION, CAUSE, AND CRITERIA The University of Tennessee Health Science Center’s Financial Aid Office did not adequately monitor the eligibility of Title IV financial aid recipients. We reviewed the entire population of 2,195 students enrolled at the University of Tennessee Health Science Center who received Title IV student financial assistance during the 2022–2023 award year. Of the 2,195 students, 8 students (0.36%) received excess financial aid based on their eligibility, resulting in overpayments totaling $75,092. • The university provided Title IV funding to four students even though they had already reached their aggregate loan limit, causing them to be ineligible for Direct Loans. 34 CFR 668.32(g) states that a student is eligible to receive Direct Loans, except as provided in 34 CFR 668.35(d), if the student has not obtained loan amounts in excess of the program’s annual or aggregate loan limits. 34 CFR 668.35(d) states that a student who has received loan funds exceeding the annual or aggregate loan limits must either repay the excess amount in full or arrange with the lender to repay the excess loan amount before they may receive any further Title IV assistance, including Pell Grants. The university did not provide documentation of these arrangements. Because Financial Aid Office staff did not properly monitor the outstanding loan amounts previously awarded to the student, the university made the following awards in violation of federal regulations: See Schedule of Findings and Questioned Costs for table. • The university awarded Pell Grant and Direct Loan funds to four students without verifying the students’ GPA met the criteria for satisfactory academic progress. 34 CFR 668.34(a) requires institutions that participate in Title IV programs to “establish a reasonable satisfactory academic progress policy for determining whether an otherwise eligible student is making satisfactory academic progress in his or her educational program and may receive assistance under the title IV, HEA programs.” While the university has a Satisfactory Academic Progress Policy in place, the university did not adhere to the policy requirement to verify a readmitted student’s academic standing before awarding funds. Because Financial Aid Office staff did not properly verify the students’ information before disbursing funds, the university awarded the following funds in violation of federal requirements: See Schedule of Findings and Questioned Costs for table. EFFECT Because Financial Aid Office staff did not properly monitor student eligibility, students received Title IV assistance for which they were not eligible. Direct Loan overpayments of $75,092 will be questioned. When the university disburses Title IV funds to students to which they were not entitled, ED could take adverse actions against the university. See Schedule of Findings and Questioned Costs for table. RECOMMENDATION Financial Aid Office management should ensure that staff and student advisors properly confirm the eligibility of Title IV recipients prior to the awarding and disbursement of Title IV funds. The university should implement controls to ensure appropriate staff monitor recipients’ adherence to annual and aggregate loan limits and satisfactory academic progress. MANAGEMENT’S COMMENT Management concurs with the finding. The excess financial aid awarded to the students will be removed from their respective student accounts and returned to the Department of Education. Management notes that the finding was restricted to the College of Nursing, and attributable to human error and lack of backup measures. Management further notes the total over award of $75,092 represents a fractional 0.08% of the total Title IV funds awarded of $90,012,792 by the institution. Management has already addressed the issue by hiring a new financial aid counselor with the appropriate training and experience.

Finding Number 2023-031 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency University of Memphis Federal Award Identification Number P007A223902, P063P220380, and P268K230380 Federal Award Year 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Eligibility Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.007 Federal Award Identification Number P007A223902 Amount $150 Assistance Listing Number 84.063 Federal Award Identification Number P063P220380 Amount $1,724 Assistance Listing Number 84.268 Federal Award Identification Number P268K230380 Amount $31,479 FINDING The University of Memphis Office of Student Financial Aid and Scholarships did not adequately monitor the eligibility of Title IV financial aid recipients BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The programs include assistance such as Pell Grants, Direct Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The schools then notify the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. Some of the responsibilities of the school are to determine student eligibility, verify data for students selected for verification by the Secretary, and ensure maximum assistance amounts established by ED are not exceeded individually or as part of the total aid package. Title 34, Code of Federal Regulations (CFR), Part 668, Section 164(b)(3), states, “At the time a disbursement is made to a student for a payment period, an institution must confirm that the student is eligible for the type and amount of Title IV, HEA program funds identified by that disbursement.” Students must also meet certain requirements, such as certain income levels and maintaining a certain grade point average, to be eligible for Title IV assistance. CONDITION, CAUSE, AND CRITERIA The University of Memphis Office of Student Financial Aid and Scholarships did not adequately monitor the eligibility of Title IV financial aid recipients. We reviewed the entire population of 12,290 students enrolled at the University of Memphis who received Title IV student financial assistance during the 2022–2023 award year. Of the 12,290 students, 20 students (0.16%) received excess financial aid based on their eligibility, resulting in overpayments totaling $33,353. • The university awarded Title IV funds to four students even though the students had already reached their aggregate loan limits. 34 CFR 668.32 states that a student is eligible to receive Direct Loans, except as provided in 34 CFR 668.35(d), if the student has not obtained loan amounts in excess of the program’s annual or aggregate loan limits. 34 CFR 668.35(d) states that a student who has received loan funds exceeding the annual or aggregate loan limits must either repay the excess amount in full or arrange with the lender to repay the excess loan amount before they may receive any further Title IV assistance, including Pell Grants. The university did not provide documentation that payment arrangements had been made that would permit the students to regain eligibility for Title IV loans. These errors occurred because Office of Financial Aid and Scholarships staff did not properly monitor the outstanding loan amounts previously awarded to the students. Therefore, the university awarded the following funds incorrectly: See Schedule of Findings and Questioned Costs for table. • The university awarded 14 students Title IV assistance that, when combined with other sources of financial aid, exceeded the students’ cost of attendance. 34 CFR 685.203(j) prohibits Direct Subsidized, Direct Unsubsidized, or Direct PLUS loans to exceed the student’s estimated cost of attendance minus other expected financial aid; Volume 6, Chapter 2, of the 2023–2024 Federal Student Aid Handbook further clarifies that “. . . a financial aid administrator may not award FWS employment to a student if that award, when combined with all other resources, would exceed the student’s need.” These errors occurred due to the timing of additional scholarships and aid being added; the additional awards were paid out after the Title IV funds were awarded and not adjusted for the additional aid. Therefore, the University of Memphis made the following awards in violation of federal regulations. See Schedule of Findings and Questioned Costs for table. • The university awarded one student a $150 Federal Supplemental Educational Opportunity Grant (FSEOG) payment even though the student had reached the Pell Lifetime Eligibility Used. 34 CFR 676.10(a) states that when selecting eligible students for each award year, “. . . an institution shall select those students with the lowest expected family contributions who will also receive Federal Pell Grants in that year.” This error occurred due to management not properly verifying Pell eligibility when determining which students would be awarded FSEOG funds. • In addition to the above errors, the university awarded one student $30 in FSEOG funds. As stated in 34 CFR 676.20(a), “an institution may award an FSEOG for an academic year in an amount it determines a student needs to continue his or her studies. However, except as provided in paragraph (c) of this section, an FSEOG may not be awarded for a full academic year that is (1) Less than $100; or (2) More than $4,000.” This error occurred due to human error and oversight. EFFECT Because Office of Financial Aid and Scholarships staff did not properly monitor student eligibility and enter student information, ineligible students received federal financial aid payments. Direct Loan overpayments, Pell Grant overpayments, and FSEOG overpayments of $33,353 will be questioned. RECOMMENDATION The Office of Financial Aid and Scholarships management should ensure that staff and student advisors properly confirm the eligibility of Title IV recipients prior to disbursement of Title IV funds. Controls should be in place to monitor enrollment changes, recipients’ enrollment in eligible programs, adherence to annual and aggregate loan limits, and satisfactory academic progress. MANAGEMENT’S COMMENT We concur with the finding and recommendation. Management will be conducting additional training with staff responsible for making awards to confirm Title IV aid eligibility and ensure aid amounts do not exceed limits. Reports will be modified to help better identify and correct potential issues that may arise through human error. Finally, additional staff will be charged with monitoring the updated reports to ensure issues are promptly resolved. These actions should create a multi-layered system of controls minimizing the likelihood of non-compliance.

Finding Number 2023-032 Assistance Listing Number 84.425F and 84.425M Program Name Education Stabilization Fund Federal Agency Department of Education State Agency Austin Peay State University Federal Award Identification Number P425F202674 and P425M200147 Federal Award Year 2020 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING Austin Peay State University did not post quarterly reports to the institution’s website in compliance with federal guidance for the Higher Education Emergency Relief Fund BACKGROUND The Coronavirus Aid, Relief, and Economic Security Act established the Higher Education Emergency Relief Fund (HEERF) to provide relief to colleges and universities that had been affected by the coronavirus pandemic. The Coronavirus Response and Relief Supplemental Appropriations Act and the American Rescue Plan Act provided additional waves of funding for the program. Since the inception of HEERF, Austin Peay State University (the university) has spent $61,230,968 in HEERF funds. During fiscal year 2023, the university only spent funds from the American Rescue Plan since funding from the first two waves was exhausted in previous years. CONDITION, CAUSE, AND CRITERIA The university did not have an effective system of internal controls, such as written policies and procedures or a reporting notification system, to ensure the university posted federal quarterly reports timely to the institution’s website. We tested all 4 quarterly HEERF reports for the year ended June 30, 2023. We found that the university did not post 3 of 4 (75%) “Quarterly Budget and Expenditure Reporting for all HEERF I, II, and III grant funds” reports within 10 calendar days after the end of the quarter in compliance with federal guidance. Based on the auditor’s inspection of the reports and review of the dates posted per the IT Webmaster, university management posted the reports to the university’s website between 8 and 99 days late for the quarters ending September 30, 2022; March 31, 2023; and June 30, 2023. Question 36 of the American Rescue Plan Act of 2021, Higher Education Emergency Relief Fund III, Frequently Asked Questions, updated October 25, 2022, states, “. . . this [report] must be conspicuously posted on the institution’s website no later than 10 days after the calendar quarter (January 10, April 10, July 10, and October 10) as long as the institution’s HEERF grant is active.” Based on discussions with the Associate Vice President of Budget and Finance, the university was short-staffed when the former Associate Vice President for Finance left in November 2022. She stated that the university did not have good records to follow, and the lack of continuity caused deadlines to be missed. As duties were reassigned, university leadership determined that reports were late and worked to resolve the backlog. EFFECT If the university does not ensure timely reporting, the U.S. Department of Education (ED) may impose further restrictions on the university, such as requiring additional monitoring or requiring the entity to obtain assistance from technical or management experts. ED may also temporarily withhold payments until the noncompliance has been corrected. In addition, not meeting the federal reporting requirements increases the likelihood that the public will not have access to transparent and accurate information regarding the university’s expenditures of federal awards. RECOMMENDATION Management should design and implement an effective system of internal controls, including written policies and procedures for all federal agency reporting. In addition, management should consider establishing a reporting notification system for federal grants to ensure timely reporting. MANAGEMENT’S COMMENT We concur with the finding. Upon becoming aware of the absence of the fiscal year 2023 reports on the website, our accounting staff promptly rectified the oversight. Furthermore, it is pertinent to note that the HEERF grants will conclude in June 2024, thereby relieving the university of the obligation to continually update the website with new reports. We are reviewing software solutions to support the Grants Office for reporting and compliance.

Finding Number 2023-033 Assistance Listing Number 84.063 and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Austin Peay State University Federal Award Identification Number P063P212217 and P268K222217 Federal Award Year 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING Austin Peay State University did not have adequate procedures to prevent, or to detect and correct, errors in enrollment reporting BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For students who receive Pell Grants or Direct Loans, ED requires institutions to report enrollment status for each term, as well as changes to enrollment, such as graduations, withdrawals, and transitions between full- and part-time status, to the National Student Loan Data System (NSLDS), which is ED’s central database for federal student aid. CONDITION, CRITERIA, AND CAUSE We tested a sample of 26 Pell recipients and Direct Loan borrowers at Austin Peay State University (the university) who had a status change during the year. We found that for 10 of 26 students tested (38.5%), the registrar’s office incorrectly reported high-risk enrollment reporting data elements. The information for 2 of these students contained multiple errors. The registrar’s office misreported the following data elements for the students: • enrollment status, • program beginning date, • program length, and • program level Office of Postsecondary Education Identification (OPEID) number. Incorrect Enrollment Status The registrar’s office incorrectly reported the program enrollment status for 6 of the 10 students. • One student was enrolled in the first and second spring terms for a total of seven credit hours, which is considered half-time; however, the registrar’s office incorrectly reported the student’s program enrollment status as less than half-time because staff did not include the hours taken in the second spring term. In addition, the registrar did not report the student’s withdrawal from an associate’s degree program when the student changed to a bachelor’s degree program on March 7, 2023. When the system updated the active associate’s degree status, the system applied the spring term as the end term. As a result, the system continued to report the associate’s degree with an active status until the full spring term ended, even though the status should have changed to inactive after March 7, 2023. Chapter 4.2.1 of the NSLDS Enrollment Reporting Guide, issued November 2022, states, “Whenever a student changes majors, the school should report the student as withdrawn from the previous program and enrolled in the new program on the next enrollment submission. . . . Additionally, if the student is enrolled in the same unique program multiple times, Schools should only report one version of the program with the earliest Program Begin Date.” The registrar’s office did not have a manual process to verify the proper program status for mid-term status changes. • The registrar’s office improperly updated two students’ program enrollment statuses in NSLDS to withdrawn when the students completed the spring term, enrolled in the summer term, and subsequently withdrew from the summer term. ED’s electronic announcement, “(General) Subject: Summer Term Enrollment Reporting to the National Student Loan Data System (NSLDS),” posted on April 20, 2017, states, “If such a student subsequently withdraws from the summer term, the student’s most recent enrollment status of half time or greater should be reported throughout the remainder of the summer.” The registrar was unaware of the unique summer enrollment reporting guidance for student withdrawals. • The registrar’s office did not update the program enrollment status in the university’s system for three students when the students graduated from the program, causing the program status to incorrectly show as active in NSLDS as of December 14, 2024. Two of the students graduated on May 5, 2023, and the third student graduated on May 21, 2023. The registrar’s office reported the graduated status for the program in the National Student Clearinghouse; however, the university’s system retained the active status because the student was also enrolled in another program. The NSLDS Enrollment Reporting Guide, Chapter 4.4.4, states, “A school must correctly report students who have completed a program with a ‘G’ for ‘Graduated’ status rather than a ‘W’ for ‘Withdrawn’. Further, an accurately anticipated completion date aids in correct servicing of a student’s loans, avoiding unnecessary early conversion to repayment or too late conversion, causing technical defaults.” Management stated that the university does not have a process to report the graduated program status when a student is enrolled in another active program. As a result, the registrar’s office continued to report the graduated program as active with the students’ current enrollment status information for the other program. Incorrect Program Beginning Date The registrar’s office reported the incorrect beginning date of the program of study for 2 students who changed programs during the year. Staff reported the program’s beginning date between 877 and 980 days after the appropriate term start date. The NSLDS Enrollment Reporting Guide, Chapter 4.4.8, states, “The Program Begin Date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program, unless the student enrolled in the program on an earlier date.” When a student already enrolled in a program changes to a new program, the prior program should be withdrawn and a new program reported. The program’s beginning date should be the date the student directly began attending the program being reported. Based on discussions with the registrar, she thought the program beginning date only mattered for the credential level and did not know that changes in the field of study would generate a new beginning date. The registrar’s office could not explain where the selected program beginning dates originated for these students. Incorrect Program Length The registrar’s office reported the program length as 4.5 years rather than 4.0 years for the Radiologic Science bachelor’s degree for 1 of the 10 students. Title 34, Code of Federal Regulations, Part 668, Chapter 41(a), defines normal time as “the amount of time necessary for a student to complete all requirements for a degree or certificate according to the institution’s catalog. This is typically four years for a bachelor’s degree in a standard term-based institution.” The registrar’s office had set up a general rule in the institution’s information system to assign any program with more than 120 credit hours with a completion length greater than 4 years. The Radiologic Science bachelor’s degree requires 121 credit hours; however, the program is completed in 4 years. The registrar’s office does not have a manual process to confirm the accuracy of the general rule. Incorrect Program Level OPEID Number For three students, the registrar’s office reported the OPEID number for the main campus, rather than the OPEID number for the campus location where the student attended classes. The NSLDS Enrollment Reporting Guide, Chapter 4.1, states, “Enrollment is reported for a specific location of each campus; that is, the eight-digit Office of Postsecondary Education Identification (OPEID) number.” The registrar stated that the programs in the system are exclusively tied to the OPEID number for the main campus. As a result, the university reported the main campus OPEID number for all programs. The registrar was not aware of the requirement to report the OPEID number based on the campus location where the student attends classes. EFFECT A student’s enrollment status determines eligibility for in-school status, deferment, and grace periods, and it provides vast amounts of critical data about the effectiveness of Title IV aid programs. Timely and accurate enrollment reporting is critical for effective management of the programs. Incorrectly reporting enrollment status changes could result in several errors, such as awarding grants based on the wrong enrollment status, inappropriately granting an in-school loan deferment, or failing to start the grace period or properly initiate the loan repayment process for students who are no longer enrolled. Noncompliance with enrollment reporting requirements could result in corrective actions requested by ED, such as placing further requirements or restrictions on the university. RECOMMENDATION The registrar should revise procedures to ensure that the registrar’s office uploads and submits the correct information to NSLDS. The registrar should ensure staff are adequately trained on the requirements for reporting status changes to ensure accurate reporting. Furthermore, the registrar should ensure that the university staff’s computer processes are operating effectively and should establish a process to verify statuses in NSLDS. MANAGEMENT’S COMMENT We concur with the finding. NSLDS review procedures will be created in the Office of the Registrar to ensure proper reporting occurs and verification is completed in a timely manner. These procedures will be documented by the end of fiscal year 2024 and periodically reviewed afterward. New procedures, such as reporting graduation twice, have been implemented since the conclusion of the audit. In addition to new procedures, the Registrar will implement cross-training requirements so at least three individuals may report and update information with NSLDS anytime.

Finding Number 2023-001 Assistance Listing Number 84.425E and 84.425J Program Name Education Stabilization Fund Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number P425E200897 - 20B and P425J200061 - 20B Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Activities Allowed or Unallowed Allowable Costs/Cost Principles Matching, Level of Effort, Earmarking (84.425J) Repeat Finding 2022-001 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.425E Federal Award Identification Number P425E200897 - 20B Amount $85,000 Assistance Listing Number 84.425J Federal Award Identification Number P425J200061 - 20B Amount $233,113 FINDING Tennessee State University continued not to follow federal guidance for the Higher Education Emergency Relief Fund BACKGROUND The Coronavirus Aid, Relief, and Economic Security Act established the Higher Education Emergency Relief Fund (HEERF) to provide relief to colleges and universities affected by the coronavirus pandemic. The Coronavirus Response and Relief Supplemental Appropriations Act and the American Rescue Plan (ARP) Act provided additional waves of funding for the program. Since the inception of HEERF, Tennessee State University (TSU) has been awarded $115,573,226 through three primary types of HEERF funds. The first type was student funds intended to be used for student emergency aid grants. The second type was institutional funds, which were allowed to be spent for certain things, such as additional emergency aid grants to students, including discharging student debt, supplies to combat the coronavirus, and lost revenue. The third type was supplemental funds dedicated for Historically Black Colleges and Universities (HBCUs). TSU was allowed to use its HBCU HEERF for additional institutional costs and to provide scholarships and grants to students. At the beginning of fiscal year 2023, TSU had used all of the institutional and HBCU HEERF funds awarded and had $4,622,145 of student funds remaining. Executive leadership decided to use the remaining student funds to cover emergency aid grants and persistence grants. During the current fiscal year, HBCU HEERF funds totaling $233,113 became available because of late adjustments to debt-discharged student accounts due to revised charges, payments received, and/or applied scholarships. The reclaimed HBCU funds were used to provide scholarships to students, called tuition assistance grants, which could cover any part of the student’s cost of attendance. To receive HEERF funds, TSU was required to follow federal regulations and additional federal guidance, such as Frequently Asked Questions (FAQs) published by the U.S. Department of Education (ED). Based on the work performed during our audit, we noted that TSU did not establish an adequate control structure for the HEERF award to ensure compliance with these federal guidelines. We noted issues in all three fund types of HEERF aid because of TSU’s lack of internal controls. Student Funds CONDITION AND CRITERIA Tennessee State University management did not follow federal guidance related to the student portion of HEERF. TSU used $85,000 of the student portion of its HEERF award on persistence grants rather than emergency aid grants. TSU’s persistence grants awarded $1,000 at the end of the academic year to freshman students who had maintained passing grades (a 2.0 GPA) and attended several student engagement events held throughout the year. These stipulations were not allowable under the student portion of the HEERF award. ED required the institutions to prioritize students with exceptional need, as noted in the ARP HEERF III FAQs Updates, Question 7, which states, institutions are directed with the ARP funds to prioritize students with exceptional need, such as students who receive Pell Grants or are undergraduates with extraordinary financial circumstances in awarding emergency financial aid grants to students. Question 12 of the ARP HEERF III FAQs Updates, published May 11, 2021, states, The Department will make an individualized determination about whether an institution failed to prioritize emergency financial aid grants to students with exceptional need. The Department may determine an institution has failed to do so if the institution established preconditions for students to receive emergency financial aid grants (e.g., (1) establishing a minimum GPA, (2) imposing other academic or athletic performance or good standing requirements, (3) requiring continued enrollment in the institution or (4) required the student to first pay any outstanding debt or balance) that results in failure to prioritize students with exceptional need. Since TSU only offered persistence grants to a small portion of students and imposed a minimum GPA and event attendance requirements, TSU did not clearly demonstrate that it prioritized students with exceptional need. The amount of these awards totaled $85,000, which we are identifying as questioned costs. CAUSE Based on discussions with TSU personnel, the President and the executive leadership team determined the conditions of the persistence grants. However, this upper management group did not ensure that the conditions met all federal requirements, which prohibited conditioning awards on certain student actions. EFFECT While the university used the $85,000 of the student portion of the HEERF award to benefit students, management inappropriately prioritized students who met the university’s pre-conditions rather than those with exceptional need. Students with exceptional need who did not meet the university-imposed GPA or campus engagement requirements might have missed vital financial help for their education. Because of management’s decision to screen students for criteria other than need, TSU may be required to repay the $85,000 to the U.S. Department of Education with other operational funds. Institutional Funds CONDITION AND CRITERIA TSU management did not comply with an earmarking requirement to conduct direct outreach to financial aid applicants about the opportunity to receive a financial aid adjustment due to the recent unemployment of a family member or independent student, or other circumstances. This requirement was related to the institutional portion of the funds and should have been completed by the last day of the grant period, June 30, 2023. According to Section 2003 of the American Rescue Plan Act: (5) . . . an institution shall use a portion of funds received under this section to — . . . (B) conduct direct outreach to financial aid applicants about the opportunity to receive a financial aid adjustment due to the recent unemployment of a family member or independent student, or other circumstances, described in section 479A of the Higher Education Act of 1965 (20 U.S.C. 1087tt). TSU did not meet the requirements of subsection (5)(B) to conduct direct outreach to students notifying them that financial aid adjustments were available if their circumstances had changed since completing the Free Application for Federal Student Aid (FAFSA). CAUSE Based on discussions with the Vice President of Business and Finance and the Associate Vice President of Business and Finance, TSU management was aware of the earmarking requirement for outreach. However, TSU management stated they misunderstood the requirement and believed providing the additional HEERF fund scholarships to students would satisfy the requirement. EFFECT By not meeting the federal award earmarking requirement and providing outreach to students, the university could not ensure it met the grant’s purpose of helping all eligible students, including those with financial hardships, pay for higher education. Supplemental Funds CONDITION AND CRITERIA As noted in the prior-year audit, Tennessee State University management continued to not comply with federal requirements regarding documenting how a student could receive the HBCU HEERF funds used for tuition assistance grants. This included failing to document the actual award decisions and how management determined the amount of each student’s award in accordance with federal requirements. According to the certification and agreement for the CARES Act a(2) funds, For grants made to students, the Recipient should maintain records on how grants were distributed to students, how the amount of each grant was calculated, and any instructions or directions given to students about the grants. TSU did not have HBCU HEERF money remaining at the beginning of fiscal year 2023, but late adjustments in student accounts resulted in prior-year debt discharges being reduced. The reduction in these debt discharges made $233,113 of HBCU HEERF funds available during the fiscal year. While we questioned these costs as part of the prior audit finding related to debt discharge, we are also questioning the $233,113 for the current fiscal year after the prior-year costs were reversed and then again spent in a similar fashion. CAUSE Per discussions with the former Assistant Vice President of Financial Aid, the executive leadership team provided an amount of tuition assistance grants that both Enrollment Reporting and Financial Aid could spend. However, the directive contained no further guidance about the dollar amount of individual awards, or reference to federal requirements on record-keeping, or award criteria. Per discussions with the Associate Vice President of Business and Finance, the procedures for providing tuition assistance grants did not change from the prior fiscal year to fiscal year 2023. Executive leadership did not establish clear policies, procedures, or controls around awarding HEERF scholarships. This lack of policies and procedures from upper management resulted in a failure to follow federal requirements for recording how grants were distributed or calculated. EFFECT U.S. Department of Education guidance for HEERF funds included elements to ensure ED’s ability to maintain adequate oversight of awards. TSU management’s failure to follow federal requirements resulted in the university management, auditors, and ED being unable to determine whether funds were used appropriately and distributed to students fairly. RECOMMENDATION Executive leadership should provide appropriate guidance and oversight when devising how to expend resources for a federal program, especially new programs with quickly evolving guidance and multiple programs providing similar types of funding. This should include creating documented policies, procedures, and controls for implementing those funds; these procedures should be guided by the corresponding federal authority. Management should also document reviews by knowledgeable employees throughout the implementation process to compare the implementation with federal guidance and university policy. MANAGEMENT’S COMMENT We do not concur with this finding. However, the executive leadership team will provide better guidance and better oversight if we ever receive funding of this type again. We will engage our grants accounting team to help develop policies and procedures and implement controls so that we stay compliant with any federal guidelines associated with such funds. In the event we are awarded funds of this nature again, we will develop a system to document reviews throughout the process. AUDITOR’S COMMENT We have reviewed management’s comments. We have not adjusted the finding since management did not provide an argument for or evidence of the university’s compliance with federal regulations, and management stated they will develop policies and procedures and will implement controls for future funding to ensure they are compliant.

Finding Number 2023-002 Assistance Listing Number 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number P268K230381 Federal Award Year 2022 and 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Cash Management Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The financial aid office did not adequately reconcile its direct loan records to the Direct Loan Servicing System’s records, as required by federal regulations, and therefore could not resolve discrepancies timely BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for Student Financial Assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The United States Department of Education (ED) has established certain requirements for each school to participate in the Student Financial Assistance programs. For direct loans, ED requires schools to reconcile direct loan data monthly between the school’s financial aid office and business office, and between school data, ED’s Common Origination and Disbursement System, and ED’s Grants Management (G5) System. CONDITION The financial aid office at Tennessee State University did not reconcile the university’s direct loan financial records with the federal Direct Loan Servicing System monthly, as required. While the financial aid office was able to provide reports needed to reconcile direct loans, there was no documentation indicating the reconciliation was actually performed. As a result, any discrepancies were not identified, investigated, and resolved timely. The Director of Financial Aid stated that the university usually does not perform a complete reconciliation each month as required by ED. Instead, TSU management waits until the year-end closeout is completed to resolve most reconciling items. As of September 25, 2023, the financial aid office had not completed this reconciliation for fiscal year 2023. CRITERIA Title 34, Code of Federal Regulations, Part 685, Section 300(b)(5), states that to participate in the Direct Loan program, a school must “on a monthly basis, reconcile institutional records with Direct Loan funds received from the Secretary and Direct Loan disbursement records submitted to and accepted by the secretary.” The 2022–2023 Federal Student Aid Handbook, Volume 4, Chapter 6, gives additional information regarding the reconciliation process: A school that participates in the Direct Loan Program is required to reconcile cash (funds it received from the G5 system to pay its students) with disbursements (actual disbursement records) it submitted to the Common Origination and Disbursement (COD) system monthly. In addition, Chapter 6 of the handbook goes on to state, A school has completed its monthly reconciliation when all differences between the Direct Loan SAS [Student Account Statement] and the school’s internal records (Direct Loan system, financial aid office, and business office system) have been resolved or documented and the school’s ending cash balance is zero. Schools should clearly outline their reconciliation process and document in both the business office and financial aid office procedures. Finally, while the handbook does not specify a particular format or reconciliation method, it does require that the school maintains “documented results of its monthly reconciliation to provide to auditors and reviewers at their request.” CAUSE The Director of Financial Aid stated that the financial aid office has differences from month to month because of the timing of funds being disbursed and drawn down, but these items will usually resolve themselves by the end of the award period. Because of these timing discrepancies, the university has not emphasized performing a complete reconciliation each month. In addition, the university did not have any policies or procedures outlining the direct loan reconciliation process. As previously stated, management had not provided the auditors with evidence of a complete reconciliation for any month of the fiscal year or the year-end closeout reconciliation as of September 25, 2023. EFFECT When the university does not reconcile its financial aid records to the net cash drawdowns and net booked disbursements as reported to the federal government, there could be unresolved errors in either the federal government’s records or the university’s records. The university could receive excess amounts from ED, which could result in questioned costs, or amounts could be due to the university if the funds are not being drawn down. In addition, when the university does not fully reconcile direct loans each month, reconciling items and errors may be harder to identify over time, making the annual reconciliation more complex than necessary. Performing documented monthly reconciliations and retaining all supporting documentation ensures that financial aid staff will receive all direct loan funds from ED and will make timely and accurate disbursements to students. RECOMMENDATION The financial aid office and the business office should develop policies and procedures for the reconciliation process. The Director of Financial Aid should ensure that the required monthly reconciliations are prepared and documented based on instructions in the Federal Student Aid Handbook and yearly training documents. If any items in the School Account Statement do not agree with the institution’s financial records, financial aid staff should investigate and resolve these differences promptly. The Director of Financial Aid and a member of the business office should review the reconciliation each month and at award year-end to ensure its accuracy and completeness. MANAGEMENT’S COMMENT Tennessee State University concurs; both the prior Assistant Vice President (AVP) and the Associate Director of Loans of Financial Aid are no longer with the university. Reporting to the prior AVP, the prior Associate Director of Loans had primary oversight/responsibilities of the administration of the Federal Direct Loan Program, return of Title IV, overawards, loan limit C-flags, and reconciliation of federal programs. The Office of Financial Aid has restructured this position and created an additional position, the Assistant Director of Compliance, and both positions report to the Director. Under prior leadership, monthly meetings with the business office were conducted with verbal reconciliation amounts; however, no supporting documentation of reconciliation was provided. The Office of Financial Aid is in the process of hiring an independent financial aid consultant to solely focus on Direct Loan reconciliation to bring the program in compliance. The Director will review monthly reconciliations performed by the Associate Director of Loans.

Finding Number 2023-003 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number P007A073927, P063P070381, and P268K230381 Federal Award Year 2022 and 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING Tennessee State University did not have adequate procedures to ensure Title IV credits were refunded timely per federal guidelines BACKGROUND The student financial assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. These Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of the total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. As a condition of these programs, institutions must provide notifications of the amounts awarded and loans disbursed. In addition, institutions are required to refund credits to the student’s account within 14 days of posting the award to the student’s account. CONDITION We tested a sample of 40 Title IV recipients at Tennessee State University (TSU) to determine whether TSU met disbursement requirements. These requirements included disbursing Title IV aid timely and in the appropriate amount, sending notices to students informing them of their awards and/or loan disbursements, and refunding within 14 days of disbursement any credits to student accounts created by Title IV aid. Based on this work, we noted that 5 of the 26 students in our testwork (19%) had Title IV credits that were not refunded within 14 days of the date of disbursement. As noted in the table below, 8 separate refunds were not refunded timely, ranging from 1 to 85 days late. See Schedule of Findings and Questioned Costs for table. While conducting our testwork, we noted that 4 additional students also received refunds more than 14 days after the Title IV aid was disbursed to each student’s account. Because each student had a combination of federal and non-federal aid creating the credit, it did not meet the federal definition of a Title IV credit. However, these errors are a further indication of TSU’s failure to process refunds in a timely manner. Errors Noted by Another State Entity In addition, the Tennessee Student Assistance Corporation (TSAC) reported similar errors in an October 11, 2023, Program Review Report of TSU’s procedures for administering state financial aid programs. In this report, TSAC noted that 103 of 589 students tested (17%) who received state aid had a credit balance on their student account for an extended period; these balances were not refunded to the students in accordance with the institution’s policy. Although TSAC tested students who received state aid, these errors could have also affected students who received Title IV aid. CRITERIA The 2022–2023 Federal Student Aid Handbook, Volume 4, Chapter 2, states: If FSA disbursements to a student’s account at the school create a Title IV credit balance, the school must pay the credit balance directly to the student or parent as soon as possible but no later than 14 days after: [emphasis in original] • the first day of class of a payment period if the credit balance occurred on or before that day, or • the balance occurred if that was after the first day of class. CAUSE TSU management implemented a general refund policy outlining the timing of refunds, as well as the differences between automatic and manual refunds. However, management did not develop adequate procedures to ensure that all Title IV credits are refunded within the timeframes required by federal guidance. Per discussion with TSU management, employee shortages and turnover resulted in the process not always being performed as outlined in the policy. EFFECT Refunding credits to students in a timely manner is essential to fulfilling the goals of Title IV programs. Students may depend on these refunds to pay for non-institutional charges, such as off-campus housing, transportation, or meals. Without these funds, students may not have the resources available to pay for these potentially significant costs, which can be a barrier to a successful college career. In addition, violations of federal requirements could result in ED imposing a fine on the university and/or limiting, suspending, or terminating TSU’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. RECOMMENDATION TSU management should revise and adequately document procedures to ensure that credits on student accounts are refunded within 14 days of Title IV aid being disbursed. In addition, leadership should take necessary steps to ensure that staffing is adequate to ensure compliance. Finally, TSU management should establish additional review procedures to identify credits that have not been refunded and ensure refunds are processed timely. MANAGEMENT’S COMMENT Tennessee State University concurs with the finding and has taken steps to strengthen processes around student refunds. The Bursar’s Office has undergone restructuring to build out a resolute accounting team, including a refund analyst reporting to the new Accounting Manager. Recruitment is underway for two additional analyst roles to complete the review team, who will monitor refund compliance daily. Interviews are currently in progress to fill these new positions. The university is committed to continuous improvement in this area and enhancing the capacity of the Bursar’s Office to provide timely and accurate refunds to students.

Finding Number 2023-004 Assistance Listing Number 84.063 and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number P063P070381 and P268K230381 Federal Award Year 2022 and 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING For the federal Direct Loan and Pell Grant programs, Tennessee State University did not report timely and accurate information regarding students’ enrollment statuses BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For student recipients of Pell Grants or Direct Loans, ED requires institutions to report students’ enrollment statuses for each term to the National Student Loan Data System (NSLDS). The institution is also required to report changes to students’ enrollment, such as graduations, withdrawals, and transitions between full- and part-time status. CONDITION We tested a sample of 42 Direct Loan borrowers and/or Pell Grant recipients at Tennessee State University (TSU). These 42 students had 54 separate instances where TSU should have reported an enrollment status change to NSLDS. As of August 17, 2023, the day of our testwork, we found that for 16 of 54 (30%) status changes tested, TSU either did not report any information or reported incorrect information to NSLDS. Not Reported • The enrollment services office had not reported May 2023 graduations for 5 former students at the time of our testing. • The enrollment services office had not reported 3 status change occurrences from the spring semester. This included 2 withdrawals and 1 situation where the student dropped courses, causing a change in their enrollment status. • For 2 students enrolled in the spring semester, there was no record of enrollment history in NSLDS. • Per discussion with the Assistant Vice President of Admissions and Records, TSU had not reported any student’s status for the summer 2023 term. This led to 4 students in our sample having statuses that TSU had not reported 79 days after the semester began on May 30, 2023. Reported Incorrectly • The enrollment services office incorrectly reported enrollment status changes for 2 students during the spring semester. These were full-time students but were reported as half-time and three-quarter time. Errors Noted by Another State Entity In addition, the Tennessee Student Assistance Corporation (TSAC) reported additional errors that could affect enrollment reporting in an October 11, 2023, Program Review Report of TSU’s procedures for administering state financial aid programs. In this report, TSAC noted that the institution updated the grading policy to add an “FA” grade; however, TSU staff described this grade as both an unofficial withdrawal and a failure. For students with this grade, the LDA [last day of attendance] was not documented in every case and there was no evidence of internal controls in place to monitor instructors who fail to use the grade properly or to evaluate the student’s enrollment to verify financial aid was correctly paid to the student. The TSAC review report also noted that “there was no evidence the institution monitors course engagement and enrollment changes for students participating in state programs, which led to incorrect awarding of state aid.” TSAC noted the following examples of inconsistencies in enrollment: • Course hours removed . . . due to a noted registration error • Withdrawals are processed retroactively and back dated prior to the start of class with some or all courses completely disappearing from the student’s enrollment . . . • Students receiving an “FA” grade without a last date of attendance. Although TSAC tested students who received state aid, these errors could have also affected students who received Title IV aid. CRITERIA Federal Guidance The Federal Student Aid Handbook, Volume 2, Chapter 3, states that institutions “must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that file.” In the introduction to Chapter 1, the NSLDS Enrollment Reporting Guide states, “Accurate and timely Enrollment Reporting to NSLDS is essential to the Department of Education’s successful delivery of Title IV aid.” The requirements are established in Title 34, Code of Federal Regulations, Section 309(b). CAUSE Per discussion with the Assistant Vice President of Admissions and Records, some graduates were late additions to the graduation list. These late additions were due to a variety of situations but were primarily related to students having to obtain approval to replace required courses for a degree with other courses. TSU did not report any additional graduations to NSLDS after the late additions were made. Based on our review, it does not appear that TSU management is ensuring changes in enrollment are being made timely. In addition, TSU is not adequately reviewing enrollment information in NSLDS to ensure changes are reported accurately. Management did not provide any additional information to help determine the cause, despite our multiple attempts to follow up on the issues. EFFECT Timely and accurate enrollment reporting is critical for effective management of ED programs. The accurate administration of the Title IV programs depends heavily on the accuracy of the enrollment information reported by schools. Accurate, timely, and complete enrollment data is also important to the students, who can view their current campus enrollment information and their program enrollment history. Also, if an individual graduated or no longer attends TSU but is not reported as such, the individual’s loan repayment grace period could be improperly extended, resulting in the student’s loan repayments being improperly deferred. RECOMMENDATION TSU management should review and update its processes as necessary to ensure the enrollment services office uploads and submits the correct information to NSLDS. In addition, the Assistant Vice President of Admissions and Records should ensure that staff know reporting deadlines and the importance of reporting enrollment status changes. The Assistant Vice President of Admissions and Records should also ensure that enrollment status changes are reported timely. MANAGEMENT’S COMMENT Tennessee State University concurs with the finding. Additional staff will be hired to oversee enrollment reporting. Updates to the National Student Clearinghouse will be reported on the census date, every 30–45 days thereafter (subsequent of term), and at the end of the term. Any errors will be corrected within 5–7 business days. The withdrawal process will be communicated to the staff during training sessions and staff meetings.

Finding Number 2023-005 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number P007A073927, P063P070381, and P268K230381 Federal Award Year 2022 and 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.007 Federal Award Identification Number P007A073927 Amount $46,352 Assistance Listing Number 84.063 Federal Award Identification Number P063P070381 Amount $2,563 Assistance Listing Number 84.268 Federal Award Identification Number P268K230381 Amount $71,344 FINDING Tennessee State University did not return Title IV funds in compliance with federal regulations BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For Title IV recipients who did not complete at least 60% of the semester, the school is required to perform a calculation to determine the amount of unearned aid that it must return to ED. CONDITION We selected 2 samples of 30 students who officially or unofficially withdrew from classes at Tennessee State University (TSU) during the 2021–2022 award year. We selected the first sample of 30 student withdrawals from a population of 164 students who had an official or unofficial withdrawal before the 60% completion date. We tested these items to ensure that withdrawal dates were accurate, that calculations were performed correctly, and that amounts were returned to ED within the required timeframes. Of the 30 withdrawals, we were not able to test 18 as these students were on the withdrawal list but never began classes and did not receive Title IV aid during the semester of the withdrawal. Of the remaining 12 withdrawals, we noted 7 (58.3%) errors. Of the 7 errors, 4 errors were for students who withdrew during the semester. Specifically, • For 1 student, TSU did not return the Title IV funds to ED even though the student withdrew on the second day of the fall 2022 term, resulting in questioned costs of $3,374. • For 1 student, TSU did not enter the correct amount of the student’s Pell disbursement in the return calculation. This led to TSU calculating and returning from university funds $8,083, which was $432 more than necessary. • For 1 student, TSU returned the correct portion of Direct Loans that the student received but did not return the applicable amount of the Pell Grant. This resulted in a return of $3,096 instead of the correct $6,309, a $3,213 shortfall. We identified this shortfall as questioned costs. • For 1 additional student, TSU management returned the Title IV funds 49 days after the student’s withdrawal date. This is 4 days later than the 45 days required for returning funds because of withdrawals. The remaining 3 errors were related to students who were initially charged tuition and had Title IV aid applied to their account but never began attendance. While the school applied charges and Title IV aid to these students’ accounts based on information from the FAFSA, we noted that these students had not registered for classes. ED specifies that awards to students who never begin attendance are overawards and must be returned within 30 days after the school has determined the student did not begin attendance. • For 2 of these students, TSU management returned the full amount of the Title IV overaward, but did so 37 and 42 days after the school determined the student did not begin attendance for the spring 2023 semester. These returns were 7 and 12 days late, respectively. • For 1 student, TSU performed a return of Title IV funds calculation based on an incorrect withdrawal date even though the student had never registered for the fall 2023 semester. TSU returned $2,761; however, the full amount of $5,240 should have been considered an overaward and fully returned. This led to questioned costs of $2,479. In addition, we selected a sample of 30 from a population of 75 students who completed over 60% of the semester in which they withdrew to ensure that TSU recorded the withdrawal dates correctly, had adequate attendance records to support the withdrawal date, and did not remove Title IV funds from the account. Of the original 30 sample items, we were not able to test 7 items as the student was on the withdrawal list but never began classes and never received Title IV aid during the semester of the withdrawal. Of the 23 remaining items, we noted 21 (91.3%) errors: • For 1 student, TSU entered a withdrawal date beyond the 60% point of the semester; however, the student never began attendance but did have Title IV aid of $4,446 applied to his account, which we have identified as questioned costs. • For 20 students, TSU entered a withdrawal date, but attendance records did not support the withdrawal date, and management could not provide any additional support for the withdrawal dates used upon further request. Questioned costs related to these items were $107,179. Due to the high number of errors in both samples, we determined that additional testwork was not required to replace the items for which testing was not applicable. Errors Noted by Another State Entity In addition, the Tennessee Student Assistance Corporation (TSAC) reported similar errors in an October 11, 2023, Program Review Report of TSU’s procedures for administering state financial aid programs. In this report, TSAC noted that the institution updated the grading policy to add an “FA” grade; however, TSU staff described this grade as both an unofficial withdrawal and a failure. For students with this grade, the LDA [last day of attendance] was not documented in every case and there was no evidence of internal controls in place to monitor instructors who fail to use the grade properly or to evaluate the student’s enrollment to verify financial aid was correctly paid to the student. The TSAC review report also noted that “there was no evidence that TSU monitors course engagement and enrollment changes for students participating in state programs, which led to incorrect awarding of state aid.” TSAC noted the following examples of inconsistencies in enrollment: • Course hours removed . . . due to a noted registration error • Withdrawals are processed retroactively and back dated prior to the start of class with some or all courses completely disappearing from the student’s enrollment . . . • Students receiving an “FA” grade without a last date of attendance. Although TSAC tested students who received state aid, these errors could have also affected students who received Title IV aid. CRITERIA The 2022–2023 Federal Student Aid Handbook, Volume 5, Chapter 1, states, Up through the 60% point in each payment period or period of enrollment, a pro rata schedule is used to determine the amount of Title IV funds the student has earned at the time of withdrawal. After the 60% point in the payment period or period of enrollment, a student has earned 100% of the Title IV funds the student received and was scheduled to receive during the period [emphasis in original]. Title 34, Code of Federal Regulations, Part 668, Section 22(b)(1), states, For purposes of this section, for a student who ceases attendance at an institution that is required to take attendance, . . . the student’s withdrawal date is the last date of academic attendance as determined by the institution from its attendance records. The 2022–2023 Federal Student Aid Handbook, Volume 4, Chapter 3, states, Schools must return funds disbursed to a student who failed to begin attendance as soon as possible but no later than 30 days after the date they become aware that the student has not begun and will not begin attendance [emphasis in original]. The 2022–2023 Federal Student Aid Handbook, Volume 5, Chapter 2, provides that A school must return unearned funds for which it is responsible as soon as possible but no later than 45 days after the date of determination of a student’s withdrawal [emphasis in original]. CAUSE Based on our review, it appears that staff do not always appropriately update Banner, TSU’s information system. Specifically, we noted that attendance records, withdrawal dates, and financial aid information were unsupported or incorrect in a majority of the errors. Management did not provide us with additional information related to the cause of these issues, despite our numerous requests. EFFECT For the 35 students tested, TSU calculated a total return of $38,053 in Title IV funds. The corrected total after adjustment for the errors we noted in our testwork was $51,133, which is $13,080 more than TSU returned to ED. In addition, we were unable to verify withdrawal dates for 20 students. The students for whom we could not determine withdrawal dates received $107,179 in Title IV funds. This resulted in total questioned costs of $120,259. Violations of the federal requirement to timely return Title IV funds to ED could result in ED imposing a fine on TSU and/or limiting, suspending, or terminating TSU’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. In addition, incorrect return calculations and/or withdrawal dates can negatively impact students. If TSU incorrectly calculates and returns the amount of unearned aid to ED, it could impact the amount of aid the student is eligible to receive in future terms. RECOMMENDATION The Registrar’s Office and the Financial Aid Office should follow federal regulations. Management should ensure that the Financial Aid Office reperforms all return of Title IV funds calculations and makes necessary corrections to student and federal fund accounts for the 2022–2023 academic year. Finally, TSU should ensure that the Registrar’s Office communicates any withdrawals to the Financial Aid Office in a timely manner. MANAGEMENT’S COMMENT Tennessee State University concurs; both the prior Assistant Vice President (AVP) and the Associate Director of Loans of Financial Aid are no longer with the university. Reporting to the prior AVP, the prior Associate Director of Loans had primary oversight/responsibilities of the administration of the Federal Direct Loan Program, return of Title IV, overawards, loan limit C-flags, and reconciliation of federal programs. The Office of Financial Aid has restructured this position and created an additional position, the Assistant Director of Compliance, and both positions report to the Director. The Office of Financial Aid will review 2022–2023 Title IV funds and make necessary corrections. Additionally, the Return of Title IV report will be reviewed daily by both the Financial and Records Office to ensure federal regulations are followed. The Registrar’s Office is in the process of developing internal automated withdrawal notices to ensure the respective departments are aware of withdrawals in real time.

Finding Number 2023-006 Assistance Listing Number 84.007, 84.033, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number P007A073927, P033A223927, P063P070381 and P268K30381 Federal Award Year 2022 and 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Eligibility Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.007 Federal Award Identification Number P007A073927 Amount $3,500 Assistance Listing Number 84.033 Federal Award Identification Number P033A223927 Amount $939 Assistance Listing Number 84.063 Federal Award Identification Number P063P070381 Amount $16,222 Assistance Listing Number 84.268 Federal Award Identification Number P268K230381 Amount $162,822 FINDING Tennessee State University’s Office of Financial Aid granted Title IV funds to ineligible students BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. These Title IV programs include assistance such as Pell Grants, Direct Loans, and Federal Work Study. To be eligible for student financial assistance, a student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. In order to participate, some of Tennessee State University’s (the university) responsibilities are to determine student eligibility, verify data for students selected for verification, and not exceed ED’s maximum assistance amounts either individually or as part of the total aid package. Title 34, Code of Federal Regulations (CFR), Part 668, Section 164(b)(3), states, “At the time a disbursement is made to a student for a payment period, an institution must confirm that the student is eligible for the type and amount of Title IV, HEA [Higher Education Act] program funds identified by that disbursement.” Students must also meet and maintain certain requirements, such as income levels and grade point averages (GPAs), to be eligible for Title IV assistance. CONDITION, CAUSE, AND CRITERIA The university’s Office of Financial Aid did not adequately verify whether student recipients were eligible for Title IV financial aid. We found that management lacked controls, and as a result, the university overpaid $183,483 to student recipients. We reviewed the entire population of 5,619 students enrolled at the university who received Title IV student financial assistance during the 2022–2023 award year. Of the 5,619 students, 30 students (0.53%) received excess financial aid based on their eligibility. Our results revealed the following: • The university awarded Title IV funds to 17 students that had already reached their aggregate loan limit and were ineligible for additional Title IV financial aid. 34 CFR 668.32 states that a student is eligible to receive Direct Loans, except as provided in 34 CFR 668.35(d), if the student has not obtained loan amounts in excess of the program’s annual or aggregate loan limits. 34 CFR 668.35(d) states that if a student has received loan funds exceeding the annual or aggregate loan limits, the student must either repay the excess amount in full or arrange with the lender to repay the excess loan amount before they may receive any further Title IV assistance, including Pell Grants. The university did not provide documentation that students had made these arrangements. Therefore, the university made awards in violation of federal regulations as shown in Table 1. See Schedule of Findings and Questioned Costs for table. • For six students, the university did not obtain the documentation to verify certain information on FAFSAs before awarding aid to the students, as required by ED. 34 CFR 668.60 (b)(1)(i) requires institutions to verify that applicants for financial aid provided documentation supporting their applications, and the institution may not award funds if the applicants do not provide the requested documentation. Additionally, 34 CFR 668.60(c)(2) states, “If the applicant does not provide to the institution the requested documentation and, if necessary, a valid SAR [Student Aid Report] or the institution does not receive a valid ISIR [Institutional Student Information Record], within the additional time period . . . the applicant—(i) Forfeits the Federal Pell Grant for the award year; and (ii) Must return any Federal Pell Grant payments previously received for that award year.” By awarding funds to students without receiving the necessary documentation, the university awarded the aid listed in Table 2 in violation of federal regulations. See Schedule of Findings and Questioned Costs for table. • For five students, the university awarded Title IV funds that, when combined with other sources of financial aid, exceeded the student’s cost of attendance. 34 CFR 685.203(j) prohibits Direct Subsidized, Direct Unsubsidized, or Direct PLUS loans from exceeding the student’s estimated cost of attendance minus other expected financial aid. Volume 6, Chapter 2 of the 2023–2024 Federal Student Aid Handbook further clarifies that “a financial aid administrator may not award [Federal Work Study] employment to a student if that award, when combined with all other resources, would exceed the student’s need.” Therefore, the university awarded the following aid in violation of federal regulations, as shown in Table 3. See Schedule of Findings and Questioned Costs for table. • The university awarded Pell and Direct Loan funds to one student without verifying that the student’s GPA met the criteria for satisfactory academic progress. 34 CFR 668.34(a) requires institutions that participate in Title IV programs to “establish a reasonable satisfactory academic progress policy for determining whether an otherwise eligible student is making satisfactory academic progress in his or her educational program and may receive assistance under the title IV, HEA programs.” While the university has a satisfactory academic progress policy in place, it did not adhere to the policy requirement to verify a readmitted student’s academic standing before awarding funds. Therefore, the university awarded the following aid to the student in violation of federal regulations, as shown in Table 4. See Schedule of Findings and Questioned Costs for table. • The university awarded one student $3,448 in Pell funds without verifying that the student had completed high school. 34 CFR 668.32(e)(j) requires students to have a high school diploma, its equivalent, or an approved alternative to receive Title IV funds. The university did not have the student’s diploma or equivalent on file. Therefore, the university awarded the aid in violation of federal regulations. Errors Noted by Another State Entity In addition, the Tennessee Student Assistance Corporation (TSAC) reported similar errors in an October 11, 2023, Program Review Report of the university’s procedures for administering state financial aid programs. In this report, TSAC noted 26 observations, warnings, and findings related to the university’s administration of state financial aid. These observations, warnings, and findings included issues such as not verifying the student was a high school graduate, not correctly administering satisfactory academic progress, not monitoring student attendance or enrollment changes, and awarding aid in excess of the student’s cost of attendance. Although TSAC tested students who received state aid, these errors could have also affected students who received Title IV aid. EFFECT Because Financial Aid staff did not properly monitor student eligibility and enter accurate student information, students received Title IV financial assistance for which they were not eligible. Because of the university’s errors, we are questioning a total of $183,483, broken down by program in Table 5. See Schedule of Findings and Questioned Costs for table. Furthermore, when the university grants students Title IV funds to which they are not entitled, ED could take adverse actions against the university, including a fine, suspension, or termination from the Title IV program. These actions would hurt the university and the students impacted by the loss of Title IV aid. RECOMMENDATION Tennessee State University should ensure that they properly confirm the eligibility of Title IV aid recipients before disbursing Title IV funds to students. The university should implement controls to ensure the appropriate staff confirm that students do not receive aid when they have already reached the loan limit or if the total funds would be greater than the cost of attendance. The controls should also ensure that staff verify required documents and monitor satisfactory academic progress. MANAGEMENT’S COMMENT Tennessee State University concurs; both the prior Assistant Vice President (AVP) and the Associate Director of Loans of Financial Aid are no longer with the university. Reporting to the prior AVP, the prior Associate Director of Loans had primary oversight/responsibilities of the administration of the Federal Direct Loan Program, return of Title IV, overawards, loan limit C-flags, and reconciliation of federal programs. The Office of Financial Aid has restructured this position and created an additional position, the Assistant Director of Compliance, and both positions report to the Director. The prior AVP of Financial Aid oversaw the review and eligibility of maximum timeframe satisfactory academic progress (SAP) for students; the Office of Financial Aid has created an additional internal control that prevents readmitted and transfer students from being included in the automation of evaluation until admission requirements are verified by Enrollment Services.

Finding Number 2023-007 Assistance Listing Number 84.010 and 84.424 Program Name Title I Grants to Local Educational Agencies Student Support and Academic Enrichment Program Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number S010A190042, S010A200042, S010A210042, S010A220042, S424A190044, S424A200044, S424A210044, and S424A220044 Federal Award Year 2019 through 2023 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Matching, Level of Effort, Earmarking Repeat Finding 2022-008 Pass-Through Entity N/A Questioned Costs N/A FINDING Because department management has been working with the U.S. Department of Education on a year-by-year basis to correct prior-year miscalculations, department management did not have approved, correct prior-year amounts on which to base the 2023 allocations, which caused the allocations to be incorrect for the third year in a row BACKGROUND The Tennessee Department of Education (the department) is the pass-through entity for federal programs and distributes funds to the state’s 146 local educational agencies (LEAs) under the following programs administered by the U.S. Department of Education (ED): Title I Grants to Local Educational Agencies(1) (Title I) and Student Support and Academic Enrichment Program Grant(2) (Title IV). (1)Title I Grants to Local Educational Agencies is a federal program to improve the teaching and learning of children who are at risk of not meeting challenging academic standards and who reside in areas with high concentrations of children from low-income families. (2)The Student Support and Academic Enrichment Program is a federal program to improve students’ academic achievement by providing all students with access to a well-rounded education, improving school conditions for student learning, and improving the use of technology to improve academic achievement and digital literacy of all students. The department received federal funding as presented in Table 1. See Schedule of Findings and Questioned Costs for table. Department’s Responsibilities as a Grant Administrator As outlined in Title 2, Code of Federal Regulations (CFR), Part 200, Section 303, as a grant administrator for federal funds, the department must (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. . . . (c) Evaluate and monitor the non-Federal entity’s compliance with statutes, regulations and the terms and conditions of Federal awards. . . . (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Overview of Allocation Distribution by Funding Source Title I Title I consists of four grant formulas: basic, concentration, targeted, and education finance incentive grants. ED determines the amount to allocate to each state and each LEA based on their formula children(3) counts. When applicable, the department must then adjust the ED allocation amounts for 1. when LEAs consolidate or separate, when area boundaries are redrawn, or when changes have occurred since the Census Bureau updated its list of LEAs(4); and 2. for special LEAs that are not on the list of traditional LEAs provided to the ED by the Census Bureau.(5) (3) According to 34 CFR 200.70, formula children include children ages 5 to 17 who are “(1) From families below the poverty level based on the most recent satisfactory data available from the Bureau of the Census; (2) From families above the poverty level receiving assistance under the Temporary Assistance for Needy Families program under Title IV of the Social Security Act; (3) Being supported in foster homes with public funds; and (4) Residing in local institutions for neglected children.” (4)For our audit period, this adjustment was not applicable. (5) The department’s special LEAs include the Achievement School District and the state’s special schools. Tennessee’s Special School Districts include the Tennessee School for the Blind, the Tennessee School for the Deaf, the West Tennessee School for the Deaf, and the Alvin C. York Institute. For all students enrolled in special LEAs, the department must determine under which traditional LEA the student is counted. The department uses this information to transfer funding from the traditional LEA to the special LEA based on the formula children criteria. Once the department adjusts the original ED allocation for the special LEAs, it must then further adjust the allocations to ensure each LEA receives at least its hold-harmless amount(6), which is calculated using the prior-year allocations. The department determines which LEA allocations do not meet the LEAs’ hold-harmless amount and proportionately reduces or raises allocations to meet the hold-harmless amount. (6) Hold-harmless requires the department to allocate to an LEA at least a certain percentage of its prior-year allocation—85%, 90%, or 95%, depending on the LEA’s proportion of formula children. Title IV The department uses Title I allocations to determine Title IV allocations to LEAs. Title IV allocations should be proportionate to the Title I allocations the LEA received in the preceding fiscal year. PRIOR AUDIT RESULTS Department’s Noncompliance and Inadequate Controls As we first reported in the 2021 State of Tennessee Single Audit Report (Finding 2021-015), in April 2021, the ED’s Office of Elementary and Secondary Education (OESE) conducted a performance monitoring review of multiple programs and found the department incorrectly calculated its funding allocations to LEAs under the Title I program. Because the department must use the Title I allocations to determine Title IV allocations to LEAs, the department also incorrectly allocated this program. OESE stated in the Tennessee Consolidated Performance Review Report #2 of 2 FY 2021,(7) dated November 30, 2021, that for the special LEAs, the department determines their allocations for [Title I] based on their enrollment. This approach is inconsistent with the requirements . . . for Title I, Part A because [the department] does not derive a Title I, Part A formula count for these LEAs or determine whether they meet the eligibility criteria under each formula. (7) Tennessee Consolidated Performance Review Reports can be found at https://oese.ed.gov/files/2021/11/TDOE-Performance-Review-Report-Part-1.pdf and https://oese.ed.gov/files/2021/11/TDOE-Performance-Monitoring-Review-Report-2.pdf. In 2021, OESE also found that the department failed to update its allocation methodology when the federal requirements changed in 2018; therefore, management did not correctly apply hold-harmless requirements for Title I for each of the four formula grants. The department instead determined if LEAs met hold-harmless requirements based on the total Title I allocations. In 2021 and 2022, management responded to the finding that they were continuing to work with the U.S. Department of Education on a corrective action plan for prior years, including determining whether any allocations should be adjusted retroactively. CURRENT CONDITION AND CAUSE Status of Corrective Action to Address Lack of Internal Control and Noncompliance Department management has been working with OESE to develop and implement corrective action, since late summer/fall of 2021. Management developed updated procedures to calculate Title I and Title IV allocations and obtained approval from OESE to continue with allocation corrections for fiscal years 2018 through 2022 using those procedures. Beginning in January 2022 and continuing through our audit period, management worked with OESE to review allocations and develop a plan to pay LEAs that were under-allocated using other available federal funds. In response to the repeat audit finding (2022 State of Tennessee Single Audit Finding 2022-008), management indicated that once OESE and the department agree on the allocation corrections and an appropriate repayment plan, management will document the details in a Memorandum of Agreement, which the department will implement upon signing. As of December 11, 2023, the department and OESE are working toward finalizing the corrective action in the Memorandum of Agreement. Given management’s ongoing involvement with OESE to recalculate and correct all affected years’ allocations, we are continuing to report this finding to fulfill our reporting responsibilities under the Office of Management and Budget’s Compliance Supplement and the requirement of 2 CFR 200. Current Risk Assessment Because of the issues we identified, we reviewed the department’s December 2022 Financial Integrity Act Risk Assessment and determined that management listed the risk of inadequate controls over the data and the funding calculation for Every Student Succeeds Act allocation for school districts. Management listed “experienced staff with detailed understanding of the mechanics” as a control to mitigate the risk; however, the control, as noted by management in our discussions, was adversely impacted due to turnover of experienced staff. Without having appropriate risk responses to identify, analyze, and respond to changes, management could not mitigate the identified risk, increasing the likelihood of error and noncompliance. EFFECT Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. CRITERIA Title I In its review report in 2021, OESE summarized 34 CFR 200.72 and stated that for each special LEA, management must estimate the number of Title I, Part A formula children for that LEA by deriving the equivalent of the most recently available poverty estimates from the U.S. Census Bureau’s Small Area and Income Population Estimates (SAIPE) branch, which the Department provides to each [state]. [A state] must then use the derived formula count to determine whether the LEA meets the eligibility criteria under each Title I, Part A formula. Title IV According to Section 4105(a)(1) of the Elementary and Secondary Education Act of 1965, as amended by the Every Student Succeeds Act, From the funds reserved by a State under section 4104(a)(1), the State shall allocate to each local educational agency in the State that has an application approved by the State educational agency under section 4106 an amount that bears the same relationship to the total amount of such reservation as the amount the local educational agency received under subpart 2 of part A of title I for the preceding fiscal year bears to the total amount received by all local educational agencies in the State under such subpart for the preceding fiscal year. Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, “Identify, Analyze, and Respond to Risks,” 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. According to Principle 9, “Identify, Analyze, and Respond to Change,” 9.03 Conditions affecting the entity and its environment continually change. Management can anticipate and plan for significant changes by using a forward-looking process for identifying change. Management identifies, on a timely basis, significant changes to internal and external conditions that have already occurred or are expected to occur. Changes in internal conditions include changes to the entity’s programs or activities, oversight structure, organizational structure, personnel, and technology. Changes in external conditions include changes in the governmental, economic, technological, legal, regulatory, and physical environments. Identified significant changes are communicated across the entity through established reporting lines to appropriate personnel. RECOMMENDATION Management should continue working with OESE to recalculate LEA allocations and make whole the underfunded LEAs. After management recalculates allocations and OESE approves the revisions, management should also finalize and implement their policies and procedures governing the allocations to ensure staff responsible for performing and reviewing federal award calculations are aware of current federal requirements. Management should identify all risks and implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding. The department’s Deputy Commissioner, Chief Operating Officer, Assistant Commissioner of Federal Programs and Oversight, and Chief Financial Officer worked with the U.S. Department of Education to finalize and obtain approval for a corrective action plan in December 2023. The corrective action plan will be implemented from state fiscal year 2024 to state fiscal year 2031. The department’s Division of Local Finance and Division of Federal Programs and Oversight will continue to implement revised controls to address the risks noted in this finding. This work will include updating the department’s risk assessment as necessary, professional development, and taking the necessary actions if deficiencies are identified. Internal controls will be developed to ensure that staff responsible for performing and reviewing federal award calculations are aware of current federal requirements. Moving forward, the department’s Office of Finance will serve as a secondary internal check before annual allocations are released.

Finding Number 2023-008 Assistance Listing Number 84.424 Program Name Student Support and Academic Enrichment Program Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number S424A200044 Federal Award Year 2020 through 2022 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding N/A Pass-Through Entity N/A Questioned Costs 47,303 FINDING The Department of Education management reimbursed local educational agencies for expenditures that occurred outside of the Student Support and Academic Enrichment Program grant’s period of performance BACKGROUND The Title IV, Part A, Student Support and Academic Enrichment Program (Title IV) is a federal program to improve students’ academic achievement by providing all students with access to a well-rounded education, improving school conditions for student learning, and improving the use of technology in order to improve the academic achievement and digital literacy of all students. Federal funding for Title IV is only available to the Department of Education (the department) and its subrecipients for a limited time (referred to as the grant’s period of performance).(8) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the Title IV award amount and the period of performance (budget period).(9) The department has 15 months to charge expenditures to each grant award; however, Title IV is governed by the requirements of the Tydings Amendment (Title 20, United States Code, Chapter 31, Section 1225[b]), which extends the period of performance 12 additional months, for a total of 27 months. (8) According to Title 2, Code of Federal Regulations (CFR), Part 200 Section1, “Period of performance means the total estimated time interval between the start of an initial Federal award and the planned end date, which may include one or more funded portions, or budget periods.” (9) According to 2 CFR 200.1, “Budget period means the time interval from the start date of a funded portion of an award to the end date of that funded portion during which recipients are authorized to expend the funds awarded, including any funds carried forward.” CONDITION AND CAUSE We tested a nonstatistical, random sample of 25 expenditure transactions, totaling $120,267, from a population of 44 expenditure transactions, totaling $164,532, that were charged to the Title IV grant award S424A200044 after September 30, 2022, to determine if the costs occurred during the grant’s period of performance, July 1, 2020, through September 30, 2022. For 15 of 25 expenditure transactions tested (60%), management did not ensure the costs reimbursed to the local educational agencies (LEAs) occurred within the period of performance, resulting in $47,303 in questioned costs. According to department management, between October 1 and January 30 of each year, the department reviews all LEA reimbursement requests to determine if the reimbursement request is charged to a grant that ended on September 30 of that year. If so, the department contacts the LEA to determine if the reimbursement request contains any expenditures that occurred after September 30. If expenditures occurred after September 30, the department sends the reimbursement request back to the LEA to remove those expenditures. If the reimbursement request contains no expenditures that occurred after September 30, the department approves the request and processes it for payment. Even though department management stated they had controls in place, we found that the controls were not effective to ensure compliance with the period of performance requirement; as such, the department reimbursed LEAs for costs that did not occur within the authorized period of performance. Per discussion with department management, human error was the cause of the errors noted in this finding. CRITERIA According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . (h) Cost must be incurred during the approved budget period. Risk Assessment We reviewed the department’s December 2022 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with the period of performance. Management identified the review of charges to federal grants as a control to mitigate the risk; however, based on the results of our review, management’s review was not effective in mitigating the risks of noncompliance and the resulting questioned costs. According to the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. According to Green Book Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have effective internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award. This also increases the risk that funds will be expended outside of the period of performance. The lack of mitigating controls increases the risk of noncompliance with the federal program requirements and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should develop effective control procedures to ensure that costs reimbursed to local educational agencies occurred during the grant award’s period of performance. In addition, management should carefully evaluate their risk assessments to ensure they include all risks and should implement effective controls to address the risks noted in this finding. Management should update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding. The Chief Financial Officer will collaborate with program teams to create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance. Management will evaluate the effectiveness of the control activities for this risk and update the department’s annual risk assessment to reflect any new controls management implements. The Chief Financial Officer will create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements.

Finding Number 2023-009 Assistance Listing Number 84.027 Program Name Special Education Cluster (IDEA) Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number H027A200052, H027A210052, and H027A220052 Federal Award Year 2020 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Activities Allowed or Unallowed Allowable Costs/Cost Principles Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.027 Federal Award Identification Number H027A200052 Amount $64,065 Assistance Listing Number 84.027 Federal Award Identification Number H027A210052 Amount $25,561 Assistance Listing Number 84.027 Federal Award Identification Number H027A220052 Amount $13,312 FINDING Department management reimbursed local education agencies and vendors for costs that were unallowable or not adequately supported, resulting in $102,938 in federal questioned costs BACKGROUND The Department of Education (the department) serves as the pass-through entity for the Special Education Cluster,(10) administered by the U.S. Department of Education. The department awards this federal program’s funds primarily to subrecipients, commonly known as the local educational agencies (LEAs); it also contracts with vendors. (10) Pursuant to the federal Individuals with Disabilities Education Act, Special Education Cluster grants ensure that all children with disabilities receive a free, appropriate public education that emphasizes special education and related services designed to meet their unique needs. The grants also ensure that the rights of children with disabilities and their parents are protected; help states, localities, educational service agencies, and federal agencies provide for the education of all children with disabilities; and assess and ensure the effectiveness of efforts to educate children with disabilities. LEA High-Cost Reimbursement Process According to the Individuals with Disabilities Act (IDEA), each state can reserve IDEA funds of up to 10% of the amount reserved for other state-level activities to address high-cost services to individuals with disabilities, including transportation to state special schools(11) and specialized equipment for students’ needs. For fiscal year 2023, the department reserved $16,148,134 for other state-level activities and $2,985,177 for high-cost funding. (11) A state special school is a school managed directly by the state. Some of these schools provide specialized academic instruction to students with specific disabilities. State special schools relevant to IDEA high-cost funding include the Tennessee School for the Deaf, the West Tennessee School for the Deaf, and the Tennessee School for the Blind. Throughout the year, LEAs incur expenses in providing special education and related services to high-need students. At the end of each fiscal year, LEAs can submit high-cost reimbursement requests for individual students to the department via ePlan.(12) After LEAs submit high-cost reimbursement requests, an IDEA Grants Management Consultant reviews each request to ensure that all expenses are allowable and adequately supported. The department categorizes high-cost students into three categories: • Priority 1 – Students who attend a state special school, but their local LEA is responsible for costs related to transporting the student to school. • Priority 2 – Students who were placed into an LEA by a state agency(13) for their first academic year and, as a result, were not included on the census and did not generate funds for that LEA. • Priority 3 – Students who require extensive and costly special education and related services for their LEA to provide a free, appropriate public education. Per federal and state requirements, these students must have eligible high-cost expenses greater than three times the state’s average per-pupil expenditures in order to be eligible for reimbursement. (12) ePlan is the department’s grants management system. (13) These state agencies include the Tennessee Department of Human Services, the Department of Mental Health and Substance Abuse Services, the Department of Children’s Services, and the Department of Health. After reviewing each student’s request, the IDEA Grants Management Consultant either approves an LEA’s reimbursement request for payment or sends the request back to the LEA for correction. If allowable, the department will reimburse LEAs in the fiscal year following the one in which the expenses were incurred. In fiscal year 2023, the department paid out $4,723,016 in high-cost funding to LEAs for expenses incurred in fiscal year 2022. IDEA Service Contract Reimbursement Process According to the Individuals with Disabilities Education Act, the department may use funding reserved under state-level activities to fund resources and initiatives that support the education of students with disabilities. To administer this funding, the department contracts the services of public and private vendors, which receive IDEA funding as reimbursement for providing services that support special education initiatives. To receive reimbursement for their services, vendors submit invoices with appropriate documentation of expenditures to their contract manager(14) at the department. During the majority of our audit period, the contract manager initially reviewed the invoice and documentation. After this initial review, the invoice and documentation were given to the Assistant Commissioner of Special Education and Intervention Programs for final review and signature before being sent to accounting staff for processing and payment. If issues are noted at any of the review levels, the invoice is returned to the vendor for corrections. In spring 2023, management revised their review process and included an additional level of review. (14) Contract managers are department employees who are primarily responsible for a given contract with a vendor. These managers possess specialized knowledge of their vendor’s subject matter and serve as the vendor’s main point of contact. CONDITIONS AND CAUSE The Department Reimbursed Subrecipients From the High-Cost Fund for Unallowable and Unsupported Expenditures Management’s review of LEA reimbursement requests did not prevent various instances of reimbursement for unallowable or inadequately supported expenditures. We tested a nonstatistical, random sample of 6 high-cost reimbursement transactions paid in fiscal year 2023, totaling $993,113, from a population of 59 high-cost reimbursement transactions, totaling $4,850,728. We found that for 2 high-cost reimbursements (33%), the LEA was reimbursed in part for inadequately supported or unallowable expenses, resulting in questioned costs of $57,709. The questioned cost details are as follows: • $28,219 for fuel and maintenance costs for student transportation vehicles, in addition to a mileage rate intended to be inherently inclusive of all fuel and maintenance costs, resulting in double payment for those expenditures; • $31 for unsupported expenditures; and • $29,459 for students with total eligible high-cost expenses that were less than the required threshold of three times the state average per-pupil expenditure. Management cited multiple factors that led to questioned costs for the high-cost fund. Although the process includes a secondary review, management noted that during our audit period, staffing levels were not sufficient to perform the secondary review. Additionally, because the IDEA Grants Management Consultant who performed the initial high-cost review was out on leave following an injury, the former Elementary and Secondary Education Act Grants Manager was asked to perform the initial high-cost review during our audit and may not have understood all of the requirements. Lastly, management noted that fiscal year 2023 was the first year that the department had used ePlan to facilitate the high-cost review and reimbursement process. Management stated that this resulted in technical issues that complicated the review. We performed a walkthrough of management’s new review process implemented in fiscal year 2024, and it appears to address the conditions noted in this finding. We will follow up on this finding and evaluate the control’s effectiveness in the 2024 Single Audit. The Department Reimbursed Vendors for Expenditures That Were Not Properly Supported Management did not ensure that vendors submitted adequate documentation for expenditures invoiced to the department. We tested a nonstatistical, random sample of 17 vendor reimbursements paid in fiscal year 2023, totaling $1,103,230, from a population of 167 vendor reimbursements, totaling $10,879,926, and found that for 6 reimbursements (35%), the department and vendors were unable to provide adequate supporting documentation for the full reimbursement amount, resulting in questioned costs of $45,229. Following the 2022 Single Audit work, management identified risks related to vendor payments as a result of our audit inquiries. Specifically, management identified the risk that the department would reimburse unsupported expenditures because contract managers may not identify issues with the documentation in their review. To address this risk, in spring 2023, management started providing additional training to contract managers to ensure they knew how to evaluate documentation of expenditures for reimbursement. Additionally, in spring 2023, the Senior Director of Special Education Operations and Oversight began performing a secondary review of all vendor reimbursement requests utilizing IDEA funding before the request goes to the Assistant Commissioner of Special Education and Intervention Programs, who does a final, high-level review before payment. Of the 17 items in our sample, 4 occurred after management revised their process, and we did not note any issues with these 4 reimbursements. Risk Assessment We reviewed the department’s December 2022 Financial Integrity Act Risk Assessment and determined that management listed the risk of charging unallowable costs to a federal program. Management listed the following controls to mitigate the risk: • Maintain a library of resources within ePlan for stakeholders and TDOE staff to use, including on allowable uses. • Regular technical assistance training on internal controls and program rules. • The [Consolidated Funding Application] undergoes multiple levels of review from the [Federal Programs and Oversight] divisional coordinators to the appropriate program manager. • Experienced staff familiar with specific grant rules. • Provide specific technical assistance and written corrective actions to correct the misuse of funds. • Focus monitoring of systemic and/or egregious misuse of funds by an LEA. • Require payback for misuse of funds. • Apply grant conditions to LEAs that misused funds. Additionally, management listed the risk that costs charged to a federal program are not adequately documented at the subrecipient level. Management listed the following controls to mitigate the risk: • Maintain a library of resources within ePlan for stakeholders and TDOE staff to use, including on allowable uses. • Regular technical assistance trainings on internal controls and program rules. • Annual risk based monitoring for both programmatic and fiscal requirements. • Provide specific technical assistance and written corrective actions to correct non-compliance. • Focus monitoring of systemic and/or egregious misuse of funds by an LEA. • Apply grant conditions to LEAs that had systemic/egregious non-compliance. We were able to view materials the department made available on allowable uses and documentation requirements for IDEA expenditures. We determined that these resources did assist subrecipients in allocating IDEA funding appropriately; however, based on the results of our review, the resources and other control activities were not sufficient to fully mitigate the risks of noncompliance. CRITERIA Allowable Costs Compliance According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 403, Except for where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards . . . (g) Be adequately documented. According to 34 CFR 300.704(c)(3)(i)(A)(2), the state must develop a plan for the high-cost fund. As part of that plan, the state is required to create a definition of a “high need child” that ensures that the cost of the high need child with a disability is greater than 3 times the average per pupil expenditure . . . in that State. According to 2 CFR 200.302(b), The financial management system of each non-Federal entity must provide for the following . . . (3) Records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Additionally, the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 10.03, states, Effective management of an entity’s workforce, its human capital, is essential to achieving results and an important part of internal control. Only when the right personnel for the job are on board and are provided the right training, tools, structure, incentives, and responsibilities is operational success possible. Management continually assesses the knowledge, skills, and ability needs of the entity so that the entity is able to obtain a workforce that has the required knowledge, skills, and abilities to achieve organizational goals. Training is aimed at developing and retaining employee knowledge, skills, and abilities to meet changing organizational needs. Risk Assessment According to Green Book Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. According to Green Book Principle 9.03, “Identification of Change,” Conditions affecting the entity and its environment continually change. Management can anticipate and plan for significant changes by using a forward-looking process for identifying change. Management identifies, on a timely basis, significant changes to internal and external conditions that have already occurred or are expected to occur. Changes in internal conditions include changes to the entity’s programs or activities, oversight structure, organizational structure, personnel, and technology. Changes in external conditions include changes in the governmental, economic, technological, legal, regulatory, and physical environments. Identified significant changes are communicated across the entity through established reporting lines to appropriate personnel. EFFECT Without an effective internal control system, the department risks paying LEAs or vendors for unallowable or ineligible expenses. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should design, implement, and monitor the effectiveness of internal controls over the high-cost reimbursement process to address the risks noted in this finding. Additionally, management should cross-train employees on the requirements of high-cost reimbursements to ensure a knowledgeable person is available to perform primary and secondary reviews, regardless of turnover and leave status. Management should continue to monitor the effectiveness of the service contract reimbursement review process to ensure that all invoices are supported by adequate documentation that fully details the expenditures for which the vendor is seeking reimbursement. MANAGEMENT’S COMMENT The department concurs with this finding. The Chief Academic Officer in conjunction with the Chief Operating Officer will oversee a collaborative process led by the Assistant Commissioner of Student Services & Supports and Chief Financial Officer to design, implement, and monitor the effectiveness of internal controls over the high-cost reimbursement process to address the risks noted in this finding. Additionally, the Assistant Commissioner of Student Services will be responsible for cross-training employees on the requirements of high-cost reimbursements to ensure knowledgeable staff are available to perform primary and secondary reviews, regardless of turnover and leave status. The Office of Academics and the Division of Student Services & Supports should continue to monitor the effectiveness of the service contract reimbursement review process to ensure that all invoices are supported by adequate documentation that fully details the expenditures for which the vendor is seeking reimbursement.

Finding Number 2023-010 Assistance Listing Number 84.027 and 84.173 Program Name Special Education Cluster (IDEA) Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number H027A200052, H027A220052, and H173A200095 Federal Award Year 2020 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.027 Federal Award Identification Number H027A200052 Amount $4,730 Assistance Listing Number 84.027 Federal Award Identification Number H027A220052 Amount $1,500 Assistance Listing Number 84.173 Federal Award Identification Number H173A200095 Amount $7,743 FINDING Department of Education management incurred expenditures, liquidated funds, and reimbursed local educational agencies for expenditures that occurred outside of the Special Education grants’ periods of performance BACKGROUND AND CRITERIA The Individuals with Disabilities Education Act (IDEA) is a federal program to assist states in providing children with disabilities a free, appropriate public education. Federal funding for IDEA is only available to the Department of Education (department) and its subrecipients for a limited time (referred to as the grant’s period of performance).(15) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the IDEA award amount and the period of performance (budget period).(16) The department has 15 months to charge expenditures to each grant award; however, IDEA is governed by the requirements of the Tydings Amendment (Title 20, United States Code, Chapter 31, Section 1225[b]), which extends the period of performance 12 additional months, for a total of 27 months. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 344, the department must liquidate all financial obligations incurred under the federal award within 120 days of the end of the period of performance. (15) According to 2 CFR 200.1, “Period of performance means the total estimated time interval between the start of an initial Federal award and the planned end date, which may include one or more funded portions, or budget periods.” (16) According to 2 CFR 200.1, “Budget period means the time interval from the start date of a funded portion of an award to the end date of that funded portion during which recipients are authorized to expend the funds awarded, including any funds carried forward. . . .” According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards . . . (h) Cost must be incurred during the approved budget period. CONDITION We obtained the population of expenditures charged to the IDEA grants for fiscal year ended June 30, 2023. We performed analytical procedures on the expenditures, comparing the accounting dates to the grant’s period of performance to determine if the expenditures were within each grant’s period of performance. Based on our initial analysis, we noted the following. See Schedule of Findings and Questioned Costs for table. Expenditures Obligated After Period of Performance We identified 233 expenditure transactions totaling $5,111,341 that were charged to IDEA grant awards H173A200095 and H027A200052 that, based on the accounting date, were obligated after the grants’ period of performance. We further tested a nonstatistical, random sample of 25 expenditure transactions from the 233 transactions, totaling $430,967, to determine if the transactions were obligated within the period of performance. Based on a review of supporting documentation, we found that for 16 of 25 expenditure transactions tested (64%), management reimbursed local educational agencies (LEAs) and paid administrative expenses that were obligated after the grants’ period of performance, resulting in $12,377 of known questioned costs and likely questioned costs of $96,986. Expenditure Obligated and Liquidated Outside of Grant’s Period of Performance Based on our initial analysis and inquiry with management, we identified one transaction charged to IDEA grant award H027A200052 for which management had both obligated and liquidated the expenditure transaction outside of the period of performance and approved liquidation date, resulting in $96 in questioned costs. The expenditure was obligated and liquidated in May 2023. Unsupported Adjusting Entry Based on our initial analysis, we identified 8,350 adjusting entry expenditure transactions totaling $14,086,520 that were charged to the IDEA grants during fiscal year 2023. We tested a nonstatistical, random sample of 40 adjusting entry expenditure transactions, totaling $3,659,863 to determine if the original expenditure transaction was obligated within the grants’ period of performance. Based on testwork, we found that for 1 of 40 adjusting entries tested (3%), management did not provide documentation of the original expenditure; therefore, we could not determine if the original expenditure occurred within the grant’s period of performance. As a result, we questioned $1,500 for the unsupported expenditure transaction charged to grant award H027A220052, and likely questioned costs totaled $5,773. Summary of Questioned Costs See Schedule of Findings and Questioned Costs for table. Risk Assessment and Internal Control Criteria We reviewed the department’s December 2022 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with period of performance. Management identified the review of charges to federal grants as a control to mitigate the risk; however, based on the results of our review, the review was not effective in mitigating the risks of noncompliance and resulting questioned costs. According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. According to Green Book Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. CAUSE Management stated that program and fiscal staff are responsible for reviewing and approving expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated and liquidated within the period of performance before approving the expenditures for payment. According to department management, between October 1 and January 30 of each year, the department reviews all LEA reimbursement requests to determine if they are charged to a grant that ended on September 30 of that year. If so, the department contacts the LEA to determine if the reimbursement request contains any expenditures that were incurred after September 30. If there are expenditures incurred after September 30, the department sends the reimbursement request back to the LEA to remove those expenditures. If the reimbursement request contains no expenditures that were incurred after September 30, the department approves the request and processes it for payment. Even though the department management stated they had review procedures in place, we found that the control was not effective in ensuring compliance with the period of performance requirement, and as such, the department paid for expenditures and reimbursed local educational agencies for costs that were not incurred within the authorized period of performance. Per discussion with department management, human error was the cause of the errors noted in this finding. We also identified staff’s inexperience with program requirements due to staff turnover at the department as a potential cause for the human errors management noted. EFFECT When the department does not have adequate internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award and increases the risk that funds will be expended outside of the period of performance. The lack of mitigating controls increases the risk of noncompliance with the federal program requirements and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should design and implement effective control activities to ensure before they reimburse local educational agencies that the agencies incurred the costs during the grant award’s period of performance. In addition, management should carefully evaluate their risk assessments to ensure they include all risks and should implement effective controls to address the risks noted in this finding. Management should update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding. The Chief Financial Officer will collaborate with program teams to create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance. Management will evaluate the effectiveness of the control activities for this risk and update the department’s annual risk assessment to reflect any new controls management implements. The Chief Financial Officer will create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements.

Finding Number 2023-011 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number V048A210042 and V048A220042 Federal Award Year 2021 through 2023 Finding Type Material Weakness and Noncompliance Compliance Requirement Matching, Level of Effort, Earmarking Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING Department of Education management did not have effective internal controls over matching, maintenance of effort, and earmarking requirements and, due to turnover and poor records management, could not provide evidence of compliance BACKGROUND AND COMPLIANCE CRITERIA The U.S. Department of Education (ED) provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006, which was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act (Perkins V). Perkins V provides grants to states to develop the academic knowledge and technical and employability skills of secondary students and postsecondary students. The Tennessee Department of Education (the department) is the pass-through entity for Perkins funds and disburses those funds to local education agencies (LEAs) within the state and the Tennessee Board of Regents. As a recipient of federal funding, the department is subject to federal matching, level of effort – maintenance of effort (MOE), and earmarking requirements.(17) These requirements mandate that the department maintain its fiscal effort from state appropriations for CTE when compared with the preceding years; for example, the department must allocate state resources in fiscal year 2023 that meet or exceed the allocated state resources for fiscal year 2022. The department must also allocate CTE funds received for specific activities in keeping with the following requirements: • not less than 85 percent to Secondary and Postsecondary Career and Technical Education Programs; • not more than 10 percent to State Leadership Activities; and • not more than 5 percent or $250,000, whichever is greater, to State Administration. (17) Federal matching, level of effort, and earmarking requirements for this award are found in Title 20, United States Code, Sections 2391 and 2322. In addition, the department is required to match federal funds reserved for State Administration with non-federal funds, such as state appropriations, on a dollar-for-dollar basis. Annually, ED requires Perkins recipients to submit financial and performance data via the Consolidated Annual Report (CAR). The CAR contains CTE programmatic and financial information and includes the department’s demonstrated compliance with maintenance of effort requirements. Department staff complete the CAR in December using the two most recent fiscal years’ financial data—for example, the CAR submitted in December 2022 included data from state fiscal years 2021 and 2022. CONDITION AND CAUSE Insufficient Internal Controls and Lack of Evidence of Compliance Department management has not developed and implemented policies and procedures to ensure that matching, MOE, and earmarking requirements are met. Management also did not ensure that the former Grants Manager carried out procedures to confirm the department’s compliance with these requirements and did not maintain key documentation as evidence of compliance. There was significant turnover in the department’s staff, and, without documented policies and procedures, management was unable to locate and provide documentation related to supporting calculations that demonstrated the department’s compliance with these requirements. Due to the condition above, we noted the following: Maintenance of Effort According to department management, the former Grants Manager calculated the CTE MOE amounts reported in the CAR for state fiscal year 2023. Due to the employee’s separation and poor records management, department management was unable to locate and provide supporting documentation for adjustments and the final amounts reported in the CAR. We attempted to verify the amounts reported in the CAR, but without sufficient support for those calculations, including adjustments, we were unable to independently verify that the reported MOE numbers were accurate; therefore, we were unable to determine if the department met MOE compliance requirements. Additionally, although management stated they reviewed the calculation at the time it was completed, there was no evidence of the review. Earmarking According to department management, the former Grants Manager accidentally overwrote key earmarking documentation for fiscal year 2023 when working on calculations related to the fiscal year 2024 award. Staff were able to recreate the documentation, and the department complied with earmarking requirements; however, staff were unable to provide the documentation that was originally used to calculate the figures. While management stated they reviewed the calculation, there was no evidence of this review. Matching Because of the department’s lack of policies and procedures and due to the former Grants Manager’s separation, management was not able to describe the process the former Grants Manager used for determining compliance with matching requirements during the audit period. Additionally, because management did not have adequate records management processes in place to ensure continued access to the former Grants Manager’s documentation, department management was unable to provide us with any documentary evidence of the department’s compliance with matching requirements. As a result, we were unable to perform any procedures to independently verify if the department met matching compliance requirements. Current Risk Assessment and Internal Control Criteria Because of the issues we identified, we reviewed the department’s December 2022 Financial Integrity Act Risk Assessment. The department’s risk assessment for CTE states that the risk of the loss of institutional knowledge due to turnover and resulting potential understaffing is mitigated in part by process documentation, including templates, timelines, and historical records; however, based on our work, we found that this control was not operating effectively. Management also identified the risk of noncompliance with federal program regulations and requirements. The controls listed to mitigate this risk include training, assignment of responsibility for each grant to a Grants Manager, and “procedures in place to appropriately monitor and document all grant and subgrant activities”; however, this control activity was not operating effectively. Without having appropriate risk responses to identify, analyze, and respond to changes, management fails to mitigate the risk and increases the likelihood of error and noncompliance. According to “Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,” Title 2, Code of Federal Regulations, Part 200, Section 303, the non-federal entity must establish and maintain effective internal controls over the federal award that provide reasonable assurance that the entity is managing the award in compliance with federal statutes, regulations, and the terms and conditions of the award. The entity must also evaluate and monitor its compliance with statutes, regulations, and the terms and conditions. In addition, Part 200, Section 508, explains that the auditee must provide the auditor with access to personnel, accounts, books, records, supporting documentation, and other information as needed for the auditor to perform the audit required by this part. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government, Principle 10.03, “Design of Appropriate Types of Control Activities,” states, Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. . . . Documentation and records are properly managed and maintained. Also, Principle 12.03, “Documentation of Responsibilities through Policies,” states, Management documents in policies for each unit its responsibility for an operational process’s objectives and related risks, and control activity design, implementation, and operating effectiveness. . . . Additionally, Principle 12.04, “Documentation of Responsibilities through Policies,” states, . . . Management communicates to personnel the policies and procedures so that personnel can implement the control activities for their assigned responsibilities. EFFECT Without appropriate internal controls over matching, MOE, and earmarking requirements, there is a risk that department staff will not comply with all related federal requirements and potentially miscalculate the state’s matching, MOE, and earmarking amounts. If a miscalculation results in the state’s noncompliance, the department risks a reduction of federal funding for CTE activities in subsequent award years, which may impact the department’s ability to provide services to students at Tennessee’s schools. RECOMMENDATION The Commissioner should work with appropriate program and fiscal staff to design and implement sufficient controls for matching, MOE, and earmarking compliance requirements, which includes developing and documenting key processes to ensure ongoing compliance during periods of high turnover. Management should also ensure that the agency maintains supporting documentation, including documentation of review activities, to monitor ongoing compliance. Management should evaluate the effectiveness of the control activities for the risks identified in this finding and update the department’s annual risk assessment to reflect any new controls management implements. MANAGEMENT’S COMMENT The department concurs with this finding. The Assistant Commissioner of CCTE and the Chief Financial Officer will collaborate to create sufficient controls for the calculation of MOE, including a complete supervisory review of their MOE calculations to ensure compliance. Management will evaluate the effectiveness of the control activities for this risk and update the department’s annual risk assessment to reflect any new controls management implements. Internal controls will be developed to ensure that staff responsible for performing and reviewing federal award calculations are aware of current federal requirements. The department’s Office of Finance will serve as a secondary internal check before MOE is submitted. Further, the Chief Operations Officer, Chief Information Officer, and Director of Human Resources will create a process to ensure documents are maintained and are not tied to a specific employee’s hardware, including but not limited to data stored on a physical storage device.

Finding Number 2023-012 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number V048A180042 and V048A200042 Federal Award Year 2018 through 2022 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.048 Federal Award Identification Number V048A180042 Amount $1,619,984 Assistance Listing Number 84.048 Federal Award Identification Number V048A200042 Amount $1,322 FINDING The Department of Education management paid for administrative expenditures that occurred outside of the Career and Technical Education program’s period of performance BACKGROUND The U.S. Department of Education provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006, which was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act (Perkins V). Perkins V provides grants to states to develop the academic knowledge, technical skills, and employment readiness skills of secondary students and postsecondary students. The Tennessee Department of Education (the department) is the pass-through entity for CTE-Perkins funds and disburses those funds to local education agencies within the state and the Tennessee Board of Regents.(18) Federal funding for CTE is only available to the department and its subrecipients for a limited time (referred to as the grant’s period of performance.)(19) Each year, the department receives a grant award notification from the U.S. Department of Education outlining the CTE award amount and the period of performance (budget period.)(20) The department has 15 months to charge expenditures to each grant award based on the budget period; however, CTE is governed by the requirements of the Tydings Amendment (Title 20, United States Code, Chapter 31, Section 1225[b]), which extends the period of performance 12 additional months, for a total of 27 months. According to 2 CFR 200.344, the department must liquidate all financial obligations incurred under the federal award within 120 days of the end of the period of performance. (18) The Tennessee Board of Regents awards CTE funds to eligible community colleges and colleges of applied technology to meet the program objectives for postsecondary students. (19) According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 1, “Period of performance means the total estimated time interval between the start of an initial Federal award and the planned end date, which may include one or more funded portions, or budget periods.” (20) According to 2 CFR 200.1, “Budget period means the time interval from the start date of a funded portion of an award to the end date of that funded portion during which recipients are authorized to expend the funds awarded, including any funds carried forward.” CONDITION AND CAUSE Period of Performance We obtained a population of 10,843 expenditures charged to the CTE grants for the fiscal year ended June 30, 2023. We analyzed the expenditures, comparing the accounting dates to the grant’s period of performance to determine if the expenditures were within each grant’s period of performance. See Table 1. See Schedule of Findings and Questioned Costs for table. Based on our initial analysis, we found 17 expenditure transactions charged to CTE grant award V048A180042 that were outside the grant’s period of performance. We reviewed the supporting documentation for each transaction and determined that for all 17 transactions, department fiscal staff paid for expenditures that were obligated and liquidated outside the grant’s period of performance, resulting in $1,619,984 in federal questioned costs. In addition, based on our initial analysis, we found 259 travel expenditure transactions, totaling $17,317, that were charged to grant award V048A200042 outside the grant’s period of performance. We tested a nonstatistical, random sample of 25 expenditure transactions, totaling $1,322, from the population to determine if the costs were obligated and liquidated during the grant’s period of performance. Based on our testwork, we found that for 25 of 25 expenditure transactions tested (100%), management reimbursed for travel expenses that were outside of the grant’s period of performance, resulting in $1,322 in known questioned costs and $17,317 in likely questioned costs. Management stated that program and fiscal staff are responsible for reviewing and approving expenditures, including invoices, accounting data, and any other supporting documentation in Edison, the state’s accounting system, to ensure that the expenditures were obligated and liquidated within the period of performance before approving the expenditures for payment. Even though department management stated they had controls in place, we found that the review controls were not effective to ensure compliance with the period of performance requirements. As such, the department paid for expenditures that did not occur within the authorized period of performance. Per our discussion with department management, human error caused the errors noted in this finding. We also identified staff turnover, and resulting inexperience with program requirements, as a potential cause for the human errors that management noted. Risk Assessment We reviewed the department’s December 2022 Financial Integrity Act Risk Assessment and determined that management listed the risk of noncompliance with period of performance. Management identified the review of charges to federal grants as a control to mitigate the risk; however, based on the results of our review, this review was not effective in mitigating the risks of noncompliance and resulting questioned costs. CRITERIA Period of Performance According to 2 CFR 200.303, The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to 2 CFR 200.403, Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. . . (h) Cost must be incurred during the approved budget period. Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to the Green Book, Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. According to Green Book Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have adequate internal controls in place to ensure expenditures occurred within the grant’s period of performance, management cannot ensure that expenditures will be charged to the appropriate grant award, which increases the risk that funds will be expended outside of the period of performance. The lack of mitigating controls increases the risk of noncompliance with the federal program requirements and may require the state to return these funds to the U.S. Department of Education. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208 (c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should develop adequate control procedures to ensure that expenditures occurred during the grant award’s period of performance. In addition, management should carefully evaluate their risk assessments to ensure they include all risks and should implement effective controls to address the risks noted in this finding. Management should update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. MANAGEMENT’S COMMENT The department concurs with this finding. The Chief Financial Officer will collaborate with program teams to create sufficient controls for reviewing and approving reimbursement requests to ensure requests are within the period of performance. Management will evaluate the effectiveness of the control activities for this risk and update the department’s annual risk assessment to reflect any new controls management implements. The Chief Financial Officer will create professional development to ensure that staff responsible for reviewing and approving reimbursement requests understand the federal requirements.

Finding Number 2023-013 Assistance Listing Number 84.126, 93.575, and 93.667 Program Name Rehabilitation Services Vocational Rehabilitation Grants to States Child Care and Development Fund (CCDF) Cluster Social Servies Block Grant Federal Agency Department of Education Department of Health and Human Services State Agency Department of Human Services Federal Award Identification Number H126A230063, 2301TNCCDD, and 2301TNSOSR Federal Award Year 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.126 Federal Award Identification Number H126A230063 Amount $5,601 Assistance Listing Number 93.575 Federal Award Identification Number 2301TNCCDD Amount $291,339 Assistance Listing Number 93.667 Federal Award Identification Number 2301TNSOSR Amount $33,651 FINDING For three federal programs, Department of Human Services management obligated expenditures outside the period of performance BACKGROUND Federal funding for the Department of Human Services’ (the department) federal programs is only available to the department for a limited time (referred to as the grant’s period of performance). Each year, the department receives grant award notifications from federal agencies, such as the U.S. Department of Health and Human Services and the U.S. Department of Education, which outline the federal grant award amount and the period of performance. The department administers its grants using the federal fiscal year, which is from October 1 through September 30.(21) (21) Our audit period is from July 1, 2022, through June 30, 2023. Child Care and Development Fund The Child Care and Development Fund (CCDF) is a federal program that provides childcare subsidies to low-income families to allow parents to work or attend educational or training programs. The program also promotes overall childcare quality for all children. As of July 18, 2023, the department received $214,056,377 in grant funds for award number 2301TNCCDD,(22) which had a period of performance beginning October 1, 2022. (22) This is a three-year grant and will end on September 30, 2025. Social Services Block Grant The Social Services Block Grant (SSBG) provides funds to states to help families, individuals, or groups of individuals achieve or maintain economic self-sufficiency; prevent or remedy the neglect, abuse, or exploitation of children and adults who cannot protect their own interests; preserve, rehabilitate, and reunite families; and provide community- or home-based care, other forms of intensive care, or when necessary, assist with institutional care. As of June 30, 2023, the department received $33,727,138 in SSBG grant funds for award number 2301TNSOSR,(23) which had a period of performance beginning October 1, 2022. (23) This is a two-year grant and will end on September 30, 2024. Rehabilitation Services Vocational Rehabilitation Grants to States The Rehabilitation Services Vocational Rehabilitation Grants to States (VR) program assists states with operating a comprehensive, statewide program to provide services that help individuals with disabilities prepare for and engage in gainful employment. During fiscal year ended June 30, 2023, the department received a $62,120,561 grant, award number H126A230063, which had a period of performance beginning October 1, 2022. Edison Projects When a new grant is received, the department’s fiscal staff establishes the grant in Edison, the state’s accounting system, with corresponding project IDs, which identify the federal grant program and grant funding period. Project IDs are used to track expenditures by grant program. Department’s Expenditure Approval Process Department programs are responsible for reviewing and approving program expenditures, including the invoices, accounting data, and any other supporting documentation, to ensure the expenditures are accurate and allowable under the federal program. To complete the process, fiscal staff process payments with related supporting documentation through Edison, verifying the service date (the date the expenditure was incurred). Fiscal Management’s Process to Ensure Period of Performance Compliance Fiscal management meets quarterly with program management to discuss the federal requirements and review period of performance as fiscal staff complete federal reporting requirements. In the meetings, fiscal and program management discuss whether the department is complying with all federal requirements, including period of performance, relative to the beginning and end of the grant period. When preparing federal reports, fiscal staff initiate an Edison query, called the General Ledger Expenditure query, to evaluate expenditures for period of performance compliance. Staff analyze the query’s data and enter the data into the required federal report. CONDITION, CRITERIA, AND CAUSE To determine if fiscal management properly recorded federal program expenditures during the grant’s period of performance, we analyzed all expenditures charged to the 2023 federal fiscal year CCDF, SSBG, and VR grants from October 1, 2022, through June 30, 2023 (see Table 1). See Schedule of Findings and Questioned Costs for table. Based on our analysis of expenditures charged to the 2023 CCDF, SSBG, and VR grants, we determined that the key control to ensure that management complied with each grant’s period of performance requirement was not sufficient to prevent the department from charging expenditures obligated outside of a grant’s period of performance. Results of Analysis Based on our expenditure analysis, which included the service date, we found that the department’s fiscal staff charged expenditures to the 2023 CCDF, SSBG, and VR grants that were actually incurred before October 1, 2022, the start date for each grant’s period of performance; therefore, these expenditures should have been charged to earlier grants. See Table 2. See Schedule of Findings and Questioned Costs for table. Title 2, Code of Federal Regulations (CFR), Part 200, Section 1, defines period of performance as “the total estimated time interval between the start of an initial Federal award and the planned end date.” According to federal regulations, the department may charge costs related to the federal grant award if the expenditure was obligated during the grant awards’ period of performance.(24) (24) The requirements set forth in 45 CFR 75.309(a) apply to CCDF and SSBG. 2 CFR 200.211, which applies to VR, requires federal awarding agencies to provide the period of performance start and end date in their grant award notifications. According to the Fiscal Director, management agreed with the errors noted and stated that the Edison General Ledger Expenditure query, which management uses to monitor period of performance compliance, was not sufficient because it does not include the service date. To correct this issue in the future, the Fiscal Director stated that fiscal services will reconcile the General Ledger Expenditure query to another Edison query—the Edison Federal Project query—which includes the expenditures’ service date, at least monthly for the first quarter of each federal fiscal year and quarterly after that, as part of their monitoring process. During fieldwork, we verified that fiscal management had corrected the errors noted in Table 2. See Schedule of Findings and Questioned Costs for table. Risk Assessment In the department’s 2022 Financial Integrity Act risk assessment, the department identified the risk of expenditures being charged to grants that are outside the period of performance and identified three controls to mitigate the risk: 1. Fiscal staff review of items charged to federal grant projects; 2. Fiscal management review of trends in actual results period over period; and 3. Close projects to procurement and accounts payable. However, based on the results of our review, the controls in place did not identify the condition noted in this finding. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, “Identify, Analyze, and Respond to Risks,” 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When the department does not have sufficient internal controls in place to ensure expenditures occur within the grant’s period of performance, management cannot ensure that expenditures are charged to the appropriate grant award, and the department increases the risk that funds will be expended outside of the period of performance in violation of federal requirements. The lack of sufficient mitigating controls increases the risk of noncompliance with the federal program requirements and may require the state to return these funds to the federal granting agency. Additionally, federal regulations address actions that the U.S. Department of Health and Human Services (HHS) may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 45 CFR 75.207(b),(25) “Specific award conditions,” These additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 45 CFR 75.371,(26) “Remedies for noncompliance,” outlines additional actions HHS may take. Depending on the circumstances, these actions may include • withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the award, • initiating suspension or debarment, • withholding awards, or • pursuing other legal remedies. (25) For non-HHS programs, language comparable to 45 CFR 75.207(b) can be found in 2 CFR 200.208(c). (26) For non-HHS programs, language comparable to 45 CFR 75.371 can be found in 2 CFR 200.339. RECOMMENDATION The department’s fiscal management should actively monitor the most recent corrective action they put in place to address the condition noted in this finding to ensure expenditures are charged to the correct federal grant awards. If management identifies expenditures charged to the wrong grant awards, management should take immediate action to correct the errors. MANAGEMENT’S COMMENT We Concur. The Department of Finance and Administration, which staffs the Department of Human Services accounting office, monitors the Department of Human Services’ period of performance compliance requirements. Unfortunately, the Edison query used to perform the review only included the accounting date, not the service date. Once discovered, fiscal management immediately corrected the monitoring deficiency by reconciling two Edison queries to capture both the accounting and service dates. Correcting journals were posted and verified by the auditors during their field work. The Department’s 2024 Financial Integrity Act risk assessment has been updated to include this review process as a control performed during our month-end close process.

Finding Number 2023-014 Assistance Listing Number 93.575 and 93.596 Program Name Child Care and Development Fund (CCDF) Cluster Federal Agency Department of Health and Human Services State Agency Department of Human Services Federal Award Identification Number 2201TNCCDM, 2301TNCCDD, and 2301TNCCDF Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Allowable Costs/Cost Principles Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 93.575 Federal Award Identification Number 2301TNCCDD Amount $22,489 Assistance Listing Number 93.596 Federal Award Identification Number 2201TNCCDM Amount $17,114 Assistance Listing Number 93.596 Federal Award Identification Number 2301TNCCDF Amount $32,563 FINDING The Department of Human Services management did not follow their established process to ensure expenditures complied with Child Care and Development Fund program requirements, resulting in $91,199 in federal and state questioned costs BACKGROUND The Tennessee Department of Human Services (the department) administers the Child Care and Development Fund (CCDF), a federal program that provides subsidies for child care. CCDF funds the state’s Child Care Certificate Program, which helps Families First(27) participants, parents transitioning from the Families First program, teen parents, and other individuals obtain child care. To participate in the Child Care Certificate Program, children must be declared eligible by department staff or, for children in foster care or protective services, by Department of Children’s Services staff. Guardians receiving assistance through the Child Care Certificate Program may enroll their children in any child care provider of their choice. In order to receive payments for child care services through the Child Care Certificate Program, the department maintains a contract with each provider that includes payment terms and the program’s requirements. (27) The federal Temporary Assistance for Needy Families program. Child Care Assistance Payments To receive payment for services, child care providers must submit Enrollment Attendance Verification (EAV) forms electronically through the department’s Provider Portal. An EAV form is the provider’s record of each child’s attendance at the child care facility. The department pays providers weekly. The department also pays providers the full cost of a child’s care when the child is absent as long as the child has not been absent for more than 20 consecutive days. Once the child exceeds the absence allowance, department management continues paying the provider while they follow up with the child’s family to determine whether the child should be disenrolled from the provider’s care. Child Care Assistance EAV Review During our scope period, department staff relied on a manual EAV review process from July through March and changed to an automated EAV review process starting in April. Beginning in April 2022, providers submit attendance information and EAVs every Friday in the Provider Portal. The EAVs are then electronically transferred to NextGen, the department’s system of record for child care assistance payments, where the attendance information is analyzed for discrepancies. Child Care staff run an EAV report in NextGen that is used to create an EAV exception report. EAV Exception Review Prior to January 2023 (Manual Process) The EAV exception report shows what the provider reported for child care attendance and notes any providers with discrepancies between attendance information and payments for the child, such as if a child has been absent for more than 20 consecutive days but the provider still received payment. Once the EAV exception report is created, department management upload it into a shared Google document, which regional supervisors use to contact the child’s guardian and/or provider within 7 days after the child’s 20th day absent. If the regional employee receives no response from both the provider and guardian, then the regional employee manually disenrolls the child from the provider in the Tennessee Child Care Management System (TCCMS), the child care assistance eligibility system. When a child is disenrolled, the provider can no longer claim the child on an EAV. EAV Exception Review After January 2023 (Automated Process) In January 2023, management implemented an automated follow-up process. If the provider and guardian consent to receive electronic communications, TCCMS sends an automated notification to the provider and guardian at the 24- and 48-hour mark after the child reaches 20 consecutive absences. Beginning in April 2023, TCCMS automatically disenrolls the child and transfers the disenrollment to NextGen to prevent the provider from claiming the child on an EAV. If the provider or guardian did not consent to receive electronic communications, or the child is eligible through Families First or the Department of Children’s Services, department staff must manually follow up with the provider and guardian. EAV Payment Process When providers submit EAV forms, NextGen processes them for accuracy and then transmits correct EAV invoices to Edison, the state’s accounting system, to process the payments. If the EAV has an error, NextGen places the EAV in pending or special handling status. An account technician reviews it in NextGen and works with program management and the provider to make corrections. NextGen then reprocesses the EAV and sends it to Edison for payment. CONDITION AND CAUSE From a population of 183,540 expenditure transactions, totaling $161,010,079, charged to the CCDF program for child care assistance, we selected a sample of 60 providers that the department paid a total of $20,669,599 for child care assistance for the fiscal year to determine if the department complied with the CCDF program requirements. Based on our review of all 60 providers’ weekly EAVs for the fiscal year, we found that the department overpaid child care assistance to 11 of the 60 providers for 34 children who were absent for more than 20 consecutive days. These overpayment errors occurred for providers under the department’s manual EAV review process. We did not find any issues involving provider payments that were subject to EAVs processed through the department’s automated EAV review process. As a result of our review and the errors noted, we identified a total of $91,199 in federal and state questioned costs ($72,166 in federal questioned costs and $19,033 in state matching funds). Based on our discussion with the department’s Director of Compliance, although management had a control in place to prevent overpayments, the high number of EAV exceptions impeded management’s implementation of the control. With the implementation of the automated process in April, the Compliance Director believes this will no longer be an issue. We will examine the automated EAV review process during the next audit. CRITERIA According to Title 45, Code of Federal Regulations, Part 98, Section 21(a), A Lead Agency shall re-determine a child's eligibility for child care services no sooner than 12 months following the initial determination or most recent redetermination, subject to the following . . . (5) Notwithstanding paragraph (a)(1), the Lead Agency may discontinue assistance prior to the next re-determination in limited circumstances where there have been: (i) Excessive unexplained absences despite multiple attempts by the Lead Agency or designated entity to contact the family and provider, including prior notification of possible discontinuation of assistance; (A) If the Lead Agency chooses this option, it shall define the number of unexplained absences that shall be considered excessive. The Child Care and Development Fund (CCDF) Plan for Tennessee, which applies to federal fiscal years 2022 through 2024, states, Absences would not impact payment for a given child unless the child was absent for more than 20 days in a row. After an absence of 20 consecutive days, the Lead Agency would reach out to the family to confirm that the child was not returning to care before stopping the payments to the provider. EFFECT When department management and staff do not ensure internal controls are implemented and operating as intended, management increases the risk of continuing to pay child care providers for children who are no longer attending. They also increase the risk of errors, fraud, waste, and abuse. Additionally, federal regulations address actions that the U.S. Department of Health and Human Services (HHS) may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 45 CFR 75.207(b), “Specific award conditions,” These additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 45 CFR 75.371, “Remedies for noncompliance,” outlines additional actions HHS may take. Depending on the circumstances, these actions may include • withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the award, • initiating suspension or debarment, • withholding awards, or • pursuing other legal remedies. RECOMMENDATION Department management should ensure that the internal controls related to the new automated EAV exception review process are effective to timely identify and address children with 20 consecutive absences. Management should seek other alternatives to address high volumes of system exceptions when necessary. Finally, management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, obtain documentation for deficiencies noted, and seek to recover any funds paid out on behalf of children who were ineligible for the program. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT We concur. The Department concurs with the finding that management did not follow their established process to manage extended absences, resulting in federal and state questioned costs. Since April 2023, absences over twenty consecutive days have moved to an automated process. The Department will continue with the automated process to ensure extended absences and child enrollments are managed properly. The NextGen System sends EAV exception files on all weekdays to TCCMS. If the file has one of the exceptions for 20 days consecutive absences, TCCMS will send the first notice to the parent/guardian on the day it is received for the child, then sends a 2nd notice, and after 48 hours terminates the child’s enrollment with the provider, so long as the parent did not contact the Child Care Specialist. The timeframe for this process related to twenty consecutive days absences is established by Tennessee’s program policies and is not federally mandated. The Department is reviewing each child on the excessive absences report from the audit to determine the overpayment amount and has started the process to recoup payment. The Department’s 2024 Financial Integrity Act risk assessment will be updated to include establishing and strengthening internal controls for risks identified in the finding.

Finding Number 2023-015 CFDA Number 84.002 Program Name Adult Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Labor and Workforce Development Federal Award Identification Number V002A200043, V002A210043, and V002A220043 Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING Adult Education management did not obtain and review subrecipients’ single audits to ensure programmatic monitoring requirements were met BACKGROUND The Adult Education – Basic Grants to States program administered by the Division of Adult Education (the division) within the Department of Labor and Workforce Development (the department) provides grants to 14 eligible agencies (subrecipients) to provide adult education and literacy services. These grants help adults become literate and obtain the knowledge and skills necessary for employment, obtain the educational skills necessary to become full partners in the educational development of their children, and complete secondary school education. Federal grantors and the state’s Central Procurement Office (CPO)(28) require agencies that distribute grant funds to monitor the grantees’ activities as necessary to ensure they use grant funds for authorized purposes in compliance with federal and state statutes, regulations, and any applicable terms and conditions. State regulations also require the department to provide sufficient oversight of their subrecipients to ensure they are complying with all grant funding requirements. (28) CPO is administratively attached to the state’s Department of General Services and is responsible for the state’s procurement and contracting processes, for which CPO circulates guidance and additional resources to the state’s various entities. To ensure state agencies comply with both federal and state monitoring requirements for grantees, CPO Policy 2013-007, “Grant Management and Subrecipient Monitoring Policy and Procedures,” established guidelines for grantor state agencies. The policy requires each state agency to develop and submit the annual monitoring plan to CPO for review by October 1 of each year. The monitoring plan is a summary of the grantor state agency’s planned monitoring activities for the upcoming annual monitoring cycle. The plan must include all awards of state and federal funds and non-cash assistance, and the agency must also evaluate each grantee’s risk of noncompliance based on the following factors: • the grantee’s prior grant experience; • the results of prior audits and federal monitoring, including single audits; and • new personnel or new or significantly modified information systems. The department’s responsibility for monitoring includes both program and fiscal activities. For the Adult Education program, division staff are responsible for monitoring the subrecipients’ programmatic activities, and the department’s Performance Accountability Review (PAR) Unit staff are responsible for monitoring fiscal-related activities. During our audit we found that division staff and PAR staff completed subrecipient monitoring of each subrecipient; however, the division’s subrecipient monitoring did not include reviewing the subrecipient’s single audit. CRITERIA, CONDITION, AND CAUSE As the pass-through entity, the department is required by 2 CFR 200.332 to verify that all subrecipients that spend $750,000 or more in federal, state, and/or federal/state combined obtain a single audit within nine months after the subrecipient’s fiscal year-end. When the subrecipient’s single audit includes audit findings, the department must issue a management decision within six months of the audit report’s release, indicate if the subrecipient agreed with the finding, and describe any corrective action the subrecipient must take. To obtain an understanding of management’s subrecipient monitoring procedures, we met with management, and based on our discussions, we determined that for fiscal year ended June 30, 2023, management did not • obtain and review subrecipients’ single audit reports and issue management decisions on findings as required by 2 CFR 200.332, and • assess subrecipients’ single audits as part of their risk-based monitoring plan in accordance with CPO Policy 2013-007. While the PAR unit did obtain and review subrecipients’ single audit reports for those subrecipients that were monitored through fiscal-related activities, according to the division’s Assistant Commissioner, no one was assigned the responsibility for reviewing the subrecipients’ single audits for the programmatic activities or issuing management decisions. As of October 31, 2023, the division has designated a new point of contact for receiving single audit reports. The new point of contact will work with the Adult Education program to develop a process to obtain and review the single audit reports for programmatic requirements. Risk Assessment We reviewed the department’s 2022 Financial Integrity Act Risk Assessment and noted that management identified risks associated with the failure to review subrecipient single audit reports, but management failed to implement controls to mitigate these risks. Green Book Principle 7.09 states that management may conduct periodic risk assessments to evaluate the effectiveness of their actions to address the risk. When necessary, management should update their mitigating controls based on those periodic risk assessments if the effectiveness of their internal control is no longer valid or insufficient. EFFECT When programmatic program management does not obtain and review subrecipients’ single audit results as required by federal regulations and state policy, management increases the risk that it will not promptly identify subrecipients’ noncompliance and/or control deficiencies that require subrecipients’ corrective action. Additionally, failure of the programmatic monitors to review the single audits reduces the effectiveness of management’s risk assessments for each subrecipient, increasing the risk that a higher-risk subrecipient is not identified and monitored. RECOMMENDATION The Commissioner should ensure that programmatic program personnel are aware of all required monitoring responsibilities, including reviewing subrecipients’ single audit reports, issuing management decisions, and obtaining subrecipients’ corrective action plans when necessary. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT We concur. We have assigned our administrator over grants and budgets to begin receiving subrecipients’ single audit reports and to involve our Adult Education management in reviewing audit findings and issuing management decisions, when applicable. We have revised our subrecipient risk assessment to include single audits as one of the risk factors. In addition, we have developed standard operating procedures concerning receiving and reviewing subrecipient audit reports. Management has added this SOP to the department’s internal risk assessment. Also, management will monitor the procedures to ensure that the process is functioning properly.

Finding Number 2023-016 Assistance Listing Number 17.258, 17.259, and 17.278 Program Name Workforce Innovation and Opportunity Act (WIOA) Cluster Federal Agency Department of Labor State Agency Department of Labor and Workforce Development Federal Award Identification Number 23A55AY000009, AA-28344-16-55-A-47, AA-30740-17-55-A-47, AA-32192-18-55-A-47, AA-33257-19-55-A-47, AA-34796-20-55-A-47, AA-36347-21-55-A-47, and AA-38557-22-55-A-47 Federal Award Year 2017 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding 2022-005 Pass-Through Entity N/A Questioned Costs N/A FINDING For the third year in a row, the Workforce Services Division management did not ensure that program staff performed required programmatic subrecipient monitoring BACKGROUND The Workforce Innovation and Opportunity Act (WIOA) cluster of federal programs helps participants overcome barriers to obtaining employment by providing education, training, job search, and other support services. The WIOA cluster consists of three core programs: Adult, Dislocated Worker, and Youth. The U.S. Department of Labor (USDOL) awards funding for these programs through formula grants to states. In Tennessee, the Workforce Services Division (the division) within the Tennessee Department of Labor and Workforce Development (the department) administers WIOA programs. American Job Centers The WIOA cluster of programs provides employment services to individuals through a network of American Job Centers (job centers).(29) Individuals may visit a job center to determine whether they are eligible to receive services and, if so, obtain free employment assistance. The division awards grants to nine subrecipients, known as Local Workforce Development Boards (development boards),(30) to oversee the job centers in their Local Workforce Development Area (local area). Each development board serves multiple counties, contracts with a One-Stop Operator to manage the operations of the job centers, and appoints a Fiscal Agent who is responsible for the accounting and finances for the job centers. (29) The Workforce Investment Act of 1998 established One-Stop centers, which were physical locations where individuals may visit and determine if they are eligible for employment assistance from a variety of federal programs. When WIOA repealed and replaced the Workforce Investment Act, it changed the name of One-Stop centers to American Job Centers. (30) According to 20 CFR 679.300, the Local Workforce Development Board “is to serve as a strategic leader and convener of local workforce development system stakeholders.” For fiscal year 2023, the department’s expenditures for the WIOA Cluster totaled $43,639,761. The expenditures for each program are outlined in Table 1. See Schedule of Findings and Questioned Costs for table. Monitoring Requirements Federal grantors and the state’s Central Procurement Office (CPO)(31) require agencies that distribute grant funds to monitor grantees’ activities as necessary to ensure they use grant funds for authorized purposes in compliance with federal and state statutes, regulations, and any applicable terms and conditions. State regulations require the department to provide sufficient oversight of their subrecipients to ensure they are complying with all grant funding requirements. Specifically, Title 29, United States Code, Chapter 32, Section 3244(a)(4), “Monitoring,” states, “Each Governor of a State shall conduct on an annual basis onsite monitoring of each local area within the State to ensure compliance with the uniform administrative requirements.” (31) CPO, administratively attached to the state’s Department of General Services, is responsible for the state’s procurement and contracting processes and provides guidance and additional resources to the state’s entities. For the WIOA cluster of programs, the department divides its responsibility for monitoring between program and fiscal activities (discussed next). Workforce Services Division staff are responsible for monitoring the subrecipients’ programmatic activities, and the department’s Program Accountability Review (PAR) Unit staff are responsible for monitoring fiscal-related activities. Quarterly Desktop Program Monitoring Division staff perform programmatic monitoring through two methods: quarterly desktop reviews and annual on-site reviews. Desktop reviews include reviewing participant eligibility determinations, which are used to support the required annual on-site reviews. Division staff document monitoring review results and instances of noncompliance by generating quarterly monitoring reports that detail any identified issues classified as either a finding, observation, or concern. After the division’s Program Integrity Unit (PIU) reviews the quarterly reports, division staff send the reports to the subrecipients to notify them of the deficiencies and to set expectations for corrective action. Subrecipients communicate with PIU staff to follow up on findings identified in their quarterly monitoring reports and submit corrective action plans for the identified deficiencies. Joint Annual On-site Monitoring Reviews Program On-site Monitoring Activities During the annual joint on-site visit, the division staff follow a checklist to ensure that each job center has all required items available. These items include Equal Opportunity posters, Comptroller fraud hotline posters, and Adult Education posters. Additionally, the PIU monitors observe job center staff performing the daily processes, and then the monitors document the effectiveness of the center’s operation on the monitoring checklist. Fiscal On-site Monitoring Activities PAR Unit staff are responsible for monitoring fiscal-related activities. For example, PAR staff review the allowability of the expenditures included in the subrecipients’ fund reimbursement requests. PAR compiles a list of expenditures for each subrecipient to be monitored to select a random sample to test during the visit. Because it can take time to obtain the documentation, management notifies the subrecipient of the sample expenditures selected and encourages the subrecipient to provide the information before the on-site visit. Once the PIU and the PAR Unit have completed the annual on-site review, the results of the review are combined into a monitoring report for each subrecipient. The annual monitoring reports are approved by the Program Integrity Director and then issued to the subrecipients. All corrective action follow-ups are performed by the division’s PIU staff. PRIOR AUDIT RESULTS Our prior audit reported a finding related to the WIOA subrecipient monitoring, which included the following conditions: • division staff did not conduct on-site programmatic monitoring of subrecipients for the Adult, Youth, or Dislocated Worker programs; • division staff did not conduct any desktop programmatic reviews during three quarters and only conducted a desktop programmatic review for one of nine subrecipients in quarter 4 for the Adult, Youth, or Dislocated Worker programs; and • division staff did not follow the ETA’s Core Monitoring Guide for all reviews and as such did not adequately monitor relevant program requirements such as participant eligibility. Management concurred with the prior finding and stated the development board’s single audit reports will be reviewed by September 2023, and a review will occur from both a programmatic and fiscal perspective. Management also stated the development boards will be notified of any need for corrective action, and Internal Audit will be notified of actions taken by the division and the department’s Finance and Administration staff. Management also noted in their six-month follow-up on the finding that subrecipient monitoring would be conducted through desktop file reviews and annual on-site reviews. CURRENT AUDIT RESULTS As part of our current audit and based on discussions with management and our review of current policies and procedures, we determined that the department developed a tracking system to document when subrecipient single audit reports were received and reviewed. Additionally, we determined that management implemented programmatic monitoring procedures to ensure subrecipients were monitored based on federal and state compliance requirements; however, we still identified the following monitoring deficiencies. CONDITION, CRITERIA, AND CAUSE Management Failed to Develop Controls to Ensure Documentation for Monitoring Was Maintained According to management, during the scope of our audit, PIU monitors were able to complete annual on-site reviews(32) for three subrecipients; however, PIU staff did not maintain monitoring working papers for these reviews. Therefore, we were not able to determine whether these on-site reviews occurred and/or whether the monitoring reviews were adequate. Additionally, management stated that PIU monitors did quarterly desktop programmatic monitoring for all nine subrecipients. Once again, management was not able to provide monitoring working papers for the desktop programmatic review, so we were not able to determine whether the monitoring occurred or that the monitoring activities were adequate. See Monitoring Requirements section above for specific monitoring criteria. (32) The other six subrecipients’ annual on-site monitoring reviews were ongoing during our audit. According to division management, the on-site programmatic monitoring was documented manually on paper copies; however, these copies could not be located and were never uploaded into the system because management had not developed a process to collect and upload these documents into the department’s shared network. We did note that the PAR Unit did have working papers for fiscal monitoring of all nine subrecipients. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) offers guidance to management for developing internal controls and maintaining documentation. Principle 10, “Design Control Activities,” 10.03, “Design of appropriate types of control activities,” establishes, Management designs appropriate types of control activities for the entity’s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system. Principle 10 further describes in “Appropriate documentation of transactions and internal control,” Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. The documentation may appear in management directives, administrative policies, or operating manuals, in either paper or electronic form. Documentation and records are properly managed and maintained. Management Failed to Develop Controls to Ensure Subrecipients Submitted Corrective Action Plans and That the Department’s Program Monitors Issued Corrective Action Resolution Letters According to management, the PIU monitors are responsible for ensuring subrecipients take corrective action for all findings identified in the subrecipient monitoring reports, both program and fiscal. Based on our audit work, management could not provide us with corrective action plans or management’s resolution letters for two of three subrecipients (66%) that had findings as part of their on-site and quarterly monitoring results. Title 29, United States Code, Chapter 32, Section 3244(a)(5), states that when a state determines a local area is not in compliance, the state must require corrective action to ensure the local area is in compliance. Division management stated that specific staff within the PIU conduct corrective action follow-ups for both on-site and desktop reviews. We found, however, that staff did not have a process in place for documenting and tracking subrecipient follow-ups. Management noted that, moving forward, a tracking tool has been created that will document all monitoring efforts, including both annual on-site and quarterly desktop reviews. The new tracking method will also enable the Workforce Services Division to keep track of deficiencies noted during monitoring and will alert staff when corrective actions are due. Additionally, management is in the process of finalizing the Standard Operating Procedure for the quarterly monitoring to establish a uniform approach in distinguishing findings, concerns, and observations. Risk Assessment We reviewed the department’s 2022 Financial Integrity Act Risk Assessment and noted that the program management did not identify any risks related to subrecipient monitoring for programmatic activities and, as such, did not design and implement effective controls. Green Book Principle 7, “Identify, Analyze, and Respond to Risks,” 7.02, “Identification of Risks” states, “Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.” EFFECT When program management does not maintain appropriate and sufficient monitoring documentation, it increases the risk that management may be unaware of deficiencies identified at the subrecipient level and may not ensure that each subrecipient’s management takes action to correct any noncompliance or areas for improvement identified in the subrecipient monitoring reports. RECOMMENDATION The Commissioner should ensure the Workforce Services Division develops adequate procedures to maintain subrecipient monitoring documentation, including working papers. MANAGEMENT’S COMMENT We concur. Prior findings indicated a lack of on-site and virtual monitoring of Workforce Services programs. Those findings have been resolved as monitoring both on-site and virtual have been and are being conducted. However, due to a lack of work paper management, proof of all reviews was not able to be demonstrated. To resolve this finding, accountability controls have been put in place to allow management to track progress on monitoring conducted and to ensure work papers are maintained. Standard Operating Procedures, effective January 1, 2024, have been developed for both on-site monitoring and case file (i.e., desktop) reviews which include instructions on where we are currently saving working papers. Tracker spreadsheets, effective January 1, 2024, have been developed to track every step in the monitoring process including the submission of reviews conducted by each program. Virtual tools, effective January 1, 2024, have been revised to allow for ease of use and submission upon completion of reviews. Monitoring training was conducted in January 2024 with program units by Program Integrity to ensure new processes are understood and expectations are clearly defined. An Assistant Director position has been hired, effective January 28, 2024, to oversee the monitoring team. This will add a level of management needed to ensure the organization of all divisional monitoring is being conducted, communicated, and tracked. The Workforce Services Risk Assessment has been updated to include a high inherent risk of subrecipient monitoring to include controls to mitigate that risk. The controls to mitigate this risk will be monitored quarterly by reports submitted to Workforce Services management. These reports will show progress on monitoring to include supporting work papers.

Finding Number 2023-017 Assistance Listing Number 17.225 Program Name Unemployment Insurance Federal Agency Department of Labor State Agency Department of Labor and Workforce Development Federal Award Identification Number CARES Act Federal Award Year 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Eligibility Repeat Finding 2022-006 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 17.225 Federal Award Identification Number CARES Act Description Mixed Earner Unemployment Compensation Amount $9,110 Description Pandemic Unemployment Assistance Amount $100 FINDING As noted in the four prior single audits, the Department of Labor and Workforce Development paid Unemployment Insurance benefits to ineligible claimants due to ineffective internal controls BACKGROUND The Unemployment Insurance (UI) program is a federal-state partnership designed to ensure the economic security of workers who lose their jobs through no fault of their own. The U.S. Department of Labor provides grant funding for each state to design and administer its own UI program within federal requirements. In Tennessee, the Department of Labor and Workforce Development (the department) operates the state’s UI program to process claims and issue direct benefit payments to individuals during times of involuntary unemployment. Pandemic Programs On top of its regular(33) and temporary disaster relief programs, the department implemented four programs, listed below, to provide relief in response to the COVID-19 pandemic. The federal government reimburses the department for 100% of the benefits it pays to pandemic program claimants. (33) Regular programs include Tennessee Unemployment Compensation (TUC), Unemployment Compensation for Ex-Servicemembers (UCX), Unemployment Compensation for Ex-Federal Employees (UCFE), and Trade Adjustment Assistance (TAA). Pandemic Unemployment Assistance From January 27, 2020, through July 3, 2021, the Pandemic Unemployment Assistance (Pandemic) program provided temporary benefits to workers who had exhausted or were ineligible for regular Unemployment Insurance (such as part-time workers, the self-employed, and contractors) who lost work for certain COVID-19-related reasons. Pandemic Emergency Unemployment Compensation Pandemic Emergency Unemployment Compensation provided a maximum of 53 additional weeks of benefits to individuals who had exhausted their rights to regular Unemployment Insurance for weeks of unemployment through July 3, 2021. Federal Pandemic Unemployment Compensation Federal Pandemic Unemployment Compensation provided a supplemental weekly payment to individuals who received at least $1 in benefits from another UI subprogram. The weekly supplement was $600 (in addition to the claimant’s other benefits) for weeks of unemployment ending April 4, 2020, through July 25, 2020, and $300 for weeks of unemployment ending January 2, 2021, through July 3, 2021. Mixed Earner Unemployment Compensation Mixed Earner Unemployment Compensation (Mixed Earner) provided a supplemental weekly payment of $100 to individuals receiving benefits other than Pandemic Unemployment Assistance. Their prior earnings had to have included both wages from traditional employment and at least $5,000 from self-employment. Under federal law, all four pandemic programs expired on September 6, 2021. Governor Bill Lee opted to terminate Tennessee’s participation in these programs early, effective July 3, 2021. Throughout fiscal year 2023, the department followed federal guidance by continuing to process and pay backlogged benefits to eligible pandemic claimants for weeks of unemployment ending on or before the program’s termination date. General Eligibility Criteria and Determination Processes for Unemployment Claims The department uses the Geographic Solutions Unemployment System (GUS) application to process eligibility determinations for unemployment claims. Claimants submit an initial application for unemployment benefits in the system via the jobs4tn.gov website, which interfaces directly with GUS. GUS initiates various automated processes to help the department determine the claimant’s eligibility for benefits. If these processes yield information that could potentially disqualify a claimant’s eligibility, GUS flags the claim with an issue and attaches a work item. The work item triggers department personnel to review and resolve the issue on the claim manually. Management has configured business rules(34) in GUS to prevent claims with significant issues from paying benefits until department personnel have reviewed the claims to determine the claimants’ eligibility. (34) Business rules are instructions programmed into GUS directing the system how to process claims in accordance with state and federal eligibility requirements. Weekly Certifications After filing an initial claim for benefits, claimants must file weekly certifications via jobs4tn.gov to attest to their continued ability to work and availability for work, disclose income earned during the week, and report on work search activities. GUS automatically disqualifies the week as ineligible for payments if a claimant certifies no longer being unemployed, earning excess income, or not actively searching for and available to accept suitable work. PRIOR AUDIT RESULTS Our prior audit reported a finding, with multiple deficiencies, related to UI eligibility. Management concurred with the prior finding and attributed the conditions to the impact of the COVID-19 pandemic on claims volume and system issues. See Table 1 for a list of finding conditions identified in our prior audit and their disposition in the current audit. See Schedule of Findings and Questioned Costs for table. CURRENT AUDIT RESULTS We provide the results of our current audit below. As a result of our review, we identified $9,210 in federal questioned costs for the Mixed Earner and Pandemic programs. In addition, we identified $798 in state questioned costs for improper benefits paid from the unemployment trust fund to ineligible Tennessee claimants. For major programs such as the UI program, Title 2, Code of Federal Regulations (CFR), Part 200, Section 516(a)(3), “Audit findings,” requires us to report known and likely questioned costs greater than $25,000 for a type of compliance requirement for a major program. While cumulative known questioned costs for all errors did not exceed $25,000, we determined that likely questioned costs exceeded $25,000. CONDITIONS, CRITERIA, AND CAUSE Claimants Received Mixed Earner Benefits Without Providing Evidence of Past Earnings From Self-Employment (Repeat Condition) The U.S. Department of Labor issued operating guidance for the Mixed Earner program in Unemployment Insurance Program Letter No. 15-20, Change 3, which states, Individuals who apply for MEUC [the Mixed Earner program] are required to submit documentation substantiating their self-employment income for purposes of the state determining their eligibility for MEUC. . . . Individuals may submit this documentation at any time while the MEUC program is in effect. . . . However, until the individual provides the documentation and the state can determine that it substantiates that the amount of self-employment income meets MEUC eligibility requirements, MEUC payments may not begin. The federal guidance further established that claimants should provide a copy of their income tax return for the most recently completed tax year prior to application for regular unemployment benefits. Acceptable documentation also includes pay stubs, bank receipts, business records, accounting ledgers, invoices, and billing statements that substantiate self-employment income of at least $5,000 for the most recent tax year. As noted in our prior audit findings related to UI eligibility, department management did not design and implement internal controls, including controls integrated in its information systems, that ensured compliance with federal regulations. The existing control structure did not address the risks associated with the number, timing, nature, complexity, and volume of applicants for the federal programs that the department oversees. Specifically, the internal control structure was not designed to manage the number of temporary programs implemented due to the pandemic and natural disasters, in addition to changes in federal guidance for regular programs. While pandemic programs expired in the first week of fiscal year 2022, department management was challenged with continuing to process and pay backlogged claims throughout the year. We obtained the population of 30 claimants who received a total of 264 Mixed Earner payments, totaling $26,310, that the department issued in fiscal year 2023. We tested all 30 claimants for compliance with Mixed Earner eligibility requirements. Based on our testwork, the department issued Mixed Earner benefits without verifying evidence of self-employment earnings for 16 of 30 (53%) claimants tested. We identified a total of $9,110 in known federal questioned costs for improper Mixed Earner payments. Department Staff Paid Unemployment Insurance to a Claimant Who Had Not Contacted Three Separate Employers (New Condition) From the population of 608,685 regular, Pandemic, Trade Adjustment Act, Ex-Federal, and Ex-Service payments, totaling $148,557,672, that the department issued in fiscal year 2023, we selected a proportional sample of 75 benefit payments, to determine compliance with non-monetary eligibility requirements. In general, non-monetary eligibility requires the department to establish that a claimant has lost their most recent employment due to no fault of their own. See Table 2 for our testwork. See Schedule of Findings and Questioned Costs for table. Based on our review, we found for 1 claimant, the department issued benefits totaling $100 when the claimant had used the same 3 job contacts for 5 weeks over the period covered by the claim. This is not allowed under Section 50-7-302(a)(4), Tennessee Code Annotated, and thus results in federal questioned costs. According to management, even though the system should have prevented the payment, management had to assess and respond to the risk of providing benefits to ineligible claimants against the risk of not providing timely benefits to eligible claimants. To help control the volume of new and continuing claims for benefits, management relied on GUS tools designed to reduce manual claims handling. Management stated that these tools, however, did not always work as intended and resulted in unintentionally issuing benefits to ineligible claimants. These tools also did not address the root cause of system incidents, so management encountered recurring problems in GUS that the vendor had previously told management were fixed. EFFECT Without internal control processes designed to address and adapt to periods of high unemployment, the department increases the risk of improper payments to ineligible claimants. By not ensuring the vendor identifies and takes corrective action to fix claims processing errors within GUS, department management increases the risk of information systems controls not operating as designed or achieving the desired result. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of Labor and Workforce Development should work with UI program management to implement internal controls to mitigate the risks of improperly paying ineligible claimants. Management should review the exceptions we identified and, when appropriate, disqualify ineligible claimants and work to recover improper payments. MANAGEMENT’S COMMENT We concur. The department acknowledges that management and the vendor could not design and implement timely internal controls, due to the need to adjudicate pandemic claims quickly while ensuring compliance with all the federal pandemic programs. Regular Tennessee Unemployment Compensation controls could not encompass new federal programs never administered by State Unemployment Insurance within the compliance timeline. However, during and even after the pandemic, the department continued to work through its historic claim load and adjudicate pandemic-related claims as accurately and as timely as possible. The department worked with our vendor to ensure as much integrity as possible during these times. All efforts to alleviate recurring system problems and adjudicate the volume of claims filed during the pandemic were the priority of the division; however, these factors combined led to agency errors. The Assistant Administrator monitors MEUC payments through the daily payment register with a specific line item for MEUC payments. Excerpt of daily email received: There were no claimants with “Stimulus-MEUC” for today. In each case examined by the Comptroller’s Office, the claimant stated they earned $5,000 in self-employment in the prior calendar year. Once the claim was reviewed by staff and proof was not submitted by the claimant, staff denied the MEUC payments, and the claimant was advised of the potential overpayment of benefits of MEUC payments. Management gave claims staff a reference guide to resolving mixed earnings unemployment compensation. Staff was advised they must adjudicate these issues with a determination. The ones that paid in error were incorrectly resolved by staff. Usually, this would be acceptable as erroneous issues are resolved this way, but due to the complexity of this issue it did not resolve in that manner, equating to an approval for MEUC. To prevent payment on MEUC, the non-monetary issue must be denied with a determination. The department worked diligently to correct issues as they arose. The UI program continues to monitor and address risks of improperly paying claimants regardless of the program. Eight claimants received erroneous MEUC payments in 2022, eight in 2023, and only three of those sixteen claimants received MEUC payments after the single audit report was received in 2023. As stated in the finding, the MEUC overpayments did not reach the 25,000-dollar threshold. Minimizing the overpayments was due to the department’s efforts to reduce the payment errors made on this program.

Finding Number 2023-018 Assistance Listing Number 93.568 Program Name Low-Income Home Energy Assistance Federal Agency Department of Health and Human Services State Agency Tennessee Housing Development Agency Federal Award Identification Number 2202TNLIEA and 2102TNE5C6 Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Tennessee Housing Development Agency did not have adequate internal controls to ensure subrecipients obtained a unique entity identifier before the agency awarded federal funds BACKGROUND The U.S. Department of Health and Human Services provides grant funding under the Low-Income Home Energy Assistance Program (LIHEAP) to the Tennessee Housing Development Agency (the agency). The objective of LIHEAP is to help low-income households meet the costs of home energy, increase their energy self-sufficiency, and reduce their vulnerability resulting from energy needs. The agency makes subawards to subrecipients to fulfill the objectives of LIHEAP. CONDITION, CRITERIA, AND CAUSE Management did not have adequate internal controls to prevent the agency from making subawards to subrecipients without obtaining the subrecipients’ unique entity identifier (UEI). As a result, 15 of 19 (79%) LIHEAP subrecipients were not eligible to receive federal funds. Title 2, Code of Federal Regulations (CFR), Part 25, Section 300, states that “a recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier.” Management stated they incorrectly made the subawards because they were not aware of this requirement. In addition, the Federal Award ID sheet, which is part of the contract template, had a spot for the Data Universal Numbering System (DUNS) number, rather than the UEI. Because the agency obtained the UEI from each subrecipient after the audit period, we did not question the costs the agency paid to the subrecipients during the year. EFFECT Because the agency made unauthorized payments to subrecipients without a UEI, management was unable to comply with Federal Funding Accountability and Transparency Act requirements to report subrecipient information. The Act’s subaward reporting system requires a UEI in the subrecipient information. See Finding 2023-019. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • withholding further awards for the project or program, or • pursuing other available legal remedies. Granting subawards to subrecipients who have not obtained a UEI could result in questioned costs. RECOMMENDATION Management should develop procedures to ensure that all subrecipients have obtained a UEI before the agency makes a subaward. Management should also update the Federal Award ID sheet to include the UEI. MANAGEMENT’S COMMENT We concur. As noted in the report, THDA has collected all of the UEI numbers associated with LIHEAP grantees. Because THDA contracts with the same entities annually to administer LIHEAP, this issue is resolved. However, THDA is updating its applications associated with all other federal grant programs to obtain the UEI number at time of application. Program staff will also transmit the UEI numbers to THDA’s accounting team at time of funding the award. Additionally, should a LIHEAP grantee change in future years, THDA will ensure collection of the information prior to entering into the grant award for LIHEAP funds.

Finding Number 2023-019 Assistance Listing Number 93.568 Program Name Low-Income Home Energy Assistance Federal Agency Department of Health and Human Services State Agency Tennessee Housing Development Agency Federal Award Identification Number 2202TNLIEA and 2102TNE5C6 Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entit N/A Questioned Costs N/A FINDING Tennessee Housing Development Agency management did not have effective internal controls over reporting for the Low-Income Home Energy Assistance Program BACKGROUND The U.S. Department of Health and Human Services (HHS) provides grant funding through the Low-Income Home Energy Assistance Program (LIHEAP) to the Tennessee Housing Development Agency (the agency). The objective of LIHEAP is to help low-income households meet the costs of home energy, increase their energy self-sufficiency, and reduce their vulnerability resulting from energy needs. As a condition of the grant, HHS requires the agency to report on the use of federal funds through financial, performance, and special reports. In addition to federal requirements in the Code of Federal Regulations, the HHS Office of Administration for Children and Families, Office of Community Services (OCS), provides guidance to LIHEAP recipients by issuing Action Transmittals. CONDITION, CRITERIA, AND CAUSE The agency did not have adequate internal controls to ensure it provided the federal grantor (HHS) with timely or accurate reports. In addition, management was unable to provide the underlying documentation to support all amounts reported. Management was unable to determine why reports were submitted late or contained errors since the former program director left before we identified the errors. Special Reporting LIHEAP Carryover and Reallotment Report According to Title 45, Code of Federal Regulations (CFR), Part 96, Section 81(b), “Each grantee must submit a [carryover and reallotment] report to [HHS] by August 1 of each year.” The OCS LIHEAP Action Transmittal 2022-05 extended the deadline to submit the report to December 30, 2022. We reviewed the 2022 LIHEAP Carryover and Reallotment Report to ensure management submitted the report timely and reported key line items accurately. We noted that management submitted the report 90 days after the due date. Annual Report on Households Assisted by LIHEAP According to 45 CFR 96.82(a), the agency is required to submit to HHS the Annual Report on Households Assisted by LIHEAP “for the 12-month period corresponding to the Federal fiscal year (October 1–September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance.” Per the OCS LIHEAP Action Transmittal 2023-01, the final data for the Annual Report on Households Assisted by LIHEAP was due on December 30, 2022. We reviewed the 2022 Annual Report on Households Assisted by LIHEAP to ensure management submitted the report timely and reported key line items accurately. We noted that management submitted the report 90 days late. We also noted errors for 14 key line items. In addition, management could not provide support for the number of households reported on the Weatherization Line in Section IV. Management stated that the Energy Housing Program Manager responsible for the report left in September 2023, and management no longer has access to the files she used to prepare the report. See Schedule of Findings and Questioned Costs for table. Quarterly Performance and Management Report LIHEAP Action Transmittal 2022-03 Quarterly Report Instructions Attachment 1 requires grant recipients to submit data and information about LIHEAP through the Quarterly Performance and Management Reports. The quarterly reports “focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility assistance programs, and training and technical assistance needs.” We reviewed the 2022 Quarterly Performance and Management Report for the fourth quarter of the fiscal year to ensure management submitted the report timely and reported key line items accurately. We noted errors for four key line items on the report. See Schedule of Findings and Questioned Costs for table. FFATA Reporting The Federal Funding Accountability and Transparency Act (FFATA) and 2 CFR 170, Appendix A, require the agency to report subrecipient financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. Reports are due no later than the end of the month following the month when the obligation occurred. The subaward information in FSRS is then made available to the public on USAspending.gov for transparency. We reviewed FSRS to determine the agency’s compliance with FFATA reporting. Based on our review of the system and discussion with management, management did not report any of their 19 subawards in FSRS. Management did not report 15 of the 19 subrecipients’ information because management violated 2 CFR 25.300 by making subawards to subrecipients who did not have a unique entity identifier; this number is required to enter subrecipient information into FSRS. See Finding 2023-018. Management stated that the other 4 subrecipients were not entered because of management oversight. Performance Reporting OCS LIHEAP Action Transmittal 2023-02 states that the LIHEAP Performance Data Form is an annual report in response to Title 42, United States Code, Section 8629(b), which requires the Secretary of the HHS to submit a report to Congress containing a detailed compilation of information on home energy consumption; the amount, cost, and type of fuels used for households eligible for assistance; the number and income levels of households assisted; and the number of households that received such assistance and include 1 or more individuals who are 60 years or older or disabled or include young children. We reviewed the LIHEAP Performance Data Form to ensure management submitted the report timely and reported key line items accurately. We noted that management submitted the required report on March 20, 2023, 48 days after the January 31, 2023, due date. We also noted errors on 3 key line items. See Schedule of Findings and Questioned Costs for table. EFFECT When agency staff do not proactively perform procedures to ensure that reports generated are timely and adequately supported, management increases the risk of reporting inaccurate or untimely data to HHS. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • withholding further awards for the project or program, or • pursuing other available legal remedies. RECOMMENDATION Management should implement a system of internal controls that will allow staff to submit required reports to the federal grantor accurately and timely. Management should ensure all reports are reviewed for accuracy by a supervisor prior to submission to the federal grantor. Management should maintain access to former employees’ work files until management can review the files to determine what files should be maintained. MANAGEMENT’S COMMENT We concur. Management is putting into place a reporting schedule of all LIHEAP reports due, with periodic checkpoints between the preparer and supervisor to determine progress and address issues prior to the due dates. Additionally, all documentation (emails, system reports, etc.) supporting the report and values included is required to be stored at the same location as the final report on THDA’s shared drive. Finally, each federal report will be reviewed by a supervisor prior to its submission in order to confirm accuracy of data values and narrative and ensure that supporting documentation is on file.

Finding Number 2023-020 Assistance Listing Number 93.568 Program Name Low-Income Home Energy Assistance Federal Agency Department of Health and Human Services State Agency Tennessee Housing Development Agency Federal Award Identification Number 2202TNLIEA, 2102TNE5C6, 2202TNLIEE, 2302TNLIEA and 2302TNLIEE Federal Award Year 2021 through 2024 Finding Type Material Weakness Compliance Requirement Other Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING Agency management did not establish a key process to ensure that internal controls related to the vendor-hosted THO application were appropriately designed and operating effectively BACKGROUND The Tennessee Housing Development Agency contracted with an information technology (IT) vendor, THO Software Solutions, to develop and maintain a web-based system to administer the Low-Income Home Energy Assistance Program (LIHEAP). THDA also contracts with human resource agencies as the vehicle to provide federal assistance to eligible households through the LIHEAP program. According to THDA’s contract with the vendor, the THO application provides human resource agencies the ability to enter and process LIHEAP applications and generate reports. More specifically, the contract requires that THO • Track duplication of services based on social security numbers and process applications based on THDA specifications if duplicate is found • Allow agencies to update household and LIHEAP application data for households already existing and previously served in the statewide database • Allow agencies to enter new household and LIHEAP application data for households applying for service for the first time • Flag each application with the appropriate agency ID • Provide agencies with the ability to process and pay their own agency LIHEAP applications • Provide the ability to receive LIHEAP regular assistance online applications for households which received a LIHEAP benefit within the past 2 years • Provide LIHEAP agencies with the required reports and reporting ability to successfully create payments, process refunds, and void payments as appropriate • Provide THDA with access to a statewide database for its own reporting requirements. CONDITION AND CAUSE THDA did not evaluate whether the IT contractor implemented relevant internal controls over the processing and storage of agency program data within the THO application or whether the controls implemented were in place and operating effectively to ensure THDA could properly administer the LIHEAP program. While THDA management and internal audit obtained a self-assessment of THO’s controls provided by the vendor and assessed THO as being a critical vendor with moderate risk, THDA did not conduct any specific assessments of THO’s controls. Additionally, when THDA management renewed the contract with THO in 2019, management did not ensure that the contract required THO to provide any type of independent assurance report, such as a System and Organization Controls (SOC) report. According to THDA management, the vendor did not have a SOC report or another equivalent assessment available at the time of our audit. Because the current contract with the IT vendor does not require an independent examination of internal controls, THDA management was unable to obtain assurance of controls by reviewing an independent examination report, such as a SOC report, that described the IT contractor’s internal controls and the auditor’s opinion regarding the effectiveness of controls. Because the current contract with THO expires in September 2024, THDA is currently in the process of creating a Request for Proposal (RFP) to acquire a new contract for an information system to support the LIHEAP program. THDA stated the RFP will include a clause that requires the contractor to provide a SOC 2 Type 2 report for their information system services and to comply with all relevant state security policies. A SOC 2 Type 2 report provides management and other auditors with information regarding the design and effectiveness of internal controls and focuses on data security, availability, processing integrity, confidentiality, and/or privacy. EFFECT Failure to provide an independent audit of internal controls over THO or otherwise obtaining assurance of internal controls prevents agency management from obtaining assurance that the awards were processed and information was collected to comply with the federal requirements. Without an assurance report, we were unable to determine whether THO implemented relevant internal controls and whether those controls operated effectively. Because THO does not have a SOC report available, and since agency management has not gained additional visibility into THO’s relevant internal control environment by other means, the agency may not design and implement appropriate safeguards to address the risks of using THO’s services to support the federal program. SOC audit reports also identify any complementary user entity controls that a service organization, such as THO, would expect its customers to implement to achieve the control objectives specified in the SOC report. Consequently, the agency using the services offered by the information system provider may not have adequate internal controls implemented over its business processes if the agency is not made aware of complementary user entity controls. CRITERIA The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to “Documentation of the Internal Control System,” Sections 3.09 through 3.11 of the Green Book, Management develops and maintains documentation of its internal control system. Effective documentation assists in management’s design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. . . . Management documents internal control to meet operational needs. Documentation of controls, including changes to controls, is evidence that controls are identified, capable of being communicated to those responsible for their performance, and capable of being monitored and evaluated by the entity. “Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,” Title 2, Code of Federal Regulations, Part 200, Section 1, states, Internal controls for non-Federal entities means: (1) Processes designed and implemented by non-Federal entities to provide reasonable assurance regarding the achievement of objectives in the following categories: i. Effectiveness and efficiency of operations; ii. Reliability of reporting of internal and external use; and iii. Compliance with applicable laws and regulations. Best practices in the National Institute of Standards and Technology’s Special Publication 800-53 (Rev. 5), Security and Privacy Controls for Information Systems and Organizations, Section SA-9, “External System Services,” states that “the responsibility for managing risks from the use of external system services remains with the authorizing officials.” Additionally, Section RA-3, “Risk Assessment,” states that risk assessments consider threats, vulnerabilities, likelihood, and impact to organizational operations and assets, individuals, other organizations, and the Nation. Risk assessments also consider risk from external parties, including contractors who operate systems on behalf of the organization, individuals who access organizational systems, service providers, and outsourcing entities. As another source of guidance on best practices, the Center for Internet Security’s CIS Critical Security Controls, Version 8, Control 15, “Service Provider Management,” 15.5, “Assess Service Providers,” recommends that an organization “Assess service providers consistent with the enterprise’s service provider management policy. Assessment scope may vary based on classification(s), and may include review of standardized assessment reports, such as Service Organization Control 2 (SOC 2) and Payment Card Industry (PCI) Attestation of Compliance (AoC), customized questionnaires, or other appropriately rigorous processes. Reassess service providers annually, at a minimum, or with new and renewed contracts.” RECOMMENDATION While management continues the process of procuring a new information system vendor to support the LIHEAP program, management should ensure that internal controls related to their applications are appropriately designed and operating effectively. When management establishes the new contract, they should ensure that the contract requires independent reviews of internal controls, such as SOC 2 Type 2 examinations. As part of its risk assessment, management should review these SOC examinations annually. MANAGEMENT’S COMMENT We concur. In 2020, THDA made changes to the contract procurement process to include IT as an approver for all contracts being processed through the contract approval software system. The THO contract extension was processed in December of 2019 solely by program staff. The contract extension also included the addition of new services. At the time of the contract extension, IT was unaware of the amount and type of data to be stored/collected in the system. IT leadership did meet with THO late in 2023 to express concerns around security, and the fact that they had no SOC II Type 2, nor did they have anything in the works to obtain one. As a result, THO did configure and add multi-factor authentication to the system in January of 2024. A Request for Proposal is being developed to be issued in the second quarter of 2024 which should allow for a new system by the second quarter of 2025. THDA is in the midst of drafting its RFP to secure a software vendor to administer select federal programs, including LIHEAP. THDA has included in this RFP the following mandatory requirement: “For cloud-based software, provide a copy of a valid and current SOC 2 Type 2 certification for the system itself, not just the hosting platform such as Azure or AWS.”

Finding Number 2023-021 Assistance Listing Number 93.788 and 93.959 Program Name Opioid STR Block Grants for Prevention and Treatment of Substance Abuse Federal Agency Department of Health and Human Services State Agency Department of Mental Health and Substance Abuse Services Federal Award Identification Numbers H79TI083307, H79TI085738, B08TI083477-01, B08TI083515, B08TI084672-01, and B08TI085834 Federal Award Year 2021 through 2023 Finding Type Noncompliance Compliance Requirement Activities Allowed or Unallowed Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 93.788 Federal Award Identification Number H79TI083307, H79TI085738 Amount $80,275 Assistance Listing Number 93.959 Federal Award Identification Number B08TI083477-01, B08TI083515, B08TI084672-01, B08TI085834 Amount $80,000 FINDING The Department of Mental Health and Substance Abuse Services reimbursed subrecipients for potentially unallowed activities, resulting in questioned costs totaling $160,275 BACKGROUND The Substance Abuse Prevention and Treatment Block Grant (block grant) and State Opioid Response (opioid) programs are administered by the state to help prevent and treat substance abuse and are funded by the U.S. Department of Health and Human Services. The federal department’s Substance Abuse and Mental Health Services Administration (SAMHSA) division administers the block grant and opioid programs at the federal level, and the Tennessee Department of Mental Health and Substance Abuse Services (the department) administers the programs at the state level. The block grant allows for activities that address the use and/or abuse of both licit and illicit drugs, alcohol, and tobacco, which includes alcohol and drug treatment and rehabilitation, as well as activities such as education and counseling designed to reduce the risk of substance abuse. The opioid program is specifically for the prevention and treatment of opioid usage. The department administers the block grant and the opioid programs by partnering with subrecipient entities across the state that are responsible for local-level program administration. The department accepts applications from prospective subrecipients and uses interviews and site visits to select and approve subrecipients. Once a subrecipient is approved, the department program staff work closely with the subrecipient to determine which program services the subrecipient will provide. The department staff list and define allowable activities in each subrecipient’s contract and establish the related reimbursement rate for all subrecipients. Subrecipients are responsible for invoicing the department monthly through the Tennessee Web-based Information Technology System (TN-WITS), and the department subsequently reimburses the subrecipients through Edison based on the department’s invoice approval process. The block grant and opioid funds may be used for a broad range of substance abuse prevention, treatment, and recovery activities; however, Title 42, Code of Federal Regulations (CFR), specifically states that SAMHSA funds cannot be used for inherently religious activities, such as worship, religious instruction, or proselytization.(35) (35) Proselytization is defined as the process to induce someone to convert to one’s faith. CONDITION AND CRITERIA Methodology For our block grant program testwork, we selected a nonstatistical, random sample of 40 expenditures, and 1 additional significant expenditure, from a population of 2,266 expenditures, totaling $35,253,875, paid in fiscal year 2023. For our opioid program testwork, we selected a nonstatistical, random sample of 40 expenditures, and 2 additional significant expenditures, from a population of 1,189 expenditures, totaling $30,631,119, paid in state fiscal year 2023. Results Based on our testwork, we found that the department reimbursed block grant subrecipients $660 for pastoral/spiritual support for 4 of 41 items tested (10%). In addition, we found that the department paid an opioid subrecipient $4,680 for pastoral/spiritual support for 1 of 42 items tested (2%). Because the pastoral/spiritual support activity did not apply to all subrecipient invoices, we decided to inquire with management about the total amount paid to the subrecipients for pastoral/spiritual support instead of projecting the errors to the expenditure population. Based on further discussion with department staff and a review of all transactions recorded as pastoral/spiritual support services in TN-WITS, we determined that the department paid block grant subrecipients a total of $80,000 and opioid subrecipients $80,275 in the fiscal year ended June 30, 2023, for the potentially unallowed activity. The subrecipients’ contracts provide that pastoral/spiritual support may include services that incorporate faith and religious beliefs in the recovery process, including helping service recipients develop their spirituality and religious practices. Furthermore, the contracts state that services could include practices such as prayer and scripture; one example of such services includes studying the application of religious beliefs with a spiritual leader. While faith-based organizations are eligible subrecipients of SAMHSA funds, the subrecipients cannot be reimbursed by the state for any inherently religious activities using either block grant or opioid federal program funds. CAUSE Based on our discussion with management, they do not interpret the pastoral services offered under the subrecipients’ contracts as the same activities unallowed under the “inherently religious activities” described under 42 CFR 54.4. Management stated that faith-based organizations are valuable partners, particularly in rural areas where there are fewer substance abuse services available. We requested clarifying guidance from SAMHSA regarding whether the pastoral/spiritual support services the department offers are prohibited under the federal regulations; however, at the time of this report, SAMHSA had not provided any additional guidance. EFFECT Without clarifying guidance from the federal grantor for proper grant administration, there is an increased risk of management’s noncompliance with the grant award and terms. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION We recommend that the Commissioner and staff obtain clarifying guidance from SAMHSA regarding whether the pastoral/spiritual support services that the department offers are allowable under federal regulations for the block grant and opioid programs. MANAGEMENT’S COMMENT TDMHSAS partially concurs as our proposal to SAMHSA included the Pastoral/Spiritual Services referenced and was accepted. Additionally, according to 42 CFR § 54.4, examples of inherently religious activities include “worship, religious instruction, or proselytization”. TDMHSAS would draw a distinction of these inherently religious activities from the activities funded through ARP, as the latter are not centered on attempting to convert an ARP recipient from one religion to another. Rather, ARP Pastoral/Spiritual Support Services are built on the premise that recovery from substance use disorder, as defined by SAMHSA, is “holistic, addressing not just a person’s substance use problems but also their physical, emotional, social, and spiritual wellness”. TDMHSAS ARP Pastoral/Spiritual Support Services are focused on assisting one in developing his/her spirituality and religious practices of their choosing. The individual’s right to choose is further ensured through Charitable Choice Regulations set forth in 42 CFR §§ 54.1e and referenced in each ARP grant contract. In addition, SAMHSA approved its COVID Emergency Relief Funding Proposal which references “pastoral/spiritual support” in the recovery services TDMHAS proposed to use funding for. With this said, TDMHSAS recognizes that the current service definition for ARP Pastoral/Spiritual Support references terms “scripture”, “religious beliefs”, and “religious practices”. In that these terms could misconstrue relevance to inherently religious activities, TDMHSAS will remove these terms from its service definition. AUDITOR’S COMMENT We have reviewed management’s comments and maintain our finding to seek federal grantor guidance.

Finding Number 2023-022 Assistance Listing Number 93.788, 93.958, and 93.959 Program Name Opioid STR Block Grants for Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse Federal Agency Department of Health and Human Services State Agency Department of Mental Health and Substance Abuse Services Federal Award Identification Number H79TI083307, H79TI085738, B09SM083790-01, B09SM083949-01, 1B09SM085345-01, B09SM085873-01, B09SM085993-01, B09SM087344-01, B08T1083477-01, B08TI083515, B08TI084672-01, and B08TI085834 Federal Award Year 2021 through 2023 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Mental Health and Substance Abuse Services did not comply with Federal Funding Accountability and Transparency Act reporting requirements BACKGROUND The Department of Mental Health and Substance Abuse Services (the department) is the pass-through entity for the following programs administered by the Substance Abuse and Mental Health Services Administration (SAMHSA), a division of the Department of Health and Human Services: • the Block Grants for Community Mental Health Services (mental health block grant), which provides states funds to help them provide community-based mental health services to adults with mental illness and children with serious emotional disturbances; • the Block Grants for the Prevention and Treatment of Substance Abuse (substance abuse block grant), which helps states prevent and treat abuse of substances such as licit and illicit drugs, alcohol, and tobacco; and • the Opioid State Targeted Response (opioid) program, which is specifically for prevention and treatment of opioid usage. The Coronavirus Response and Relief Supplement Appropriations Act and the American Rescue Plan Act (collectively referred to as the COVID funds) provided the department with additional funds for the mental health and substance abuse block grants for state fiscal year 2023. The acts required the department to adhere to Federal Funding Accountability and Transparency Act (FFATA) reporting requirements for the COVID funds. Beginning in fiscal year 2021, SAMHSA also required the department to comply with FFATA reporting requirements for non-COVID funds in the mental health and substance abuse block grants as well as the opioid program. FFATA Reporting The FFATA requires the department to report subrecipient subaward financial information through the FFATA Subaward Reporting System (FSRS) for all subawards $30,000 and over. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 170(a)(2)(ii), reports are due “no later than the end of the month following the month in which the obligation was made.” For public transparency, the subaward information in FSRS is then available to the public on the USA Spending website. The report includes key data elements such as the awardee name, award amount, the unique entity identifier, and the subaward obligation/action date. The department uses its Budget Contract Monitoring System (BCMS) to track federal grants and subsequent subawards of the grants that require reporting under FFATA. Department staff also use an internal spreadsheet to track subaward information, including cumulative subaward amounts. Monthly, department staff generate the BCMS FFATA Contract report, which lists all grant awards that require FFATA reporting. Staff compare the report and internal spreadsheet to determine if subawards require initial reporting or if staff need to adjust previously reported subaward information. Staff report the transactions by the end of the following month of the initial subaward or adjustment. CONDITION A AND CAUSE Staff Did Not Report Non-COVID Subawards for the Mental Health and Substance Abuse Block Grants as Required by FFATA Based on inquiries with the department’s fiscal team, we found that for fiscal year ended June 30, 2023, department staff did not report non-COVID subawards for the mental health and substance abuse block grants under the FFATA requirements. Further discussion with department staff revealed that department staff did not report any non-COVID subawards since the reporting requirement for the mental health and substance abuse grants became effective in 2021. According to department staff, when they developed BCMS in 2015, FFATA reporting did not apply to the mental health and substance abuse block grants; thus, management did not design the information system to track whether those grants required FFATA reporting. When the department received the COVID funds, they adjusted BCMS to account for the FFATA reporting requirement for those grants; however, staff did not adjust the system to account for FFATA reporting requirements for the non-COVID funds. As a result, management did not design a mitigating control to ensure the non-COVID mental health block grant, substance abuse block grant, and the opioid program and subsequent subawards were included in the BCMS FFATA Contracts report that staff used to comply with FFATA reporting. In summary, for fiscal year 2023, the department expended $16,526,780 for non-COVID mental health and $33,036,585 for non-COVID substance abuse block grants. However, without reviewing all contracts and amendments, department staff could not provide us the number and amount of subawards that were not reported under FFATA for these two block grants. CONDITION B AND CAUSE Department Staff Reported Subawards Late Based on FFATA Requirements We obtained a population of 61 mental health block grant COVID subawards, 42 substance abuse block grant COVID subawards, and 160 opioid subawards $30,000 and over that were obligated during fiscal year ended June 30, 2023. We selected a nonstatistical, random sample of 43 subawards across the 3 programs to determine if the department complied with FFATA reporting requirements. See Table 1 for a breakdown for each program. See Schedule of Findings and Questioned Costs for table. Based on our work on the 43-item sample, we noted that fiscal staff did not report the following by the end of the month following the month management obligated the funds: • 8 of 10 mental health block grant COVID subawards tested (80%), • 5 of 7 substance abuse block grant COVID subawards tested (71%), and • 10 of 26 opioid subawards tested (38%). Staff reported the subawards to FSRS between 27 and 112 days late. See Table 2 for a breakdown of the department’s noncompliance by program. See Schedule of Findings and Questioned Costs for table. Department management stated that the subawards were reported late because the fiscal accountant who handled the FFATA reporting during fiscal year 2023 was out on extended leave, and fiscal staff who assumed the FFATA reporting responsibilities required time to learn the FFATA reporting requirements and the department’s process. Risk Assessment We reviewed the department’s December 2022 Financial Integrity Act Risk Assessment and determined that management included that fiscal staff could be out for an extended period of time, causing FFATA subawards to not be reported timely. Management also identified a mitigating control to address this risk, which included a back-up employee with access to FSRS to ensure timely FFATA reporting. We found, however, that management did not implement this mitigating control and did not assign a back-up employee with FFATA reporting responsibilities and access to the FSRS until the fiscal accountant was already on extended leave. As such, staff failed to meet reporting deadlines required by FFATA regulations. Additionally, the department’s risk assessment did not identify the risk of failing to report all FFATA contracts and did not develop a mitigating control to address the risk; thus, they did not ensure all subawards were properly reported. CRITERIA Condition A and Condition B Appendix A to “Reporting Subaward and Executive Compensation Information,” 2 CFR 200.170, states: a. Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency. . . . 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2010.) Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to the Green Book, Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. According to Green Book Principle 7.09, “Response to Risks,” When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT Not meeting the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of the Department of Mental Health and Substance Abuse Services should ensure staff are aware of the FFATA reporting requirements for all applicable grants and ensure any system used to determine appropriate reporting is complete and accurate. Management should implement a contingency plan to ensure FFATA reporting continues if staff take extended leave or separate from the department. MANAGEMENT’S COMMENT We concur. This finding was corrected during the audit. A new report was created in BCMS to provide a listing of new contracts and contract amendments related to the federal block grants and was tested and implemented during the audit. In addition, a detective control has been created to identify any contracts with payments posted to the Edison accounting system not only for the federal block grants but for any federal discretionary grants as well. This Edison query will be run monthly and reviewed to ensure that all new contracts with payment activity have had FFATA reports prepared and submitted to fsrs.gov. This new mitigating control will be added to the department’s Financial Integrity Act Risk Assessment. During the audit, the responsibility for FFATA reporting was split between two staff members; one staff member prepares and submits the FFATA reports for the non-discretionary federal grants while the other staff member prepares and submits the FFATA reports for the federal block grants. The responsibility for the sign off on the Month-end Closing Checklist ensuring that FFATA reporting has been completed was also reassigned to the Accounting Manager supervising these two staff members. So, currently, we have three staff members familiar with FFATA reporting.

Finding Number 2023-023 Assistance Listing Number 93.767 Program Name Children’s Health Insurance Program Federal Agency Department of Health and Human Services State Agency Department of Finance and Administration Federal Award Identification Number 2205TN5021 and 2305TN3002 Federal Award Year 2022 and 2023 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Repeat Finding 2022-007 Pass-Through Entity N/A Questioned Costs $25,294 FINDING As noted in the prior two audits, management did not address the division’s CoverKids eligibility process deficiencies, resulting in $31,499 in federal and state questioned costs BACKGROUND The Division of TennCare (the division) oversees CoverKids, Tennessee’s Children’s Health Insurance Program. Funded at both the federal and state levels, the program provides health insurance coverage to uninsured, low-income children and pregnant women not otherwise eligible for Medicaid. From July 1, 2022, through June 30, 2023, the division made two types of payments on behalf of CoverKids members: • monthly capitation payments to the managed care organizations;(36) and • reimbursements to benefit managers for services, such as pharmacy and dental services. (36) The division contracts with three managed care organizations and only pays them a capitation rate per member per month to provide services to CoverKids members. According to the Centers for Medicare and Medicaid Services, capitation is a way of paying organizations a set amount of money to cover the predicted cost of all or some health care services. The Division’s Eligibility Determination Process for CoverKids Applicants and Members Initial Eligibility Process CoverKids applicants apply for eligibility using TennCare Connect, the public-facing web portal of the division’s Tennessee Eligibility Determination System (TEDS). In addition to TennCare Connect, the division continues to accept applications through each of following methods: • by phone or online through the Federally Facilitated Marketplace;(37) • by phone or a paper application; • online through the TennCare Access partner portal;(38) or • by visiting a Department of Human Services office for in-person assistance with applying online, by paper, or by phone. (37) The U.S. Department of Health and Human Services operates the Federally Facilitated Marketplace, an organized marketplace of health insurance plans where individuals can apply for health insurance, including Medicaid and CoverKids. (38) The division partners with the Department of Health, certain hospitals, and certain long-term care providers to assist an individual in the application process. Generally, staff manually enter information received from phone and paper applications into TEDS, while information from online applications automatically uploads into the system. TEDS then automatically processes and verifies the applicant’s demographic, income, and household information against multiple state and federal databases to determine if the applicant is eligible for any available TennCare or CoverKids eligibility category, thereby removing the need for human intervention in many cases. If the applicant’s eligibility determination requires human intervention, such as when the system identifies discrepancies in application information or cannot verify information, the system automatically assigns an eligibility caseworker to process the application manually in TEDS.(39) (39) According to division management, TEDS is a task-based system where an eligibility caseworker may have to manually verify an applicant’s information (such as Social Security Administration payment history or family composition) to continue processing eligibility. Eligibility Renewals Begin April 1, 2023 Pursuant to the Families First Coronavirus Response Act, the division was not permitted to terminate members who were enrolled when the federal COVID-19 public health emergency (PHE) period began, with limited exceptions. As such, the division paused CoverKids eligibility renewals, eligibility category changes, and terminations from March 18, 2020, until March 30, 2023.(40) During the pause, the division could only terminate CoverKids coverage for existing members who died; voluntarily terminated coverage; became residents of another state; or, for members with pregnancy coverage, when the member’s postpartum period ended. The division began performing the Children’s Health Insurance Program (CHIP) eligibility renewals on April 1, 2023. (40) The federal government extended the PHE through January 11, 2023. CMS instructed states to begin redeterminations as early as February 1, 2023, and to complete all redeterminations by May 31, 2024. PRIOR AUDIT RESULTS In the prior audit, we determined that division management attempted to address the TEDS system error that allowed ineligible members to continue with coverage after their postpartum period had ended, but this attempt was unsuccessful. Additionally, we identified an instance in which staff members incorrectly determined a member for CoverKids when he did not meet the residency requirement and an instance in which TEDS prohibited the termination of coverage for an individual who aged out of CoverKids. Management concurred and stated that the division has dedicated staff monitoring documented risk assessment mitigation strategies to limit the number of eligibility errors in the program. Management stated that they also continually monitor both the TEDS system and the division’s manual eligibility process. CONDITION, CRITERIA, AND CAUSE For the current audit, we determined that management decided to achieve corrective action through the unwinding renewal process, which started in April 2023. Additionally, we identified instances in which staff members and TEDS did not calculate the household income correctly, income was not verified, or the individual was over the income limit. Noncompliance With CMS Guidelines and Eligibility Process Deficiencies To determine whether management made capitation payments on behalf of eligible CoverKids members, we tested a random, nonstatistical sample of 60 capitation payments made between July 1, 2022, and June 30, 2023, totaling $14,387. The sample was selected from a population of 491,621 capitation payments totaling $114,412,773. From our capitation sample, we identified questioned costs of $1,591 in federal and $382 in state. We expanded our review of the members’ benefits and identified additional known questioned costs of $22,109 in federal and $5,419 in state related to capitation payments and claims payments during the period of ineligibility. Based on our review, for 12 of 60 payments tested (20%), eligibility caseworkers and TEDS did not verify the members’ eligibility. • For 9 of the 12, TEDS did not terminate coverage for pregnant women members’ after their postpartum period ended. According to management, these issues occurred in part due to the division’s misunderstanding of the Centers for Medicare and Medicaid Services (CMS) guidelines. Also, management did not communicate a request to its system vendor to remove this category from the monthly unwinding renewal process, allowing the members to keep benefits until they completed the renewal process. As a result of these nine errors, we identified $17,928 in federal questioned costs and an additional $4,401 in state questioned costs. CMS published guidance through a January 6, 2021, Frequently Asked Questions (FAQ) for the Family First Coronavirus Response Act. This FAQ clarified that agencies should terminate CoverKids coverage for members who qualified for the program due to their pregnancy status at the conclusion of their postpartum period, provided they do not qualify for another program. • For 2 of the 12, the member was over the income for CoverKids benefits or their income was not verified. According to management, these issues occurred due to a caseworker not verifying the income. As a result of these two errors, we identified $5,772 in federal questioned costs and an additional $1,400 in state questioned costs. Title 42, Code of Federal Regulations, Part 457, Section 380(d), “Eligibility verification,” instructs that if a state “does not accept self-attestation of income, the State must verify the income of an individual by using the data sources and following standards and procedures for verification of financial eligibility. . . .” According to the division’s Policy 200.035, “Verification,” the division must verify and document all of the member’s financial and non-financial information. • For 1 of the 12, the member showed no household income reported; however, the individual was approved for CoverKids benefits instead of properly approved for the Medicaid program. According to management, this error occurred due to a system issue involving the income record. There were no questioned costs related to this error since the individual was still eligible for benefits; however, due to the other system issues we identified through our audit, we are including this system error description so that management is aware of all the system issues which should be addressed. Section 1200-13-13-.02 of the Rules of the Tennessee Department Finance and Administration Bureau of TennCare, “TennCare Medicaid,” requires enrollees to meet all technical and financial requirements applicable to their category of medical assistance. Noncompliance With CMS Guidelines and Renewal Process Deficiencies To determine whether management conducted and documented CoverKids renewals appropriately, we tested a random, nonstatistical sample of 60 renewals occurring between April 1, 2023, and June 30, 2023. The sample was selected from a population of 5,134 renewal packets that were sent to CoverKids members. Based on our review, for 2 of 60 renewals tested (3%), we determined that division staff or TEDS did not terminate or renew the members eligibility correctly. Specifically, • For 1 of the 2, TEDS did not terminate coverage for a pregnant woman after their postpartum period ended. According to management, the member never responded to their pre-termination notice, and coverage was scheduled to end on June 13, 2023. Management stated that on June 29, 2023, a data fix was implemented to reinstate her benefits because the coverage was terminated prior to the pre-termination due date. Ultimately, management did not communicate a request to its system vendor to remove this category from the monthly unwinding renewal process, allowing the member to keep benefits until the renewal process was complete. As a result of this error, we identified $376 in federal questioned costs and an additional $95 in state questioned costs. • For the remaining error, the individual was approved for continued benefits without division staff or TEDS verifying the household income. According to management, this error occurred due to a system issue in TEDS that prevented interfaces from running to verify the income. As a result of this error, we identified $1,218 in federal questioned costs and an additional $309 in state questioned costs. For these 2 errors, the division’s Policy 200.035, “Verification,” identifies that the division must verify and document all of the member’s financial and non-financial information. In total, we questioned the costs associated with these eligibility and renewal process deficiencies totaling $31,499 ($25,294 of which were federal and $6,205 of which were state questioned costs). Risk Assessment We reviewed the Division of TennCare’s December 2022 Financial Integrity Act Risk Assessment and determined that management listed the risk of an eligibility caseworker or TEDS performing inaccurate eligibility determinations for which they designed appropriate controls; however, the controls as designed were not effective to prevent or identify the noncompliance errors we found. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, “Identify, Analyze, and Respond to Risks,” 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT When division staff and TEDS do not process CoverKids eligibility determinations, renewals, and terminations correctly, the division increases the risk of keeping ineligible individuals on its membership rolls, thereby allowing them to receive CoverKids benefits to which they are not entitled, resulting in costs not allowable under the federal Children’s Health Insurance Program. Additionally, federal regulations address actions that the U.S. Department of Health and Human Services (HHS) may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 45 CFR 75.207(b), “Specific award conditions,” These additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 45 CFR 75.371, “Remedies for noncompliance,” outlines additional actions HHS may take. Depending on the circumstances, these actions may include • withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the award, • initiating suspension or debarment, • withholding awards, or • pursuing other legal remedies. RECOMMENDATION The Deputy Commissioner should ensure that the Assistant Commissioner works with the TEDS contractor to verify that all system changes are operating to align with the program’s rules and regulations. In addition, the Assistant Commissioner should ensure that eligibility caseworkers are fully trained so that they understand their responsibilities relating to CHIP eligibility and renewals and can properly determine if members are eligible for CoverKids benefits. Furthermore, the division should determine any additional unallowable payments made on behalf of members whose postpartum eligibility period has ended. Management should evaluate the effectiveness of control activities for the risks identified in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT TennCare agrees that a portion of CoverKids members who reached the end of the postpartum period were not terminated as quickly as they could have been. Each issue identified by the auditors will be addressed below. For 9 of the 12, TEDS did not terminate coverage for pregnant women members’ after their postpartum period ended. TennCare concurs. Some CoverKids pregnant women did not begin the eligibility review and potential termination process immediately upon the end of their postpartum period in error. Instead, they were queued for the Unwinding renewal process to ensure a full review would be completed prior to loss of benefits. As noted during the previous audit, during the Public Health Emergency TennCare misinterpreted CMS guidance to require states to continue eligibility for this population until the formal Unwinding renewals began in 2023. Although that understanding was corrected in early 2023 and TennCare began taking steps to close coverage for many CoverKids women whose eligibility continued to remain open in February and March 2023, during the massive undertaking of restarting renewals after a three-year pause, TennCare staff failed to communicate a change order to its system vendor to remove this category from the monthly Unwinding renewal process. The impact was that coverage remained open pending the outcome of the renewal if both the change termination process and the renewal process occurred simultaneously. TennCare has now implemented a change to the Unwinding process to remove CoverKids pregnant women from the formal renewal process. For 2 of the 12, the member was over the income for CoverKids benefits or their income was not verified. TennCare concurs. Targeted coaching has been completed with the staff who incorrectly processed these cases. For 1 of the 12, the member showed no household income reported; however, the individual was approved for CoverKids benefits instead of properly approved for the Medicaid program. TennCare concurs. The system was updated in April 2022 to prevent this issue moving forward. A query was performed to identify similar cases and none were found. For 1 of the 2, TEDS did not terminate coverage for a pregnant woman after their postpartum period ended. TennCare concurs. The reason why the coverage remained open after the pre-termination notice was not returned was initially due to a defect and the need to reinstate to provide proper due process. Ultimately, however, the member was scheduled for a future renewal, as discussed in the issue with the 9 cases above. For the remaining error, the individual was approved for continued benefits without division staff or TEDS verifying the household income. TennCare concurs. The issue was corrected in April 2023. TennCare will continue its extensive training for eligibility staff. The previously described monthly case reading process will also continue with a special focus on entry and processing of income data.

Finding Number 2023-024 CFDA Number 21.027 Program Name Coronavirus State and Local Fiscal Recovery Funds Federal Agency Department of the Treasury State Agency Department of Economic and Community Development  Federal Award Identification Number SLFRP5534 Federal Award Year 2021 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Economic and Community Development management did not ensure that subrecipient contracts contained all the required subaward information at the time of the subaward BACKGROUND The American Rescue Plan Act of 2021 established the Coronavirus State and Local Fiscal Recovery Funds (the Fund) to provide state, local, and tribal governments with the resources needed to respond to the pandemic and its economic effects and to build a stronger, more equitable economy during the recovery. The U.S. Department of the Treasury issued an interim final rule implementing the Fund’s program on May 10, 2021, and has since disbursed over $240 billion to state, local, and tribal governments and received over 1,500 public comments on the interim final rule. Tennessee has received $3.7 billion from the Fund. State agencies submitted proposals to state leadership through the Governor’s Financial Stimulus Accountability Group (FSAG),(41) which issued the Tennessee Resiliency Plan to summarize selected projects. (41) On April 16, 2020, the Governor created the FSAG to aid in the proper fiscal management of stimulus funds. The FSAG allocated $500 million to the Department of Economic and Community Development (the department) to continue its work on the Tennessee Emergency Broadband Fund. The purpose of this fund is to provide non-recurring funding to internet service providers (subrecipients) to facilitate broadband access to all Tennesseans and promote programs that encourage broadband adoption and use. CONDITION AND CRITERIA In awarding these federal funds to subrecipients, the department was required by “Requirements for pass-through entities,” Title 2, Code of Federal Regulations (CFR), Part 200, Section 332, to include specific award information to subrecipients at the time of the award. This information includes (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient’s unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date . . . of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D [Research and Development]; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged). As required by the Department of Finance and Administration, the department attested to its responsibilities to comply with pass-through entity requirements stated in 2 CFR 200.332. Department management informed us that the required information is listed in the Federal Award Identification Worksheet, Attachment B of each subrecipient’s contract. Of 65 total executed contracts with subrecipients between July 1, 2022, and September 30, 2023, we tested a sample of 25 subrecipient contracts. We found that for all contracts tested (100%), the department did not inform the subrecipients of the following required information: • the Federal Award Identification Number (iii); • the date of the federal award (iv); and • the amount of federal funding obligated to the subrecipient by the pass-through entity (viii). We also found that, in 5 of the 25 contracts (20%), the department listed the incorrect unique entity identifier (ii). The unique entity identifiers did belong to other subrecipients of the Emergency Broadband Fund, but they were not the correct identifiers for these 5 subrecipients. CAUSE According to our discussions with department management, a former employee was responsible for entering the required federal award information into the subrecipient contracts. This employee entered the information available to them at the time; however, apparently because they lacked some of the federal information, they omitted required information at the time of the subaward. Management believed that all required information was already included because they were using the Central Procurement Office(42) contract template; therefore, management did not perform a subsequent review. (42) The Central Procurement Office is responsible for managing centralized procurement of goods and services for use by state departments and agencies and is responsible for vendor relations and contract management. EFFECT Management’s inability to include the required grant award information at the time of the subaward increases the risk that the subrecipients may not possess all pertinent federal award information to achieve compliance with all federal grant requirements. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: • Requiring payments as reimbursements rather than advance payments; • Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; • Requiring additional, detailed financial reports; • Requiring additional project monitoring; • Requiring the non-Federal entity to obtain technical or management assistance; or • Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner should ensure that management is aware of the requirements listed in 2 CFR 200.332. Management and staff should properly communicate federal award information when making subawards to subrecipients. Additionally, the Commissioner should ensure management designs and implements internal controls around such communication. MANAGEMENT’S COMMENT We concur with the finding. Title 2, Code of Federal Regulations, Section 200.332 (a) says that subaward identification “includes the following information at the time of subaward” and furthermore “when some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward at the time of the award.” As mentioned above, staff completed the provided Central Procurement Office (CPO) template with the information and guidance available at the time. The template provided has since been updated by CPO and no longer refers to DUNS and CFDA numbers, which are now defunct identifiers. Since the execution of these contracts, the broadband team has grown to include seven full-time employees and an outside contractor to assist with the workload to help us better address grants management going forward. Now that all information is available, management has a plan to both update/alert current subrecipients with missing or dated information and to prevent this finding from recurring. First, management is updating the information on the federal award identification worksheet and will provide an updated form to all current subrecipients in compliance with guidance from CPO. CPO guidance from contract template: Option: Federal Award Identification Worksheet If the Grantee is a subrecipient and the Grant Agreement involves any federal funds, the Grantor State Agency must complete the federal award identification worksheet on the following page and reference the worksheet by adding the following section. Include the worksheet as an attachment to the Grant Agreement. If some federal award identification worksheet information is not available, provide as much information as is available. Grantor State Agencies should update the worksheet no more than once every six (6) months to reflect any changes. Grantor State Agencies should also send the updated worksheet to the Grantee and upload a copy into Edison. Second, TNECD uses a standard contracting template spreadsheet to develop contracts. Prior to the TEBF-ARP contracts, the items for the FAIN were not included as a part of our spreadsheet. As a result of this finding, management has worked with our legal and contracting team and CPO to ensure each of these line items is added as a column on the spreadsheet. This will streamline the inclusion of this information. Furthermore, the two primary grants managers on the broadband team have completed three Management Concept courses covering Grants Management for Pass Through Entities (PTEs), with plans to complete more in pursuit of a certification. This ensures that relevant staff are receiving extensive training on compliance with federal funds.

Finding Number 2023-025 Assistance Listing Number 15.605, 15.611, and 15.626 Program Name Fish and Wildlife Cluster Federal Agency Department of the Interior State Agency Tennessee Wildlife Resources Agency Federal Award Identification Number F16AF00250, F16AF00736, F17AF00625, F18AF00534, TNW-F18AF00054, F19AF00465, F19AF00527, F19AF00545, F19AF01174, F19AF01175, F19AF01176, F19AF01177, F20AF00301, F21AF00850, F21AF01215, F21AF02151, F21AF03909, F22AF00573, F22AF02144, and F23AF00751 Federal Award Year 2016 through 2023 Finding Type Material Weakness and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding 2022-014 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior audit, Tennessee Wildlife Resources Agency management did not perform required subrecipient monitoring and did not obtain and review subrecipients’ Single Audits BACKGROUND The Tennessee Wildlife Resources Agency (TWRA) administers the Fish and Wildlife cluster of programs, which are federal programs under the oversight of the U.S. Fish and Wildlife Service. The Fish and Wildlife Cluster includes the following programs: • The Sport Fish Restoration program provides funds to restore, conserve, and enhance sport fish populations and to provide for public use and enjoyment of these fishery resources. • The Wildlife Restoration program provides funds to restore, rehabilitate, and improve wildlife populations and their habitats; to conduct wildlife management research, and wildlife population surveys and inventories; to acquire land; and to provide for public use of wildlife resources. • The Basic Hunter Education program provides training to hunters in the safe handling and use of firearms and archery equipment; hunter responsibilities and ethics; survival; construction, operation, and maintenance of public shooting ranges; and basic wildlife management and identification. • The Enhanced Hunter Education and Safety program provides funds to enhance programs for hunter education, recruitment, and safety; to increase interstate coordination of hunter education programs; to enhance programs for bow hunters and archers; to enhance construction and development of firearm and archery ranges; and to update safety features of firearm and archery ranges. For fiscal year 2023, TWRA awarded a total of $3,183,825 in federal funds to 14 subrecipients, such as nonprofit foundations and universities, to carry out the activities of the Fish and Wildlife Cluster programs. PRIOR AUDIT RESULTS In the prior audit, we reported that management did not perform subrecipient monitoring and did not obtain and review subrecipients’ Single Audit reports. We also reported that TWRA management’s December 2021 Financial Integrity Act Risk Assessment did not identify risks related to the failure to perform subrecipient monitoring activities and the failure to obtain and review subrecipients’ Single Audit reports and, as such, did not identify control activities to mitigate these risks and ensure compliance with federal requirements. TWRA management concurred with the finding and stated that the agency did not perform subrecipient monitoring and did not obtain and review subrecipients’ Single Audit reports due to a lack of staff. TWRA management stated they would create a program monitoring guide and update the current risk assessment by July 31, 2023. In the agency’s six-month follow-up report of corrective action, dated September 21, 2023, management stated they updated the risk assessment in relation to the subrecipient monitoring finding and updated the related policy; however, management did not implement the updated policy because they were considering contracting with an outside agency for assistance with grants management. To improve compliance with grant requirements, management created a new training presentation for all agency staff who manage grants. Additionally, the Executive Director approved a new position to serve as a grant monitor, but the agency has not filled the position as of November 29, 2023. CONDITION, CRITERIA, AND CAUSE To obtain an understanding of TWRA management’s subrecipient monitoring procedures, we met with management, and based on our discussions, we determined that for fiscal year ended June 30, 2023, management still did not • perform subrecipient monitoring as required by Title 2, Code of Federal Regulations (CFR), Part 200, Section 332(d); and • obtain and review subrecipients’ Single Audit reports and issue management decisions on findings as required by 2 CFR 200.332. According to 2 CFR 200.332(d), management must Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. As the pass-through entity, TWRA is required by 2 CFR 200.332 to verify that all subrecipients that spend $750,000 or more obtain a Single Audit within nine months after the subrecipient’s fiscal year-end. When the subrecipient’s Single Audit includes audit findings, TWRA must issue a management decision within six months of the audit report’s release, indicate if the subrecipient agency agreed with the finding, and describe any corrective action the subrecipient must take. TWRA management stated that they did not monitor any subrecipients and did not obtain and review subrecipients’ Single Audit reports because of a lack of staff. Management also stated that in response to the prior audit finding, they developed procedures for subrecipient monitoring; however, they have not put these procedures into practice. Management created a subrecipient risk assessment monitoring document in June 2023 as a part of the procedures developed to document risks noted as they monitor subrecipients but have not started using this form. The Chief of Real Estate and Federal Aid stated that they were waiting to hire an internal audit director who would be the one to monitor the subrecipients using this form. Risk Assessment We reviewed TWRA’s 2022 Financial Integrity Act Risk Assessment and noted that management identified risks associated with the lack of subrecipient monitoring and with the failure to review subrecipient Single Audit reports, but management failed to implement controls to mitigate these risks. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 10.02, “Response to Objectives and Risks,” Management designs control activities in response to the entity’s objectives and risks to achieve an effective internal control system. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives to achieve the entity’s objectives and address related risks. EFFECT When TWRA management does not follow federal requirements to perform subrecipient monitoring, management cannot ensure subrecipients have reasonably complied with federal statutes, regulations, and terms and conditions of the grant award. Also, when management does not obtain and review subrecipients’ Single Audit results as required by federal regulations, including Single Audit findings, management increases the risk that it will not promptly identify subrecipients’ noncompliance and control deficiencies so that corrective action can be achieved. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” these actions may include • requiring payments as reimbursements rather than advance payments; • withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; • requiring additional, more detailed financial reports; • requiring additional project monitoring; • requiring the non-federal entity to obtain technical or management assistance; or • establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • withholding further awards for the project or program, or • pursuing other available legal remedies. RECOMMENDATION The Executive Director should ensure management and staff comply with federal regulations and requirements related to subrecipient monitoring and should ensure management implements policies and procedures to guide agency staff tasked to perform subrecipient monitoring activities. Management should take prompt action to initiate monitoring activities to identify areas of subrecipient noncompliance and follow up on required corrective action as needed. Management should also ensure key personnel are aware of all required monitoring responsibilities, including reviewing subrecipients’ Single Audit reports, issuing management decisions, and obtaining subrecipient corrective action plans when necessary. Management should implement effective controls to address the risks noted in this finding and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT We concur. The Tennessee Wildlife Resources Agency continues to progress toward full implementation of our sub-recipient monitoring process. Several key elements of the process have been implemented to date. First, we have developed the Federal Aid Procedures Manual. Included in the manual are chapters on Sub-recipient Monitoring and Procedures and a subrecipient risk assessment process, complete with risk assessment templates. Second, we have assigned responsibility for the process with the TWRA Project Manager, Tennessee Finance and Administration Controller for TWRA, and the TWRA Federal Aid and Real Estate Division jointly responsible for monitoring of each Federal subaward throughout the life of the award. Lastly, our staff have attended training and are now required to attend annual update trainings. Direct subrecipient monitoring activities will be split between the TWRA Federal Aid and Real Estate Division and the TWRA Project Manager. The TWRA Federal Aid and Real Estate Division, with the assistance of the Grant Monitor, is responsible for macro‐ (institutional) level monitoring processes while the TWRA Project Manager is responsible for micro‐ (project) level monitoring. Macro-level monitoring processes include advising the subrecipient of requirements imposed on them by federal laws, regulations, and the provisions of the subaward agreement; review of the single audit as required; and conducting periodic spot checks of reports to ensure the award is being carried out according to the terms and conditions of the agreement. Micro‐level monitoring, conducted by the Project Manager, should involve regular (at semi‐annual) communication between TWRA and the subrecipient organization to ensure the project is being carried out as proposed and according to schedule. Of note, our recent Office of Inspector General (OIG) audit of U.S. Fish and Wildlife Service Grants resulted in a similar finding. During that audit, the OIG “reviewed the (sub-recipient monitoring) procedures and found them to be adequate” and acknowledged that the process was being implemented, albeit outside of the timing of their audit. We anticipate full implementation of this process by June 30, 2024.

Finding Number 2023-026 Assistance Listing Number 10.568 and 10.569 Program Name Food Distribution Cluster Federal Agency Department of Agriculture State Agency Department of Agriculture Federal Award Identification Number 225TN813P1103, 225TN817Y8105, and 235TN817Y8105 Federal Award Year 2022 and 2023 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Subrecipient Monitoring Special Tests and Provisions Repeat Finding 2022-013 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the two prior audits, the Tennessee Department of Agriculture did not have internal controls over household eligibility determinations and annual inventory counts at storage locations for the Emergency Food Assistance Program BACKGROUND The Department of Agriculture (the department), in partnership with the U.S. Department of Agriculture (USDA) and local organizations, operates the Emergency Food Assistance Program (food program) to provide low-income households emergency food assistance. USDA purchases a variety of food items and makes them available to state distributing agencies. On behalf of the department, subrecipients on contract with the department administer the program in compliance with the grant award. The department places food orders with USDA on behalf of the subrecipients, and USDA delivers the food directly to the subrecipients’ warehouses. The subrecipients must manage the inventory in their warehouses by tracking food receipts and food distributions, performing a physical food inventory count at least annually, and documenting adjustments to food inventory records, such as losses due to spoilage. Also, the subrecipients determine whether applicants meet income requirements and are residents of the state of Tennessee, and they provide food to households deemed eligible. The department reimburses the subrecipients for administrative costs, such as payroll costs associated with operating the food program. During our audit period, the department contracted with 22 subrecipients for the purpose of administering the program. PRIOR AUDIT RESULTS In the 2021 Single Audit, we noted that management did not have controls in place for household eligibility determinations and food inventory. In prior years, the department performed on-site subrecipient reviews to determine if subrecipients were accurately determining household eligibility and managing the inventory according to federal requirements. According to management, they stopped performing the on-site reviews in March 2020 because of the COVID-19 pandemic. Management concurred with the prior finding and stated the following: The department will establish control activities (review process) to ensure and document subrecipient compliance with inventory and eligibility requirements. If deficiencies are disclosed, the department will submit a report of findings to the subrecipient and ensure corrective action is taken. . . . Monitoring activity will transition to a desk audit format with virtual visits incorporated as needed to maximize safety protocols and minimize disruption of the monitoring schedule due to public health or other emergency situations. If deficiencies are disclosed, the department will submit a report of findings to the subrecipient and ensure corrective action is taken. The commodity administrator will be responsible for monitoring risks and assessing controls. During the 2022 Single Audit, management explained in their six-month follow-up for the 2021 audit finding “that upon approval by the USDA Southeast Regional Office, management will conduct desk audit reviews of all 22 eligible recipient agencies (ERAs) during Federal Fiscal Year 2023. In November 2022, the UDSA approved the department’s plan to begin reviews of subrecipients.” Because the department was waiting for USDA to approve the department’s plan, it did not monitor its subrecipients, resulting in a repeat finding in the 2022 Single Audit. Department management still did not have controls in place for household eligibility determinations and food inventory. Additionally, the 2022 Single Audit identified subrecipient noncompliance related to nonperformance of annual inventory counts and inaccurate inventory records at three of the four sites visited. Management concurred and stated it would implement the USDA-approved monitoring plan in April 2023 and complete the monitoring by September 2023 to coincide with the end of the federal fiscal year. However, in management’s six-month follow-up for the 2022 audit finding, the department’s plan to conduct desk audit reviews of all 22 ERAs during federal fiscal year 2023 was delayed with a new completion date of December 15, 2023. After completing the initial desk reviews, the department will move to a 4-year cycle where they will examine 25% of all ERAs and will ensure that no subrecipient goes 4 years without a review. The department will also review the lesser of one-tenth or 20 subrecipients that receive food pursuant to an agreement with another ERA, using a risk-based and random sampling approach. CONDITION AND CAUSE Inventory Management and Household Eligibility As noted in the prior audit finding, department management did not implement monitoring controls to ensure compliance with the food program’s inventory and eligibility requirements. Based on our discussions with department management, during fiscal year ended June 30, 2023, management had neither resumed their previous control activity of on-site reviews nor implemented other control activities to ensure subrecipients reasonably complied with the federal regulations. In the absence of management controls, we performed compliance testwork to determine whether three subrecipients complied with federal regulations for inventory records and household eligibility determinations. Based on our compliance testwork and discussions with department and subrecipient management, we found that two of the subrecipients had not maintained accurate food commodity inventory records, and one did not perform the annual inventory as required. Inaccurate Inventory Records At two of the three subrecipients we visited, we noted inaccurate food records and inaccurate food distribution counts. We performed very limited counts and still noted discrepancies: • During our inventory count for 1 subrecipient, we expected to find only 56 pouches of chili, but we found the subrecipient had 220 pouches of chili in stock. • During our review of 1 subrecipient’s records to support accurate reporting of distributed items, we noted a significant difference in the number of items reported on the October 2022 and January 2023 monthly inventory reports submitted to the Department of Agriculture. The documentation provided to show the number of items distributed failed to match the monthly inventory reports for all 10 items randomly selected for testing. The range in discrepancies varied from underreporting 12,360 items to overreporting 5,616 items. Based on the documentation provided by the subrecipient, we were unable to support that the agency accurately reported the number of items distributed on the monthly inventory reports. Annual Inventory Not Performed Regarding the subrecipient that did not perform the required annual inventory, we had previously identified this same subrecipient in the prior audit for failing to conduct the inventory count, and we determined through our current testwork that management has not ensured corrective action during the current audit. Specifically, according to subrecipient management and their food distributor,(43) this subrecipient (along with four other subrecipients under the same food distributor also reported in the prior audit) still did not conduct an annual inventory count or request tracking documents, such as bills of lading, receipts for received food, or documents showing food distributed, and relied solely on the information provided by the distributor. (43) A food distributor stores the subrecipient’s food items until the subrecipient requests the distributor to deliver the food items to locations and in the quantities directed by the subrecipient. Risk Assessment We reviewed the Department of Agriculture’s 2022 Financial Integrity Act Risk Assessment for department operations and determined that management did not identify the risk of the department’s or their subrecipients’ noncompliance with federal inventory and eligibility requirements and, as such, did not identify or implement control activities to ensure compliance with these requirements. CRITERIA Inventory Management and Household Eligibility According to Title 2, Code of Federal Regulations, Part 200, Section 303(a), a non-federal agency must Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, according to Title 7, CFR, Part 251, Section 10(e), (1) Each State agency must monitor the operation of the program to ensure that it is being administered in accordance with Federal and State requirements. State agencies may not delegate this responsibility. . . . (3) Each [subrecipient monitoring] review must encompass, as applicable, eligibility determinations, food ordering procedures, storage and warehousing practices, inventory controls, approval of distribution sites, reporting and recordkeeping requirements, and civil rights. According to Title 7, CFR, Part 250, Section 12(b), “Inventory Management,” On an annual basis, the distributing agency must conduct a physical review of donated food inventories at all storage facilities used by the distributing agency (or by a subdistributing agency) and must reconcile physical and book inventories of donated foods. According to the department’s The Emergency Food Assistance Program Manual for subrecipients, Required Records: Each RA [Recipient Agency] or other entity which has an agreement with the RA is required to keep accurate and complete records associated with the receipt, storage, distribution, disposal, and inventory of TEFAP [the Emergency Food Assistance Program] foods as well as any funding received under the TDA [Tennessee Department of Agriculture] grant contract. Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Additionally, Principle 9.04, “Analysis of and Response to Change,” states As part of risk assessment or a similar process, management analyzes and responds to identified changes and related risks in order to maintain an effective internal control system. Changes in conditions affecting the entity and its environment often require changes to the entity’s internal control system, as existing controls may not be effective for meeting objectives or addressing risks under changed conditions. Management analyzes the effect of identified changes on the internal control system and responds by revising the internal control system on a timely basis, when necessary, to maintain its effectiveness. EFFECT The lack of sufficient monitoring controls over inventory management and household eligibility determinations increases the risk of noncompliance with federal requirements and fraud, waste, and abuse in this federal program. Without sufficient monitoring, department management cannot reasonably ensure that subrecipients fulfill federal requirements and meet the goals of this federal program. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR, Part 200, Section 208(c), “Specific conditions,” Additional Federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, Title 2, CFR, Part 200, Section 339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of the Department of Agriculture should ensure staff members have the resources to establish internal controls to ensure staff and subrecipients comply with inventory and eligibility requirements. Management should take prompt action to implement the USDA-approved monitoring plan to identify areas of subrecipient noncompliance and follow up on required corrective action as needed. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. MANAGEMENT’S COMMENT We concur. To ensure and document effective internal controls, the department has implemented the USDA-approved monitoring plan to identify areas of subrecipient noncompliance and will follow up on required corrective action as needed. The approved monitoring plan establishes controls to address the risks noted in the finding. Although delayed per our response to the 2022 single audit, the department has now completed desk audit reviews of all 22 subrecipients, which will serve as a baseline for subsequent years’ reviews. Each subrecipient completed a self-assessment document, which has been used to identify areas where technical assistance is needed and which will be used for comparison as the department conducts future monitoring activities following the USDA-prescribed four-year review cycle. Additionally, the following was added to the 2023 Departmental Risk Assessment (Form 3): Risk: TEFAP subrecipients are not monitored in accordance with USDA inventory and eligibility requirements. Controls: 1. The Administration and Grants Division ensures the TEFAP monitoring plan filed with the CPO meets all current USDA requirements for a state monitoring system. (Annually) 2. The monitoring plan is monitored internally to ensure the monitoring plan is completed within the timeline. (Regularly throughout the year.) The commodity administrator will be responsible for monitoring risks and assessing controls.

Finding Number 2023-027 Assistance Listing Number 97.036 Program Name Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Agency Department of Homeland Security State Agency Department of Military Federal Award Identification Number FEMA-4427-DR, FEMA-4476-DR, FEMA-4514-DR, FEMA-4541-DR, FEMA-4550-DR, FEMA-4594-DR, FEMA-4601-DR, and FEMA-4609-DR Federal Award Year2019 through 2021 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Military does not have adequate procedures for subrecipient monitoring, resulting in noncompliance BACKGROUND The Federal Emergency Management Agency (FEMA), which is part of the Department of Homeland Security, provides grant funding to the Tennessee Emergency Management Agency (TEMA) within the Tennessee Department of Military (Military) to help TEMA fulfill its mission “to coordinate preparedness, response, and recovery from man-made, natural, and technological hazards in a professional and efficient manner in concert with our stakeholders.” When a disaster occurs, Military (the recipient) obtains a prime award with FEMA. Using this award, applicants (for example, counties, cities, and nonprofits) apply directly with FEMA to obtain approval for projects supporting the disaster. Military or another state agency may also be an applicant in situations where Military or the state agency uses its own staff and resources to perform project activities. After reviewing the request, FEMA approves the applicant for the requested project. Once FEMA approves the project, Military then develops and obtains an agreement with the applicant. After the agreement between Military and the applicant is in place, applicants bill Military for allowable costs incurred. Military then pays the applicant and ultimately bills FEMA for the costs paid for all approved projects. Applicants other than Military or other state agencies are considered subrecipients of the awards. As such, FEMA requires Military to perform subrecipient monitoring procedures. As part of the subrecipient monitoring, Military is required to ensure subrecipients submit single audits to the Federal Audit Clearinghouse (FAC) within either 30 calendar days after receiving the reports or 9 months after the end of the subrecipient’s year-end, whichever is earlier. If the subrecipient’s single audit includes a finding for the subaward, Military then has 6 months to issue a management decision to the subrecipient. To comply with these requirements, Military must have sound procedures to routinely search for single audits, identify and document subrecipients who should and should not receive an audit, and follow up with subrecipients when audits are not submitted timely. During the audit period, staff used a list of all open and executed Military agreements with applicants to create a list of all subrecipients to use as a basis for monitoring audits. Staff then searched for single audits or other audits on the Tennessee Comptroller of the Treasury’s website for each subrecipient included on the list. Staff reviewed the audit results and documented the total federal expenditures reported in the audit on the list. In addition to the audit report monitoring, Military also performs more detailed monitoring, such as reviewing documentation to ensure funds were used for allowable purposes for a portion of the program’s subrecipients. Management selects subrecipients based on a risk assessment. The risk assessment includes several factors, such as subrecipient experience with similar subawards and prior audit results. Management’s review of subrecipient single audit reports is an important part of overall subrecipient monitoring. It allows management to leverage work performed by the subrecipients’ external auditors to help management ensure subawards are used for authorized purposes. CONDITION AND CAUSE From the list of subrecipients with detailed monitoring, we selected a sample of 40 subrecipients to determine if Military had fulfilled its subrecipient monitoring responsibilities. Through our gaining an understanding of the subrecipient monitoring process and our testwork, we determined that Military’s subrecipient monitoring process was not adequate to ensure it met the federal requirements regarding subrecipient single audits. We noted the following six specific internal control weaknesses in Military’s procedures. • Military used an incorrect website to confirm compliance with audit requirements. • Military did not have adequate procedures to determine if a subrecipient was required to have an audit. • Military’s procedures used to identify subrecipients did not identify all subrecipients. • Management does not have a process to perform routine searches for audit reports. • Management could not provide complete documentation of its audit report review. • Management did not adequately document its review of subrecipients included in parent entity single audits. Military Used an Incorrect Website to Confirm Compliance With Audit Requirements Management used the Comptroller’s website to confirm that subrecipients submitted audits, but management should have verified this information on the FAC’s website. While the Comptroller’s website is a tool for gathering information about subrecipients, the federal requirements described in this finding require the subrecipients to submit audit reports to the FAC. Because subrecipients may have an audit on the Comptroller’s website but not on the FAC’s website, Military was unable to determine compliance. Military Did Not Have Adequate Procedures to Determine if a Subrecipient Was Required to Have an Audit Military did not determine if all identified subrecipients on the list of all subrecipients were required to have a single audit. Instead, if staff could not locate a single audit, they did not update the “Date of Audit Monitoring” column. Our testwork revealed that monitoring procedures for 10 of 40 subrecipients (25%) tested were not adequate: • For 7 of the subrecipients tested, the “Date of Audit Monitoring” field was not updated, and there was no evidence that management had determined if the lack of an audit was due to the subrecipient’s failure to obtain an audit or if the subrecipient was not required to have an audit because they did not exceed $750,000 of federal award expenditures. Five subrecipients had blank entries in the “$750K verification” column and the other two had amounts exceeding $750,000, but these amounts were for old single audits. None of the 7 had current audits in the FAC. • For an additional 3 subrecipients tested, the “Date of Audit Monitoring” field included a date for a current period review, but the subrecipient did not have a current audit in the FAC. Since there were no current audits in the FAC, we were not able to determine which audits management reviewed. Additionally, for 2 of the subrecipients, management recorded expenditures exceeding $750,000 in the “$750K verification” column, suggesting that an audit of the subrecipient may be required. Military’s Procedures Used to Identify Subrecipients Did Not Identify All Subrecipients As noted above, an applicant applies for a subaward from FEMA before entering into an agreement with Military, which could be months later. This process may result in an applicant reporting expenses in the fiscal year before the Military agreement is in place. Because Military creates its audit report monitoring list based on its open and executed agreements, not a list of FEMA awards, Military may not recognize all applicants as subrecipients. By searching the FAC for entities in Tennessee with findings pertaining to this program, we found one subrecipient that Military had not identified. FEMA approved the applicant’s award in April 2020, but Military did not have an agreement with the applicant until the following fiscal year in December 2021. We noted two instances of noncompliance because Military did not identify this applicant as a subrecipient: • Military had not issued a management decision on the subrecipient’s audit finding as of October 23, 2023, almost five months late. • FAC did not receive the subrecipient’s June 30, 2021, single audit report until November 28, 2022, almost eight months after the due date. During fieldwork, we became aware of two additional subrecipients not included on the audit report monitoring list. Management could not explain why the two subrecipients were not on the monitoring list. Management Does Not Have a Process to Perform Routine Searches for Audit Reports According to the list of all subrecipients, most of the audit reports were reviewed in April, May, and June, although subrecipients submit reports to the FAC throughout the year. Our testwork revealed that Military did not review two subrecipients’ audit reports timely. One subrecipient’s June 30, 2022, single audit was released to the FAC on October 13, 2022, but Military did not review the report until June 5, 2023. If the audit had contained findings, management would not have been able to issue a management decision within the required timeframe. In the other instance, Military did not ensure that one subrecipient’s June 30, 2021, single audit was submitted timely. The audit report was due on March 31, 2022, but was not released to FAC until November 4, 2022. Management Could Not Provide Complete Documentation of Its Audit Report Review Military either did not document or update the date the audit report was reviewed for 12 of the 40 subrecipients (30%) tested. Since management included total Schedule of Expenditures of Federal Awards amounts that matched the current year’s single audit report on the list, we determined there was evidence that Military completed the audit report monitoring for these subrecipients, but we were not able to ascertain when the review occurred. The Program Monitor did not know why dates were not included or were not updated. Management Did Not Adequately Document Its Review of Subrecipients Included in Parent Entity Single Audits Two of the subrecipients in our sample of 40 were utility departments for a local government. These entities’ activities were included in the local government’s audit instead of a separate audit of the utility department. Military reviewed the audit report for the parent for one of the local governments; however, Military did not review the other local government report. In both instances, management did not document which parent entity’s audit report was reviewed. CRITERIA As the pass-through entity, Military is required by Title 2, Code of Federal Regulations (CFR), Part 200, Section 332(f), to verify that all subrecipients that spend $750,000 or more of federal awards obtain a single audit. According to 2 CFR 200.512(a)(1), the audit must be submitted to the FAC within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. 2 CFR 200.521(d) states that The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. EFFECT When management does not obtain and review subrecipients’ single audit results as required by federal regulations, including single audit findings, the risk increases that management will not promptly identify subrecipients’ noncompliance and control deficiencies so that corrective action can be achieved. When management does not track subrecipients for exceeding the single audit threshold, has procedures that do not identify all subrecipients, or does not perform routine searches of single audits, management is hindered in issuing timely management decisions when necessary and in its ability to timely identify and follow up with subrecipients that fail to submit audits timely. In addition, not updating the date of the audit report review creates questions about whether management completed the audit report monitoring for the subrecipient. For subrecipients included in parent governments’ single audits, not documenting or understanding the inclusion of those subrecipients in larger government single audits increases the risk that management will not become aware of findings related to the subrecipient and will not be able to issue management decisions timely. When staff do not use the FAC to confirm audits are submitted, the risk increases that Military will not timely detect subrecipients that have not submitted to the FAC. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” these actions may include the following: • not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; • requiring additional, more detailed financial reports or additional project monitoring; • requiring the agency to obtain technical or management assistance; or • establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include the following: • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • withholding further awards for the project or program, or • pursuing other available legal remedies. RECOMMENDATION Management should update the process to identify subrecipients to ensure the audit report monitoring list includes all subrecipients for the monitoring cycle. Management should develop a procedure for tracking subrecipients’ expenditures to evaluate whether they exceed the single audit threshold requiring an audit. Additionally, the tracking should include determining the financial relationship between the entities since some applicants are audited as a part of a local government. Management should improve the audit monitoring process by adequately documenting the date a single audit is reviewed. The monitoring should include a search for single audits in the Federal Audit Clearinghouse and a monthly or quarterly search for the released single audits to ensure timeliness in audit releases and any possible management decisions. The monitoring should reference the tracking of subrecipients’ expenditures for identification of the subrecipients who are required to have a single audit. MANAGEMENT’S COMMENT We concur. Our team is developing written procedures for evaluating the website to determine if a single audit is required. These procedures will outline the criteria for conducting the evaluation, the individuals responsible for performing the assessment, and the frequency of the evaluation. Written procedures will include bookmarking the correct website for all future evaluations. Management is researching training capabilities with outside resources to gain more extensive knowledge about the audit criteria requirements and how to evaluate the Federal Audit Clearinghouse website. We will provide training to relevant staff members on the newly established procedures to ensure they understand their roles and responsibilities in evaluating the website for single audit requirements. We will conduct a review of the website in accordance with the new procedures to determine if a single audit is required for the current fiscal year and document the results of this evaluation for audit trail purposes. Program Monitoring management will work with the Tennessee Emergency Management Agency (TEMA) on gaining proper reporting criteria within the Federal award scope versus state agreement elements. In addition, we will work internally to build a parent/child relationship hierarchy for the federal awards to ensure thresholds are properly evaluated. Finally, we will implement a process for regular review and update of the procedures to ensure they remain relevant and effective in identifying the need for a single audit. We are committed to improving our internal controls and procedures to ensure compliance with audit requirements.

Finding Number 2023-028 Assistance Listing Number 84.007, 84.033, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency University of Tennessee Federal Award Identification Number 23P007A223937, P033A223937, P063P222250, and P268K23250 Federal Award Year 2022 and 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The university’s Knoxville campus did not perform a risk assessment for its information security program as required by the Gramm-Leach-Bliley Act CONDITION AND CAUSE The Standards for Safeguarding Customer Information, established by the Gramm-Leach-Bliley Act (GLBA), requires institutions to safeguard sensitive data, which includes information obtained in support of the administration of the federal financial assistance programs. While management at the university’s Knoxville campus has taken steps to comply with the GLBA, management did not conduct a written risk assessment to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of students’ information, as required by GLBA. Campus management has purchased a risk assessment software solution, and they plan to complete a written risk assessment in early 2024. Because the current Chief Information Security Officer began employment subsequent to the audit period, he was unable to determine why former leadership did not conduct this risk assessment. CRITERIA According to the “Standards for Safeguarding Customer Information,” Title 16, Code of Federal Regulations, Part 314, Section 3(a), “you shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts.” Additionally, according to 16 CFR 314.4(b), the institution must Base your information security program on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks. (1) The risk assessment shall be written and shall include: (i) Criteria for the evaluation and categorization of identified security risks or threats you face; (ii) Criteria for the assessment of the confidentiality, integrity, and availability of your information systems and customer information, including the adequacy of the existing controls in the context of the identified risks or threats you face; and (iii) Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the information security program will address the risks. (2) You shall periodically perform additional risk assessments that reexamine the reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and reassess the sufficiency of any safeguards in place to control these risks. EFFECT Not performing a risk assessment for its information security program as required by the GLBA increases the risk that the campus’s information technology safeguards may not align with the risks the campus faces. As a result, students’ financial information could be more susceptible to unauthorized disclosure, misuse, alteration, destruction, or other compromise. Risk assessments are essential to designing and implementing appropriate safeguards that address internal and external threats to the campus’s information technology resources. RECOMMENDATION Management should develop, implement, and maintain a comprehensive information security program based on a documented risk assessment. The risk assessment should identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of student information, as required by the Gramm-Leach-Bliley Act. MANAGEMENT’S COMMENT Management concurs that the Knoxville campus did not perform a formal written risk assessment of the controls related to financial aid systems, as required by the Gramm-Leach-Bliley Act. As noted in the audit finding, management at the Knoxville campus has taken significant steps to comply with the GLBA. Additionally, Knoxville campus management performed a non-documented risk assessment which complied with GLBA.

Finding Number 2023-029 Assistance Listing Number 84.063 and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency University of Tennessee Federal Award Identification Number P063P222250 and P268K23250 Federal Award Year 2022 and 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Eligibility Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.063 Federal Award Identification Number P063P222250 Amount $4,821 Assistance Listing Number 84.268 Federal Award Identification Number P268K23250 Amount $136,014 FINDING The University of Tennessee – Knoxville Office of Financial Aid and Scholarships did not adequately monitor the eligibility of Title IV financial aid recipients BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending eligible institutions of postsecondary education. The programs include assistance such as Pell Grants, Direct Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. Each school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. Some of the responsibilities of the school are to determine student eligibility, verify data for students selected for verification by the Secretary, and ensure maximum assistance amounts established by ED are not exceeded individually or as part of the total aid package. Title 34, Code of Federal Regulations (CFR), Part 668, Section 164(b)(3), states, “At the time a disbursement is made to a student for a payment period, an institution must confirm that the student is eligible for the type and amount of Title IV, HEA program funds identified by that disbursement.” Students must also meet certain requirements, such as certain income levels and maintaining a certain grade point average, to be eligible for Title IV assistance. CONDITION, CAUSE, AND CRITERIA The University of Tennessee’s Office of Financial Aid and Scholarships did not adequately monitor the eligibility of Title IV financial aid recipients. We reviewed the entire population of 14,260 students enrolled at The University of Tennessee – Knoxville who received Title IV student financial assistance during the 2022–2023 award year. Of the 14,260 students, 17 students (0.12%) received excess financial aid based on their eligibility, resulting in overpayments totaling $140,835. • The university provided Title IV funding to 5 students enrolled in ineligible programs. Three of the 5 students had completed 60 hours in an eligible non-degree-seeking program and had not transferred to a degree-seeking or other eligible program. The remaining 2 students did not complete the required “non-degree” appeal form in order to receive Title IV funds while enrolled in an Advanced Transition program. According to management, students are allowed to be enrolled in a University Early Transition program up to 60 hours before being required to declare a major. If the student reaches 60 hours before declaring a major, that student is moved to the Advanced Transition program and is no longer eligible for Title IV funds. These errors occurred because the university had not configured its Banner system to verify the number of completed hours before payment, and management did not properly monitor the students’ accounts. Additionally, the Advanced Transition program for the remaining 2 students does not qualify for Title IV funds without a “non-degree” waiver in place. Financial aid staff instructed students to complete the form, but staff did not verify that students completed the form before awarding funds. Therefore, staff incorrectly awarded the following funds: See Schedule of Findings and Questioned Costs for table. • The university awarded Subsidized Direct Loans and Unsubsidized Direct Loans to five ineligible students because management incorrectly classified their grade levels in the Banner system. 34 CFR 668.203 sets the annual Direct Loan limits based on the student’s dependency status and grade level. Volume 3, Chapter 5, of the Federal Student Aid Handbook states that it is the responsibility of the university to verify that the student’s information is accurate before disbursing Title IV funds. Financial aid staff did not properly verify the information in Banner before disbursing funds; therefore, staff incorrectly awarded the following funds: See Schedule of Findings and Questioned Costs for table. • The university awarded $66,017 of Unsubsidized Direct Loan funds to six students even though the students had already reached their aggregate loan limit. 34 CFR 668.32 states that a student is eligible to receive Direct Loans, except as provided in 34 CFR 668.35(d), if the student has not obtained loan amounts in excess of the program’s annual or aggregate loan limits. 34 CFR 668.35(d) states that a student who has received loan funds exceeding the annual or aggregate loan limits must either repay the excess amount in full or arrange with the lender to repay the excess loan amount before they may receive any further Title IV assistance, including Pell grants. The university did not provide documentation that payment arrangements had been made that would permit the students to regain eligibility for Title IV loans. These errors occurred because financial aid staff did not properly monitor the outstanding loan amounts previously awarded to the student. • The university awarded $20,284 in Unsubsidized Direct Loans to one student although the student was in default on previous Title IV financial aid. 34 CFR 668.19(a)(d) states that if the student previously attended another institution, the institution must determine if the student is in default on any Title IV loan. This error occurred because financial aid staff did not properly monitor the status of outstanding loans previously awarded to the student. EFFECT Because financial aid staff did not properly monitor student eligibility and enter student information correctly, students received Title IV assistance for which they were not eligible. Pell Grant overpayments of $4,821 and Direct Loan overpayments of $136,014 will be questioned. When the university disburses Title IV funds to which students were not entitled, ED could take adverse actions against the university. See Schedule of Findings and Questioned Costs for table. RECOMMENDATION Office of Financial Aid and Scholarships management should ensure staff and student advisors properly confirm the eligibility of Title IV recipients prior to the awarding and disbursement of Title IV funds. The university should implement controls to ensure appropriate staff monitor recipients’ enrollment in eligible programs, adherence to annual and aggregate loan limits, and whether students are in default on previous loans. MANAGEMENT’S COMMENT Management concurs. The UTK Office of Financial Aid & Scholarships experienced significant administrative staffing transitions related to the areas of eligibility noted in the finding. The staffing changes, combined with the manual nature of the noted processes, resulted in eligibility errors related to enrollment, grade level, loan status, and aid disbursement. Additional staff training and automated processes in the Banner Financial Aid System are being implemented to provide greater quality controls to review aid eligibility prior to and following aid disbursement. The Financial Aid review process for academic changes for non-degree status and degree major changes administered by the academic colleges is also being automated and reviewed periodically throughout each semester to ensure proper disbursement of aid. Management notes the total over award of $140,835 represents a fractional 0.08% of the total Title IV funds awarded of $173,771,469 by the institution.

Finding Number 2023-030 Assistance Listing Number84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency University of Tennessee Federal Award Identification Number P268K232842 Federal Award Year 2022 and 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Eligibility Repeat Finding N/A Pass-Through Entity N/A Questioned Costs $75,092 FINDING The University of Tennessee Health Science Center Financial Aid Office did not adequately monitor the eligibility of Title IV financial aid recipients BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The programs include assistance such as Pell Grants, Direct Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. Some of the responsibilities of the school are to determine student eligibility, verify data for students selected for verification by the Secretary, and ensure maximum assistance amounts established by ED are not exceeded individually or as part of the total aid package. Title 34, Code of Federal Regulations (CFR), Part 668, Section 164(b)(3), states, “At the time a disbursement is made to a student for a payment period, an institution must confirm that the student is eligible for the type and amount of Title IV, HEA program funds identified by that disbursement.” Students must also meet certain requirements, such as certain income levels and maintaining a certain grade point average, to be eligible for Title IV assistance. CONDITION, CAUSE, AND CRITERIA The University of Tennessee Health Science Center’s Financial Aid Office did not adequately monitor the eligibility of Title IV financial aid recipients. We reviewed the entire population of 2,195 students enrolled at the University of Tennessee Health Science Center who received Title IV student financial assistance during the 2022–2023 award year. Of the 2,195 students, 8 students (0.36%) received excess financial aid based on their eligibility, resulting in overpayments totaling $75,092. • The university provided Title IV funding to four students even though they had already reached their aggregate loan limit, causing them to be ineligible for Direct Loans. 34 CFR 668.32(g) states that a student is eligible to receive Direct Loans, except as provided in 34 CFR 668.35(d), if the student has not obtained loan amounts in excess of the program’s annual or aggregate loan limits. 34 CFR 668.35(d) states that a student who has received loan funds exceeding the annual or aggregate loan limits must either repay the excess amount in full or arrange with the lender to repay the excess loan amount before they may receive any further Title IV assistance, including Pell Grants. The university did not provide documentation of these arrangements. Because Financial Aid Office staff did not properly monitor the outstanding loan amounts previously awarded to the student, the university made the following awards in violation of federal regulations: See Schedule of Findings and Questioned Costs for table. • The university awarded Pell Grant and Direct Loan funds to four students without verifying the students’ GPA met the criteria for satisfactory academic progress. 34 CFR 668.34(a) requires institutions that participate in Title IV programs to “establish a reasonable satisfactory academic progress policy for determining whether an otherwise eligible student is making satisfactory academic progress in his or her educational program and may receive assistance under the title IV, HEA programs.” While the university has a Satisfactory Academic Progress Policy in place, the university did not adhere to the policy requirement to verify a readmitted student’s academic standing before awarding funds. Because Financial Aid Office staff did not properly verify the students’ information before disbursing funds, the university awarded the following funds in violation of federal requirements: See Schedule of Findings and Questioned Costs for table. EFFECT Because Financial Aid Office staff did not properly monitor student eligibility, students received Title IV assistance for which they were not eligible. Direct Loan overpayments of $75,092 will be questioned. When the university disburses Title IV funds to students to which they were not entitled, ED could take adverse actions against the university. See Schedule of Findings and Questioned Costs for table. RECOMMENDATION Financial Aid Office management should ensure that staff and student advisors properly confirm the eligibility of Title IV recipients prior to the awarding and disbursement of Title IV funds. The university should implement controls to ensure appropriate staff monitor recipients’ adherence to annual and aggregate loan limits and satisfactory academic progress. MANAGEMENT’S COMMENT Management concurs with the finding. The excess financial aid awarded to the students will be removed from their respective student accounts and returned to the Department of Education. Management notes that the finding was restricted to the College of Nursing, and attributable to human error and lack of backup measures. Management further notes the total over award of $75,092 represents a fractional 0.08% of the total Title IV funds awarded of $90,012,792 by the institution. Management has already addressed the issue by hiring a new financial aid counselor with the appropriate training and experience.

Finding Number 2023-031 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency University of Memphis Federal Award Identification Number P007A223902, P063P220380, and P268K230380 Federal Award Year 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Eligibility Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.007 Federal Award Identification Number P007A223902 Amount $150 Assistance Listing Number 84.063 Federal Award Identification Number P063P220380 Amount $1,724 Assistance Listing Number 84.268 Federal Award Identification Number P268K230380 Amount $31,479 FINDING The University of Memphis Office of Student Financial Aid and Scholarships did not adequately monitor the eligibility of Title IV financial aid recipients BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The programs include assistance such as Pell Grants, Direct Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The schools then notify the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. Some of the responsibilities of the school are to determine student eligibility, verify data for students selected for verification by the Secretary, and ensure maximum assistance amounts established by ED are not exceeded individually or as part of the total aid package. Title 34, Code of Federal Regulations (CFR), Part 668, Section 164(b)(3), states, “At the time a disbursement is made to a student for a payment period, an institution must confirm that the student is eligible for the type and amount of Title IV, HEA program funds identified by that disbursement.” Students must also meet certain requirements, such as certain income levels and maintaining a certain grade point average, to be eligible for Title IV assistance. CONDITION, CAUSE, AND CRITERIA The University of Memphis Office of Student Financial Aid and Scholarships did not adequately monitor the eligibility of Title IV financial aid recipients. We reviewed the entire population of 12,290 students enrolled at the University of Memphis who received Title IV student financial assistance during the 2022–2023 award year. Of the 12,290 students, 20 students (0.16%) received excess financial aid based on their eligibility, resulting in overpayments totaling $33,353. • The university awarded Title IV funds to four students even though the students had already reached their aggregate loan limits. 34 CFR 668.32 states that a student is eligible to receive Direct Loans, except as provided in 34 CFR 668.35(d), if the student has not obtained loan amounts in excess of the program’s annual or aggregate loan limits. 34 CFR 668.35(d) states that a student who has received loan funds exceeding the annual or aggregate loan limits must either repay the excess amount in full or arrange with the lender to repay the excess loan amount before they may receive any further Title IV assistance, including Pell Grants. The university did not provide documentation that payment arrangements had been made that would permit the students to regain eligibility for Title IV loans. These errors occurred because Office of Financial Aid and Scholarships staff did not properly monitor the outstanding loan amounts previously awarded to the students. Therefore, the university awarded the following funds incorrectly: See Schedule of Findings and Questioned Costs for table. • The university awarded 14 students Title IV assistance that, when combined with other sources of financial aid, exceeded the students’ cost of attendance. 34 CFR 685.203(j) prohibits Direct Subsidized, Direct Unsubsidized, or Direct PLUS loans to exceed the student’s estimated cost of attendance minus other expected financial aid; Volume 6, Chapter 2, of the 2023–2024 Federal Student Aid Handbook further clarifies that “. . . a financial aid administrator may not award FWS employment to a student if that award, when combined with all other resources, would exceed the student’s need.” These errors occurred due to the timing of additional scholarships and aid being added; the additional awards were paid out after the Title IV funds were awarded and not adjusted for the additional aid. Therefore, the University of Memphis made the following awards in violation of federal regulations. See Schedule of Findings and Questioned Costs for table. • The university awarded one student a $150 Federal Supplemental Educational Opportunity Grant (FSEOG) payment even though the student had reached the Pell Lifetime Eligibility Used. 34 CFR 676.10(a) states that when selecting eligible students for each award year, “. . . an institution shall select those students with the lowest expected family contributions who will also receive Federal Pell Grants in that year.” This error occurred due to management not properly verifying Pell eligibility when determining which students would be awarded FSEOG funds. • In addition to the above errors, the university awarded one student $30 in FSEOG funds. As stated in 34 CFR 676.20(a), “an institution may award an FSEOG for an academic year in an amount it determines a student needs to continue his or her studies. However, except as provided in paragraph (c) of this section, an FSEOG may not be awarded for a full academic year that is (1) Less than $100; or (2) More than $4,000.” This error occurred due to human error and oversight. EFFECT Because Office of Financial Aid and Scholarships staff did not properly monitor student eligibility and enter student information, ineligible students received federal financial aid payments. Direct Loan overpayments, Pell Grant overpayments, and FSEOG overpayments of $33,353 will be questioned. RECOMMENDATION The Office of Financial Aid and Scholarships management should ensure that staff and student advisors properly confirm the eligibility of Title IV recipients prior to disbursement of Title IV funds. Controls should be in place to monitor enrollment changes, recipients’ enrollment in eligible programs, adherence to annual and aggregate loan limits, and satisfactory academic progress. MANAGEMENT’S COMMENT We concur with the finding and recommendation. Management will be conducting additional training with staff responsible for making awards to confirm Title IV aid eligibility and ensure aid amounts do not exceed limits. Reports will be modified to help better identify and correct potential issues that may arise through human error. Finally, additional staff will be charged with monitoring the updated reports to ensure issues are promptly resolved. These actions should create a multi-layered system of controls minimizing the likelihood of non-compliance.

Finding Number 2023-032 Assistance Listing Number 84.425F and 84.425M Program Name Education Stabilization Fund Federal Agency Department of Education State Agency Austin Peay State University Federal Award Identification Number P425F202674 and P425M200147 Federal Award Year 2020 through 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING Austin Peay State University did not post quarterly reports to the institution’s website in compliance with federal guidance for the Higher Education Emergency Relief Fund BACKGROUND The Coronavirus Aid, Relief, and Economic Security Act established the Higher Education Emergency Relief Fund (HEERF) to provide relief to colleges and universities that had been affected by the coronavirus pandemic. The Coronavirus Response and Relief Supplemental Appropriations Act and the American Rescue Plan Act provided additional waves of funding for the program. Since the inception of HEERF, Austin Peay State University (the university) has spent $61,230,968 in HEERF funds. During fiscal year 2023, the university only spent funds from the American Rescue Plan since funding from the first two waves was exhausted in previous years. CONDITION, CAUSE, AND CRITERIA The university did not have an effective system of internal controls, such as written policies and procedures or a reporting notification system, to ensure the university posted federal quarterly reports timely to the institution’s website. We tested all 4 quarterly HEERF reports for the year ended June 30, 2023. We found that the university did not post 3 of 4 (75%) “Quarterly Budget and Expenditure Reporting for all HEERF I, II, and III grant funds” reports within 10 calendar days after the end of the quarter in compliance with federal guidance. Based on the auditor’s inspection of the reports and review of the dates posted per the IT Webmaster, university management posted the reports to the university’s website between 8 and 99 days late for the quarters ending September 30, 2022; March 31, 2023; and June 30, 2023. Question 36 of the American Rescue Plan Act of 2021, Higher Education Emergency Relief Fund III, Frequently Asked Questions, updated October 25, 2022, states, “. . . this [report] must be conspicuously posted on the institution’s website no later than 10 days after the calendar quarter (January 10, April 10, July 10, and October 10) as long as the institution’s HEERF grant is active.” Based on discussions with the Associate Vice President of Budget and Finance, the university was short-staffed when the former Associate Vice President for Finance left in November 2022. She stated that the university did not have good records to follow, and the lack of continuity caused deadlines to be missed. As duties were reassigned, university leadership determined that reports were late and worked to resolve the backlog. EFFECT If the university does not ensure timely reporting, the U.S. Department of Education (ED) may impose further restrictions on the university, such as requiring additional monitoring or requiring the entity to obtain assistance from technical or management experts. ED may also temporarily withhold payments until the noncompliance has been corrected. In addition, not meeting the federal reporting requirements increases the likelihood that the public will not have access to transparent and accurate information regarding the university’s expenditures of federal awards. RECOMMENDATION Management should design and implement an effective system of internal controls, including written policies and procedures for all federal agency reporting. In addition, management should consider establishing a reporting notification system for federal grants to ensure timely reporting. MANAGEMENT’S COMMENT We concur with the finding. Upon becoming aware of the absence of the fiscal year 2023 reports on the website, our accounting staff promptly rectified the oversight. Furthermore, it is pertinent to note that the HEERF grants will conclude in June 2024, thereby relieving the university of the obligation to continually update the website with new reports. We are reviewing software solutions to support the Grants Office for reporting and compliance.

Finding Number 2023-033 Assistance Listing Number 84.063 and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Austin Peay State University Federal Award Identification Number P063P212217 and P268K222217 Federal Award Year 2023 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING Austin Peay State University did not have adequate procedures to prevent, or to detect and correct, errors in enrollment reporting BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For students who receive Pell Grants or Direct Loans, ED requires institutions to report enrollment status for each term, as well as changes to enrollment, such as graduations, withdrawals, and transitions between full- and part-time status, to the National Student Loan Data System (NSLDS), which is ED’s central database for federal student aid. CONDITION, CRITERIA, AND CAUSE We tested a sample of 26 Pell recipients and Direct Loan borrowers at Austin Peay State University (the university) who had a status change during the year. We found that for 10 of 26 students tested (38.5%), the registrar’s office incorrectly reported high-risk enrollment reporting data elements. The information for 2 of these students contained multiple errors. The registrar’s office misreported the following data elements for the students: • enrollment status, • program beginning date, • program length, and • program level Office of Postsecondary Education Identification (OPEID) number. Incorrect Enrollment Status The registrar’s office incorrectly reported the program enrollment status for 6 of the 10 students. • One student was enrolled in the first and second spring terms for a total of seven credit hours, which is considered half-time; however, the registrar’s office incorrectly reported the student’s program enrollment status as less than half-time because staff did not include the hours taken in the second spring term. In addition, the registrar did not report the student’s withdrawal from an associate’s degree program when the student changed to a bachelor’s degree program on March 7, 2023. When the system updated the active associate’s degree status, the system applied the spring term as the end term. As a result, the system continued to report the associate’s degree with an active status until the full spring term ended, even though the status should have changed to inactive after March 7, 2023. Chapter 4.2.1 of the NSLDS Enrollment Reporting Guide, issued November 2022, states, “Whenever a student changes majors, the school should report the student as withdrawn from the previous program and enrolled in the new program on the next enrollment submission. . . . Additionally, if the student is enrolled in the same unique program multiple times, Schools should only report one version of the program with the earliest Program Begin Date.” The registrar’s office did not have a manual process to verify the proper program status for mid-term status changes. • The registrar’s office improperly updated two students’ program enrollment statuses in NSLDS to withdrawn when the students completed the spring term, enrolled in the summer term, and subsequently withdrew from the summer term. ED’s electronic announcement, “(General) Subject: Summer Term Enrollment Reporting to the National Student Loan Data System (NSLDS),” posted on April 20, 2017, states, “If such a student subsequently withdraws from the summer term, the student’s most recent enrollment status of half time or greater should be reported throughout the remainder of the summer.” The registrar was unaware of the unique summer enrollment reporting guidance for student withdrawals. • The registrar’s office did not update the program enrollment status in the university’s system for three students when the students graduated from the program, causing the program status to incorrectly show as active in NSLDS as of December 14, 2024. Two of the students graduated on May 5, 2023, and the third student graduated on May 21, 2023. The registrar’s office reported the graduated status for the program in the National Student Clearinghouse; however, the university’s system retained the active status because the student was also enrolled in another program. The NSLDS Enrollment Reporting Guide, Chapter 4.4.4, states, “A school must correctly report students who have completed a program with a ‘G’ for ‘Graduated’ status rather than a ‘W’ for ‘Withdrawn’. Further, an accurately anticipated completion date aids in correct servicing of a student’s loans, avoiding unnecessary early conversion to repayment or too late conversion, causing technical defaults.” Management stated that the university does not have a process to report the graduated program status when a student is enrolled in another active program. As a result, the registrar’s office continued to report the graduated program as active with the students’ current enrollment status information for the other program. Incorrect Program Beginning Date The registrar’s office reported the incorrect beginning date of the program of study for 2 students who changed programs during the year. Staff reported the program’s beginning date between 877 and 980 days after the appropriate term start date. The NSLDS Enrollment Reporting Guide, Chapter 4.4.8, states, “The Program Begin Date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program, unless the student enrolled in the program on an earlier date.” When a student already enrolled in a program changes to a new program, the prior program should be withdrawn and a new program reported. The program’s beginning date should be the date the student directly began attending the program being reported. Based on discussions with the registrar, she thought the program beginning date only mattered for the credential level and did not know that changes in the field of study would generate a new beginning date. The registrar’s office could not explain where the selected program beginning dates originated for these students. Incorrect Program Length The registrar’s office reported the program length as 4.5 years rather than 4.0 years for the Radiologic Science bachelor’s degree for 1 of the 10 students. Title 34, Code of Federal Regulations, Part 668, Chapter 41(a), defines normal time as “the amount of time necessary for a student to complete all requirements for a degree or certificate according to the institution’s catalog. This is typically four years for a bachelor’s degree in a standard term-based institution.” The registrar’s office had set up a general rule in the institution’s information system to assign any program with more than 120 credit hours with a completion length greater than 4 years. The Radiologic Science bachelor’s degree requires 121 credit hours; however, the program is completed in 4 years. The registrar’s office does not have a manual process to confirm the accuracy of the general rule. Incorrect Program Level OPEID Number For three students, the registrar’s office reported the OPEID number for the main campus, rather than the OPEID number for the campus location where the student attended classes. The NSLDS Enrollment Reporting Guide, Chapter 4.1, states, “Enrollment is reported for a specific location of each campus; that is, the eight-digit Office of Postsecondary Education Identification (OPEID) number.” The registrar stated that the programs in the system are exclusively tied to the OPEID number for the main campus. As a result, the university reported the main campus OPEID number for all programs. The registrar was not aware of the requirement to report the OPEID number based on the campus location where the student attends classes. EFFECT A student’s enrollment status determines eligibility for in-school status, deferment, and grace periods, and it provides vast amounts of critical data about the effectiveness of Title IV aid programs. Timely and accurate enrollment reporting is critical for effective management of the programs. Incorrectly reporting enrollment status changes could result in several errors, such as awarding grants based on the wrong enrollment status, inappropriately granting an in-school loan deferment, or failing to start the grace period or properly initiate the loan repayment process for students who are no longer enrolled. Noncompliance with enrollment reporting requirements could result in corrective actions requested by ED, such as placing further requirements or restrictions on the university. RECOMMENDATION The registrar should revise procedures to ensure that the registrar’s office uploads and submits the correct information to NSLDS. The registrar should ensure staff are adequately trained on the requirements for reporting status changes to ensure accurate reporting. Furthermore, the registrar should ensure that the university staff’s computer processes are operating effectively and should establish a process to verify statuses in NSLDS. MANAGEMENT’S COMMENT We concur with the finding. NSLDS review procedures will be created in the Office of the Registrar to ensure proper reporting occurs and verification is completed in a timely manner. These procedures will be documented by the end of fiscal year 2024 and periodically reviewed afterward. New procedures, such as reporting graduation twice, have been implemented since the conclusion of the audit. In addition to new procedures, the Registrar will implement cross-training requirements so at least three individuals may report and update information with NSLDS anytime.

Finding Number 2022-001 Assistance Listing Number 84.425F and 84.425J Program Name Education Stabilization Fund Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number P425F201352, P425F201352 ? 20B, P425J200061, and P425J200061-20C Federal Award Year 2020 through 2022 Finding Type Material Weakness and Noncompliance Compliance Requirement Activities Allowed or Unallowed and Allowable Costs/Cost Principles Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.425F Federal Award Identification Number P425F201352, P425F201352 ? 20B Amount $8,185,797 Questioned Costs Assistance Listing Number 84.425J Federal Award Identification Number P425J200061, P425J200061 ? 20C Amount $9,328,636 - $15,188,327 Finding Tennessee State University did not discharge student debt within federal guidance or their internal policy, and scholarship determinations and award calculations were not adequately documented in compliance with federal guidance for Higher Education Emergency Relief Funds Background The Coronavirus Aid, Relief, and Economic Security Act established the Higher Education Emergency Relief Fund (HEERF) to provide relief to colleges and universities who had been affected by the coronavirus pandemic. The Coronavirus Response and Relief Supplemental Appropriations Act and the American Rescue Plan Act provided additional waves of funding for the program. Since the inception of HEERF, Tennessee State University has been awarded $115,573,226 through three primary types of HEERF funds. The first type was student funds intended to be used for emergency aid grants to students. The second type was institutional funds, which were allowed to be spent for certain things, such as additional emergency aid grants to students, including discharging student debt, supplies to combat the coronavirus, and lost revenue. Lastly, TSU was granted supplemental funds dedicated for Historically Black Colleges and Universities (HBCU). TSU was allowed to use their HBCU HEERF for additional institutional costs as well as providing scholarships and grants to students. Executive leadership decided to use their HEERF funds primarily to discharge the debt of students, award scholarships, or issue student assistance grants. Executive leadership used the student funds to provide student assistance grants as emergency aid. Executive leadership chose to use a portion of the institutional HEERF award and a portion of the HBCU HEERF award to discharge debt. In addition, executive leadership used a portion of the HBCU HEERF award to provide additional scholarships to students during academic year 2021-2022. These scholarships were provided as either additional university scholarships or as tuition assistance grants, both of which could cover any part of the student?s cost of attendance. To receive these funds, TSU was required to follow federal regulations and additional federal guidance, such as Frequently Asked Questions (FAQs) published by the U.S. Department of Education (USDOE). Based on the work performed during our audit, we noted that TSU did not establish an adequate control structure for the institutional funds or HBCU portions of the HEERF award to ensure compliance with these federal guidelines. We noted the following issues because of the lack of internal controls. Debt Discharges Condition and Criteria Tennessee State University management did not discharge debt in compliance with federal guidance because they conditioned the discharge on the student reenrolling. In addition, management did not discharge debt in accordance with TSU?s internal guidance because they discharged debt outside of the parameters of the press release. Even after multiple discussions with TSU management, they were unable to provide us with any documentation of their policies and procedures surrounding these debt discharges. However, we were able to locate a press release on TSU?s website, dated August 4, 2021, which stated, It?s important to note that this account balance forgiveness initiative applies only to [fall 2021] returning students who were enrolled Spring 2020, Fall 2020, and Spring 2021. It will also cover Summer 2020 and 2021. Federal Guidance As noted in the press release, TSU only discharged student debt for students who reenrolled in the fall 2021 semester. However, an FAQ published by USDOE on May 11, 2021, stated, The institution cannot condition, nor imply that it will condition, discharging these funds on the condition the student takes any specified actions (i.e. no conditioning a discharge of debt on continued reenrollment). The statement in TSU?s press release is a violation of this guidance, as it allows for the debt discharge only if the student reenrolled in the fall 2021 semester. TSU?s internal policy As mentioned above, TSU did not discharge debt in accordance with TSU?s press release dated August 4, 2021. In addition, we tested a sample of 40 student debt discharges to determine whether management carried out the debt discharges as described in the press release. Based on this testwork, we noted that Tennessee State University management discharged debt outside of the parameters set forth in the press release. For 34 of 40 students tested (85%), the students? debt was discharged for terms outside of the eligible semesters. Each of the 34 students had debt discharged for the fall 2021 semester, totaling $135,344, and 2 of those students also had debt discharges for periods prior to spring 2020, totaling $225. The total estimated fall 2021 debt discharged was $14,019,614, representing 73.5 percent of the debt discharged during the fiscal year. Management stated they had updated the policy to include the fall 2021 semester; however, they were unable to provide documentation of the revised policy. Because management has made systematic errors in applying student payments to the correct terms, as discussed below, we were not able to determine the exact amount of questioned costs related to the student debt discharges; our best estimate of these questioned costs is $2,326,106. Cause Based on discussion with TSU personnel, the President and the executive leadership team determined the conditions of the debt discharge. However, this upper management group did not ensure the conditions met all federal requirements, such as conditioning discharges and documenting eligibility. For discharges of semesters before spring 2020, the issue stemmed from historical errors in which payments to student accounts have not always been applied to the correct term in the accounting system. This creates scenarios where a student?s account may balance in total, but each semester shows either an overpayment or underpayment. This created difficulties determining which debts were truly related to the semesters approved for discharge. HEERF Scholarships Condition and Criteria Tennessee State University management did not comply with federal requirements regarding documenting how a student could receive the HBCU HEERF funds used for tuition assistance grants, the actual award decisions, or how management determined the amount of each student?s award in accordance with federal requirements. In addition, management overspent the HBCU award. Management then transferred the overspent amount to other funding sources without verification that the transferred awards were in compliance with federal requirements of the new funding source. According to the Certification and Agreement for the CARES Act a(2) funds, For grants made to students, the Recipient should maintain records on how grants were distributed to students, how the amount of each grant was calculated, and any instructions or directions given to students about the grants. After numerous requests for documentation of management?s methodology for awarding and calculating awards, management was only able to provide us with emails sent to some students. These emails contained language such as the following: Our records show that you have not registered for fall 2021. Since you do not owe a balance from the last semester, we will assist you with paying your fees for this fall semester. The tuition assistance grant is available for students returning this fall. . . . we will assist you with your tuition and fees for fall 2021. We are providing up to $10,000 for this academic year. However, none of these emails describe how assistance would be determined. Management initially stated the award decision and award calculations were determined uniquely for each student who requested the award, but the determining factors were either not documented or the documentation was not retained. The Vice President of Business and Finance later stated that the President?s directive was to provide tuition assistance grants as last-dollar scholarships that would clear the student?s account. However, the Assistant Vice President of Financial Aid stated this was not the case during fiscal year 2022, and the only directive was to ?help the students and students could receive refunds or still owe balances, depending on the individual?s unique circumstances.? Management could not provide documentation to support either of these directives. The amount of these awards totaled $15,188,327, which we are identifying as questioned costs. In addition, management awarded $7,084,921 more in scholarships than they had available in HBCU HEERF funds. In an attempt to correct the overspending, management transferred $5,859,691 to institutional HEERF and $1,225,230 to the university?s general funds. The HEERF FAQ Rollup Document, Updated November 20, 2020, Question 36, states: Institutions may also use the funds for Recipient?s Institutional Costs received through the HEERF under Sections 18004(a)(1) and 18004(c) of the CARES Act to make additional emergency financial aid grants to students, provided that such emergency financial aid grants are for expenses related to the disruption of campus operations due to coronavirus (see FAQ #29). As long as awarding scholarships and providing payment for future academic terms are costs associated with significant changes to the delivery of instruction due to the coronavirus or, if provided to students in the form of emergency financial aid, are for expenses related to the disruption of campus operations due to coronavirus, such uses are allowable. An example of a cost that could have been covered from institutional funds related to the disruption of campus operations due to coronavirus would be a scholarship to pay for access to an online library while physical libraries were closed. Since the university applied these scholarships and tuition assistance grants to any portion of the cost of attendance and did not restrict their use to only those charges related to the significant changes to the delivery of instruction due to the coronavirus, TSU was not in compliance with federal requirements related to the institutional portion of the HEERF award. Questioned costs related to these scholarships and tuition assistance grants are $5,859,691. Cause Executive leadership did not establish clear policies, procedures, or controls around the awarding of HEERF scholarships. Based on discussion with auditee personnel, the President provided the total amount to be used for each type of scholarship to management and staff. The Office of Financial Aid and the Office of Enrollment Services were both involved in awarding the scholarships to students. This decentralized process, along with a lack of policies and procedures from upper management, resulted in a failure to adequately document awards. In addition, the Associate Vice President of Financial Services did not track the scholarships to monitor the amount of scholarships awarded and funds available until a reconciliation at yearend, which identified the overspending. Debt Discharges and HEERF Scholarships Effect USDOE guidance for HEERF funds included elements to ensure USDOE?s ability to maintain adequate oversight of awards. The lack of documentation limits the oversight ability of the federal departments and other applicable entities, creating difficulties in identifying whether the award was appropriate or whether any students were treated unfairly. Tennessee State University did not routinely track expenditure amounts and did not confirm the costs transferred to the institutional portion were allowable under institutional portion guidance. As a result, management overspent federal awards, and those awards were not in compliance with federal regulations, resulting in federal questioned costs. Because management overspent HBCU HEERF funds and did not maintain documentation identifying whether a student award was ultimately funded by HBCU HEERF, institutional HEERF, or university general funds, management was unable to determine compliance with federal guidance. The missing identification limits management, federal grantor, and auditor oversight, increasing the likelihood of undiscovered question costs and noncompliance. The transfer documentation did not distinguish between tuition assistance grants and institutional scholarships; thus, we were unable to determine whether the questioned costs on the two scholarship issues identified overlap. Therefore, instead of an exact amount of questioned costs, a range between $17,514,433 and $23,374,124 was noted for total questioned costs. Recommendation Executive leadership should provide appropriate guidance and oversight when devising how to expend resources for a federal program, especially new programs with quickly evolving guidance and multiple programs providing similar types of funding. This should include the creation of documented policies, procedures, and controls for the implementation of those funds and the federal authority underpinning the procedures. Management should also document reviews by employees knowledgeable of the guidance and policy throughout the implementation process for comparing the implementation with federal guidance and university policy. Furthermore, management should properly apply payments to the appropriate term on student accounts to ensure accuracy in term balances. Management should also regularly monitor expenditures under federal awards to ensure there are available funds remaining. Finally, management should appropriately identify which expenditures are transferred between different portions of federal funds to allow appropriate oversight and to ensure compliance with federal guidelines under the new funding source. Management?s Comment CFDA 84.425F We do not concur with this finding. This was an internal transfer between two HEERF accounts, from the institutional HEERF to the HBCU HEERF. Management made a correcting entry to record the scholarships under the correct federal award number. The full amount has not been drawn via G5 and the university has until June 30, 2023, to spend the funding and close out the CARES Act funding. When final reports are submitted to the awarding agency, all costs will be reported in the correct fund and award. This is simply an adjusting entry and by no means rises to the level of a finding. CFDA 84.425J We do not concur with this finding. In reference to the questioned costs in 84.425J, we believe the auditors are unsubstantiated in reporting this as such. Per federal regulations (2 CFR 200.84), questioned costs are expenses that are questioned by the auditor because of an audit finding. A questioned cost 1) may result from a violation or possible violation of a state, regulation, or terms and conditions of a federal award, 2) may not be supported by adequate documentation, or 3) may appear unreasonable (does not reflect the actions that a prudent person would take in the circumstances). Neither of these conditions relate to the transactions included herein. We have not violated any regulation; in fact, we remained in constant contact with the U.S. Department of Education to ensure that we were administering the funds in accordance with USDOE regulations. The auditors are inaccurate by issuing a finding that TSU did not discharge student debt within federal guidance. We are doing exactly as instructed by USDOE in assisting our students and allowing them to continue their education. We have provided all documentation available to explain our rationale and the decisions our President and the cabinet were making in a very fluid environment, which included a Pandemic Task Force. It is unfortunate that the auditors concluded that TSU did not have an adequate control structure for the institutional funds or the HBCU portion of the HEERF funds. In the auditors? analysis, reference was made to only one letter sent to students, that is being referred to as a press release. This report based the analysis only on the August 4, 2021, letter to students. TSU provided several emails and letters to students regarding funding to pay off their balances. Grants were distributed to students in accordance with the HEERF guidelines and were based on the amount owed. Assistance to students was based on the amount owed up to a maximum of $10,000. This was shown to the auditors. Requests were made by the auditors for documentation, policies, and procedures that are not required per the federal standards for the single audit. Again, we remained in contact with USDOE, the Management and Program Analyst with the Emergency Response Unit for the United States Department of Education. We followed the directions of USDOE very carefully and we believe costs (scholarship amounts) are reasonable and are within the definition of costs of attendance as defined in section 472 of the Higher Education Act of 1965. We further believe that our Financial Aid Officers, who work day in and day out with our students and are trained and certified to administer financial aid funding to our students through Title IV programs, are the best suited in our university to award this funding. For these reasons, we believe these costs are allowable, in total, related to 84.425J. Moreover, when the auditor brought it the attention of TSU that a policy was required before student debt could be discharged and that we did not follow federal policies or internal policies, we immediately notified the management and program specialist for the district that includes Tennessee. She directly informed us that per the guidance no such policy was required. In fact, these funds operate in the same manner as other grants the university had received. The management representative for the USDOE HEERF requested the notifications that were sent to students and the list of students whose debt was discharged, the amount of the debt, and how the amount was calculated. We provided to the USDOE Management and Program Specialist the list of 4,576 students whose debt was discharged in the amount totaling $15,188,327. This is the exact same information that we provided to the state auditors. The USDOE Management and Program Specialist reviewed the documentation outlined above and indicated that ?Regarding the $15 million as questioned costs, I have reviewed documentation requested and provided. Your account is in good standing with paying off student balances in the manner documented? as referenced in her communication on February 22, 2023. TSU discharged student debt within federal guidelines, as shown by the communication from the USDOE. TSU did not and was not required to have an internal policy that differed from the federal guidance. Though TSU has proper documentation, federal guidance did not require the specific documentation referenced in the auditor?s statement. TSU has maintained records in compliance with federal guidance for HEERF and USDOE has confirmed this. Auditor?s Comment We have reviewed management?s comments specific to their nonconcurrence with our finding and with the basis of questioned costs. Our finding, including questioned costs, is based on management?s inability to provide documentation of clear policies, procedures, or controls related to their spending of HEERF I, II, and III. We communicated with USDOE?s Office of the General Counsel, who confirmed that ?Institutions must document how each award was distributed to students under HEERF I, II, and III. The obligation for a grantee to `maintain records on how grants were distributed to students, how the amount of each grant was calculated, and any instructions or directions given to students about the grants? is subsumed under the general recordkeeping requirements of 2 CFR ? 200.334. Absent such records, a grantee would fail to demonstrate that the award amounts were `reasonable and necessary? in accordance with 2 CFR ? 200.404.? We also confirmed that the general recordkeeping requirements of 2 CFR 200.334 apply to all HEERF grants, including grant awards made under Assistance Listing Number 84.425J, Historically Black Colleges and Universities. We stand by the finding given that management has not provided documentation sufficient to support their assertions. Our duty is to report the matter to the federal grantor for ultimate consideration.

Finding Number 2022-002 Assistance Listing Number 93.575 and 93.596 Program Name Child Care and Development Fund Cluster Federal Agency Department of Health and Human Services State Agency Department of Human Services Federal Award Identification Number 1901TNCCDF, 2001TNCCC3, 2001TNCCDF, 2101TNCCDF 2101TNCCC5, 2101TNCDC6, 2101TNCSC6, 2201TNCCDF, and 2201TNCCDD Federal Award Year 2019 through 2022 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Repeat Finding 2021-027 Pass-Through Entity N/A Questioned Costs $47,723 Finding The Department of Human Services did not have sufficient internal controls in place to ensure children?s eligibility determinations were documented, resulting in $47,723 in federal questioned costs Background The Tennessee Department of Human Services (DHS) administers the Child Care and Development Fund (CCDF), a federal program that provides subsidies for child care. CCDF funds the state?s Child Care Certificate Program, which helps Families First (Temporary Assistance for Needy Families) participants, parents transitioning from the Families First program, teen parents, and other individuals obtain child care. To participate in the Child Care Certificate Program, children must be declared eligible by DHS staff or, for children in foster care or protective services, by Department of Children?s Services staff. In addition to income limits and other eligibility requirements, children must be under the age of 13 to participate in the program, unless they are incapable of self-care or are under court supervision. To document a child?s eligibility, DHS program staff use the Tennessee Child Care Management System (TCCMS), which is the system of record for the CCDF program. Title 45, Code of Federal Regulations (CFR), Part 98, Chapter 20(a)(2), requires that for a child to be eligible for child care services, family income cannot exceed 85% of the state median income according to the U.S. Bureau of the Census and family assets cannot exceed $1,000,000. To document whether a family meets the federal income and asset requirement, DHS requires families to complete the parental agreement form (PAF). According to program staff, DHS merged the PAF into the program?s application during fiscal year 2022. Electronic File Management System TCCMS is the department?s primary eligibility determination and payment processing system for the CCDF program. According to management, program staff store documentation supporting a child?s eligibility in two electronic file management systems: Family Assistance Record Application System and Child Care Certificate BOX, a cloud-based document storage system. DHS upgraded TCCMS during fiscal year 2022 and integrated into it the BOX system, which went live on March 18, 2022. Prior Audit Results In the prior audit, we noted that management did not maintain documentation of children?s eligibility determinations. Management concurred and stated the department was in the process of child care modernization that would address the issues noted. Condition and Cause Program Staff Did Not Have Sufficient Internal Controls In Place to Document Children?s Eligibility Based on our review, program management has not developed policies and procedures to guide staff on how to use the electronic file management system to ensure staff uploaded all required eligibility documentation so that the system housed sufficient documentation for eligible children participating in the program. We found that program staff uploaded emails but did not know to upload the email?s attachments separately into BOX. Additionally, staff did not verify that the documents uploaded properly. As a result, we could not verify all eligibility determinations in our sample testwork, as discussed below. According to program management, the implementation of a new electronic file management system and program staff turnover contributed to the eligibility documentation issues. To achieve efficiency, management stated that they decided to use one file management system, instead of two, and made the decision to discontinue BOX in June 2022, and replaced it with Service Now. We will examine Service Now as the electronic file management system during the next audit of the CCDF program. Missing Documentation to Support Eligibility Determinations To determine whether program staff correctly determined eligibility for the Child Care Certificate Program, we selected a nonstatistical, random sample of 60 children from a population of 25,697 children whose families received CCDF payments totaling $93,147,295, from July 1, 2021, through June 30, 2022. Based on our testwork, we found that for 14 of 60 children tested (23%), program staff did not maintain documentation supporting eligibility determination. Specifically, we identified the following overlapping issues. ? For 13 children, program management could not locate or did not obtain the parental agreement form (PAF) to ensure the income and asset amounts do not exceed the federally required thresholds. Six files did not contain a form or certification of assets on the eligibility application, nor was one ever obtained. For 7 of the 13, although we saw references to the PAF in the case notes in TCCMS, management could not provide the forms to substantiate eligibility. The PAF was not available from September 2021 through March 2022 because program management decided to remove the form from the process with the intention of merging the form into the eligibility application, but management did not add the PAF until April 2022. Program management, however, was not aware the PAF had not been merged with the eligibility application until we brought it to their attention during the audit. ? For four children, program management could not locate documentation of the child?s or sibling?s ages, or the relationship of household members to the child. For one child, program staff uploaded an email but failed to upload the participant?s birth certificate and the siblings? birth certificates in BOX. We questioned the costs, totaling $47,723, which DHS paid to families without sufficient eligibility documentation during our audit period. Risk Assessment We reviewed DHS?s 2021 Financial Integrity Act Risk Assessment and determined that management did not identify the risk of noncompliance with eligibility determinations, including the preservation of program documentation. As such, management did not establish control activities to ensure compliance with CCDF eligibility requirements as evidenced by sufficient documentation. Criteria Documentation Requirements The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides guidance to management for maintaining documentation of its internal control system. According to Green Book Principle 3.10, ?Documentation of the Internal Control System,? Effective documentation assists in management?s design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel, as well as a means to communicate that knowledge as needed to external parties, such as external auditors. According to 45 CFR 98.20(a), CFR (a) To be eligible for services under ? 98.50, a child shall, at the time of eligibility determination or redetermination . . . (2)(i) Reside with a family whose income does not exceed 85 percent of the State?s median income (SMI), which must be based on the most recent SMI data that is published by the Bureau of the Census, for a family of the same size; and (ii) Whose family assets do not exceed $1,000,000 (as certified by such family member) . . . . According to DHS Policy 11.12, ?Determining Family Household Size for Child Care Eligibility,? 1. Verification of relationships and age for applicants is to be provided during the initial eligibility determination process. These verifications are to be documented in the official case history. 2. Verification of relationship and age, including a new HS-3408 Application for Child Care Assistance/Smart Steps, must be provided for new household members due to a change (i.e. adoption, birth, marriage) or during re-determination for child care payment assistance. Risk Assessment According to Green Book Principle 7.02, ?Identification of Risks,? Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Effect Without establishing and implementing effective documentation controls, the risks increase that documentation used to support federal programs would not be available to external users, such as federal program auditors, and could result in questioned costs and possibly federally disallowed costs. Federal regulations address actions that the U.S. Department of Health and Human Services (HHS) may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 45 CFR 75.207(b), ?Specific award conditions,? these actions may include ? requiring reimbursement instead of advance payments; ? not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; ? requiring additional, more detailed financial reports or additional project monitoring; ? requiring the agency to obtain technical or management assistance; or ? establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 45 CFR 75.371, ?Remedies for noncompliance,? outlines additional actions HHS may take. Depending on the circumstances, these actions may include ? temporarily withholding payments until the noncompliance has been corrected, ? denying the use of funds, ? partly or fully suspending or terminating the federal award, ? initiating suspension or debarment proceedings, ? withholding further awards for the project or program, or ? pursuing other available legal remedies. Recommendation The Commissioner should ensure that management and program staff obtain and maintain supporting documentation for participants who are determined eligible for CCDF funding in accordance with federal and department requirements. As DHS continues to modernize its information systems, management should ensure that they establish adequate controls, including written policies and procedures, so that staff are fully aware of the system?s functionality and limitations. This should include a quality control review to ensure the system is working as intended. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, obtain documentation for deficiencies noted and/or seek recovery of any funds paid out on behalf of children that were ineligible. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. The Department could not produce all supporting eligibility documentation for fourteen (14) children. The Department has started utilizing the Staff Portal supported by ServiceNow to view online documentation. Any documents submitted with an online application through the Customer Portal will be stored in Box by an interface and is accessed through the Staff Portal by Child Care Specialists. Any supporting documentation with a paper application will be stored in TCCMS in the application tracking screen or case document tab. The Department includes sections on document retention in New Employee Academy training and Program includes document retention in on the job training with all new hires. Also, document retention is a section of the case reading tool that is used for the ongoing quality assurance process.

Finding Number 2022-003 Assistance Listing Number 93.575 and 93.596 Program Name Child Care and Development Fund Cluster Federal Agency Department of Health and Human Services State Agency Department of Human Services Federal Award Identification Number 1901TNCCDF, 2001TNCCDF, 2001TNCCC3, 2101TNCCDF, 2101TNCCC5, 2101TNCDC6, 2101TNCSC6, 2201TNCCDD, and 2201TNCCDF Federal Award Year 2019 through 2022 Finding Type Material Weakness and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2021-025 Pass-Through Entity N/A Questioned Costs N/A Finding As noted in the six prior audits, the Department of Human Services did not comply with the federal health and safety requirements for the Child Care and Development Fund program, and did not implement internal controls to ensure that providers complied with the necessary requirements Background and Criteria The Department of Human Services (DHS) is Tennessee?s lead agency responsible for administering the Child Care and Development Fund (CCDF) cluster of programs, which is a federal program under the oversight of the U.S. Department of Health and Human Services. CCDF funds subsidize child care for low-income families for parents who are working or attending training or educational programs. Additionally, the program supports activities to promote overall child care quality for all children, regardless of subsidy receipt. Under the CCDF Block Grant and Title 45, Code of Federal Regulations (CFR), Part 98, Section 41, lead agencies, such as DHS, have significant responsibility for ensuring the health and safety of children in child care through the state?s child care licensing system and for establishing health and safety standards for children who receive CCDF funds. 45 CFR 98.41 requires CCDF providers to meet the following 11 requirements related to health and safety, covering the health of children they serve and the safety of the building and premises where they serve children: 1. Prevention and control of infectious diseases (including immunization) . . . ; 2. Prevention of sudden infant death syndrome and use of safe sleeping practices; 3. Administration of medication, consistent with standards for parental consent; 4. Prevention and response to emergencies due to food and allergic reactions; 5. Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; 6. Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; 7. Emergency preparedness and response planning for emergencies resulting from a natural disaster or a man-caused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act [42 U.S.C. 5195a(a)(1)] . . . ; 8. Handling and storage of hazardous materials and the appropriate disposal of bio-contaminants; 9. Appropriate precautions in transporting children (if applicable); 10. Pediatric first aid and [CPR]; [and] 11. Recognition and reporting of child abuse and neglect. Although DHS is the state?s lead agency, DHS has a Memorandum of Agreement with the state?s Department of Education (DOE) to perform health and safety inspections of the state?s school-administered child care program providers to verify that the providers meet all 11 areas. For all other in-state providers, DHS is responsible for performing inspections to ensure that the providers meet all health and safety requirements. During the prior audit, DHS requested and was approved for waivers to reduce the number of health and safety requirements reviewed during inspections from 11 to 5. The waivers expired on September 30, 2021. CCDF Provider Classification The state?s child care providers participating in the CCDF program may be licensed or license-exempt. Licensed providers consist of family day cares, group child care homes, and child care centers. License-exempt providers consist of individuals that provide care for a small number of children, Boys and Girls Clubs, and other education-related providers assigned to DOE. Additionally, Tennessee?s children who are eligible for CCDF may receive child care from providers located outside the state. In that case, DHS staff obtain an up-to-date license from the providers? respective state regulators as assurance that those providers have met the health and safety requirements. Processes for Inspections of Child Care Providers Department of Human Services According to DHS Policy 13.02, ?Monitoring for Compliance,? providers must receive at least one announced visit per licensing year, and the number of unannounced visits per licensing year is determined by the provider?s star-quality rating and any complaints received. For license-exempt providers, DHS licensing consultants perform health and safety inspections during their initial enrollment and annually thereafter. From our walkthroughs, we learned that licensing consultants must complete the Child Care Agency Monitoring and Evaluation Check Sheet, a 12-page checklist with 15 high-risk areas encompassing various departmental rules. The checklist helps the consultants evaluate provider compliance with federal and state regulations, including specific items for the health and safety requirements discussed above. During our audit period, at the conclusion of their inspection, the consultants upload the completed checklist into DHS?s SharePoint site and enter a summary of the results into the Tennessee Licensed Care System (TLCS). A supervisor then reviews the inspection by examining the checklist and narrative in TLCS and documents their review in TLCS. On June 27, 2022, DHS implemented eLicensing, and according to management, program management and staff no longer had access to TLCS. For our audit scope period, management began transferring supporting documentation during our audit fieldwork; therefore, we accessed eLicensing to review these documents. Department of Education From our walkthroughs, we learned that DOE?s Early Childhood Quality and Support Specialists must complete the Verification of Program Review, a web-based checklist to help verify provider compliance. The checklist encompasses various departmental rules and federal and state regulations, including those for health and safety requirements. During inspections, the specialists must check if the provider met or did not meet each requirement. At the conclusion of their inspection, the specialists upload the completed checklist into DOE?s shared drive. A supervisor reviews the inspection by examining the checklist and narrative in their shared drive and documents their review in an Excel spreadsheet. Federal Notice of Noncompliance The U.S. Department of Health and Human Services (HHS), Administration for Children and Families, Office of Child Care monitors each state once every three years to determine if states are in compliance with federal CCDF regulations. In HHS?s federal fiscal year 2022?2024 CCDF Plan Approval Letter, dated December 13, 2021, HHS?s Office of Child Care approved Tennessee?s state plan with conditions due to DHS?s following areas of noncompliance related to DHS?s procedures described in the CCDF Plan. 1. Consumer and Provider Education (45 CFR 98.33) ? DHS ?must post monitoring and inspection reports? online. 2. Emergency Preparedness and Response Planning (45 CFR 98.41) ? DHS must develop the standards for Emergency Preparedness and Response Planning that child care providers must meet. 3. Enforcement of Licensing and Health and Safety Standards (45 CFR 98.42) ? DHS must have procedures in place ?to ensure that all child care providers caring for children receiving CCDF services comply with all applicable state and local health and safety requirements . . . .? DHS received a Preliminary Notice of Possible Non-Compliance from HHS, dated September 27, 2022, that reported that management was still not compliant with the above items. Prior Audit Results In the prior audit finding, we found that DHS and DOE program staff did not consistently document whether child care providers complied with health and safety requirements, and that DHS and DOE supervisors did not have an adequate review process. Specifically, we found DHS and DOE staff did not ensure that providers included all required areas of disaster and emergency response in their emergency preparedness plans. Lastly, we found that DHS did not include the license-exempt providers in their monitoring plan. DHS management partially concurred with the audit finding and stated that its quality contractors would provide technical assistance supporting the remediation of the Emergency Preparedness and Response Plan (plan) deficiencies noted. Management?s six-month follow-up stated that, on February 23, 2022, DHS delivered refresher training to supervisors and frontline staff on the health and safety requirements, and DHS implemented the requirement for the child care providers to submit their plans annually to DHS. Management stated they expected their child care modernization process, including the new eLicensing system, to strengthen internal controls and monitoring of supporting documentation. Finally, management stated they would resume monitoring visits of license-exempt providers in 2022. DOE concurred with the finding and stated that they would work with DHS to implement the necessary controls, revise inspection protocols, and provide training to staff and law enforcement stakeholders who perform inspections. Sample Selection Process Due to deficiencies identified in the prior audit and the Notices of Non-Compliance from HHS, we obtained the Emergency Preparedness and Response Plan for each of the providers in our samples of DHS and DOE inspections from the departments. We examined the plans to determine if they included each of the areas required by 45 CFR 98.41(a)(1)(vii). For our testwork, if the provider was licensed prior to September 30, 2021, we tested the provider for the 5 requirements approved by the waiver. If the provider was licensed after September 30, 2021, we tested the provider for all 11 requirements. From a population of 2,032 licensed providers and 5 license-exempt providers assigned to DHS and 315 providers assigned to DOE, we selected a nonstatistical, random sample of 60 child care providers and all 5 license-exempt providers from the DHS population and 40 from the DOE population. We performed testwork to determine if DHS and DOE documented on their checklists and/or on the eLicensing narratives that they had inspected the health and safety regulations applicable during our audit period. We also performed testwork to determine if supervisors documented their reviews of those inspections in eLicensing. For all 28 out-of-state providers that had received CCDF funds for providing child care to Tennessee children, we performed testwork to determine if DHS had obtained an active license issued to the child care provider by their home state regulators. Current Audit Results As a result of our work related to DOE?s inspection process, we did not note any deficiencies in provider inspections related to the Emergency Preparedness and Response Plans or any other health and safety requirements. In our review of DHS?s inspection process, we did not note any deficiencies for license-exempt providers. We did, however, find repeated conditions (as reported in prior audits) concerning provider plans. Specifically, we found that DHS staff failed to review the plans during the inspection process, and we found deficiencies related to other health and safety requirements even after DHS required providers to submit their plans to the department. Further details of the conditions at DHS are as follows. Criteria, Condition, and Cause Condition A: Health and Safety Inspections Failed to Identify Deficient Provider Emergency Preparedness and Response Plans (Repeat Condition) Emergency preparedness and response planning was a main condition in the prior audit. From the list of 11 health and safety requirements noted above, requirement seven requires each child care provider to perform emergency preparedness and response planning. This planning is required to include preparations for a natural disaster or threats perpetrated by an individual. The child care provider must address procedures for evacuation; relocation; shelter-in-place/lock down; communication and reunification with families; continuity of operations; accommodations for infants/toddlers, children with disabilities, and children with chronic medical conditions; and staff/volunteer training and drills. Based on our testwork, we found that for 38 of 60 licensed providers (63%), licensing consultants failed to identify that the providers had not included all requirements in their Emergency Preparedness and Response Plan. A further review showed that the plan?s checklist did not include written instructions for the providers to follow when a specific requirement was not applicable. According to management, they were not sure why the plans were not completed fully; however, management explained that some requirement areas of the plan may not be applicable to every provider and that going forward, they would verbally instruct providers to notate nonapplicable areas accordingly. Condition B: Supervisory Reviews Were Not Sufficient to Ensure That Inspections Included All Required Areas Related to Health and Safety (Repeat Condition) Management has not developed written policies and procedures for the supervisory review process to ensure sufficient supervisory reviews are performed. As noted in Condition A, we found that supervisors did not identify plan deficiencies in 38 provider inspections. In addition, we also found that for 8 of 60 licensed child care provider inspections (13%), the licensing consultant failed to sufficiently document which federal health and safety requirements they inspected and, although the supervisors signed off on all of these inspections, the supervisors? reviews did not identify any of the missing required elements in the inspections. To achieve DHS?s mission, management is responsible for establishing the necessary operational processes to carry out the department?s functions, objectives, and goals. These key operational processes should include effective internal control activities, including management?s oversight of key processes designed to achieve federal program compliance. Management is responsible for designing, implementing, and monitoring internal controls in accordance with Standards for Internal Control in the Federal Government (Green Book), which provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. The Green Book?s overview states, A deficiency in internal control exists when the design, implementation, or operation of a control does not allow management or personnel, in the normal course of performing their assigned functions, to achieve control objectives and address related risks. Risk Assessment We reviewed DHS?s December 2021 Financial Integrity Act Risk Assessment for department operations and determined that management listed the risk of noncompliance with federal health and safety requirements. Management identified the inspections of child care providers as the internal control to mitigate the risk. However, based on the results of our review, the inspections and subsequent supervisory reviews were not effective in mitigating the risks of noncompliance. According to Green Book Principle 7.02, ?Identification of Risks,? Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. According to Green Book Principle 7.09, ?Response to Risks,? When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. Effect When child care providers do not have a comprehensive Emergency Preparedness and Response Plan, children may be at risk during a time of crisis. Additionally, in the event of an emergency relocation, the providers may not have sufficiently addressed the likely risks related to communication and child/parent reunification. When management does not ensure provider inspections are properly performed, documented, and reviewed, children in the providers? care are subjected to potential health and safety risks. Recommendation DHS management should ensure that staff who perform inspections of child care providers understand their responsibilities for health and safety requirements and continue to work with the U.S. Department of Health and Human Services to address the noncompliance. As DHS moves toward modernizing its information systems, management must establish the necessary controls, including written policies and procedures for adequate supervisory reviews. Because of their significant responsibilities for ensuring the health and safety of children in child care, management should establish a quality assurance process to evaluate the effectiveness of their inspection process, including the actual inspection and supervisory review. In addition, management should carefully evaluate their risk assessments to ensure they include all risks and should implement effective controls to address the risks noted in this finding. Management should update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. Management?s Comment Condition A We concur. The Emergency Preparedness and Response Plans (EPRPs) for thirty-eight (38) child care providers did not fully comply with the requirements of 45 CFR ? 98.41(c)(4)(vii). The Department will work with its quality contractors to deliver target technical assistance supporting remediation of identified EPRP deficiencies during the audit to ensure corrective action is established before June 30, 2023. The Department has a EPRP template that will be strongly suggested to providers to use as their EPRP or to use the template when creating their EPRP for the agency. If a section does not apply to a provider, the providers will be instructed to indicate ?this section does not apply?. The Department is in the process of creating a checklist as a guide for Licensing Consultants to annually review EPRPs. New providers that have not been issued a continual license will continue to have their EPRP reviewed by the Pre-Licensure Unit and Quality Partner. During the transfer from provisional license to continual license there will be an additional review of the EPRP. The Department will continue to identify opportunities that further enhance training and technical assistance opportunities in the topics of emergency preparedness and response available from its quality contractors and other subject matter experts. Condition B We concur. The Licensing Consultant did not sufficiently document which federal health and safety requirements they inspected in eight (8) child care provider inspections. The Department has increased communication to Licensing Consultants and Field Supervisors to strengthen internal controls for monitoring documentation. The Department will implement a quality assurance checklist tool by April 1, 2023. The quality assurance checklist tool will be used by the Field Supervisors when reviewing work done by Licensing Consultants in the field on monitoring visits. The Department will continue to provide additional coaching for all staff, frontline and supervisors, regarding policy and expectations for conducting and documenting monitoring inspections.

Finding Number 2022-004 Assistance Listing Number 10.558 Program Name Child and Adult Care Food Program Federal Agency Department of Agriculture State Agency Department of Human Services Federal Award Identification Number 205TN331N1099, 215TN100H1706, 215TN331N1150, 215TN331N1199, 215TN331N2020, 225TN331N1150, 225TN331N1199, and 225TN331N2020 Federal Award Year 2020 through 2022 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Allowable Costs/Cost Principles Subrecipient Monitoring Repeat Finding 2021-021 and 2021-023 Pass-Through Entity N/A Questioned Costs $77,597 Finding As noted in the seven prior audits, the Department of Human Services did not ensure that the Child and Adult Care Food Program subrecipients submitted accurate meal reimbursement claims, resulting in questioned costs totaling $77,597; furthermore, the department did not ensure one subrecipient obtained a Single Audit as required by federal regulations Background The Child and Adult Care Food Program (CACFP) is a year-round food program for eligible participants at child care centers, day care homes, afterschool care programs, emergency shelters, and adult day care centers. CACFP is funded by the U.S. Department of Agriculture (USDA) and administered on the state level by the Department of Human Services (DHS). DHS contracts with these institutions, called subrecipients, who administer the program by providing meals. As a pass-through entity, DHS is responsible for ensuring that subrecipients are eligible to participate in the programs and that the subrecipients comply with federal requirements. Reimbursement Activities Food program management are responsible for approving subrecipients to participate in the program as well as approving reimbursement claims for payment. To receive payment for the meals they provide to eligible participant children, subrecipients enter and submit total monthly meal counts to DHS through the Tennessee Information Payment System (TIPS). The department does not require subrecipients to submit supporting documentation as part of their claims for reimbursement before payment to the subrecipients; instead, food program management relies on the Division of Audit Services? monitoring activities, such as site visits and desk reviews, to determine instances of subrecipient noncompliance. When the Division of Audit Services identifies subrecipient noncompliance, food program management requires the subrecipient to submit a corrective action plan and may require a repayment of program funds. Monitoring Requirements To fulfill federal requirements, the Division of Audit Services is responsible for monitoring the subrecipients? activities to provide reasonable assurance that the subrecipients administer federal awards in compliance with federal requirements, and management must take proper actions to address subrecipient noncompliance when it occurs. CACFP regulations require that the department?s Division of Audit Services monitor at least 33.3% of all subrecipients each year. Generally, as part of their monitoring plan, Audit Services? monitors review one meal reimbursement claim, representing one month of the program year, at each subrecipient. Audit Services monitors perform regular monitoring visits at each subrecipient once every two or three years, depending on the type of institution. Furthermore, pursuant to the Office of Management and Budget?s Uniform Grant Guidance and ?Audit Requirements,? Title 2, Code of Federal Regulations (CFR), Part 200, Section 501, (a) Audit required. A non-Federal entity [subrecipient] that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. Based on discussions with management, the department?s Division of Audit Services? staff extracts expenditure information paid to subrecipients from Edison, the state?s accounting system. Staff then compiles the expenditures based on the subrecipients? fiscal year to determine if DHS paid the subrecipient more than $750,000 during the subrecipients? most recent fiscal year. According to management, once they identify the subrecipients who meet the audit threshold, the division?s Director of Internal Audit creates a tracker spreadsheet using Microsoft Excel. The director will track the receipt of required audit reports throughout the fiscal year and will note on the tracker if the audit reports identified findings relevant to the federal program. If a subrecipient?s audit report identified findings, the Director of Internal Audit is responsible for notifying the program area responsible for ensuring the subrecipient?s compliance with federal requirements, including reviewing any findings and issuing management decisions. Prior Audit Results As noted in the seven prior audits, we reported that DHS management did not ensure CACFP subrecipients submitted accurate meal count claims. DHS management concurred in part with the most recent prior finding and stated, The Department continues to evaluate findings identified in this report and in our own internal monitoring and has created training sessions to mitigate the identified programmatic weaknesses. All CACFP trainings are developed and conducted in conjunction with USDA FNS [Food and Nutrition Service]. Current Audit Results From a population of 2,860 CACFP subrecipient invoices (monthly claims), with reimbursements DHS paid totaling $66,194,834 during fiscal year ended June 30, 2022, we tested a nonstatistical random sample of 60 subrecipient invoices, totaling $1,449,454, to follow up on management?s corrective actions for this repeated condition. To select the feeding site(s) to review for the claim, we haphazardly selected sites based on the following methodology: ? If the subrecipient had 10 or more feeding sites, we selected up to 10 sites. ? If the subrecipient had less than 10 feeding sites, we selected all sites. In total, we reviewed 447 feeding sites. We then obtained the subrecipients? paper supporting documentation for their claims submitted in TIPS, which consisted of an average of 117 pages, and reperformed the meal count calculations. Condition and Criteria Unsupported Monthly Claims As part of our review of claims and supporting documentation, we accepted all available supporting evidence for the claim and we only reported errors when the subrecipient did not provide accurate or complete documentation. Based on our testwork, we noted that for 32 of 60 invoices reviewed (53%) for 22 unique subrecipients and 121 feeding sites, the subrecipients could not provide documentation to support the number of meals they submitted in TIPS as meals served. We considered 6 of the 22 subrecipients high-risk. These subrecipients submitted their claim for reimbursement in TIPS for more meals served than they were able to support with proper documentation, resulting in overpayments to the subrecipients totaling $77,597. According to 7 CFR 226.15(e), At a minimum, the following records shall be collected and maintained: . . . (4) Daily records indicating the number of participants in attendance and the daily meal counts, by type (breakfast, lunch, supper, and snacks), served to family day care home participants, or the time of service meal counts, by type (breakfast, lunch, supper, and snacks), served to center participants. In addition, 7 CFR 226.10(c) states, Claims for Reimbursement shall report information in accordance with the financial management system established by the State agency, and in sufficient detail to justify the reimbursement claimed and to enable the State agency to provide the final Report of the Child and Adult Care Food Program (FNS 44) required under ?226.7(d). In submitting a Claim for Reimbursement, each institution shall certify that the claim is correct and that records are available to support that claim. Failure to Obtain a Subrecipient?s Single Audit Report Based on our review, we also found that DHS program management did not verify that one subrecipient, that was responsible for one of the 32 errors noted above, obtained a Single Audit. The subrecipient?s fiscal year ended on December 31, 2021. The Director of Internal Audit notified program management on April 7, 2022, that the subrecipient required a Single Audit and further instructed program management to notify the subrecipient of the requirement. As of January 10, 2023, even though we requested the documentation, management had not provided us with a Single Audit report or evidence that they were working with the subrecipient to meet the Single Audit requirement. According to 2 CFR 200.332(f), DHS must ?[v]erify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in ? 200.501.? Risk Assessment We reviewed the department?s 2021 Financial Integrity Act Risk Assessment and determined that management listed the risk of subrecipients submitting unsupported claims. While management identified four controls to address subrecipient noncompliance for unsupported claims, none of the controls were sufficient to mitigate the risks of paying unsupported claims given management?s current reimbursement claims process. To avoid paying unsupported claims, management would have to review volumes of paper-based supporting documentation before paying the claims or change to an automated meal count system. We also determined that management did not identify the risk of noncompliance with subrecipients? Single Audit requirement. As such, management did not establish control activities to ensure compliance with CACFP?s subrecipient monitoring requirements, including obtaining required federal single audits of subrecipients. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, ?Identification of Risks,? Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,? 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. Cause Management stated the discrepancies noted in our testwork existed due to the structure of the program and that food program management is routinely addressing these conditions through training, technical assistance, and required corrective action. Regarding the subrecipient?s missing Single Audit report, management stated that, as of January 10, 2023, they were having regular communications with the subrecipient about the report but did not provide us with documentation of such communications when we asked for it. Effect Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include ? requiring reimbursement instead of advance payments; ? not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; ? requiring additional, more detailed financial reports or additional project monitoring; ? requiring the agency to obtain technical or management assistance; or ? establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include ? temporarily withholding payments until the noncompliance has been corrected, ? denying the use of funds, ? partly or fully suspending or terminating the federal award, ? suspending or debarring the agency, ? withholding further awards for the project or program, or ? pursuing other available legal remedies. While monitoring provides management with detective controls to identify subrecipients? errors, CACFP program management must take additional actions beyond subrecipient training and monitoring, such as issuing serious deficiency notices and terminating subrecipients that fail to implement the permanent corrective action the program requires, to ensure its integrity. Additionally, without establishing and implementing effective controls over the claims reimbursement process, the risk of paying unsupported claims increases. Recommendation As the pass-through entity, DHS has the responsibility to impose additional conditions upon subrecipients who demonstrate continued program noncompliance. Without changes in the overall paper-based reimbursement process, the risk of paying unsupported claims will continue; therefore, management should explore electronic methods of counting meals to increase accountability within the food program. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. The errors identified in the Single Audit are the same type of errors that DHS identifies when it completes its monitoring process. We concur that many of the errors are a result of the overall paper-based reimbursement process and are exploring electronic methods of counting meals to increase accountability within the CACFP program. Food program has assigned a staff member to continually monitor risks within the CACFP program and assesses mitigating controls to address the risks. The department did ensure that the subrecipient obtained a Single Audit. The Single Audit in question was completed on December 1, 2022, and a copy was provided to the department on January 24, 2023. No findings were noted in the report. Food Program has revised its process for tracking and requesting Single Audits and has implemented the changes to ensure timely submission of the required single audits.

Finding Number 2022-005 Assistance Listing Number 17.258, 17.259, and 17.278 Program Name Workforce Innovation and Opportunity Act Cluster Federal Agency Department of Labor State Agency Department of Labor and Workforce Development Federal Award Identification Number AA-32192-18-55-A-47, AA-33257-19-55-A-47, AA-34796-20-55-A-47, AA-36347-21-55-A-47, and AA-38557-22-55-A-47 Federal Award Year 2019 through 2022 Finding Type Material Weakness and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding 2021-003 Pass-Through Entity N/A Questioned Costs N/A Finding As noted in the prior-year audit, Workforce Services Division management did not ensure program staff performed required programmatic subrecipient monitoring and did not document the review of subrecipients? Single Audits Background The Workforce Innovation and Opportunity Act (WIOA) cluster of federal programs helps participants overcome barriers to obtaining employment by providing education, training, job search, and other support services. The WIOA cluster consists of three programs: Adult, Dislocated Worker, and Youth. The U.S. Department of Labor awards funding for these programs through formula grants to states. In Tennessee, the Workforce Services Division (division) within the Tennessee Department of Labor and Workforce Development administers WIOA programs. American Job Centers The WIOA cluster of programs provides employment services to individuals through a network of American Job Centers (job centers). Individuals may visit a job center to determine whether they are eligible to receive services and, if so, obtain free employment assistance. The division awards grants to nine subrecipients, known as Local Workforce Development Boards (development boards), to oversee the job centers in their Local Workforce Development Area (local area). Therefore, each of the nine development boards is a subrecipient of the state?s WIOA funds. Each development board oversees a local area, contracts with a One-Stop Operator to manage the operations of the job centers, and appoints a Fiscal Agent who is responsible for the accounting and finances for the job centers. Monitoring Requirements Federal and state regulations require the department to monitor their subrecipients to ensure they are complying with all grant funding requirements. The department annually submits a monitoring guide to the state?s Central Procurement Office that describes how the department will meet monitoring requirements. For the WIOA cluster of programs, division staff are responsible for monitoring the subrecipients? programmatic activities for the WIOA cluster programs, such as eligibility determinations, and Internal Audit?s Performance Accountability Review (PAR) Unit staff are responsible for monitoring fiscal-related activities, such as reviewing expenditures in the subrecipients? funding requests to ensure they comply with federal requirements. For fiscal year 2022, the department?s expenditures for the WIOA cluster totaled $57,349,221.78. The expenditures for each program as identified by the Assistance Listing Number are outlined in Table 1. See Schedule of Findings and Questioned Costs for table. Prior Audit Results Our prior audit reported a finding related to the WIOA subrecipient monitoring, which included the following: ? Division staff did not conduct any on-site programmatic monitoring of subrecipients for the Adult, Youth, or Dislocated Worker programs. ? Division staff did not conduct any desktop programmatic monitoring of subrecipients for the Adult, and Youth programs. ? Division staff did not conduct desktop programmatic monitoring in all four quarters and did not follow the Employment and Training Administration?s Core Monitoring Guide when monitoring the Dislocated Worker program. ? Division management did not review the subrecipients? Single Audit reports to ensure the local areas took action on findings noted. ? The department identified risks and controls related to subrecipient monitoring for fiscal-related activities in their risk assessment, but did not identify and address the risk of inadequate subrecipient monitoring. Management concurred with the prior finding. Management noted that they were going to revise the current program monitoring guide and update the current risk assessment. Management stated that the revision would include additional internal controls and programmatic monitoring instruments for subrecipient monitoring. Condition, Criteria, and Cause As Noted in the Prior Audit, Division Staff Did Not Perform Programmatic Monitoring The division had a monitoring guide for program year 2021?2022 that addressed the responsibility for and frequency of monitoring. According to the guide, for each local area, division staff must ? perform quarterly desktop programmatic reviews, and ? perform annual on-site programmatic reviews. According to the Director of Program Integrity, division staff follow the U.S. Department of Labor?s Employment and Training Administration (ETA) Core Monitoring Guide to conduct programmatic monitoring reviews. The Core Monitoring Guide includes comprehensive monitoring activities designed to ?evaluate the management and administration of the grant, the quality of the program and/or services, and the performance of the grant to determine if the program is operating in compliance with the grant agreement and in a manner that ensures achievement of its goals and outcomes.? The guide also includes checklists and forms to document the monitoring activities. Based on our discussions with management and our review of the Core Monitoring Guide, the PAR Monitoring Procedure Manual, the department?s 2021?2022 Monitoring Guide, and any monitoring reports released during our audit periods, we found the following repeated conditions: ? division staff did not conduct on-site programmatic monitoring of subrecipients for the Adult, Youth, or Dislocated Worker programs; ? division staff conducted a desktop programmatic review for only one of nine subrecipients in quarter 4, but did not conduct any desktop programmatic reviews during the other three quarters for the Adult, Youth, or Dislocated Worker programs; and ? when division staff conducted the quarter 4 desktop programmatic monitoring review, they did not follow the ETA?s Core Monitoring Guide, including not monitoring program requirements such as participant eligibility. Title 29, United States Code, Chapter 32, Section 3244(a)(4), ?Monitoring,? states, ?Each Governor of a State shall conduct on an annual basis onsite monitoring of each local area within the State to ensure compliance with uniform administrative requirements.? Pursuant to the Office of Management and Budget?s Uniform Grant Guidance and Title 2, Code of Federal Regulations (CFR), Part 200, Section 332(d), ?Requirements for pass-through entities,? the department is required to monitor the local areas? activities ?as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved.? Additionally, 20 CFR 683.410(b), ?Administrative provisions under Title I of the Workforce Innovation and Opportunity Act,? states that the Governor is responsible for developing the state monitoring system, which must i. provide for annual on-site monitoring reviews of local areas? compliance with 2 CFR part 200, as required by sec. 184(a)(3) of WIOA; ii. ensure that established policies to achieve program performance and outcomes meet the objectives of WIOA and the WIOA regulations; iii. enable the Governor to determine if subrecipients and contractors have demonstrated substantial compliance with WIOA and Wagner-Peyser Act requirements; iv. enable the Governor to determine whether a local plan will be disapproved for failure to make acceptable progress in addressing deficiencies, as required in sec. 108(e) of WIOA; and v. enable the Governor to ensure compliance with the nondiscrimination, disability, and equal opportunity requirements of sec. 188 of WIOA, including the Assistive Technology Act of 1998 (29 U.S.C. 3003). According to the division?s Director of Program Integrity, the department met the annual on-site requirement through the PAR Unit?s annual on-site fiscal reviews. However, based on our review, the PAR Unit?s visits did not meet the requirements established in the monitoring guide or in ETA?s Core Monitoring Guide because they did not include a review of all program requirements such as participants? eligibility. Division?s Responsibility to Meet Subrecipient Single Audit Requirements Although the development boards submitted their Single Audit reports to the division, division management did not document the review to ensure that the development boards took action on any of the findings noted. We reviewed the nine development boards? Single Audit reports issued during the fiscal year ended June 30, 2022, and found that one Single Audit report contained a finding concerning an accounting error. For the audit finding, management did not require the development board to submit a corrective action. Additionally, division management did not issue a management decision letter for the finding noted. Pursuant to the Office of Management and Budget?s Uniform Grant Guidance and ?Audit requirements,? 2 CFR 200.501, (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. Furthermore, 2 CFR 200.332 requires the pass-through entity (in this case the Department of Labor and Workforce Development) to verify that all subrecipients that spend $750,000 or more obtain a Single Audit within nine months after the subrecipient?s fiscal year-end. As part of that Single Audit, if a subrecipient receives an audit finding, the department must issue a management decision within six months of the audit report?s release, indicate if the department agreed with the finding, and describe any corrective action the subrecipient must take. Development boards submit their Single Audit reports annually to the division?s Program Integrity Unit for the division?s review and to obtain the division?s management decision when there are findings. Risk Assessment Based on our review of both the division?s and Internal Audit?s 2021 Financial Integrity Act risk assessments, Internal Audit management identified the risk of failing to detect misuses of subrecipient grant funds by subrecipients and established corresponding controls in their risk assessment. However, the division did not identify and address the risk of inadequate subrecipient monitoring for programmatic activities and, as such, did not design and implement effective controls governing the required programmatic monitoring activities. Additionally, division management did not identify and address the risk of not reviewing subrecipients? Single Audit findings, not obtaining a corrective action plan, and not issuing a management decision letter. Effect When division staff do not perform sufficient subrecipient programmatic monitoring, management cannot reasonably ensure subrecipients have complied with federal statutes, regulations, and terms and conditions of the grant award; nor can management ensure that the subrecipients achieved subaward performance goals. In addition, when management does not ensure staff follow written procedures for programmatic monitoring, the risk that management and staff will not prevent or detect unallowable program activities increases. When division management does not review development boards? Single Audit results, including Single Audit findings, it increases the risk that management may be unaware of deficiencies identified by the auditors and may not ensure that subrecipient management takes action and responds to noncompliance or areas for improvement identified in Single Audits. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208?, ?Specific conditions,? these actions may include ? requiring reimbursement instead of advance payments; ? not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; ? requiring additional, more detailed financial reports or additional project monitoring; ? requiring the agency to obtain technical or management assistance; or ? establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include ? temporarily withholding payments until the noncompliance has been corrected, ? denying the use of funds, ? partly or fully suspending or terminating the federal award, ? suspending or debarring the agency, ? withholding further awards for the project or program, or ? pursuing other available legal remedies. Recommendation The Commissioner and division management should ensure staff are aware of their monitoring responsibilities and perform sufficient monitoring to identify areas of noncompliance. Management should ensure that division staff conduct monitoring in accordance with federal and state guidelines, including carrying out on-site monitoring and desktop reviews. The Commissioner and division management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. The Department of Labor and Workforce Development, Division of Workforce Services has implemented a new monitoring process in response to the prior-year audit observation. This new process, launched in October 2022, will ensure compliance with the on-site subrecipient programmatic monitoring requirement and the department?s internal controls. A schedule has been created to monitor all subrecipients prior to September 2023 and reports are available to show progress. A checklist and review will be incorporated into the monitoring process to ensure subrecipients? Single Audit reports are received within nine months of fiscal year end and a management decision is provided within six months of receiving and reviewing the subrecipients? Single Audit report.

Finding Number 2022-006 Assistance Listing Number 17.225 Program Name Unemployment Insurance Federal Agency Department of Labor State Agency Department of Labor and Workforce Development Federal Award Identification Number CARES Act and UI-35676-21-55A-47 Federal Award Year 2020 through 2022 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Repeat Finding 2021-002 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 17.225 Federal Award Identification Number CARES Act Description Mixed Earner Unemployment Compensation Amount $51,100 Description Federal Pandemic Unemployment Compensation Amount $6,600 Description Pandemic Unemployment Assistance Amount $2,933 Description Pandemic Emergency Unemployment Compensation Amount $273 Questioned Costs Assistance Listing Number 17.225 Federal Award Identification Number UI-35676-21-55A-47 Description Disaster Unemployment Assistance ? Humphreys, Dickson, Hickman, and Houston County Flooding Amount $4,320 Finding As noted in the prior-year audit, the Department of Labor and Workforce Development paid Unemployment Insurance benefits to ineligible claimants due to ineffective internal controls Background The Unemployment Insurance (UI) program is a federal?state partnership designed to ensure the economic security of workers who lose their jobs through no fault of their own. The U.S. Department of Labor provides grant funding for each state to design and administer its own UI program within federal requirements. In Tennessee, the Department of Labor and Workforce Development (the department) operates the state?s UI program to process claims and issue direct benefit payments to individuals during times of involuntary unemployment. Regular Programs Regular programs are permanent programs providing UI coverage to Tennessee wage and salary workers, including federal employees stationed in Tennessee and servicemembers separating from the military. There are currently three regular programs: ? Tennessee Unemployment Compensation (Tennessee) is the standard UI program, covering most Tennessee wage and salary workers. Employers pay quarterly state unemployment taxes into a trust fund from which the department distributes benefits to eligible claimants. Each employer?s unemployment tax rate is based in part on benefits collected by former employees. ? Unemployment Compensation for Ex-Servicemembers (Ex-Service) provides UI benefits to individuals transitioning from military service to the civilian labor force. Military branches do not pay unemployment taxes; instead, they reimburse the department dollar-for-dollar for all Ex-Service benefits paid. ? Unemployment Compensation for Ex-Federal Employees (Ex-Federal) is the UI program for federal government workers who lose their employment through no fault of their own. Federal agencies do not pay unemployment taxes; instead, they reimburse the department dollar-for-dollar for all Ex-Federal benefits paid. Temporary Programs Temporary programs are time-limited programs that the department activates in response to a major disaster or during periods of high unemployment. Prior to March 2020, the department could activate two temporary programs: ? Disaster Unemployment Assistance (Disaster) provides temporary benefits to individuals whose employment or self-employment has been lost or interrupted as a direct result of a presidentially declared major disaster, and who are not eligible for regular unemployment insurance. In fiscal year 2022, the department offered benefits for three major disasters. ? Federal?State Extended Benefits (Extended) is a temporary program activated during periods of high and rising state unemployment rates. When active, the program allows workers who have exhausted their entitlement to regular unemployment to claim up to 13 additional weeks of benefits with costs shared equally between the state and federal governments. Pandemic Programs Pandemic programs are temporary programs the federal government created and the department implemented in response to the COVID-19 pandemic. The federal government reimburses the department for 100% of benefits it pays to pandemic program claimants. These programs include the following: ? Pandemic Unemployment Assistance (Pandemic) is modeled on the Disaster program. From January 27, 2020, through July 3, 2021, it provided temporary benefits to workers who had exhausted, or were ineligible for, regular unemployment insurance (such as part-time workers, the self-employed, and contractors) and had lost work for certain COVID-19-related reasons. ? Pandemic Emergency Unemployment Compensation (Pandemic Extension) provided a maximum of 53 additional weeks of benefits to individuals who had exhausted their rights to regular unemployment insurance, for weeks of unemployment through July 3, 2021. ? Federal Pandemic Unemployment Compensation (Pandemic Supplement) provided a supplemental weekly payment to individuals who received at least $1 in benefits from another UI subprogram. The weekly supplement was $600 (in addition to the claimant?s other benefits) for weeks of unemployment ending April 4, 2020, through July 25, 2020, and $300 for weeks of unemployment ending January 2, 2021, through July 3, 2021. ? Lost Wages Assistance (Lost Wages) provided a supplemental weekly payment of $300 to individuals who received at least $100 in benefits from another UI program for weeks of unemployment from August 1, 2020, through September 5, 2020. ? Mixed Earner Unemployment Compensation (Mixed Earner) provided a supplemental weekly payment of $100 to individuals receiving benefits other than Pandemic, whose prior earnings included both wages from traditional employment and at least $5,000 from self-employment. Mixed Earner was payable for weeks of unemployment from December 27, 2020, through July 3, 2021. Under federal law, the Pandemic, Pandemic Extension, Pandemic Supplement, and Mixed Earner programs expired on September 6, 2021; however, Governor Bill Lee opted to terminate Tennessee?s participation in these programs early, effective July 3, 2021. Throughout fiscal year 2022, the department followed guidance set forth in the U.S. Department of Labor?s Unemployment Insurance Program Letter 14-21, which instructed states to continue to process and pay backlogged benefits to eligible pandemic claimants for weeks of unemployment ending on or before the programs? termination date. General Eligibility Criteria and Determination Processes for Unemployment Claims The department uses the Geographic Solutions Unemployment System (GUS) application to process eligibility determinations for unemployment claims. Claimants submit an initial application for unemployment benefits in the system via the jobs4tn.gov website, which interfaces directly with GUS. GUS initiates various automated processes to help the department determine the claimants? eligibility for benefits. If these processes yield information that could potentially disqualify a claimant?s eligibility, GUS flags the claim with an issue and attaches a work item. The work item triggers department personnel to manually review and resolve the issue on the claim. Management has configured business rules in GUS to prevent claims with significant issues from paying benefits until department personnel have reviewed the claims to determine the claimants? eligibility. The department?s major eligibility determination processes are as follows: Identity Verification To deter individuals from filing fraudulent claims using stolen personally identifiable information, the department uses two identity verification mechanisms on every new claim filed: 1. LexisNexis identity verification software, integrated into GUS, presents the claimant with multiple-choice questions pertaining to the claimant?s identity. 2. GUS interfaces with the Social Security Administration?s databases to verify the accuracy of key personal information from the claimant?s application. If either method cannot authenticate a claimant?s identity, GUS flags the claim with an issue to prevent payment and generates a letter instructing the claimant to submit two forms of identification within seven days. GUS routes a work item to a department Program Specialist as a prompt to check whether the claimant has submitted acceptable documentation and to resolve the issue or disqualify the claim as appropriate. Immigration Verification The department?s application for unemployment benefits collects citizenship information from all claimants. When a claimant identifies as a non-citizen, GUS flags the claim with an issue to prevent payment and generates a letter instructing the claimant to submit proof of lawful immigration and work authorization status within 10 days. GUS also interfaces with the U.S. Citizenship and Immigration Services? databases to verify the claimant?s immigration status. GUS routes a work item to a department Program Specialist to determine whether the claimant has submitted acceptable proof, to review information GUS retrieved from U.S. Citizenship and Immigration Services, and to resolve the issue or disqualify the claim as appropriate. Monetary Eligibility The department determines a claimant?s monetary eligibility for benefits and weekly benefit amount based on sufficient earnings from four quarters of recent employment (?base period?). The claimant provides base-period employment and earnings history when applying for benefits; the department uses various sources to verify this information (see Table 1). See Schedule of Findings and Questioned Costs for table. GUS generates a monetary determination letter to the claimant, listing the claimant?s earnings from all base-period employers and the weekly benefit amount the claimant may be entitled to receive if the claimant meets all other eligibility criteria. The letter instructs the claimant how to report additional employers or wages to the department if the monetary determination appears incomplete or inaccurate. Non-Monetary Eligibility Non-monetary eligibility requires the department to establish that a claimant has lost their most recent employment due to no fault of their own. In general, a claimant meets this requirement in one of three ways: 1. lack of work ? the employer laid off the employee or reduced the employee?s working hours, 2. quit ? the employee quit with good cause, or 3. discharge ? the employer terminated the employee because of performance issues other than gross misconduct. Claimants select the reason for their unemployment on the initial application for benefits. GUS generates a request letter to the claimant?s separating employer notifying the employer of the claim and the reason the claimant gave for unemployment. The employer has seven days to respond to the letter to dispute the claim. GUS creates an issue and related work item on all disputed claims and claims involving quit or discharge from employment (even if the employer does not dispute the claim). The work item prompts a department adjudicator to evaluate the facts provided by both the claimant and the employer, to gather additional information if necessary, and to determine whether the claimant?s separation qualifies for unemployment benefits under the applicable state or federal law. The department?s non-monetary eligibility determination processes differ for Disaster and Pandemic claims. GUS automatically flags Disaster claims for manual review and approval because claimants must provide documentation to support their eligibility for Disaster benefits. Until December 27, 2020, GUS did not routinely flag Pandemic claims for manual review because federal guidance instructed the department to accept a claimant?s self-certification that employment was impacted for a qualifying COVID-19 reason as evidence of eligibility. The federal guidance specifically prohibited the department from requesting supporting documentation from Pandemic claimants except to address a reasonable suspicion of fraud. After department personnel have resolved all issues requiring manual review on a claim, GUS issues a decision letter to the claimant and base-period employers explaining the department?s basis for the decision and the parties? right to appeal within 15 days. Claimants have the right to appeal if the department denies their claim for benefits. Likewise, employers may appeal approved claims to protect their state unemployment tax rate from future increases. Weekly Certifications After filing an initial claim for benefits, claimants must file weekly certifications via jobs4tn.gov to attest to their continued ability to work and availability for work, disclose income earned during the week, and report on work search activities. GUS automatically disqualifies the week as ineligible for payments if a claimant either fails to certify or certifies no longer being unemployed, earning excess income, or not actively searching for and available to accept suitable work. Overpayments The department?s eligibility determination processes serve as internal controls to prevent ineligible claimants from receiving unemployment benefits. The nature of the Unemployment Insurance program, however, is such that the department does not always have timely access to accurate information necessary to determine a claimant?s eligibility for benefits. For example, the department must rely on claimants to accurately self-report earnings from temporary and part-time employment during the weekly certification process. The department does not receive corroborating data to validate a claimant?s self-reported earnings until the department receives wage reports from employers at the end of each quarter. Therefore, management has established detective controls in the department?s Benefit Payment Control unit to identify and investigate potentially improper payments. These controls include cross-matches to compare the department?s claims data with information from external sources, such as ? state vital statistics records, to identify payments issued after a claimant?s date of death; ? state inmate records, to identify payments issued to incarcerated individuals; ? state payroll records, to identify payments to active state employees; ? quarterly employer wage reports, to verify claimants? self-reported weekly earnings; and ? state and national directories of new hires, to identify claimants who continued claiming benefits after returning to work. Upon determining that a claimant has received benefits to which the claimant is not entitled, whether due to fraud or error, a Benefit Payment Control auditor establishes an overpayment on the claimant?s file. The department?s UI Recovery unit is responsible for recouping overpayments and uses a variety of escalating techniques to achieve this purpose from establishing repayment plans with claimants to intercepting claimants? federal tax refunds. Furthermore, when a claimant with an outstanding overpayment debt qualifies for benefits on a new claim, federal and state law requires the department to apply new benefit payments toward the outstanding overpayment. Prior Audit Results Our prior audit reported a finding that found multiple deficiencies related to Unemployment Insurance eligibility. Management concurred with the prior finding and attributed the conditions to the impact of the COVID-19 pandemic on claims volume and system issues. See Table 2 for a list of finding conditions identified in our prior audit and their disposition in the current audit. See Schedule of Findings and Questioned Costs for table. In addition to the repeated and partially repeated conditions from our prior audit, we identified a new condition wherein claimants received Pandemic benefits after the department disqualified their claims due to fraud (details included below). Current Audit Results We provide the results of our current audit below. As a result of our review, we identified $60,906 in total federal questioned costs for the Pandemic, Pandemic Supplement, and Mixed Earner programs and $4,320 in total federal questioned costs for the Disaster program. In addition, we identified $9,900 in state questioned costs for improper benefits paid from the unemployment trust fund to ineligible Tennessee claimants. Title 2, Code of Federal Regulations (CFR), Part 200, Section 516(a)(3), requires us to report known and likely questioned costs greater than $25,000 for a type of compliance requirement for a major program. For this program, we determined that known and likely questioned costs exceeded $25,000. Conditions, Cause, and Criteria As noted in our prior audit findings related to Unemployment Insurance eligibility, department management did not design and implement internal controls, including controls integrated in its information systems, that ensured compliance with federal regulations. The existing control structure did not address the risks associated with the number, timing, nature, and complexity of the federal programs overseen by the department and the volume of applicants for these programs. Specifically, the internal control structure was not designed to manage the number of temporary programs implemented due to the pandemic and natural disasters in addition to changes in federal guidance for regular programs. While pandemic programs expired in the first week of fiscal year 2022, department management had to continue processing and paying backlogged claims throughout the year. According to management, the department had to assess and respond to the risk of providing benefits to ineligible claimants against the risk of not providing timely benefits to eligible claimants. To help control the volume of new and continuing claims for benefits, management relied on GUS tools designed to reduce manual claims handling. These tools included a mass adjudication tool to batch resolve remaining issues on claims which department staff had already determined were eligible or ineligible for benefits, and analysis functions to allow management to identify groups of claims on which to apply the mass adjudication tool. These tools, however, did not always work as intended and resulted in the department unintentionally issuing benefits to ineligible claimants. These tools also did not address the root cause of system incidents, so management encountered recurring problems in GUS that the vendor had previously told management were fixed. The department?s ineffective internal controls for managing Unemployment Insurance eligibility resulted in the following specific conditions of noncompliance: Claimants Received Mixed Earner Benefits Without Providing Evidence of Past Earnings From Self-Employment (Repeat Condition) The U.S. Department of Labor issued operating guidance for the Mixed Earner program in Unemployment Insurance Program Letter 15-20, Change 3, which states, Individuals who apply for MEUC [the Mixed Earner program] are required to submit documentation substantiating their self-employment income for purposes of the state determining their eligibility for MEUC. . . . Individuals may submit this documentation at any time while the MEUC program is in effect. . . . However, until the individual provides the documentation and the state can determine that it substantiates that the amount of self-employment income meets MEUC eligibility requirements, MEUC payments may not begin. The federal guidance further established that claimants should provide a copy of their income tax return for the most recently completed tax year before applying for regular unemployment benefits. Acceptable documentation also includes pay stubs, bank receipts, business records, accounting ledgers, invoices, and billing statements that substantiate self-employment income of at least $5,000 for the most recent tax year. We obtained the population of 2,195 Mixed Earner payments, totaling $219,310, that the department issued in fiscal year 2022. We tested a sample of 60 payments for compliance with Mixed Earner eligibility requirements. Based on our testwork, the department issued Mixed Earner benefits without verifying evidence of self-employment earnings for 47 of 60 (78%) payments tested. We identified a total of $51,100 in known federal questioned costs for improper Mixed Earner payments. Claimants Received Disaster Benefits for Claims Filed After the Application Deadline (Repeat Condition) According to 20 CFR 625.5, Disaster benefits are payable to workers whose unemployment is caused by a presidentially declared major disaster. On filing deadlines, 20 CFR 625.8(a) states, An initial application for DUA [Disaster benefits] shall be filed by an individual with the State agency of the applicable State within 30 days after the announcement date of the major disaster as the result of which the individual became unemployed . . . An initial application filed later than 30 days after the announcement date of the major disaster shall be accepted as timely by the State agency if the applicant had good cause for the late filing. We obtained the population of 283 Disaster payments, totaling $26,161, issued in fiscal year 2022 and used data analytics to identify 105 payments to 15 claimants who did not file for Disaster benefits within 30 days of the announcement of the major disaster. We then performed further testwork to determine whether each claimant showed good cause for the late filing. Based on this testwork, 11 of 15 claimants with late-filed applications (73%) did not show good cause for the late filing. In addition to the late filing, 9 of the 11 claimants did not appear to have a history of living or working in the disaster-affected area and thus had a questionable claim regardless of the late filing. We identified federal questioned costs totaling $4,320 for improper Disaster benefits for 11 late-filed claims. A Claimant Received Pandemic Benefits Without Providing Evidence of Past Employment, and Department Personnel Did Not Manually Review and Approve the Claim for Tennessee Benefits (Repeat Condition) From the population of 981,392 regular, Pandemic, and Pandemic Extension Unemployment Insurance (UI) payments, totaling $209,587,661, that the department issued in fiscal year 2022, we selected a proportional sample of 70 payments to determine compliance with non-monetary eligibility requirements. Based on our testwork, we found the following: ? The department issued Pandemic benefits totaling $120 and associated Pandemic Supplement benefits totaling $300 to a claimant without verifying evidence of past employment. According to U.S. Department of Labor guidance, claimants who had an existing Pandemic claim as of December 27, 2020, were required to submit documentation as evidence of prior employment or self-employment within 90 days. ? The department issued Tennessee benefits totaling $1,925 without manually reviewing and approving a claim to ensure the claimant lost his job through no fault of his own. Although the claimant?s application listed 2 base-period employers, the department did not contact the employers to verify the propriety of the claim. Under Section 50-7-303(a), Tennessee Code Annotated, certain conditions render claimants ineligible for Tennessee benefits, such as voluntarily quitting work. Department personnel must adjudicate claims by reviewing information from the claimant and the claimant?s most recent employer to assess whether the claimant is unemployed through no fault of their own. Claimants Received Unemployment Benefits Filed Under Identities Belonging to Deceased Individuals (Repeat Condition) We obtained the population of 391 work items created in fiscal year 2021 arising from the department?s cross-match of unemployment payment data with Tennessee Department of Health vital statistics records. These work items direct Benefit Payment Control auditors to investigate payments issued to deceased individuals and stop future payments on those claims. We cross-matched all 981,392 UI payments issued to 175,618 claimants, totaling $311,990,120, that the department issued in fiscal year 2022 with the Tennessee Department of Health?s vital statistics records. Historically, we have encountered data reliability issues with state vital statistics records, so we performed an additional cross-match with the U.S. Department of Treasury?s Do Not Pay service to identify death dates of claimants registered in federal databases. The Do Not Pay service provided conclusive death validation for 23 claimants who received 124 payments, totaling $40,082, for which the department did not have a corresponding work item. We performed testwork to ascertain whether the department detected benefits paid to these 23 deceased claimants. Based on our testwork, we found the department did not detect improper payment of unemployment benefits to 10 of 23 (43%) deceased claimants tested. We determined that most of these individuals died before an unemployment claim was filed in their name, indicating identity theft. The department?s mechanism to prevent filing of claims under deceased identities is the Social Security Administration and LexisNexis procedures described in the Identity Verification section of this finding. In these cases, however, Social Security Administration or LexisNexis controls were not effective for one of two reasons: ? for five claimants, the automated controls generated an issue on the claim to prevent payment, but an individual posing as the deceased claimant provided identification which department staff accepted as evidence to clear the issue; and ? for the other five claimants, the automated controls generated an issue on the claim to prevent payment; however, GUS inappropriately resolved the issue and issued payment instead of routing the claim to department personnel for manual review. We identified federal questioned costs totaling $7,876 (comprising $6,300 Pandemic Supplement, $1,303 Pandemic, and $273 Pandemic Extension) for payments to deceased claimants, as well as $7,975 in state questioned costs for Tennessee benefits. Claimants Received Pandemic Benefits After Disqualification From Unemployment Program Due to Fraud (New Condition) We obtained the population of 322,198 Pandemic Supplement payments, totaling $102,402,459, issued in fiscal year 2022 and used data analytics to identify 12,341 payments with a high risk of noncompliance with Pandemic Supplement eligibility requirements. We tested a random, nonstatistical sample of 60 payments for compliance with Pandemic Supplement requirements. While our testwork did not disclose any improper Pandemic Supplement payments, it did identify 2 payments involving claimants the department had disqualified from receiving benefits due to claiming unemployment while incarcerated. Despite the disqualification, the department issued Pandemic benefits totaling $1,510 to these claimants after the disqualification?s effective date. In accordance with Section 50-7-303(a), Tennessee Code Annotated, A claimant shall be disqualified for benefits . . . For the week or weeks in which the administrator finds that the claimant has made any false or fraudulent representation or intentionally withheld material information for the purpose of obtaining benefits . . . In addition, the claimant shall remain disqualified from future benefits so long as any portion of the overpayment or interest on the overpayment is still outstanding. Effect Without internal control processes designed to address and adapt to periods of high unemployment claims volume, the department increases the risk of making improper payments to ineligible claimants. By not ensuring the vendor identifies and takes corrective action to fix claims processing errors within GUS, department management increases the risk of information systems controls not operating as designed or achieving the desired result. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include ? requiring reimbursement instead of advance payments; ? not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; ? requiring additional, more detailed financial reports or additional project monitoring; ? requiring the agency to obtain technical or management assistance; or ? establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include ? temporarily withholding payments until the noncompliance has been corrected, ? denying the use of funds, ? partly or fully suspending or terminating the federal award, ? suspending or debarring the agency, ? withholding further awards for the project or program, or ? pursuing other available legal remedies. Recommendation The Commissioner of Labor and Workforce Development should work with Unemployment Insurance program management to design and implement internal controls to mitigate the risks of making improper payments to ineligible claimants. Such internal controls should ensure the department complies with state and federal program requirements. Management should review the exceptions identified and, when appropriate, disqualify ineligible claimants and initiate recovery of improper payments.

Finding Number 2022-007 Assistance Listing Number 93.767 Program Name Children?s Health Insurance Program (CHIP) Federal Agency Department of Health and Human Services State Agency Department of Finance and Administration Federal Award Identification Number 2105TN5021 and 2205TN5021 Federal Award Year 2021 and 2022 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Repeat Finding 2021-010 Pass-Through Entity N/A Questioned Costs $18,053 Finding As noted in the prior audit, management did not address the division?s CoverKids eligibility process deficiencies, resulting in $22,358 in federal and state questioned costs Background The Division of TennCare (division) oversees CoverKids, Tennessee?s Children?s Health Insurance Program. Funded at both the federal and state levels, the program provides health insurance coverage to uninsured, low-income children and pregnant women not otherwise eligible for Medicaid. From July 1, 2021, through June 30, 2022, the division made two types of payments on behalf of CoverKids members: ? monthly capitation payments to the managed care organizations; and ? reimbursements to benefit managers for services, such as pharmacy and dental services. Division?s Eligibility Determination Process for CoverKids Applicants and Members Initial Eligibility Process CoverKids applicants apply for eligibility using TennCare Connect, the public-facing web portal of the division?s Tennessee Eligibility Determination System (TEDS). In addition to TennCare Connect, the division continues to accept applications through each of following methods: ? by phone or online through the Federally Facilitated Marketplace; ? by phone or a paper application; ? online through the TennCare Access partner portal; or ? by visiting a Department of Human Services office for in-person assistance with applying online, by paper, or by phone. Generally, staff manually enter information received from phone and paper applications into TEDS, while information from online applications automatically uploads into the system. TEDS then automatically processes and verifies the applicant?s demographic, income, and household information against multiple state and federal databases to determine if the applicant is eligible for any available TennCare or CoverKids eligibility category, thereby removing the need for human intervention in many cases. If the applicant?s eligibility determination requires human intervention, such as when the system identifies discrepancies in application information or cannot verify information, the system automatically assigns an eligibility caseworker to process the application manually in TEDS. Eligibility Renewals Paused Pursuant to the Families First Coronavirus Response Act, the division is not permitted to terminate members who were enrolled when the federal COVID-19 public health emergency (PHE) period began, with limited exceptions. As such, the division paused CoverKids eligibility renewals, eligibility changes to lower categories, and terminations on March 18, 2020. During this pause, the division may only terminate CoverKids coverage for existing members who die; voluntarily terminate coverage; become residents of another state; or, for members with pregnancy coverage, when the member?s postpartum period ends. The PHE remained in effect during the fiscal year ended June 30, 2022. Prior Audit Results As noted in the prior audit, the division did not have an effective key internal control for ensuring that caseworkers determine eligibility correctly. Additionally, we identified a TEDS system error that prohibited the termination of benefits for members with CoverKids pregnancy coverage once their postpartum periods ended. In management?s comments to the prior finding, management stated that their TEDS contractor developed a new TEDS system update, implemented on December 13, 2021, to correct the system issue and terminate the members? postpartum benefits. Management also stated that they are now using a secondary review process for newly hired staff and staff who are undergoing Process Improvement Plans. Condition, Criteria, and Cause For the current audit, we determined that while division management attempted to address the TEDS system error that allowed ineligible members to continue with coverage, we still found several ineligible members during our audit period. Additionally, we identified an instance in which staff members incorrectly determined a member eligible for CoverKids when he did not meet the residency requirement and an instance in which TEDS prohibited the termination of coverage for an individual who aged out of CoverKids. These eligibility process deficiencies resulted in $22,358 in questioned costs, $18,053 of which were federal and $4,305 were state questioned costs. For major programs such as the Children?s Health Insurance Program (CHIP), Title 2, Code of Federal Regulations (CFR), Part 200, Section 516(a)(3), ?Audit findings,? requires us to report known and likely questioned costs greater than $25,000 for a type of compliance requirement for a major program. While cumulative known questioned costs for all errors did not exceed $25,000, we determined that likely questioned costs exceeded $25,000. Payment Testwork To determine whether management made capitation payments on behalf of eligible CoverKids members, we tested a random, nonstatistical sample of 60 capitation payments made between July 1, 2021, and June 30, 2022, totaling $11,315. The sample was taken from a population of 513,326 capitation payments totaling $122,631,382. Based on our review, for 5 of 60 payments tested (8%), eligibility caseworkers and TEDS did not verify the members? eligibility, and the members were ineligible for coverage in the month sampled. ? For 1 of 60 CoverKids capitation payments tested, an eligibility caseworker approved an individual for coverage despite information stating the individual had moved out of state and no longer met the Tennessee residency requirement. Although the child was included in a renewal application on March 29, 2022, management could not provide documentation that he had returned to Tennessee prior to that date. As a result of this error, we identified $1,083 in federal questioned costs and an additional $258 in state questioned costs. According to the state plan, the division provides CoverKids coverage to otherwise eligible residents of the state. The state plan further explains that a child?s continuous eligibility period ends when, among other things, they are no longer a resident of the state. ? For 1 of 60 CoverKids capitation payments tested, neither TEDS nor an eligibility caseworker terminated coverage for a member once they turned 19. As a result of this error, we identified $1,514 in federal questioned costs and an additional $361 in state questioned costs. According to the state plan, the division provides continuous eligibility for CoverKids coverage to eligible members for a period of 12 months. The state plan further explains that a child?s continuous eligibility period ends when, among other things, they reach 19 years of age. ? For 3 of 60 CoverKids capitation payments tested, neither TEDS nor an eligibility caseworker terminated coverage for members once their postpartum coverage ended. As a result of these errors, we identified $1,373 in federal questioned costs and $328 in state questioned costs. During the prior audit, we alerted management that its federal grantor, the Centers for Medicare and Medicaid Services (CMS) published guidance through a January 6, 2021, Frequently Asked Questions (FAQ) for the Family First Coronavirus Response Act. This FAQ clarified that agencies should terminate CoverKids coverage for members who qualified for the program due to their pregnancy status at the conclusion of their postpartum period, provided they do not qualify for another program. Management concurred with our findings and began working with the division?s TEDS contractor to implement updates that would allow for these terminations. As part of our current testwork, we discussed with management the FAQ again in response to the current audit results, and management acknowledged that the division should have terminated coverage for the two members who were not U.S. citizens or qualified noncitizens and cited TEDS systems issues as the cause for not doing so. However, management also stated that they were unable to terminate coverage for the other member, as they were a U.S. citizen and therefore may qualify for another program. When division management reached out to CMS for clarification, CMS representatives confirmed on November 18, 2022, that the division should terminate coverage for all members with pregnancy coverage, regardless of citizenship status, once their postpartum period ends. Extended Postpartum Eligibility Testwork Due to the ongoing issues with postpartum eligibility, we performed additional testwork for capitation payments made on behalf of pregnant women from our sample to determine whether any additional payments were made outside of their postpartum period. Specifically, we expanded the scope of our testwork to look at all capitation payments paid for the nine individuals during the fiscal year, totaling $46,618. We found in our expanded review, that for two individuals, the division ultimately terminated coverage five or more months after the postpartum period. For another individual, although the member was eligible for coverage during the month in our sample the member later became ineligible and management failed to terminate coverage. As a result of these three additional errors, we identified a total $14,083 in federal questioned costs and an additional $3,358 in state questioned costs. Risk Assessment We reviewed the Division of TennCare?s December 2021 Financial Integrity Act Risk Assessment and determined that management listed the risk of an eligibility caseworker or TEDS performing inaccurate eligibility determinations, case changes, and redeterminations. Management identified two controls to mitigate this risk as it relates to TEDS and three controls to mitigate this risk as it relates to eligibility caseworkers: ? TEDS will generate standard and specialized reports relating to system functionality and worker performance; ? the Compliance and Policy Group (CPG) will monitor the performance of the interfaces that feed information from, and into, TEDS; ? Eligibility Operations Group (EOG) supervisors and CPG staff will review a sample of cases authorized by each direct report; ? CPG will provide training regarding system functionality to new employees, and to existing employees as requested; and ? CPG will perform quality checks on a random sample of case actions performed by EOG employees. However, based on the results of our review, the controls in place did not identify the conditions noted in this audit. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,? 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. Effect When division staff and TEDS do not process CoverKids eligibility determinations and terminations correctly, the division increases the risk of keeping ineligible individuals on its membership rolls, thereby allowing them to receive CoverKids benefits for which they are not entitled to receive resulting in costs not allowable under the federal Children?s Health Insurance Program. Additionally, federal regulations address actions that the U.S. Department of Health and Human Services (HHS) may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 45 CFR 75.207(b), ?Specific award conditions,? these actions may include ? requiring reimbursement instead of advance payments; ? not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; ? requiring additional, more detailed financial reports or additional project monitoring; ? requiring the agency to obtain technical or management assistance; or ? establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 45 CFR 75.371, ?Remedies for noncompliance,? outlines additional actions HHS may take. Depending on the circumstances, these actions may include ? temporarily withholding payments until the noncompliance has been corrected, ? denying the use of funds, ? partly or fully suspending or terminating the federal award, ? initiating suspension or debarment proceedings, ? withholding further awards for the project or program, or ? pursuing other available legal remedies. Recommendation The Assistant Commissioner of Member Services should ensure that the division stays aware of fundamental guidance from its federal grantor on eligibility determinations. The Assistant Commissioner should also ensure that eligibility caseworkers are fully trained so that they understand their responsibilities relating to CHIP eligibility and can properly determine if members are eligible for CoverKids benefits. In addition, the Assistant Commissioner should work with the TEDS contractor to ensure the system fix is operating as designed. Furthermore, the division should determine any additional unallowable payments made on behalf of members whose postpartum eligibility period has ended. Management should evaluate the effectiveness of control activities for the risks identified in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. For one of the CoverKids child cases, a worker failed to update reported residency information that would have resulted in immediate termination. For the second child case noted, the original worker took appropriate action, but the termination errored out as a business exception and later required manual intervention. Both of these individuals were closed effective November 30, 2022. The three cases CoverKids Pregnancy cases identified were recently pregnant women who were not removed from the program quickly enough after giving birth, but only two were related to systems issues stemming from COVID-19 system changes. The first new mother was not closed because another member of the household had a pending eligibility segment that would not allow partial authorization. The second individual was not terminated timely due to an issue with a COVID-19 data fix script. The third case was related to a misinterpretation of CMS guidance related to pregnant women. TennCare understood from federal guidance that CHIP pregnant women must be reviewed for coverage in other categories 60 days after giving birth. The misinterpretation occurred in relation to women who were potentially eligible to move to a TennCare Medicaid category after giving birth, but did not return requested verifications. COVID guidance from CMS for the Medicaid population has been to provide continuous coverage in that situation and TennCare inadvertently applied the same guidance to new mothers in the CHIP population. All three of these issues have now been corrected in the eligibility system and anyone impacted has either been terminated or is pending response to new notices. It is important to note that if the Governor?s FY2024 budget passes, women in this scenario will be eligible for 12 months post-partum coverage rather than 60 days. TennCare has all risk assessment mitigation strategies in place and those strategies prevent or reduce a multitude of risks to the program. Although internal controls cannot and do not eliminate 100% of errors, TennCare continues to have dedicated staff monitoring documented mitigation strategies to limit the number of eligibility errors in our program. These strategies are explicitly designed to reduce program risk and our processes meet and often exceed that standard. While we would love to see absolute perfection in the eligibility program, that is simply not realistic for eligibility operations processing millions of transactions each year. Further, TennCare improves the risk assessment and mitigation strategies through well-established processes to regularly review and update the assessment. This is in addition to the continual monitoring of both the TEDS system and our manual eligibility processes.

Finding Number 2022-008 Assistance Listing Number 84.010, 84.367, 84.424, and 84.425U Program Name Title I Grants to Local Educational Agencies Supporting Effective Instruction State Grants Student Support and Academic Enrichment Program Education Stabilization Fund Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number S010A170042, S010A180042, S010A190042, S010A200042, S010A210042, S367A180040, S367A190040, S367A200040, S367A210040, S424A180044, S424A190044, S424A200044, S424A210044, and S425U210047 Federal Award Year 2017 through 2022 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility (84.010, 84.367, 84.424, 84.425U) Matching, Level of Effort, Earmarking (84.010) Repeat Finding 2021-015 Pass-Through Entity N/A Questioned Costs N/A Finding As noted in the prior audit, department management did not appropriately calculate grant allocations to local educational agencies Background The Tennessee Department of Education (the department) is the pass-through entity for federal programs and distributes funds to the state?s 146 local educational agencies (LEAs) under the following programs administered by the U.S. Department of Education (USDOE): ? Title I Grants to Local Educational Agencies (Title I), ? Supporting Effective Instruction State Grants (Title II), ? Student Support and Academic Enrichment Program Grants (Title IV), and ? the Elementary and Secondary School Emergency Relief (ESSER) component of the Education Stabilization Fund. The department received federal funding as presented in Table 1. See Schedule of Findings and Questioned Costs for table. Department?s Responsibilities as a Grant Administrator As outlined in Title 2, Code of Federal Regulations (CFR), Part 200, Section 303, as a grant administrator for federal funds, the department must (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. . . . (c) evaluate and monitor the non-Federal entity?s compliance with statutes, regulations and the terms and conditions of Federal awards. . . . (d) take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Overview of Allocation Distribution by Funding Source Title I Title I is comprised of four grant formulas: basic, concentration, targeted, and education finance incentive grants. USDOE determines the amount to allocate to each state and each LEA based on their formula children counts. When applicable, the department must then adjust the USDOE allocation amounts 1. when LEAs consolidate or separate, when area boundaries are redrawn, or when changes have occurred since the Census Bureau updated its list of LEAs; and 2. for special LEAs that are not on the list of traditional LEAs provided to the USDOE by the Census Bureau. For all students enrolled in special LEAs, the department must determine under which traditional LEA the student is counted. The department uses this information to transfer funding from the traditional LEA to the special LEA based on the formula children criteria. Once the department adjusts the original USDOE allocation for the special LEAs, it must then further adjust the allocations to ensure each LEA receives at least its hold-harmless amount. The department determines which LEA allocations do not meet the LEAs? hold-harmless amount, and the department proportionately reduces or raises allocations to meet the hold-harmless amount. Title II USDOE provides the department with Title II funding totals but does not determine how much should be allocated to each LEA. To allocate Title II funding, the department reduces the total funding by the state?s administration and activities set-aside and then allocates the remaining funds to the LEAs. The amount allocated to each LEA is determined based on the following: ? 20% based on the number of children ages 5 to 17 residing in the LEA?s area; and ? 80% based on the number of children ages 5 to 17 residing in the LEA?s area with families below the poverty line. To determine the allocation to special LEAs, staff use population counts that they determined during the Title I allocation process as described above. Title IV and ESSER The department uses the Title I allocations to determine Title IV and ESSER allocations to LEAs. Title IV allocations should be proportionate to the Title I allocations the LEA received in the preceding fiscal year. ESSER allocations should be proportionate to Title I allocations for the most recent fiscal year. Prior Audit Results Department?s Noncompliance and Inadequate Controls As we first reported in the 2021 State of Tennessee Single Audit Report (Finding 2021-015), in April 2021, the USDOE?s Office of Elementary and Secondary Education (OESE) conducted a performance monitoring review of multiple programs and found the department incorrectly calculated its funding allocations to LEAs under the Title I and Title II programs. Because the department must use the Title I allocations to determine Title IV and ESSER allocations to LEAs, the department also incorrectly allocated these programs. OESE stated in the Tennessee Consolidated Performance Review Report #2 of 2 FY 2021, dated November 30, 2021, that for the special LEAs, the department determines their allocations for [Title I and Title II] based on their enrollment. This approach is inconsistent with the requirements . . . for Title I, Part A because [the department] does not derive a Title I, Part A formula count for these LEAs or determine whether they meet the eligibility criteria under each formula. The approach is also inconsistent with the Title II, Part A requirements . . . because [the department] is allocating 100 percent based on the number of students in the LEA rather than 20 percent. OESE also found that the department did not apply hold-harmless requirements for Title I for each of the four formula grants. The department instead determined if LEAs met hold-harmless requirements based on the total Title I allocations. As noted in our prior finding, department management failed to update their allocation procedures to conform to the 2016 Every Student Succeeds Act (ESSA), which changed the Title I federal allocations methodology beginning in 2018. Specifically, management stated that turnover contributed to staff missing the change to ESSA requirements and, as such, the Title I allocation process was never updated to reflect the changes to the law. As a result, management and staff were unaware of the allocation problems until OESE performed their review and released their report. Department management concurred and stated, The department?s Chief of Districts and Schools will continue to work with the U.S. Department of Education to finalize and obtain approval of a corrective action plan and once approved will promptly address the LEAs Title I, II and Title IV allocations for fiscal years 2018 through 2022 as needed. Management in its six-month follow-up stated, We are actively working with U.S. Dept of Education (USDOE) to correct prior years, including if allocations should be adjusted retroactively. USDOE has approved FY2018 and FY2019 corrections and are reviewing proposed FY2020 - FY2023 corrections. USDOE approval is needed before finding 2021-015 can be considered fully corrected. Corrections are implemented as received. Estimated completion date is 3/31/23. Current Condition and Cause Status of Corrective Action to Address Lack of Internal Control and Noncompliance Based on the 2021 performance monitoring review conducted by the USDOE?s Office of Elementary and Secondary Education, the department began working with OESE in late summer/fall of 2021 to develop and implement corrective action. As part of their corrective action, management has begun working with OESE to develop an updated allocation process to calculate Title I and Title II allocations in accordance with the current federal regulations and is continuing to work with OESE to recast all affected years, 2018 through 2022. Based on our discussions with management and review of OESE approved allocations, as of January 2023, the department has provided and OESE has approved the 2018, 2019, and 2020 allocations. Management also indicated that OESE is currently reviewing the 2021 and 2022 fiscal year allocations and that they still expect approvals by March 2023. Given management?s ongoing involvement with OESE to obtain approval for the remaining fiscal year allocations (2021 and 2022), department management had to process the current allocations based on incorrect data; therefore, we did not perform allocation testwork for this audit scope. Management plans to amend/adjust these current allocations once they have approval from OESE regarding these two prior fiscal years. We, however, are reporting this finding to fulfill our reporting responsibilities under the Office of Management and Budget?s Compliance Supplement and the requirement of 2 CFR 200. Current Risk Assessment Because of the issues we identified, we reviewed the department?s December 2021 Financial Integrity Act Risk Assessment and determined that management listed the risk of ?Noncompliance with the specific requirements that are unique to each Federal program and are found in the laws, regulations, compliance supplement, and the provisions of contract or grant agreements pertaining to the program? and identified controls to mitigate the risk including ?Staff participates in regular training to be aware of all rules, regulations and laws.? However, we determined department management did not identify this risk in all divisions that provide oversight of federal programs. Without having appropriate risk response to identify, analyze, and respond to changes, management fails to mitigate the risk and increases the likelihood of error and noncompliance. Effect Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include ? requiring reimbursement instead of advance payments; ? not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; ? requiring additional, more detailed financial reports or additional project monitoring; ? requiring the agency to obtain technical or management assistance; or ? establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include ? temporarily withholding payments until the noncompliance has been corrected, ? denying the use of funds, ? partly or fully suspending or terminating the federal award, ? suspending or debarring the agency, ? withholding further awards for the project or program, or ? pursuing other available legal remedies. Criteria Title I In its review report, OESE summarized 34 CFR 200.72 and stated that for each special LEA, management must estimate the number of Title I, Part A formula children for that LEA by deriving the equivalent of the most recently available poverty estimates from the U.S. Census Bureau?s Small Area and Income Population Estimates (SAIPE) branch, which the Department provides to each [state]. [A state] must then use the derived formula count to determine whether the LEA meets the eligibility criteria under each Title I, Part A formula. In addition, 34 CFR 200.73 indicates that a state ?may not reduce the allocation of an eligible LEA below the hold-harmless amounts? and requires the state to ?apply the hold-harmless requirement separately for basic grants, concentration grants, targeted grants, and education finance incentive grants.? Title II OESE explained in their review that, according to the Elementary and Secondary Education Act, the department must allocate Title II funds in the following manner: ? 20 percent of these funds to LEAs based on the relative number of individuals ages 5 through 17 who reside in the area the LEA serves based on the most recently available data from the U.S. Census Bureau?s SAIPE branch or equivalent data derived by the [department] for LEAs for which SAIPE estimates are not available; and ? 80 percent of these funds to LEAs based on the relative numbers of individuals ages 5 through 17 who reside in the area the LEA serves and who are from families with incomes below the poverty line (based on the most recently available data from the U.S. Census Bureau?s SAIPE branch or equivalent data derived by the [state] for LEAs for which SAIPE estimates are not available). Title IV According to Section 4105(a)(1) of the Elementary and Secondary Education Act of 1965, as amended by the Every Student Succeeds Act, From the funds reserved by a State under section 4104(a)(1), the State shall allocate to each local educational agency in the State that has an application approved by the State educational agency under section 4106 an amount that bears the same relationship to the total amount of such reservation as the amount the local educational agency received under subpart 2 of part A of title I for the preceding fiscal year bears to the total amount received by all local educational agencies in the State under such subpart for the preceding fiscal year. ESSER According to Section 2001(d)(1) of the American Rescue Plan Act of 2021 (ARP Act), Each State shall allocate not less than 90 percent of the grant funds awarded to the State under this section as subgrants to local educational agencies (including charter schools that are local educational agencies) in the State in proportion to the amount of funds such local educational agencies and charter schools that are local educational agencies received under part A of title I of the Elementary and Secondary Education Act of 1965 in the most recent fiscal year. Risk Assessment The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,? 7.02 . . . Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. Recommendation Management should continue working with OESE to recalculate LEA allocations and make whole the underfunded LEAs. After management recalculates allocations and OESE approves the revisions, management should also finalize and implement their policies and procedures governing the allocations to ensure staff responsible for performing and reviewing federal award calculations are aware of current federal requirements. Management should identify all risks and implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. Management should ensure that risks and controls identified in one program area are also identified in other program areas, if applicable. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment The department concurs with this finding. The department?s Chief Operations Officer and Deputy Commissioner will continue to work with the U.S. Department of Education to finalize and obtain approval of a corrective action plan and, once approved will promptly address the LEAs Title I, Part A; Title II, Part A; and Title IV, Part A allocations for fiscal years 2018 through 2022 as needed. The department?s Division of Local Finance and Division of Federal Programs and Oversight will implement revised controls to address the risks noted in this finding. This work will include updating the department?s risk assessment as necessary, professional development, and taking the necessary actions if deficiencies are identified. Internal controls will be developed to ensure that staff responsible for performing and reviewing federal award calculations are aware of current federal requirements. Moving forward, the department?s Office of Finance will serve as a secondary internal check before annual allocations are released.

Finding Number 2022-009 ALS Number 84.424 Program Name Student Support and Academic Enrichment Program Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number S424A180044, S424A190044, S424A200044, and S424A210044 Federal Award Year 2018 through 2022 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Repeat Finding 2021-016 Pass-Through Entity N/A Questioned Costs N/A Finding As noted in the prior audit, department management did not calculate and allocate Title IV to local educational agencies in accordance with federal regulations Background The Department of Education (the department) is the pass-through entity for the Student Support and Academic Enrichment program (Title IV), which is administered by the U.S. Department of Education (USDOE). The state department awards Title IV funds primarily to subrecipients, commonly known as the local educational agencies (LEAs). To be eligible for Title IV funds, the LEA must have received Title I allocations in the state?s previous fiscal year. Each fiscal year, based on a federal grant formula, the department?s Office of the Chief Financial Officer (OCFO) calculates how much to allocate to each LEA. Each eligible LEA receives a minimum of $10,000 in Title IV funding. Currently, the state has 146 LEAs, and because all received Title I funds in FY2021, they were all eligible to receive Title IV funding in FY2022. The LEA can use the Title IV funds to accomplish the program?s objective to improve students? academic achievement, or the LEA has the option to transfer the Title IV funds for use as additional funds for other programs to improve the teaching and learning of children. If the LEA decides to use the funds for Title IV program objectives, the LEA must submit an application describing how they will use the funds to improve students? academic achievement. Prior Audit Results As reported in the prior audit, management did not ensure compliance with the federal Every Student Succeeds Act (ESSA) that requires the department to use prior fiscal year Title I LEA allocations as the basis for its calculation of Title IV funds. Instead, we found that OCFO staff used current fiscal year Title I LEA allocations. Additionally, since Title I allocations are the basis for Title IV allocations, and the prior year?s Title I allocations were also incorrect (see prior Finding 2021-015), neither management nor we were able to recalculate or determine the correct Title IV allocations for fiscal year 2021. Management concurred with our finding and stated the department?s Chief of Districts and Schools will work with USDOE to finalize and obtain approval of a corrective action plan. Management stated once USDOE approved a corrective action plan, they will address the LEAs? Title I and Title IV allocations for fiscal years 2018 through 2022 as needed. In the department?s six-month follow-up, department management stated they were actively working with USDOE to correct fiscal year 2018 through 2022 Title I and Title IV allocations and estimated a completion date of March 2023. Current Condition and Cause Status of Corrective Action Based on our review of the department?s fiscal year 2022 Title IV LEA allocations, management continued to use the current fiscal year Title I allocations instead of the prior fiscal year, which resulted in continued noncompliance. Management stated they began the allocation process for fiscal year 2022 during March 2021. Since management was not informed of Finding 2021-016 until March 2022, management did not implement corrective action for the fiscal year 2022 allocations. According to the Chief Financial Officer, the fiscal year 2023 allocations are based on the prior fiscal year Title I allocations, which we will follow up on in the 2023 Single Audit. As a result of the continued noncompliance stated above, we did not perform Title IV allocation testwork that was dependent upon the Title I base year for this audit scope; however, we did perform testwork to ensure each eligible LEA received a minimum amount of $10,000 in Title IV allocations and received department approval on submitted applications. Although we did not perform the base-year allocation testwork as noted above, we are reporting this finding to fulfill our reporting responsibilities under Office of Management and Budget?s Compliance Supplement and the requirement of Title 2, Code of Federal Regulations, Part 200. Risk Assessment Because of the issues we identified during our audit, we reviewed the department?s December 2021 Financial Integrity Act Risk Assessment and determined that management listed the risk of inadequate controls over the data and the funding calculation for ESSA allocations for school districts. Management listed ?experienced staff with detailed understanding of the mechanics? as a control to mitigate the risk; however, the control, as noted by management in our discussions, was adversely impacted due to turnover of experienced staff. Without having an appropriate risk response to identify, analyze, and respond to changes, management fails to mitigate the risk and increases the likelihood of error and noncompliance. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,? 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. According to Principle 9, ?Identify, Analyze, and Respond to Change,? 9.03 Conditions affecting the entity and its environment continually change. Management can anticipate and plan for significant changes by using a forward-looking process for identifying change. Management identifies, on a timely basis, significant changes to internal and external conditions that have already occurred or are expected to occur. Changes in internal conditions include changes to the entity?s programs or activities, oversight structure, organizational structure, personnel, and technology. Changes in external conditions include changes in the governmental, economic, technological, legal, regulatory, and physical environments. Identified significant changes are communicated across the entity through established reporting lines to appropriate personnel. Criteria According to section 4105(a)(1) of the Elementary and Secondary Education Act of 1965, as amended by ESSA, From the funds reserved by a State under section 4104(a)(1), the State shall allocate to each local educational agency in the State that has an application approved by the State educational agency under section 4106 an amount that bears the same relationship to the total amount of such reservation as the amount the local educational agency received under subpart 2 of part A of title I for the preceding fiscal year bears to the total amount received by all local educational agencies in the State under such subpart for the preceding fiscal year Effect When LEAs do not receive funding as intended by both the federal and state grantors, the underfunded LEAs may lose opportunities to accomplish the program?s objective to improve students? academic achievement. In addition, when the state department allocates LEA funding above the prescribed formula, management may have to identify new funding sources to avoid the potential negative consequences associated with asking LEAs to repay/refund the overallocation resulting from the department?s error. Recommendation The Commissioner should establish the necessary internal controls to ensure staff have the knowledge and expertise to carry out the objectives of the federal program. The Commissioner should also ensure that department staff perform the Title IV allocation calculations in accordance with program guidance and provide LEAs with the appropriate allocations as soon as feasible. Management and staff should continue to work with the U.S. Department of Education to finalize and obtain approval for their corrective action plan and once approved promptly address the LEAs? Title I and Title IV allocations as needed. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment The department concurs with this finding. The department?s Chief Operations Officer and Deputy Commissioner will continue to work with the U.S. Department of Education to finalize and obtain approval of a corrective action plan and, once approved will promptly address the LEAs Title I, Part A; Title II, Part A; and Title IV, Part A allocations for fiscal years 2018 through 2022 as needed. The department?s Division of Local Finance and Division of Federal Programs and Oversight will implement revised controls to address the risks noted in this finding. This work will include updating the department?s risk assessment as necessary, professional development, and taking the necessary actions if deficiencies are identified. Internal controls will be developed to ensure that staff responsible for performing and reviewing federal award calculations are aware of current federal requirements. Moving forward, the department?s Office of Finance will serve as a secondary internal check before annual allocations are released.

Finding Number 2022-010 Assistance Listing Number 84.027 and 84.173 Program Name Special Education Cluster Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number H027A170052, H027A180052, H027A190052, H027A200052, H027A210052, H027X210052, H173A180095, H173A190095, H173A200095, H173A210095, and H173X210095 Federal Award Year 2017 through 2022 Finding Type Material Weakness and Noncompliance Compliance Requirement Matching, Level of Effort, Earmarking Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A Finding Department of Education management did not have effective internal controls over maintenance of effort requirements and was unable to provide underlying maintenance of effort documentation for the Special Education Cluster Background The U.S. Department of Education (USDOE) provides federal grant funds through the Individuals with Disabilities Education Act (IDEA) to assist states in providing children with disabilities a free, appropriate public education. The Tennessee Department of Education (the department) is subject to federal Level of Effort - Maintenance of Effort (MOE) requirements, which prohibit a state from reducing state financial support for special education below the amount of support provided in the prior fiscal year. Known as maintenance of financial support (MFS), the requirement is intended to ensure that the state sets aside sufficient funds for special education and related services. To receive special education funds, the department is required to submit an annual application, which includes a section that allows the department to demonstrate compliance with maintenance of effort requirements. If the department fails to comply with this requirement, USDOE may reduce the state?s federal funding for educational activities in subsequent fiscal years. To calculate the IDEA MOE amounts, various staff members within the department?s Division of Special Populations utilize the MFS workbook maintained by the Assistant Commissioner for Special Populations on their personal hard drive. This workbook contains the various sources of state funding for special education programs. This funding is summed and compared to the prior year?s funding to ensure that the state is spending an adequate amount to meet MOE requirements. Once the MFS number is calculated and included on the next year?s funding application, the department submits the application to USDOE. Condition and Cause Special Education Cluster: Management Was Unable to Demonstrate Maintenance of Effort Compliance Due to Missing Documentation Management did not have any written policies and procedures over the MOE preparation and review process and the preservation of documentary evidence to demonstrate compliance with federal regulations. When we requested the MFS workbook, department leadership looked for documentation and stated that all documentation relating to MOE for our audit period was stored on a laptop hard drive that belonged to the former Assistant Commissioner for Special Populations. When the assistant commissioner left the department in October 2021, the department wiped the laptop?s hard drive of its contents and reassigned it before we began our audit work. Department leadership stated that this hard drive contained the only copy of the calculations and inputs used to demonstrate compliance with the IDEA MOE requirements. When the department wiped the hard drive, they effectively erased all relevant documentation, and without this documentation, management was unable to demonstrate how or if they met the IDEA MOE requirements. Additionally, current management stated that because of the missing documentation, they were not aware if a supervisor reviewed the 2022 IDEA application before it was submitted to USDOE. Risk Assessment We reviewed the department?s December 2021 Financial Integrity Act Risk Assessment and determined management did not identify a risk of noncompliance with MOE fiscal calculations and, as such, did not establish control activities to ensure compliance with MOE reporting requirements. Criteria Noncompliance and Internal Controls According to ?Auditee Responsibilities,? Title 2, Code of Federal Regulations, Part 200, Section 508(d), ?the auditee must . . . provide the auditor with access to personnel, accounts, books, records, supporting documentation, and other information as needed for the auditor to perform the audit required by this part.? Additionally, according to 2 CFR 200.303, the non-Federal entity must a. Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). b. Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal awards. c. Evaluate and monitor the non-Federal entity?s compliance with statutes, regulations and the terms and conditions of Federal awards. d. Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. e. Take reasonable measures to safeguard protected personally identifiable information and other information the Federal awarding agency or pass-through entity designates as sensitive or the non-Federal entity considers sensitive consistent with applicable Federal, State, local, and tribal laws regarding privacy and responsibility over confidentiality. Furthermore, the U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides guidance to management for maintaining documentation of its internal control system. Green Book Principle 3.10, ?Documentation of the Internal Control System,? states, Effective documentation assists in management?s design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel, as well as a means to communicate that knowledge as needed to external parties, such as external auditors. Risk Assessment The Green Book provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,? 7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Effect Without a proper system of internal controls over MOE, which includes a complete and comprehensive review of the special education MFS workbook, the risk increases that department staff will miscalculate and not accurately determine the state?s compliance with federal requirements. If a miscalculation results in management making the wrong determination about the state?s compliance, the department risks a reduction of federal funding for educational activities in subsequent award years. This could diminish the department?s capacity to provide sufficient oversight, monitoring, and technical assistance to the local educational agencies that provide services to students. Additionally, wiping the hard drive of a member of senior leadership without saving the contents elsewhere represents a significant risk to the department. Not only was the department unable to provide auditors with the necessary documentation as relates to the topic at hand, but any additional sensitive department data stored on the hard drive was also lost. Recommendation The Commissioner should work with appropriate program and fiscal staff to ensure sufficient controls are in place for MOE that includes a complete supervisory review of their MOE calculations to ensure compliance. Management should evaluate the effectiveness of the control activities for this risk and update the department?s annual risk assessment to reflect any new controls management implements. Department managers should also take steps to ensure that documents are maintained and are not tied to a specific employee?s hardware. For data stored on physical storage devices, the department should review and save all relevant data before hardware is erased and reassigned. Management?s Comment The department concurs with this finding. The Chief Academic Officer and Chief Operations Officer will collaborate to create sufficient controls for the calculation of MOE, which will include at minimum a complete supervisory review of their MOE calculations to ensure compliance. Management will evaluate the effectiveness of the control activities for this risk and update the department?s annual risk assessment to reflect any new controls management implements. Internal controls will be developed to ensure that staff responsible for performing and reviewing federal award calculations are aware of current federal requirements. Moving forward, the department?s Office of Finance will serve as a secondary internal check before MOE is submitted. Further, the Chief Operations Officer, Chief Information Officer, and Director of Human Resources will create a process to ensure documents are maintained and are not tied to a specific employee?s hardware, including but not limited to data stored on a physical storage device.

Finding Number 2022-011 Assistance Listing Numbers 84.425U and 84.425W Program Name Education Stabilization Fund Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number S425U210047 and S425W210044 Federal Award Year 2021 and 2022 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding 2021-017 Pass-Through Entity N/A Questioned Costs N/A Finding As noted in the prior audit, program and fiscal staff for the Department of Education did not comply with Federal Funding Accountability and Transparency Act reporting requirements for the Education Stabilization Fund Background The Department of Education (the department) is the pass-through entity for the Education Stabilization Fund (ESF), which is administered by the U.S. Department of Education. ESF combines federal disaster relief funding managed by the U.S. Department of Education from the Coronavirus Aid, Relief, and Economic Security Act; the Coronavirus Response and Relief Supplemental Appropriations Act, 2021; and the American Rescue Plan Act of 2021. The ESF is composed of 23 subprograms including ? the Elementary and Secondary School Emergency Relief (ESSER) Fund, ? the American Rescue Plan ? Elementary and Secondary School Emergency Relief (ARP-ESSER), ? the Governor?s Emergency Education Relief Fund, ? the Emergency Assistance to Non-Public Schools Fund, and ? the American Rescue Plan ? Elementary and Secondary School Emergency Relief ? Homeless Children and Youth (ARP-HCY) Reporting for the Federal Funding Accountability and Transparency Act The Federal Funding Accountability and Transparency Act (FFATA) requires the department to report subrecipient subaward financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. According to federal regulations, reports are due ?no later than the end of the month following the month in which the obligation was made.? The subaward information in FSRS is then available to the public on the USA Spending website for transparency. Key data elements are included in the report such as the awardee name, award amount, the Data Universal Numbering System number or Universal Entity Identifier, and the subaward obligation/action date. For the ESF, the department?s program staff determine the eligible award amount throughout the year for each subrecipient and enter the amount in ePlan, the department?s grants management system. For the subrecipient to receive the grant awards, program staff require the subrecipient to submit an application through ePlan summarizing how the subrecipient plans to use the grant funds to achieve the program objectives. Once staff review and the applicable subprogram?s director approves the application, the subrecipient can request reimbursement from the grant award. Upon application approval (identified as obligated/action date in the system) the grants funds are considered obligated. Prior Audit Results We reported in our prior finding that out of 87 ESF subawards sampled, we found that fiscal staff did not report and/or did not timely report 25 subawards (29%). In response to the prior audit finding, management stated they planned to implement effective controls to address risks noted with ESF FFATA reporting and to develop additional controls to mitigate these risks. In addition, management stated that they implemented FFATA training as part of the onboarding process for new hires. Condition and Cause Based on inquiries with the department?s fiscal director, we found that while management reported all ESF subawards, management still has not developed adequate internal control activities to ensure timely FFATA reporting for the ESF subawards. Unlike other programs at the department, ESF subawards can occur throughout the year and are not tied to a defined award period. From ePlan, we obtained a population of 312 ESF subawards allocated to subrecipients during FY 2022, 225 of which were allocations greater than $30,000. We selected a nonstatistical random sample of 40 subawards greater than $30,000 to determine if the department complied with FFATA reporting requirements. See Table 1 for a breakdown of each subprogram. See Schedule of Findings and Questioned Costs for table. Based on our work, we found that fiscal staff did not report 7 of 40 ESF subawards (18%) by the end of the month following the month management obligated the funds. We asked the fiscal director what prevented staff from fulfilling the FFATA requirements for these seven subawards, and he stated that program staff had not provided fiscal staff with the subaward letters and thus fiscal staff were unaware the awards had been made. For the remaining 33 subawards tested, the fiscal director batch reported these subawards in the federal FSRS using a ?date? that actually preceded the subaward application approval date (and thus before the grant was technically obligated) in ePlan. When we asked the fiscal director to explain the ?obligation date? that he selected for FSRS reporting, he was unable to provide a reason for the date he used. Given that program staff did not provide fiscal staff with the subaward letters, the fiscal director was unable to determine when FFATA reporting should begin. See Table 2 for a breakdown of noncompliance and Table 3 for details related to the seven late reports. See Schedule of Findings and Questioned Costs for tables. We met with management on December 6, 2021, to discuss the results of our 2021 Single Audit work related to FFATA, which was after the obligation dates of the subawards reported late; however, these subawards were not reported until February and November of 2022. The process during our audit period for these subawards did not change from the prior year. Risk Assessment We reviewed the department?s December 2021 Financial Integrity Act Risk Assessment and determined that management listed the risks of timely FFATA reporting to FSRS; however, management labeled the risk ?not applicable? and did not include a mitigating control. Criteria Reporting Appendix A to ?Reporting Subaward and Executive Compensation Information,? Title 2, Code of Federal Regulations (CFR), Part 170, states: a. Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. [the previous paragraph] of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2010.) 3. What to report. You must report the information about each obligating action that the submission instructions posted at http://www.fsrs.gov specify. Risk Assessment The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.01, ?Identify, Analyze, and Respond to Risks,? Management should identify, analyze, and respond to risks related to achieving the defined objectives. Attributes The following attributes contribute to the design, implementation, and operating effectiveness of this principle: ? Identification of Risks ? Analysis of Risks ? Response to Risks Effect Not meeting the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include the following: ? Requiring payments as reimbursements rather than advance payments; ? Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; ? Requiring additional, more detailed financial reports; ? Requiring additional project monitoring; ? Requiring the non-Federal entity to obtain technical or management assistance; or ? establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include the following: ? Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. ? Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. ? Wholly or partly suspend or terminate the Federal award. ? Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). ? Withhold further Federal awards for the project or program. ? Take other remedies that may be legally available. Recommendation The Commissioner of the Department of Education should require program staff to provide all subaward information to allow the department?s fiscal director to meet FFATA reporting requirements. Management and staff should ensure that effective internal controls, including better communication, is developed and implemented to address the FFATA risks involving ESF grant awards as noted in this finding. Management should ensure the appropriate staff members understand the FFATA reporting requirements and report applicable subawards in accordance with those reporting requirements. Management?s Comment The department concurs with this finding. The Assistant Commissioner of Federal Programs and Oversight will create a process of internal controls, including a structure for better communication to ensure the appropriate staff members understand the FFATA reporting requirements and report applicable subawards in accordance with those reporting requirements. This work will include updating the department?s risk assessment as necessary, professional development, and taking the necessary actions if deficiencies are identified. Internal controls will be developed to ensure that staff across fiscal, compliance and program teams responsible for performing and reviewing FFATA understand the current federal requirements.

Finding Number 2022-012 Assistance Listing Number 97.036 Program Name Disaster Grants ? Public Assistance (Presidentially Declared Disasters) Federal Agency Department of Homeland Security State Agency Department of Military Federal Award Identification Number FEMA-1909-DR-TN, FEMA-3473-EM-TN, FEMA-3576-EM-TN, FEMA-4427-DR-TN, FEMA-4471-DR-TN, FEMA-4476-DR-TN, FEMA-4514-EM-TN, FEMA-4541-DR-TN, FEMA-4550-DR-TN, FEMA-4594-DR-TN, FEMA-4601-DR-TN, FEMA-4609-DR-TN, FEMA-4637-DR-TN, and FEMA-4645-DR-TN Federal Award Year 2010 through 2022 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A Finding Management of the Tennessee Department of Military did not have adequate internal controls to ensure information provided to the federal grantor was complete and accurate, which resulted in inaccurate reporting Background The Federal Emergency Management Agency (FEMA) provides grant funding to the Tennessee Emergency Management Agency (TEMA) within the Department of Military to help TEMA fulfill its mission to coordinate preparedness, response, and recovery from man-made, natural, and technological hazards in a professional and efficient manner. As part of the federal-state partnership, FEMA requires the department to report on the use of the federal funds in three ways: SF-425 quarterly reports, Quarterly Progress Reports (QPRs), and Federal Funding Accountability and Transparency Act (FFATA) reporting. Condition, Cause, and Criteria The Department of Military did not have an effective system of internal controls to ensure that the department provided the federal grantor (FEMA) with complete and accurate information for SF-425 Federal Financial Reports, QPRs, and FFATA reports. SF-425 Per the FEMA grant award, recipients are required to submit complete and accurate SF-425 Federal Financial Reports at least quarterly throughout the period of performance for each open Public Assistance disaster grant. We tested all 17 SF-425 reports for open public assistance disaster grants for the quarter ended March 2022. Based on the testwork performed, management did not completely or accurately complete portions of the SF-425 submitted to FEMA for 14 of 17 reports tested (82%). See Schedule of Findings and Questioned Costs for table. Management also reported administrative costs using the incorrect allocation percentage, resulting in incorrect amounts for the total recipient share required and remaining recipient share to be provided. For these particular errors, while inaccurately reported, they did not result in a negative financial impact to the federal grantor. According to Department of Military management, the department experienced turnover with personnel who prepared and reviewed the SF-425 during fiscal year 2022. The new accountant?s and reviewer?s inexperience with public assistance and SF-425 preparation and misunderstandings within the department resulted in inaccurate and incomplete reports. The accountant did receive training; however, the training and subsequent reviews were not adequate to prevent errors in the preparation of the reports. QPRs FEMA requires disaster grant award recipients to submit QPRs for all ongoing large projects. According to Title 44, Code of Federal Regulations (CFR), Part 206, Section 204(f), ?Project Performance,? FEMA and the agency will determine the due date for the first report, and subsequent reports will be due quarterly after that date. We tested a sample of 25 QPRs for ongoing large projects for the quarter ended March 2022. We noted that TEMA personnel did not completely or accurately report the required elements for 22 disaster grants (88%) and project worksheets, including reporting prior-quarter values, eliminating projects from required reports, not reporting all drawdowns, incorrectly reporting or not reporting time extensions or completion dates, and reporting unsupported amounts. For these particular errors, while inaccurately reported, they did not result in a negative financial impact to the federal grantor. Management did not adhere to their written procedures when performing QPR reviews. In addition, management stated there was an extensive number of disasters in the last few years, which overloaded the department and impacted proper reporting. As a result, the department placed their focus on expenditure oversight rather than adhering to reporting requirements. FFATA reporting FFATA and 2 CFR 170, Appendix A to Part 170, Section I(a) require the department to report subrecipient financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. According to federal regulations, reports are due ?no later than the end of the month following the month the obligation was made.? The subaward information in FSRS is then available to the public on the USA Spending website for transparency. We tested a sample of 25 FFATA reports for new subawards and noted that the department submitted inaccurate information to FSRS for 7 disaster grant reports (28%) and related amendments, with some reports containing multiple errors. Management incorrectly reported subaward contract amounts rather than the federal award amount, did not include award amendments, or mistyped the award amount. For these particular errors, while inaccurately reported, they did not result in a negative financial impact to the federal grantor. We also noted that that the department did not report one of 25 subawards (4%) tested in the FSRS. The Contract Manager submitted the applicable report without one subgrant as they were awaiting the Unique Entity Identifier and planned to update the report later when the department finished the transition to the UEI system. However, no later update occurred. See Schedule of Findings and Questioned Costs for table. The Contracts Manager who prepares the reports stated that the federal government only allows one person to have access to the system. As a result, there was not a review process for FFATA reporting. Effect Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include ? requiring reimbursement instead of advance payments; ? not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; ? requiring additional financial reports or additional monitoring; ? requiring the agency to obtain assistance from technical or management experts; or ? establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include ? temporarily withholding payments until the noncompliance has been corrected, ? denying the use of funds, ? partly or fully suspending or terminating the federal award, ? suspending or debarring the agency, ? withholding further awards for the project or program, or ? pursuing other available legal remedies. In addition, not meeting the FFATA reporting requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Recommendation Management of the Department of Military should design and implement an effective system of internal controls, including documenting the process to prepare and review federal reports, to ensure that the department provides the federal grantor (FEMA) with complete and accurate information for SF-425 Federal Financial Reports, Quarterly Progress Reports, and FFATA reports. Additionally, management should provide sufficient training to staff completing and reviewing the reports and ensure that supporting calculations are complete and accurate, all required fields are complete and accurate, and all awards are included. Management?s Comment Military Department concurs with all findings. The following actions have or will be taken to enhance the Department of Military?s system of internal controls surrounding the preparation, completion, and submission of SF-425 quarterly reports, Quarterly Progress Reports (QPRs), and Federal Funding Accountability and Transparency Act (FFATA) reporting. SF425s The Department of Military has consulted with the Department of Finance and Administration, Centralized Accounting unit who prepares these reports, and the following actions have been or will be taken: 1. Additional and in-depth training was completed as of December 31, 2022, for both the preparer and reviewer to ensure all awards are included and supporting calculations and all required fields are complete and accurate. 2. Documentation of the business process used in the preparation and review of SF-425 Federal Financial Reports will be completed by April 15, 2023. This will help ensure that the accuracy and quality of the reports are not impacted by staff turnover, inexperience, or absence. FFATA Reporting As of December 31, 2022, a new review process has been developed, documented, and implemented by the TEMA Contracting Section. In accordance with this process, the Contracting Manager completes the monthly FFATA report in FSRS and saves the submitted report as a PDF. This PDF version is then reviewed by other employees in the contracting section who have received training on FFATA reporting requirements. If any discrepancies are noted, the Contracting Manager edits the report in FSRS and resubmits. QPRs As of December 31, 2022, formal review of the established QPR Standard Operating Procedure and refresher training has been completed with all Public Assistance Branch personnel. The QPR process is now part of Public Assistance Branch new employee orientation to ensure preparation and initial training occur. In addition, beginning January 1, 2023, an annual QPR review was implemented to ensure staff continue to adequately prepare QPRs, receive updated QPR training, and complete an SOP review.

Finding Number 2022-013 Assistance Listing Number 10.568 and 10.569 Program Name Food Distribution Cluster Federal Agency Department of Agriculture State Agency Department of Agriculture Federal Award Identification Number 215TN717J7003, 215TN817Y8105, 225TN813P1103, and 225TN817Y8105 Federal Award Year 2021 and 2022 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility ? Material Weakness Special Tests and Provisions ? Material Weakness and Noncompliance Repeat Finding 2021-028 Pass-Through Entity N/A Questioned Costs N/A Finding As noted in the prior audit, the Tennessee Department of Agriculture did not have internal controls over inventory and household eligibility determinations and did not ensure annual physical inventory counts were conducted at all storage locations for the Emergency Food Assistance Program. Background The Department of Agriculture (the department), in partnership with the U.S. Department of Agriculture (USDA) and local organizations, operates the Emergency Food Assistance Program (food program) to provide low-income households emergency food assistance. USDA purchases a variety of food items and makes them available to state distributing agencies. On behalf of the department, subrecipients on contract with the department administer the program in compliance with the grant award. The department places food orders with USDA on behalf of the subrecipients, and USDA delivers the food directly to the subrecipients? warehouses. The subrecipients must manage the inventory in their warehouses by tracking food receipts and food distributions, performing a physical food inventory count at least annually, and documenting adjustments to food inventory records such as losses due to spoilage. Also, the subrecipients determine whether applicants meet income requirements and are residents of the state of Tennessee, and they provide food to households deemed eligible. The department reimburses the subrecipients for administrative costs, such as payroll costs associated with operating the food program. During our audit period, the department contracted with 22 subrecipients for the purpose of administering the program. Prior Audit Results In the 2021 Single Audit we noted that management did not have controls in place for household eligibility determinations and food inventory. In prior years, the department performed on-site subrecipient reviews to determine if subrecipients were accurately determining household eligibility and managing the inventory according to federal requirements. According to management, they stopped performing the on-site reviews in March 2020 due to the effects of the COVID-19 pandemic. Management concurred with the prior finding and stated the following: The department will establish control activities (review process) to ensure and document subrecipient compliance with inventory and eligibility requirements. If deficiencies are disclosed, the department will submit a report of findings to the subrecipient and ensure corrective action is taken. The commodity administrator will be responsible for monitoring risks and assessing controls. Monitoring activity will transition to a desk audit format with virtual visits incorporated as needed to maximize safety protocols and minimize disruption of the monitoring schedule due to public health or other emergency situations. Management explained in their six-month follow-up that upon approval by the USDA Southeast Regional Office, management will conduct desk audit reviews of all 22 eligible recipient agencies (ERAs) during Federal Fiscal Year 2023 (FFY23). In November 2022, the USDA approved the department?s plan to begin reviews of subrecipients. Condition and Cause Inventory Management and Household Eligibility As noted in the prior audit finding, department management did not implement internal controls to ensure compliance with the food program?s inventory and eligibility requirements. Based on our discussions with department management, during fiscal year ended June 30, 2022, management had neither resumed their previous control activity of on-site reviews nor implemented other control activities to ensure subrecipients reasonably complied with the federal regulations. Given that management did not implement control activities, we performed compliance testwork to determine whether subrecipients complied with federal regulations for inventory records and household eligibility determinations. To perform this testwork, we visited four subrecipients to observe physical inventories, reperform inventory counts of commodities, and review supporting food inventory records and eligibility determination documentation. We also interviewed management and staff of the department and the subrecipients. Based on our testwork, we did not identify subrecipient noncompliance related to incorrect eligibility determination, but we did identify subrecipient noncompliance related to nonperformance of annual inventory counts and inaccurate inventory records at three of the four sites we visited. Annual Inventory Not Performed At one subrecipient, we found that the subrecipient?s distributor that warehouses the subrecipient?s food inventory did not provide the subrecipient with official evidence of the number of USDA commodities received and shipped. In addition, the subrecipient did not maintain documentation of the actual number of food commodities distributed but instead relied on a reconciliation of ending inventory to beginning inventory. Because of the lack of documentation for inventory received and distributed, we could not ensure the accuracy of inventory. Upon further discussion with department management and subrecipient personnel, we noted that an additional four subrecipients (total of five subrecipients) contracted with the same distributor, and that distributor did not provide any of the five subrecipients with official documentation for foods the distributor received from the USDA. We also noted that the five subrecipients did not conduct annual physical inventory counts of foods and relied only on weekly reports from the distributor. Although federal regulations permit contracting with a distributor or storage facility, the subrecipients that contract with distributors were responsible for ensuring the accuracy of distributor inventory reports. Inaccurate Inventory Records At two of the four subrecipients we visited, we noted inaccurate food distribution counts and reported distribution counts in the wrong reporting period. Specifically, we performed very limited counts and still noted discrepancies: ? One subrecipient reported staff distributed 820 cases of catfish fillets; however, inventory records showed staff distributed 841 cases. ? The other subrecipient reported staff distributed 6,240 cans of light red kidney beans in December 2021; however, inventory documentation showed staff distributed the inventory in June 2021. Risk Assessment We reviewed the Department of Agriculture?s December 2021 Financial Integrity Act Risk Assessment for department operations and determined that management did not identify the risk of noncompliance with federal inventory and eligibility requirements and as such did not identify control activities to ensure compliance with these requirements. Criteria Inventory Management and Household Eligibility According to Title 2, Code of Federal Regulations, Part 200, Section 303(a), a non-federal agency must Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, according to Title 7, CFR, Part 251, Section 10(e), (1) Each State agency must monitor the operation of the program to ensure that it is being administered in accordance with Federal and State requirements. State agencies may not delegate this responsibility. . . (3) Each [subrecipient monitoring] review must encompass, as applicable, eligibility determinations, food ordering procedures, storage and warehousing practices, inventory controls, approval of distribution sites, reporting and recordkeeping requirements, and civil rights. According to Title 7, CFR, Part 250, Section 12(b), ?Inventory Management,? On an annual basis, the distributing agency must conduct a physical review of donated food inventories at all storage facilities used by the distributing agency (or by a subdistributing agency) and must reconcile physical and book inventories of donated foods. According to the department?s The Emergency Food Assistance Program Manual for subrecipients, Required Records: Each RA [Recipient Agency] or other entity which has an agreement with the RA is required to keep accurate and complete records associated with the receipt, storage, distribution, disposal, and inventory of TEFAP foods as well as any funding received under the TDA grant contract. Risk Assessment The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, ?Identification of Risks,? Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Additionally, Principle 9.04, ?Analysis of and Response to Change,? states, As part of risk assessment or a similar process, management analyzes and responds to identified changes and related risks in order to maintain an effective internal control system. Changes in conditions affecting the entity and its environment often require changes to the entity?s internal control system, as existing controls may not be effective for meeting objectives or addressing risks under changed conditions. Management analyzes the effect of identified changes on the internal control system and responds by revising the internal control system on a timely basis, when necessary, to maintain its effectiveness. Effect The lack of sufficient internal controls over inventory management and household eligibility determinations increases the risk of noncompliance with federal requirements and fraud, waste, and abuse in this federal program. Without sufficient monitoring, department management cannot reasonably ensure that subrecipients fulfill federal requirements and meet the goals of this federal program. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to Title 2, CFR, Part 200, Section 208(c), ?Specific conditions,? these actions may include ? requiring reimbursement instead of advance payments; ? not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; ? requiring additional, more detailed financial reports or additional project monitoring; ? requiring the agency to obtain technical or management assistance; or ? establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, Title 2, CFR, Part 200, Section 339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include ? temporarily withholding payments until the noncompliance has been corrected, ? denying the use of funds, ? partly or fully suspending or terminating the federal award, ? suspending or debarring the agency, ? withholding further awards for the project or program, or ? pursuing other available legal remedies. Recommendation The Commissioner of the Department of Agriculture should ensure that appropriate staff members establish effective internal controls to ensure staff and subrecipients comply with inventory and eligibility requirements. Management should take prompt action to implement the USDA approved monitoring plan to identify areas of subrecipient noncompliance and follow up on required corrective action as needed. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. To ensure and document effective internal controls, the department will implement the USDA approved monitoring plan to identify areas of subrecipient noncompliance and will follow up on required corrective action as needed. The approved monitoring plan establishes controls to address the risks noted in the finding. The plan will be deployed the first week of April 2023 with an anticipated completion date of September 30, 2023, to coincide with the end of the federal fiscal year and the grant contract period. The commodity administrator will be responsible for monitoring risks and assessing controls.

Finding Number 2022-014 Assistance Listing Number 15.605, 15.611, and 15.626 Program Name Fish and Wildlife Cluster Federal Agency Department of the Interior State Agency Tennessee Wildlife Resources Agency Federal Award Identification Number AERIALWILDRES20, AQUATICEDUC2022, BOATACCESSX2021, BOATACCESSX2022, BUFFALORDGBLD20, BUFFALORDGRNG22, CAVEMONITORNG20, ELKVIEWGTOWER21, FLURRYMACHINS21, GREENECORANGE21, HUNTEDSEC102021, HUNTEDSEC102022, HUNTEREDUCA2021, HUNTEREDUCA2022, LONEOAKSGUNRG17, LONEOAKSYOUTH19, MALLARDRESEAR20, SCHL3DARCHERY19, SCHOLPISTOLPR19, SPORTFISHRE2021, SPORTFISHRE2022, TOYS19, TURKEYRSRCHUT17, TWFMENTORPROG20, WHITEDEERPOPU20, WHITEOAKWMARE19, WILDLIFERES2021, WILDLIFERES2022, and WMICONRSWOCON20 Federal Award Year 2017 through 2022 Finding Type Material Weakness and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A Finding Tennessee Wildlife Resources Agency management did not perform required subrecipient monitoring and did not obtain and review subrecipients? Single Audits Background The Tennessee Wildlife Resources Agency (TWRA) administers the Fish and Wildlife cluster of programs, which are federal programs under the oversight of the U.S. Fish and Wildlife Service. The Fish and Wildlife Cluster includes the following programs: ? The Sport Fish Restoration program provides funds to restore, conserve, and enhance sport fish populations and to provide for public use and enjoyment of these fishery resources. ? The Wildlife Restoration program provides funds to restore, rehabilitate, and improve wildlife populations and their habitats; to conduct wildlife management research, and wildlife population surveys and inventories; to acquire land; and to provide for public use of wildlife resources. ? The Basic Hunter Education program provides training to hunters in the safe handling and use of firearms and archery equipment; hunter responsibilities and ethics; survival; construction, operation, and maintenance of public shooting ranges; and basic wildlife management and identification. ? The Enhanced Hunter Education and Safety program provides funds to enhance programs for hunter education, recruitment, and safety; to increase interstate coordination of hunter education programs; to enhance programs for bow hunters and archers; to enhance construction and development of firearm and archery ranges; and to update safety features of firearm and archery ranges. For fiscal year 2022, TWRA awarded a total of $3,765,395 in federal and state funds to 20 subrecipients to carry out the activities of the Fish and Wildlife Cluster programs. Condition, Criteria, and Cause To obtain an understanding of TWRA management?s subrecipient monitoring procedures, we discussed management?s monitoring activities. Based on our discussions, we determined that for fiscal year ended June 30, 2022, management did not ? perform subrecipient monitoring as required by Title 2, Code of Federal Regulations (CFR), Part 200, Section 332(d); and ? obtain and review subrecipients? Single Audit reports and issue management decisions on findings as required by 2 CFR 200.332. According to 2 CFR 200.332(d), management must Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. As the pass-through entity, TWRA is required by 2 CFR 200.332 to verify that all subrecipients that spend $750,000 or more obtain a Single Audit within nine months after the subrecipient?s fiscal year-end. When the subrecipient?s Single Audit includes audit findings, TWRA must issue a management decision within six months of the audit report?s release, indicate if the subrecipient agency agreed with the finding, and describe any corrective action the subrecipient must take. TWRA management stated that they did not perform subrecipient monitoring and did not obtain and review subrecipients? Single Audit reports because of a lack of staff. Management also stated that they have not developed and implemented policies and procedures for subrecipient monitoring. Risk Assessment We reviewed TWRA?s December 2021 Financial Integrity Act Risk Assessment and determined management did not identity risks related to failure to perform subrecipient monitoring and failure to obtain and review subrecipient? Single Audit reports and, as such, did not establish control activities to ensure compliance. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, ?Identification of Risks,? Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Effect When TWRA management does not follow federal requirements to perform subrecipient monitoring, management cannot ensure subrecipients have reasonably complied with federal statutes, regulations, and terms and conditions of the grant award. Also, when management does not obtain and review subrecipients? Single Audit results as required by federal regulations, including Single Audit findings, management increases the risk that subrecipients? noncompliance and control deficiencies will not be promptly identified by TWRA management so that corrective action can be achieved. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include ? requiring reimbursement instead of advance payments; ? not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; ? requiring additional, more detailed financial reports or additional project monitoring; ? requiring the agency to obtain technical or management assistance; or ? establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include ? temporarily withholding payments until the noncompliance has been corrected, ? denying the use of funds, ? partly or fully suspending or terminating the federal award, ? suspending or debarring the agency, ? withholding further awards for the project or program, or ? pursuing other available legal remedies. Recommendation The Executive Director should ensure management and staff comply with federal regulations and requirements related to subrecipient monitoring and should ensure management develops and implements policies and procedures to guide agency staff tasked to perform subrecipient monitoring activities. Management should take prompt action to initiate the monitoring activities to identify areas of subrecipient noncompliance and follow up on required corrective action as needed. Management should also ensure key personnel are aware of all required monitoring responsibilities, including reviewing subrecipients? Single Audit reports, issuing management decisions, and obtaining subrecipient corrective action plans when necessary. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. The Tennessee Wildlife Resources Agency will create a program monitoring guide and update the current risk assessment by July 31, 2023. Agency management will continue its exhaustive review of process needs and determine assignments to carry out an effective system of monitoring. We are also exploring software options to assist with remedying this shortcoming. The agency?s risk assessment documents will be revised as appropriate.

Finding Number 2022-015 Assistance Listing Number 93.044, 93.045, and 93.053 Program Name Aging Cluster Federal Agency Department of Health and Human Services State Agency Commission on Aging and Disability Federal Award Identification Number 2001TNOASS, 2101TNOASS-00, 2001TNOACM, 2101TNOACM-00, 2101TNOAHD-00, and 2101TNOANS-01 Federal Award Year 2020 through 2022 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A Finding Fiscal staff for the Tennessee Commission on Aging and Disability did not comply with the Federal Funding Accountability and Transparency Act reporting requirements for the Aging Cluster Background The Tennessee Commission on Aging and Disability (TCAD) administers the Aging Cluster, which is a federal program under the oversight of the U.S. Department of Health and Human Services. TCAD?s fiscal duties are split between TCAD fiscal staff and the Department of Finance and Administration?s Centralized Accounting staff based on a broad outline of responsibilities established in a memorandum of understanding. Centralized Accounting is responsible for accounting functions, such as accounts payable, schedule of expenditures of federal awards, cashiering, general ledger entries, and interagency journals. TCAD fiscal staff are responsible for approving travel, creating invoices and approving payments, and filing the federal reports and certifications directly or providing the federal data to Centralized Accounting to file on TCAD?s behalf. The Federal Funding Accountability and Transparency Act (FFATA) requires the reporting of subrecipient subaward financial information through the FFATA Subaward Reporting System (FSRS). The subaward information in FSRS is then available to the public on usaspending.gov for transparency. Condition and Cause Reporting We obtained from TCAD management and verified through Edison, the state?s accounting system, the population of nine subrecipients? subawards, totaling $28,450,787, and found that management did not establish policies, procedures, or other guidance to instruct staff on the process for complying with FFATA reporting requirements. As a result, management did not report the subrecipients? subawards in FSRS as required for the year ended June 30, 2022. Although the TCAD Fiscal Director knew of the federal requirement to report, the Fiscal Director did not realize she had to provide Centralized Accounting with subrecipient subaward information. She believed the Department of Finance and Administration was solely responsible for it; however, according to Centralized Accounting management and staff, because TCAD did not provide them with the subrecipient subaward information, they did not report the required information in FSRS. Risk Assessment We reviewed TCAD?s December 2022 Financial Integrity Act Risk Assessment and determined management did not identify a risk of noncompliance with FFATA reporting and, as such, did not establish control activities to ensure compliance with FFATA reporting requirements. Criteria Reporting Appendix A to ?Reporting Subaward and Executive Compensation Information,? Title 2, Code of Federal Regulations (CFR), Part 170, states: a. Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in [the previous paragraph] of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2010.) 3. What to report. You must report the information about each obligating action that the submission instructions posted at http://www.fsrs.gov . . . d. Exemptions. If, in the previous tax year, you had gross income, from all sources, under $300,000, you are exempt from the requirements to report . . . subawards . . . e. Definitions. For purposes of this award term: 1. Federal Agency means a Federal agency as defined at 5 U.S.C. 551(1) and further clarified by 5 U.S.C. 552(f). 2. Non-Federal entity means all of the following, as defined in 2 CFR part 25: i. A Governmental organization, which is a State, local government, or Indian tribe; ii. A foreign public entity; iii. A domestic or foreign nonprofit organization; and, iv. A domestic or foreign for-profit organization . . . 4. Subaward: i. This term means a legal instrument to provide support for the performance of any portion of the substantive project or program for which you received this award and that you as the recipient award to an eligible subrecipient. ii. The term does not include your procurement of property and services needed to carry out the project or program (for further explanation, see 2 CFR 200.331). iii. A subaward may be provided through any legal agreement, including an agreement that you or a subrecipient considers a contract. 5. Subrecipient means a non-Federal entity or Federal agency that: i. Receives a subaward from you (the recipient) under this award; and ii. Is accountable to you for the use of the Federal funds provided by the subaward. Risk Assessment The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, ?Identification of Risks,? Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Effect Federal regulations address actions that the U.S. Department of Health and Human Services (HHS) may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 45 CFR 75.207(b), ?Specific award conditions,? these actions may include ? requiring reimbursement instead of advance payments; ? not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; ? requiring additional, more detailed financial reports or additional project monitoring; ? requiring the agency to obtain technical or management assistance; or ? establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 45 CFR 75.371, ?Remedies for noncompliance,? outlines additional actions HHS may take. Depending on the circumstances, these actions may include ? temporarily withholding payments until the noncompliance has been corrected, ? denying the use of funds, ? partly or fully suspending or terminating the federal award, ? initiating suspension or debarment proceedings, ? withholding further awards for the project or program, or ? pursuing other available legal remedies. Additionally, without establishing and implementing effective reporting controls over FFATA, the risk increases that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Recommendation The Executive Director of the Tennessee Commission on Aging and Disability should ensure that appropriate staff members understand their responsibilities for FFATA reporting requirements and develop policies and procedures to ensure fiscal staff report applicable subawards in accordance with those reporting requirements. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment Management concurs that an improved process for the completion and submission of FFATA reporting is needed. Management acknowledges that the FFATA reporting was not completed for the year ended June 30, 2022. Management will continue working with the Comptroller?s office to put mechanisms in place to ensure the timely completion of these reports moving forward. TCAD also will work with Centralized Accounting to clarify the March 27, 2014 Centralized Accounting Departmental Agreement, or enter into a new agreement, to clarify the allocation of responsibilities for appropriate and timely financial accounting and reporting.

Finding Number 2022-016 Assistance Listing Number 84.063 and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency East Tennessee State University Federal Award Identification Number P063P212226 and P268K222226 Federal Award Year 2020 through 2022 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Eligibility Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.063 Federal Award Identification Number P063P212226 Amount $8,844 Questioned Costs Assistance Listing Number 84.268 Federal Award Identification Number P268K222226 Amount $68,485 Finding The ETSU Office of Financial Aid and Scholarships did not adequately monitor the eligibility of Title IV financial aid recipients Condition and Cause East Tennessee State University?s Office of Financial Aid and Scholarships did not adequately monitor the eligibility of Title IV financial aid recipients. We reviewed the entire population of students enrolled at ETSU who received Title IV student financial assistance during the 2021-2022 award year. The population we reviewed also included students in the university?s Colleges of Medicine and Pharmacy. A total of 8,036 students were tested (7,593 enrolled at ETSU, 222 enrolled at the College of Medicine, and 221 enrolled at the College of Pharmacy). Of the 7,593 students at ETSU, 13 students (0.17%) received excess financial aid based on their eligibility, resulting in overpayments totaling $77,329. We did not identify errors for the College of Medicine or the College of Pharmacy. ? One student was awarded and received $2,993 in federal Pell Grants for the fall 2021 semester, but the student dropped from full-time enrollment to less than half-time prior to the census date. The award was not revised, resulting in a Pell overpayment of $2,181. ? Four students were enrolled in ineligible programs and still received Title IV funding. The students had completed 60 hours in an eligible non-degree-seeking program and needed to transfer to a degree-seeking or other eligible program. This resulted in overpayments to these students of $523 in Pell Grants, $5,442 in Subsidized Direct Loans, and $9,650 in Unsubsidized Direct Loans during the fall 2021 semester. Management stated that student advisors failed to follow policy and have the student declare and update their major. ? One student was awarded Subsidized Direct Loans based on limits in place for a second-year student even though the student was a first-year freshman, resulting in a $989 overpayment in the fall 2021 semester and a $989 overpayment in the spring 2022 semester. Management stated this student was incorrectly entered as a sophomore student in the Banner system. ? Five students were awarded and paid funds from Title IV programs even though they did not have an acceptable academic status. This resulted in an overpayment of $3,704 in Pell Grants, $1,732 in Subsidized Direct Loans, and $17,926 in Unsubsidized Direct Loans during the fall 2021 semester, along with overpayments of $2,436 of Pell Grants and $4,000 in Subsidized Direct Loans in the summer 2022 semester. The students had not maintained satisfactory academic progress; however, the aid was awarded prior to the status being entered into Banner. Financial aid staff should have revised the aid once the status was updated. ? Two students received Direct Loan funds even though they had already reached their Aggregate Loan Limit, causing them to be ineligible for Direct Loan funds. This resulted in $10,872 of Unsubsidized Direct Loans being overpaid during the fall 2021 semester, $10,142 of Unsubsidized Direct Loans being overpaid in the spring 2022 semester, and $6,743 of Direct Plus Loans being overpaid during the summer 2022 semester. These errors occurred because financial aid staff cleared the students to receive the aid in error. Criteria Title 34, Code of Federal Regulations, Part 668, Section 164(b)(3), states, ?At the time a disbursement is made to a student for a payment period, an institution must confirm that the student is eligible for the type and amount of Title IV, HEA program funds identified by that disbursement.? Effect Because Financial Aid staff did not properly monitor student eligibility and enter student information, ineligible students received federal financial aid payments. Pell grant overpayments of $8,844 and Direct Loan overpayments of $68,485 will be questioned. Recommendation East Tennessee State University should provide additional training to the Office of Financial Aid and Scholarships staff and student advisors to ensure that they properly confirm the eligibility of Title IV recipients prior to disbursement of Title IV funds. Controls should be in place to monitor enrollment changes, recipients? enrollment in eligible programs, adherence to annual and aggregate loan limits, and satisfactory academic progress. Management?s Comment We concur with the finding and recommendation. Management has implemented procedures to confirm student eligibility for financial aid. Additional training for Financial Aid and Scholarship Office staff has been initiated, and additional levels of review have been added to procedures moving forward. Management has met with the Executive Director of Academic Advising to schedule additional training for academic advisors regarding university policy relative to declaring a major. Additionally, a report has been created that identifies students that have earned more than 60 credits and have not declared a major. The report is being electronically delivered weekly to academic advisors for outreach and processing. The Director of Financial Aid and Scholarships and the Assistant Director of Financial Aid Operations also receive and review the report to ensure ineligible students do not receive financial aid.

Finding Number 2021-002 Assistance Listing Number 17.225, 97.034, and 97.050 Program Name Unemployment Insurance Disaster Unemployment Assistance Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs Federal Agency Department of Labor Department of Homeland Security State Agency Department of Labor and Workforce Development Federal Award Identification Number CARES Act, FEMA-4476-DR-TN, FEMA-4541-DR-TN, and 4514DRTNSPLW Federal Award Year 2020 and 2021 Finding Type Material Weakness (17.225 and 97.050) and Noncompliance Compliance Requirement Eligibility Repeat Finding 2020-021 and 2020-022 Pass-Through Entity N/A Questioned Costs $2,021,331 Questioned Costs Assistance Listing Number 17.225 Federal Award Identification Number CARES Act Description Extended Benefits, Pandemic Unemployment Assistance, Pandemic Emergency Unemployment Assistance, Federal Pandemic Unemployment Compensation, and Mixed Earner Unemployment Compensation Amount $1,782,074 Questioned Costs Assistance Listing Number 97.034 Federal Award Identification Number FEMA-4541-DR-TN FEMA-4476-DR-TN Description Disaster Unemployment Assistance Amount $182,257 Questioned Costs Assistance Listing Number 97.050 Federal Award Identification Number 4514DRTNSPLW Description Lost Wages Assistance Amount $57,000 As noted in the prior-year audit, the Department of Labor and Workforce Development did not properly pay Unemployment Insurance benefits due to ineffective internal controls and information processing errors Background The Unemployment Insurance program is a federal-state partnership designed to ensure the economic security of workers who lose their jobs through no fault of their own. The U.S. Department of Labor provides grant funding for each state to design and administer its own Unemployment Insurance program within federal requirements. In Tennessee, the Department of Labor and Workforce Development (the department) operates the state?s Unemployment Insurance program to process claims and issue direct benefit payments to individuals during times of involuntary unemployment. Unemployment Insurance Subprograms The Unemployment Insurance program comprises various subprograms targeted to specific classes of unemployed workers. Regular Programs Regular programs are permanent programs providing Unemployment Insurance coverage to Tennessee wage and salary workers, including federal employees stationed in Tennessee and servicemembers separating from the military. There are currently three regular programs: Tennessee Unemployment Compensation (Tennessee) is the standard Unemployment Insurance program, covering most Tennessee wage and salary workers. Employers pay quarterly state unemployment taxes into a trust fund from which the department distributes benefits to eligible claimants. Each employer?s unemployment tax rate is based in part on benefits collected by former employees. Unemployment Compensation for Ex-Servicemembers (Ex-Service) provides Unemployment Insurance benefits to individuals transitioning from military service to the civilian labor force. Military branches do not pay unemployment taxes; instead, they reimburse the department dollar-for-dollar for all benefits paid. Unemployment Compensation for Ex-Federal Employees (Ex-Federal) is the Unemployment Insurance program for federal government workers who lose their employment through no fault of their own. Federal agencies do not pay unemployment taxes; instead, they reimburse the department dollar-for-dollar for all Ex-Federal benefits paid. Temporary Programs Temporary programs are time-limited programs the department activates in response to a major disaster or during periods of high unemployment. Prior to March 2020, there were two temporary programs the department could activate: Disaster Unemployment Assistance (Disaster) provides temporary benefits to individuals whose employment or self-employment has been lost or interrupted as a direct result of a Presidentially declared major disaster, and who are not eligible for regular Unemployment Insurance. In fiscal year 2021, the department offered benefits for three major disasters: the Middle Tennessee tornado, Southeast Tennessee tornadoes, and Middle Tennessee severe storms and flooding. These benefits are federally funded. Federal-State Extended Benefits (Extended) is a temporary program activated during periods of high and rising state unemployment rates. When active, the program allows workers who have exhausted their entitlement to regular unemployment to claim up to 13 additional weeks of benefits. Ordinarily, costs are shared equally between the state and federal governments; however, federal law provided for temporary full federal funding of benefits for March 18, 2020, through September 11, 2021. Pandemic Programs Pandemic programs are temporary programs the federal government created and the department implemented in response to the COVID-19 pandemic. The federal government reimburses the department for 100% of benefits it pays to pandemic program claimants. Pandemic Unemployment Assistance (Pandemic) is modeled on the Disaster program. It provided temporary benefits to workers who had exhausted, or were ineligible for, regular Unemployment Insurance (such as part-time workers, the self-employed, and contractors) who lost work for certain COVID-19 related reasons. Pandemic Emergency Unemployment Compensation (Pandemic Extension) provided a maximum of 53 additional weeks of benefits to individuals who had exhausted their rights to regular Unemployment Insurance. Federal Pandemic Unemployment Compensation (Pandemic Supplement) provided a supplemental weekly payment to individuals who received at least $1 in benefits from another Unemployment Insurance subprogram. The weekly supplement was $600 (in addition to the claimant?s other benefits) for weeks of unemployment ending April 4, 2020, through July 25, 2020, and $300 for weeks of unemployment ending January 2, 2021, through July 3, 2021. Lost Wages Assistance (Lost Wages) provided a supplemental weekly payment of $300 to individuals who received at least $100 in benefits from another Unemployment Insurance program for weeks of unemployment from August 7, 2020, through September 5, 2020. Mixed Earner Unemployment Compensation (Mixed Earner) provided a supplemental weekly payment of $100 to individuals receiving benefits other than Pandemic, whose prior earnings included both wages from traditional employment and at least $5,000 from self-employment. The department paid the Mixed Earner supplement to eligible claimants for weeks of unemployment ending from January 2, 2021, through March 14, 2021. Under federal law, the Pandemic, Pandemic Extension, Pandemic Supplement, and Mixed Earner programs expired on September 6, 2021. Governor Bill Lee opted to withdraw Tennessee?s participation in these programs early, effective July 3, 2021. Table 1 provides an overview of all Unemployment Insurance subprograms the department administered in fiscal year 2021. The overview includes the name of the program, the intended target population to benefit from the program, when the program was active and available to beneficiaries, as well as the weekly benefit amount and the number of weeks individuals could receive these benefits. See Schedule of Findings and Questioned Costs for chart/table. General Eligibility Criteria and Determination Processes for Unemployment Claims The department uses the GUS (Geographic Solutions Unemployment System) application to process eligibility determinations for unemployment claims. Claimants submit an initial application for unemployment benefits in the system via the jobs4tn.gov website, which interfaces directly with GUS. GUS initiates various automated processes to help the department determine the claimants? eligibility for benefits. If these processes yield information that could potentially disqualify a claimant?s eligibility, GUS flags the claim with an issue and attaches a work item. The work item triggers department personnel to manually review and resolve the issue on the claim. Management has configured business rules in GUS to prevent claims with significant issues from paying benefits until department personnel have reviewed the claims to determine the claimants? eligibility. The department?s major eligibility determination processes are as follows: Identity Verification The department uses two identity verification mechanisms on every new claim filed to deter individuals from filing fraudulent claims using stolen personally identifiable information. LexisNexis identity verification software, integrated into GUS, presents the claimant with multiple-choice questions pertaining to the claimant?s identity. GUS interfaces with the Social Security Administration?s databases to verify the accuracy of key personal information from the claimant?s application. If either method cannot authenticate a claimant?s identity, GUS flags the claim with an issue to prevent payment and generates a letter instructing the claimant to submit two forms of identification within seven days. GUS routes a work item to a Program Specialist as a prompt to check whether the claimant has submitted acceptable documentation and to resolve the issue or disqualify the claim as appropriate. Immigration Verification The department?s application for unemployment benefits collects citizenship information from all claimants. When a claimant identifies as a non-citizen, GUS flags the claim with an issue to prevent payment and generates a letter instructing the claimant to submit proof of lawful immigration and work authorization status within 10 days. GUS also interfaces with the U.S. Citizenship and Immigration Services? databases to verify the claimant?s immigration status. GUS routes a work item to a Program Specialist to determine whether the claimant has submitted acceptable proof, to review information GUS retrieved from U.S. Citizenship and Immigration Services, and to resolve the issue or disqualify the claim as appropriate. Business rules are instructions programmed into GUS directing the system how to process claims in accordance with state and federal eligibility requirements. Monetary Eligibility The department determines a claimant?s monetary eligibility for benefits and weekly benefit amount based on sufficient earnings from four quarters of recent employment (?base period?). The claimant provides base period employment and earnings history when applying for benefits; the department uses various sources to verify this information (see Table 2). See Schedule of Findings and Questioned Costs for chart/table. GUS generates a monetary determination letter to the claimant, listing the claimant?s earnings from all base period employers and the weekly benefit amount the claimant may be entitled to receive if the claimant meets all other eligibility criteria. The letter instructs the claimant how to report additional employers or wages to the department if the monetary determination appears incomplete or inaccurate. Non-monetary Eligibility Non-monetary eligibility requires the department to establish that a claimant has lost their most recent employment due to no fault of their own. In general, a claimant meets this requirement in one of three ways: lack of work ? the employer laid off the employee or reduced the employee?s working hours, quit ? the employee quit with good cause, or discharge ? the employer terminated the employee because of performance issues other than gross misconduct. Department adjudicators determine whether a claimant quit for good cause on a case-by-case basis. In general, good cause exists if the claimant quit for reasons attributable to the employer (for example, workplace harassment or significant and adverse changes to conditions of employment). The department also accepts resigning to follow a spouse subject to military transfer orders as quitting with good cause. Personal reasons (such as lack of childcare or to return to school) do not meet the good cause standard. Claimants select the reason for their unemployment on the initial application for benefits. GUS generates a request letter to the claimant?s separating employer notifying the employer of the claim and the reason the claimant gave for unemployment. The employer has seven days to respond to the letter to dispute the claim. GUS creates an issue and related work item on all claims based on a claimant?s quitting or discharge from employment (even if the employer does not dispute the claim), and on all claims where the employer disputed the claimant?s separation reason. The work item prompts a department adjudicator to evaluate the facts provided by both claimant and employer, gather additional information if necessary, and determine whether the claimant?s separation qualifies for unemployment benefits under the applicable state or federal law. The department?s non-monetary eligibility determination processes differ for Disaster and Pandemic claims. GUS automatically flags Disaster claims for manual review and approval because claimants must provide documentation to support their eligibility for Disaster benefits. Until December 27, 2020, GUS did not routinely flag Pandemic claims for manual review because federal guidance instructed the department to accept a claimant?s self-certification that employment was impacted for a qualifying COVID-19 reason as evidence of eligibility. The federal guidance specifically prohibited the department from requesting supporting documentation from Pandemic claimants except to address a reasonable suspicion of fraud. After department personnel have resolved all issues requiring manual review on a claim, GUS issues a decision letter to the claimant and base period employers explaining the department?s basis for the decision and the parties? right to appeal within 15 days. Claimants have the right to appeal if the department denies their claim for benefits. Likewise, employers may appeal approved claims to protect their state unemployment tax rate from future increases. Weekly Certifications After filing an initial claim for benefits, claimants must file weekly certifications via jobs4tn.gov to attest to their continued ability to work and availability for work; disclose income earned during the week; and report on work search activities. GUS automatically disqualifies the week as ineligible for payments if a claimant certifies no longer being unemployed, earning excess income, or not actively searching for and available to accept suitable work. Overpayments The department?s eligibility determination processes serve as internal controls to prevent ineligible claimants from receiving unemployment benefits. The nature of the Unemployment Insurance program, however, is such that the department does not always have timely access to accurate information necessary to determine a claimant?s eligibility for benefits. For example, the department must rely on claimants to accurately self-report earnings from temporary and part-time employment during the weekly certification process. The department does not receive corroborating data to validate a claimant?s self-reported earnings until the department receives wage reports from employers at the end of each quarter. Therefore, management has established detective controls in the department?s Benefit Payment Control unit to identify and investigate potentially improper payments. These controls include cross-matches to compare the department?s claims data with information from external sources, such as state vital statistics records, to identify payments issued after a claimant?s date of death; state inmate records, to identify payments issued to incarcerated individuals; state payroll records, to identify payments to active state employees; quarterly employer wage reports, to verify claimants? self-reported weekly earnings; and state and national directories of new hires, to identify claimants who continued claiming benefits after returning to work. Upon determining that a claimant has received benefits to which the claimant is not entitled, whether due to fraud or error, a Benefit Payment Control auditor establishes an overpayment on the claimant?s file. The department?s UI Recovery unit is responsible for recouping overpayments and uses a variety of escalating techniques to achieve this purpose from establishing repayment plans with claimants to intercepting claimants? federal tax refunds. Furthermore, when a claimant with an outstanding overpayment debt qualifies for benefits on a new claim, federal and state law requires the department to apply new benefit payments toward the outstanding overpayment. Prior Audit Results Our prior audit reported two findings related to Unemployment Insurance eligibility, which stated the department did not issue written eligibility determinations on Tennessee, Ex-Service, Ex-Federal, Disaster, and Pandemic claims to all interested parties; did not identify Tennessee claims with disagreeing employer responses; improperly issued Disaster benefits to claimants who did not meet Disaster eligibility criteria because they were not unemployed as a direct result of a major disaster, or because they were already eligible for Tennessee benefits; accepted Disaster claims filed late; did not collect documentation to substantiate Disaster claimants? past employment or earnings; and did not issue Pandemic claimants the correct weekly benefit amount. Management concurred with the prior findings and attributed the conditions to the impact of the COVID-19 pandemic and system issues. Based on the results of our audit work for fiscal year 2021, we determined the department resolved the prior finding condition relating to written eligibility determinations. As described below, the remaining conditions from the prior year are repeated for fiscal year 2021; in addition, we identified new instances of noncompliance with federal and state eligibility requirements. Current Audit Results We provide the results of our current audit below. As a result of our review, we identified $1,929,148 in total questioned costs for the Unemployment Insurance, Disaster Unemployment Assistance, and Lost Wages Assistance programs. We provide the total questioned costs by eligibility area, program, and federal Assistance Listing Number in Table 11 and Table 12 on pages 44 and 45. Except where otherwise noted, our sampling unit for testwork purposes was a payment for one week of unemployment. When our testwork on payments disclosed noncompliance with eligibility requirements that affected other payments in a claim series, we questioned costs associated with those payments too. Conditions and Criteria Identity Verification Federal law requires all claimants to provide a Social Security Number as a condition of eligibility for unemployment benefits. Pursuant to federal guidance in Unemployment Insurance Program Letter 16-21, ?a state must have a system to reasonably ensure that the name and Social Security Number used to establish eligibility for unemployment compensation belong to the individual filing the claim.? The department issued Pandemic benefits to claimants who failed identity verifications for Tennessee benefits During our audit period, department management discovered that claimants who failed to pass the LexisNexis identity verification on a claim for Tennessee benefits could file a subsequent claim for Pandemic benefits and receive payments without first verifying their identity with the department. Based on review of communications between the department and the GUS vendor, the Director of UI Integrity discovered this issue in September 2020 and requested a system change to carry over unresolved identity verification issues from Tennessee claims to subsequent Pandemic claims. He also requested that the vendor retroactively apply this change to 43,133 Pandemic claims that had not started paying yet. The vendor completed final implementation of this change on October 26, 2020. In November 2020 and March 2021, however, the Director of UI Integrity identified Pandemic claims still affected by this problem, which the vendor attributed to the coding change not capturing incomplete claims. The vendor retroactively corrected an additional 258 claims. Initial federal guidance for the Pandemic program instructed states to rely on claimants? self-certifications of eligibility for Pandemic benefits but to perform monitoring activities for Pandemic claims for suspicious activity and request supporting documentation to address indicators of fraud. Without identity verification failures carrying over to Pandemic claims, the department lacked an effective internal control to detect and prevent payment on fraudulent claims. The department paid approximately $381 million in Pandemic benefits on over 152,000 claims before the vendor implemented corrective coding changes in October 2020. Management lacked the manpower to feasibly determine which of those active claims had prior identity verification issues and suspend future payment on those claims pending confirmation of the claimant?s identity. As a result, neither we nor management had sufficient information to calculate questioned costs associated with Pandemic identity theft. Department personnel did not verify claimant identities prior to payment resulting in questioned costs We performed testwork on a sample of GUS work items for failed LexisNexis identity verifications and a sample of GUS work items for failed Social Security Administration identity verifications to determine whether department personnel reviewed proof of identity documentation prior to issuing payment on the claim. Based on our testwork, we found GUS released payment on claims with failed identity verification issues without prior review and approval by department personnel. We provide the details of our testwork, including the results of our review, in Table 3. See Schedule of Findings and Questioned Costs for chart/table. Because our review focused on management?s control activities related to work items processed by staff and information systems and not on claimant payment amounts, we did not question costs related to identity verification from our LexisNexis and Social Security Administration testwork. We also tested samples of Tennessee, Ex-Service and Ex-Federal, Pandemic, and Disaster weekly benefit payments for compliance with subprogram eligibility requirements. This testwork identified payments to claimants who had failed LexisNexis or Social Security Administration identity verification but department personnel did not review documentation to manually verify these claimants? identities prior to payment. See Table 4 for the results of our testwork. See Schedule of Findings and Questioned Costs for chart/table. Immigration Verification State and federal law prohibits payment of unemployment benefits to non-citizens who are not lawfully permitted to work in the United States. The department collects citizenship information from all claimants via the initial application for benefits. In accordance with federal guidance issued in Unemployment Insurance Program Letter 12-03, GUS interfaces with the U.S. Citizenship and Immigration Services databases to verify the lawful immigration status of non-citizen claimants. Department personnel did not verify claimant immigration status prior to payment From the population of 12,706 immigration work items generated in fiscal year 2021, we tested a random nonstatistical sample of 60 work items to determine whether department personnel reviewed documentation to verify the lawful immigration status of non-citizen claimants prior to approving the claim for payment. Based on our testwork, the department issued payments on claims with unverified immigration status for 3 of 60 (5%) work items. This occurred when department personnel approved a claim for payment even though the claimant did not provide proof of lawful immigration status or when GUS did not function as expected and automatically approved claims for payment despite the presence of unresolved immigration issues. Because our review focused on control activities related to management?s process to handle work items processed by staff and information systems and not on claimant payment amounts, we did not question costs related to immigration verification testwork. The department issued DUA benefits to 123 claimants in fiscal year 2021. Because of the program?s small size, we determined we had obtained sufficient appropriate audit evidence to support our conclusions after testing 41 claimants instead of 60 as we did with other subprograms. Monetary Eligibility To qualify for benefits, claimants must meet monetary eligibility criteria established in state and federal law, including work history and past earnings requirements. Monetary eligibility law also determines a claimant?s weekly benefit amount. Our audit work disclosed conditions relating to noncompliance with monetary eligibility requirements in all unemployment subprograms. Claimants received incorrect weekly benefit amounts from the Tennessee, Extended, and Pandemic Extension programs Eligible Tennessee, Ex-Federal and Ex-Service, Extended, and Pandemic Extension claimants received a weekly benefit amount ranging from $30 to $275, based on average wages of at least $780.01 from the claimant?s two base period quarters with the highest total earnings. Section 50-7-301(b), Tennessee Code Annotated, provides a schedule of average high quarter earnings ranges and the corresponding weekly benefit amount for Tennessee claimants. In accordance with federal law, the department applies the formula in state law to determine weekly benefit amounts for eligible Ex-Federal and Ex-Service, Extended, and Pandemic Extension claimants. Match: Our weekly benefit amount recalculation matched the department?s calculation. The payments in this group appeared to meet monetary eligibility requirements. Risk Level Low Different Weekly Benefit Amount: Our weekly benefit amount recalculation differed from the department?s calculation. Risk Level High Insufficient Base Period Wages: We could not recalculate a weekly benefit amount because the claimant did not appear to have at least of two quarters of base period wages on record.Risk Level High See Table 5 for the results of our data analytics-based risk assessment of payments for monetary eligibility compliance. See Schedule of Findings and Questioned Costs for chart/table. The items in the Match group appeared to meet monetary eligibility requirements, so we identified these items as low risk and performed no further audit work on these results. From the high-risk groups, Different Weekly Benefit Amount and Insufficient Base Period Wages, we selected random nonstatistical samples of Tennessee, Ex-Federal and Ex-Service, Extended, and Pandemic Extension payments for testwork. We reviewed documentation in GUS for each payment to explain differences between the department?s weekly benefit amount determination and our recalculated amount. Our testwork in the Different Weekly Benefit Amount group for Extended and Pandemic Extension payments disclosed inaccurate weekly benefit amount determinations, resulting in claimants receiving overpayment and underpayment of benefits, with total questioned costs of $37,813. Our testwork in this group for Tennessee, Ex-Federal, and Ex-Service payments resulted in no errors. Instead, we found allowable adjustments, corrections, and reductions in benefits due to declared earnings explained the differences between the department?s weekly benefit amount determination and our recalculation. Based on our testwork in the Insufficient Base Period Wages group, we identified Tennessee and Extended payments to claimants who did not meet monetary eligibility criteria for those subprograms, resulting in total questioned costs of $15,101. Our testwork in this category for Ex-Federal, Ex-Service, and Pandemic Extension payments resulted in no errors. Instead, we found additional support in GUS to substantiate claimants? monetary eligibility for those benefits. See Table 6 for the results of Different Weekly Benefit Amount and Insufficient Base Period Wages testwork. See Schedule of Findings and Questioned Costs for chart/table. Claimants received Disaster and Pandemic benefits without providing evidence of past employment, and the department did not adjust weekly benefit amounts to reflect claimants? past earnings, resulting in questioned costs. Federal law directs states to calculate weekly benefit amounts for Disaster and Pandemic claimants based on the same formula as the state?s regular unemployment program. Furthermore, federal law stipulates that eligible Disaster and Pandemic claimants are entitled to a minimum weekly benefit amount equal to 50% of the state?s average weekly benefit amount?regardless of prior earnings history. The U.S. Department of Labor determines 50% of each state?s average weekly benefit amount quarterly. In Tennessee, minimum weekly benefit amounts were $120 for Pandemic claimants and for Disaster claimants affected by the March 2020 tornado in Middle Tennessee, $121 for Disaster claimants affected by the April 2020 tornadoes in Southeast Tennessee, and $109 for Disaster claimants affected by the March 2021 storms in Middle Tennessee.

Finding Number 2021-003 Assistance Listing Number 17.258, 17.259, and 17.278 Program Name WIOA Cluster Federal Agency Department of Labor State Agency Department of Labor and Workforce Development Federal Award Identification Number AA-30740-17-55-A-47, AA-32192-18-55-A-47, AA-33257-19-55-A-47, AA-34796-20-55-A-47, AA-36347-21-55-A-47 Federal Award Year 2018 through 2021 Finding Type Material Weakness and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A Workforce Services Division management did not perform required programmatic subrecipient monitoring, did not ensure staff followed policies and procedures for programmatic subrecipient monitoring, and did not review subrecipients? Single Audits Background The Workforce Innovation and Opportunity Act (WIOA) cluster of federal programs helps participants overcome barriers to obtaining employment by providing education, training, job search, and other support services. The WIOA cluster consists of three core programs: Adult, Dislocated Worker, and Youth. The U.S. Department of Labor (USDOL) awards funding for these programs through formula grants to states. In Tennessee, the Workforce Services Division (WSD) within the Tennessee Department of Labor and Workforce Development administers WIOA programs. American Job Centers The WIOA cluster of programs provides employment services to individuals through a network of American Job Centers (AJCs). Individuals may visit an AJC to determine whether they are eligible to receive services and, if so, obtain free employment assistance. The WSD awards grants to nine subrecipients, known as Local Workforce Development Boards (LWDBs), to oversee the AJCs in their Local Workforce Development Area. Each LWDB serves multiple counties; contracts with a One-Stop Operator (OSO) to manage the operations of the AJCs; and appoints a Fiscal Agent who is responsible for the accounting and finances for the AJCs. The Workforce Investment Act of 1998 established One-Stop centers which were physical locations where individuals may visit and determine if they are eligible for employment assistance from a variety of federal programs. When WIOA repealed and replaced the Workforce Investment Act, it changed the name of One-Stop centers to American Job Centers. During the COVID-19 Pandemic, certain AJCs were closed or offered virtual services online. According to CFR 679.300, the Local Workforce Development Board ?is to serve as a strategic leader and convener of local workforce development system stakeholders.? For fiscal year 2021, LWD expenditures for the WIOA Cluster totaled $49,705,534. The expenditures for each program are outlined in Table 1. See Schedule of Findings and Questioned Costs for chart/table. Condition, Criteria, and Cause WSD Staff Did Not Perform Programmatic Monitoring WSD had a Monitoring Guide for program year 2020?2021 which addresses the responsibility for and frequency of monitoring. According to the Monitoring Guide: WSD staff must perform quarterly desktop programmatic reviews, and WSD staff must perform annual on-site programmatic reviews. According to the Workforce Services Director, WSD staff follow the USDOL Employment and Training Administration (ETA) Core Monitoring Guide to conduct programmatic monitoring reviews. The ETA Core Monitoring Guide includes comprehensive monitoring activities designed to ?evaluate the management and administration of the grant, the quality of the program and/or services, and the performance of the grant to determine if the program is operating in compliance with the grant agreement and in a manner that ensures achievement of its goals and outcomes.? The guide also includes checklists and forms to document the monitoring activities. Based our discussions with management and our review of available documents we found the following: WSD staff did not conduct any programmatic monitoring of subrecipients for the Adult and Youth programs, which made up 61% of the WIOA Cluster expenditures. WSD did not conduct on-site programmatic monitoring of subrecipients for the Adult, Youth, or Dislocated Worker programs. WSD staff conducted desktop programmatic monitoring reviews of subrecipients for the Dislocated Worker program in quarter 3; however, staff are required to conduct monitoring in all four quarters. When WSD staff conducted the 3rd quarter Dislocated Worker programmatic monitoring reviews, they did not follow the ETA Core Monitoring Guide. Title 29, United States Code, Chapter 32, Section 3244(a)(4), ?Monitoring,? states, ?Each Governor of a State shall conduct on an annual basis onsite monitoring of each local area [LWDAs] within the State to ensure compliance with uniform administrative requirements?? Pursuant to the Office of Management and Budget?s Uniform Grant Guidance and Title 2, Code of Federal Regulations (CFR), Part 200, Section 332, ?Requirements for Pass Through Entities,? LWD is required to monitor the LWDAs? activities ?as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved.? Additionally, ?Administrative Provisions under Title I of the Workforce Innovation and Opportunity Act,? Title 20, Code of Federal Regulations, Part 683, Section 410(b), states that the Governor is responsible for developing the State monitoring system, which must provide for annual on-site monitoring local areas? [LWDAs] compliance with the Office of Management and Budget?s Uniform Grant Guidance; ensure that established policies to achieve program performance and outcomes meet the objectives of WIOA and WIOA regulations; help the Governor determine whether subrecipients and contractors have demonstrated substantial compliance with WIOA requirements; help the Governor determine whether to disapprove a local plan for failure to make acceptable progress in addressing deficiencies; and ensure compliance with the nondiscrimination, disability, and equal opportunity requirements as established in WIOA regulations. According to the Director of Program Integrity, the department met the annual onsite requirement through the PAR Unit annual onsite fiscal reviews. The Director also stated that the department monitors subrecipients through data validation to ensure information in their Virtual One-stop (VOS) case management system matches relevant supporting documentation. Based on our review, however, these activities did not meet the requirements established in the Monitoring Guide or ETA Core Monitoring Guide. Subrecipient Single Audit Requirements Although LWDAs submitted their Single Audit reports to WSD, WSD management did not review the reports to ensure that the LWDAs took action on any of the findings noted. We reviewed the 9 LWDA Single Audit reports issued during the fiscal year ended June 30, 2021, and found that one audit report that contained a Single Audit finding concerning an accounting error. Because there was no one assigned to review these reports, management did not require or consider the LWDA?s corrective action or issue a management decision letter for the finding noted. Based on discussions with management, the employee who previously reviewed the single audit reports left the agency, and the responsibility to review single audit reports was not reassigned during the unit reorganization. Pursuant to the OMB?s Uniform Grant Guidance and ?Audit Requirements,? Title 2, Code of Federal Regulations (CFR), Part 200, Section 501, Audit required. A non-federal entity [LWDAs] that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. An independent audit is an examination of financial records, accounts, business transactions, accounting practices, and internal controls conducted by a third party, such as a CPA firm. Furthermore, as the pass-through entity, LWD is required by 2 CFR 200.332 to verify that all subrecipients that spend $750,000 or more obtain a Single Audit within 9 months after the subrecipient?s fiscal year-end. As part of that Single Audit, if a subrecipient receives an audit finding, the department must issue a management decision within six months of the audit report?s release, indicate if the department agreed with the finding, and describe any corrective action the subrecipient must take. LWDAs submit their Single Audit reports annually to the WSD?s Program Integrity Unit for the division?s review and to obtain LWD?s management decision when there are findings. Risk Assessment Based on our review of the LWD 2020 Financial Integrity Act risk assessment, management identified risks and controls related to subrecipient monitoring for fiscal-related activities in their risk assessment but did not identify and address the risk of inadequate subrecipient monitoring for programmatic activities, and as such did not design and implement effective controls governing the required programmatic monitoring activities. Additionally, management did not identify and address the risk of not reviewing subrecipient single audit findings, not obtaining a corrective action plan, and not issuing a management decision letter. Effect When department staff do not perform sufficient subrecipient programmatic monitoring, management cannot ensure subrecipients? have reasonably complied with federal statutes, regulations, and terms and conditions of the grant award; nor can management ensure that subaward performance goals were achieved. In addition, when management does ensure staff follow written procedures for programmatic monitoring, the risk that management and staff will not prevent or detect unallowable program activities increases. When LWD management does not review LWDAs? single audit results, including single audit findings, it increases the risk that management may be unaware of deficiencies identified by the auditors and may not ensure that subrecipient management takes action and responds to noncompliance or areas for improvement identified in Single Audits Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include requiring reimbursement instead of advance payments; not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; requiring additional, more detailed financial reports or additional project monitoring; requiring the agency to obtain technical or management assistance; or establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include temporarily withholding payments until the noncompliance has been corrected, denying the use of funds, partly or fully suspending or terminating the federal award, suspending or debarring the agency, withholding further awards for the project or program, or pursuing other available legal remedies. Recommendation Workforce Services Division management should ensure staff are aware of their monitoring responsibilities and perform sufficient monitoring to identify areas of noncompliance. The Assistant Commissioner should ensure that WSD staff conduct monitoring in accordance with federal and state guidelines, including carrying out on-site monitoring and desktop reviews. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. The Department of Labor and Workforce Development will revise the current program monitoring guide and update the current risk assessment by May 2022 to demonstrate how we will mitigate this risk moving forward. This revision will include additional internal controls and programmatic monitoring instruments for subrecipient monitoring. This process will be documented through revised standard operating procedures which clearly define roles, responsibilities, and frequency of programmatic subrecipient monitoring and review of subrecipients? Single Audits by department staff.

Finding Number 2021-004 Assistance Listing Number 17.225 Program Name Unemployment Insurance Federal Agency Department of Labor State Agency Department of Labor and Workforce Development Federal Award Identification Number UI-34086-20-55-A-47 and UI-35676-21-55-A-47 Federal Award Year 2020 and 2021 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Period of Performance Repeat Finding N/A Pass-Through Entity N/A Questioned Costs Assistance Listing Number 17.225 Federal Award Identification Number UI-35676-21-55-A-47 Amount $199,345.84 The Department of Labor and Workforce Development obligated federal Unemployment Insurance grant funds before the beginning of the period of performance Background The Unemployment Insurance program is a federal-state partnership designed to ensure the economic security of workers who lose their jobs through no fault of their own. The U.S. Department of Labor is responsible for allocating annual administrative grant funds to states, establishing overall program policies, and monitoring state performance and conformity with federal requirements. In Tennessee, the Department of Labor and Workforce Development (department) is responsible for administering the state?s Unemployment Insurance program. The department uses its federal grant funding for administrative costs such as staffing, equipment, and other expenditures necessary to carry out its program responsibilities, which include determining worker eligibility for benefits and collecting quarterly unemployment taxes from Tennessee employers. The department signs an annual funding agreement with the U.S. Department of Labor before the start of each federal fiscal year. The agreement sets forth a grant expenditure period, identifying the obligation beginning and ending dates during which time the department may obligate (commit to spend) the federal funds and the liquidation date by which the department must liquidate (spend) the federal funds. The agreement also provides an extended grant expenditure period for funds the department specifically uses on information technology projects to automate program operations. The minimum expenditure period on each annual Unemployment Insurance grant is 15 months; therefore, the department had two active grants in fiscal year 2021. See Table 1 for the grant expenditure periods for the department?s grant funding for federal fiscal years 2020 and 2021. See Schedule of Findings and Questioned Costs for chart/table. Condition and Cause We obtained the population of the department?s Unemployment Insurance administrative expenditures for fiscal year 2021 totaling $121,267,912. We compared the dates as documented in the accounting records to the obligation (beginning and ending) and liquidation dates established in the federal award. We inquired with management and reviewed supporting documentation for transactions that, based on our analysis, the department obligated outside the period allowed by the annual funding agreement. We were able to resolve the questions we had regarding expenditures that appeared to occur after the period of performance ended; however, we found that the department charged expenditures totaling $199,355 to the 2020 and 2021 Unemployment Insurance grants that were incurred before each grant?s beginning date. See Table 2. See Schedule of Findings and Questioned Costs for chart/table. Based on discussion with the department?s Controller and review of documentation, the telecommunications and information technology resource expenditures related to centralized service costs. These are costs for shared business functions the state?s Department of Finance and Administration (F&A) incurs and allocates amongst departments that use the centralized services. The state?s Department of Finance and Administration (F&A) bills the department for these costs one month in arrears, and personnel in F&A?s Division of Accounts record the related journal entries; however, Department of Labor and Workforce Development fiscal management did not have an effective internal control in place to ensure staff obligated and liquidated the expenditures within the period of performance and did not have a process in place to identify and correct errors that occurred. Regarding filing fees, due to delays between incurring filing fees and receiving invoices, department personnel inadvertently charged this expenditure to the incorrect grant. We found one small filing fee expenditure charged before the 2020 grant as well. Under the Executive Branch central accounting initiative, the Department of Labor and Workforce Development fiscal staff are employed by the Department of Finance and Administration. Risk Assessment We reviewed the department?s 2020 Financial Integrity Act Risk Assessment and determined that management listed the risk of charging supplier invoices from outside the period of performance to the federal grant. Management identified fiscal staff?s review of items charged to federal grant projects as an internal control to mitigate this risk, but this control was not in place for journal entries recorded by F&A Division of Accounts personnel. The control referenced in the risk assessment is in place for journal entries recorded by Department of Labor and Workforce Development fiscal personnel. Criteria The department?s annual funding agreement with USDOL for the 2021 grant states, UI Administration ? These funds are for States to administer the State UI, Unemployment Compensation of ex-service members (UCX) and Unemployment Compensation of Federal Employees (UCFE) programs and available for obligation by the Grantee (State) beginning October 1, 2020, and shall be available for obligation by the States through December 31, 2021, and unless an extension is otherwise approved, funds are to be expended/liquidated by March 31, 2022, except that funds used for automation shall be available for State obligation through September 30, 2023, . . . and unless an extension is otherwise approved, funds are to be expended/liquidated by December 31, 2023. Likewise, the department?s annual funding agreement for the 2020 grant establishes a basic obligation period beginning October 1, 2019, and ending December 31, 2020, with a liquidation deadline of March 31, 2021. Title 2, Code of Federal Regulations (CFR), Part 200.62, states, Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards: Transactions are properly recorded and accounted for, in order to: Permit the preparation of reliable financial statements and Federal reports; Maintain accountability over assets; and Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award; Transactions are executed in compliance with: Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and Any other Federal statutes and regulations that are identified in the Compliance Supplement; and Funds, property, and other assets are safeguarded against loss from unauthorized use or disposition. Furthermore, 2 CFR 200.71 states, When used in connection with a non-Federal entity?s utilization of funds under a Federal award, obligations means orders placed for property and services, contracts and subawards made, and similar transactions during a given period that require payment by the non-Federal entity during the same or a future period. According to the U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government, Principle 10.03, ?Management designs appropriate types of control activities for the entity?s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system.? Effect When fiscal management does not review expenditures to ensure the transactions occurred within the grant?s obligation and liquidation periods, management cannot ensure that expenditures are charged to the appropriate grant award. As a result, management increases the risk that funds will be expended outside of the period of performance. By not applying expenditures within the period of performance established in the grant award agreement, department management charged expenditures to the incorrect grant award, resulting in unallowable costs of $199,355. Additionally, under the OMB?s Uniform Grant Guidance, the federal awarding agency may pursue other remedies to address deficiencies and achieve state compliance, as outlined in 2 CFR 200. Recommendation Management should make correcting journal entries to apply the expenditures identified in this finding to the correct grant. Management should establish internal controls to ensure that expenditures are only applied to grants for which the expenditure was obligated during the grant?s period of performance. Management should implement internal controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. A journal entry will be recorded by March 31, 2022, to correct the items noted by moving allowable costs from the FY21 grant to the appropriate FY20 or FY19 grant. Controls have been implemented to prevent reoccurrence. After a grant closes and during the closeout period, the accounting managers will review charges to ensure they are applied to the appropriate grant. This control activity will also be added to the internal control checklist and require sign off upon competition.

Finding Number 2021-005 Assistance Listing Number 17.225 Program Name Unemployment Insurance Federal Agency Department of Labor State Agency Department of Labor and Workforce Development Federal Award Identification Number UI-31319-18-55-A-47, UI32627Q10, UI340863I0, UI35676DO0, UI-31319-18-55-A-47, UI32627Q10, UI340863I0, and UI35676DO0 Federal Award Year 2018 through 2021 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A Department management lacked procedures to ensure the accuracy of the ETA 9050 and ETA 9052 reports, resulting in the overstatement of the ETA 9050 reports; and management was unable to provide supporting information for the ETA 9055 reports Background The Unemployment Insurance (UI) program is a federal-state partnership to ensure the economic security of workers who lose their jobs through no fault of their own. The U.S. Department of Labor provides grant funding for each state to design and administer its own Unemployment Insurance program in compliance with federal requirements. In Tennessee, the Department of Labor and Workforce Development (the department) operates the state?s Unemployment Insurance program to process claims and issue direct benefit payments to individuals during times of involuntary unemployment. The U.S. Department of Labor Office of Unemployment Insurance?s Employment and Training Administration (ETA) administers a performance management system, ?UI Performs,? to ensure states provide effective, consistent, and efficient services to workers and employers. As part of the performance management system, ETA requires states to submit performance reports on certain core measures. Each core measure encompasses key performance areas and allows ETA to monitor the effectiveness of the UI program in that state. The department?s core measures and the reports associated with those measures are provided in Table 1. The scope of our audit includes examining the performance reports to determine if they are accurate, based on review of supporting documentation and to determine if they were submitted timely. Compliance with federal performance measures is not in the scope of this audit. This is not a comprehensive list of all core measures or reports; we have only listed those core measures that are relevant to the reports included in the scope of this audit. See Schedule of Findings and Questioned Costs for chart/table. Report Review and Approval Process The department uses the Geographic Solutions Unemployment System (GUS) to administer the UI program and has a contract with Geographic Solutions, Inc (GSI), a third-party vendor, to maintain the system. Department staff use GUS to maintain and process the data to generate the ETA 9050, ETA 9052, and ETA 9055 reports. The Unemployment Program Specialist retrieves the applicable report from GUS and emails the reports to applicable staff, who review the reports for accuracy. ETA 9050 and ETA 9052 ? These reports go to the UI Integrity Division Director, who stated he reviews both reports for reasonableness based on his program knowledge. ETA 9055 (lower-level appeals information) ? This part of the report goes to the Administrative Services Assistant. The Administrative Services Assistant runs a daily report of outstanding appeals from GUS, and the Director of Appeals follows up with Administrative Law Judges about these appeals. The Administrative Services Assistant compiles these daily reports into an Excel spreadsheet and reconciles this spreadsheet with the ETA 9055 report to ensure accuracy. ETA 9055 (higher-level appeals information) ? This part of the report goes to the Senior Associate Counsel who compares the report with an Excel spreadsheet of active appeals, which she maintains and updates daily to determine accuracy. Each of these individuals emails the Unemployment Program Specialist to communicate their approvals regarding the accuracy or reasonableness of the reports. Once the Unemployment Program Specialist obtains the approved report, she submits the report to the U.S. Department of Labor. Condition, Criteria, and Cause Reasonableness Review of the ETA 9050 and ETA 9052 Reports To determine that the department submitted accurate federal reports, we discussed the report review process with the UI Integrity Division Director. We found that although he conducted reasonableness reviews of the reports, neither he nor the Unemployment Program Specialist evaluates the integrity of GUS supporting data before submission of the reports to USDOL. Based on our further discussions with the UI Program Integrity Director, he was unaware that the department should have additional procedures to evaluate the supporting data of the ETA 9050 and ETA 9052 report before submission. Historically, the department has had problems generating accurate federal reports from GUS because of various technical system issues impacting the integrity/accuracy of the underlying data supporting the reports. Given these system risks, management cannot ensure the accuracy of the reports without formal procedures to verify the sufficiency and accuracy of the supporting data. Both individuals involved in reviewing the ETA 9055 stated that the reason they implemented their review process is because GUS has not always provided accurate data; however, without more than a ?reasonableness? review, management cannot be sure they have submitted accurate federal reports. According to the Government Accountability Office?s Standards for Internal Control in the Federal Government, Principle 11.17, ?Management . . . evaluates the unique risks that using a service organization presents for the completeness, accuracy, and validity of information submitted to and received from the service organization.? Additionally, Principle 13.04 states, Management obtains relevant data from reliable internal and external sources in a timely manner based on the identified information requirements. Relevant data have a logical connection with, or bearing upon, the identified information requirements. Reliable internal and external sources provide data that are reasonably free from error and bias and faithfully represent what they purport to represent. Management evaluates both internal and external sources of data for reliability. Sources of data can be operational, financial, or compliance related. Management obtains data on a timely basis so that they can be used for effective monitoring. According to the Government Accountability Office?s Standards for Internal Control in the Federal Government, Principle 10.03, ?Management designs appropriate types of control activities for the entity?s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system.? Additionally, Principle 10.03 goes on to state, ?Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination . . . Documentation and records are properly managed and maintained.? Inaccurate Reporting for ETA 9050 through May 2021 Given that the UI Integrity Division Director only conducted a reasonableness review of the ETA 9050 and 9052 reports, we performed audit work to test the accuracy of these reports. For the ETA 9052, we sampled 2 of the 12 monthly reports for Fiscal Year 2021. Our audit work did not reveal any discrepancies between the reported amounts and non-monetary determinations supporting these amounts. Although we noted no discrepancy with the ETA 9052 report, we noted that the department submitted overstated ETA 9050 reports to the USDOL, which is discussed further below. For the ETA 9050, we initially selected a sample of 2 reports, the July 2020 and the June 2021 report, from a population of all 12 monthly reports for the State Fiscal Year. We then generated these two reports from GUS to obtain all underlying supporting payments. We found that the department?s June 2021 report contained the same number of benefit payments to claimants as the report we generated; however, the July 2020 report contained more payments than the report we generated. See Table 2 for more details. See Schedule of Findings and Questioned Costs for chart/table. According to the UI Integrity Division Director, an error within GUS?s computer coding logic resulted in duplicate payments for the reports covering July 2020 through May 2021. GSI discovered the logic error in May 2021 and fixed the error in June 2021 before management submitted the June 2021 report. Due to this coding error, we expanded our review and generated the remaining 10 monthly reports (August 2020 through May 2021) from GUS and compared those reports with the respective reports submitted to USDOL. Our comparison revealed management reported more payments in these 10 reports than was reflected in the reports we generated from GUS. Given the coding error, we believe the reports submitted for July 2020 through May 2021 contained more payments than they should have due to the duplicate payments. We performed no further audit work with the July 2020 through May 2021 reports. We performed further audit work related to the June 2021 report. From the 11,638 payments comprising the June 2021 report, we selected a sample of 60 payments and successfully traced the payment date to underlying source information within GUS. No Supporting Documentation for ETA 9055s To determine if the department accurately reported the ETA 9055 report, we selected a sample of 2 reports, the July 2020 and June 2021 report, from a population of all 12 monthly ETA 9055 reports for state fiscal year 2021. We then ?generated? these two reports from GUS to compare with respective reports submitted by the department; however, neither report matched the ones the department submitted to USDOL. The department provided the auditors with read-only access to the live version of GUS, and the auditors used their GUS access to generate these reports. According to the UI Integrity Division Director, the reports submitted to the U.S. Department of Labor were accurate at the time the department submitted those reports; however, neither management nor we could match supporting appeals data housed in GUS with the ETA 9055 reports submitted to the USDOL. Given the problems with GUS, management could have maintained the underlying support when generating the reports as documentation of their accuracy reviews; however, management did not retain the source data. As a result, we could not test the appeals comprising the reports submitted to USDOL to ensure that this underlying data was accurate. According to the U.S. Department of Labor Office of Unemployment Insurance?s ETA Handbook 401, 5th Edition, which contains instructions for state agencies for the preparation and submittal of UI reports, Section L. Record Retention, ?. . . source data supporting counts should be retained for at least three years.? When we were unable to obtain the source data to complete our work, the UI Integrity Division Director stated that management would work with GSI to retain the source data for ETA 9055 reports. We verified that the department submitted a request with the vendor in December 2021 to correct this issue. On February 2, we discussed the status of the request with the UI Integrity Division Director, who stated that although the department has attempted to request that GSI archive the report as of the date that staff run the report, the report that GSI archives is from the last date of the reporting period and not the run date. The Director stated that he would continue to work toward a resolution with GSI, but that he plans to begin using the archived report from the last day of the reporting period as the basis of the report going forward. The department administers federal grant awards which are subject to ?Uniform Administrative Guidance,? Title 2, Code of Federal Regulations (CFR), Part 200. Specifically, 2 CFR 200.302, ?Financial management,? states Each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state?s own funds. In addition, the state?s and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal award, must be sufficient to permit the preparation of reports required by general and program- specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations and the terms and conditions of the Federal award. Risk Assessment We reviewed the department?s 2020 risk assessment and found that management had not identified the risk of failing to maintain supporting documentation required by federal regulations, including sufficient documentation of the department?s internal control activities and source data to support the ETA reports. Additionally, management did not identify the risk of an information systems processing error impacting federal reports, and thus management had not implemented control activities to address the risk. Effect When department staff do not proactively perform procedures to ensure that reports generated and the underlying data obtained from GUS is reliable, management increases the risks of reporting inaccurate and incomplete data to the USDOL. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include requiring reimbursement instead of advance payments; not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; requiring additional, more detailed financial reports or additional project monitoring; requiring the agency to obtain technical or management assistance; or establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include temporarily withholding payments until the noncompliance has been corrected, denying the use of funds, partly or fully suspending or terminating the federal award, suspending or debarring the agency, withholding further awards for the project or program, or pursuing other available legal remedies. Recommendation The U.S. Department of Labor has identified core measures by which it assesses program health at the state level; therefore, accurate performance reporting is critical for program oversight. Given the ongoing issues with GUS, management should establish procedures to analyze and validate the accuracy of the underlying data supporting their performance reports. Management should also work with GSI to regularly review GUS and ensure GUS operates as designed and that the reports provided to the U.S. Department of Labor are complete and accurate. Management should also obtain and retain the underlying data supporting the submitted performance reports. Additionally, management should evaluate the effectiveness of the control activities for the risks identified in this finding, update the department?s risk assessment to reflect any new controls management implements, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. As stated during the audit, the data available for the ETA 9050 was correct as of the date the report was pulled and submitted. Below is the explanation as to why the report changed after it was initially submitted. Geographic Solutions, the department?s system vendor states, ?there was an issue discovered in late May early June 2021 for another client that identified offsets for one week - that in some cases were the first compensable week - that were spread across multiple payment register ids with the same payment stub/week-end date. As you know, there were a lot of opportunities for offset payments for those recently separated due to the pandemic that had outstanding overpayments. This confused the existing logic. The fix was to report those payments while eliminating any duplicate payment records for the same week. A refresh for all states was done on 6/15/2021. I do want to note that we went through the logic on this report very carefully and made the adjustments based on the data we were seeing especially early on in the pandemic, to ensure that the first compensable week was reported correctly, especially as states started waiving the waiting week.? All reports prior to June 15, 2021, have been resubmitted to USDOL as amended/corrected reports. The report for July 2020 that was re-submitted matches the totals the auditor mentions in the finding. The issue causing the differences has been corrected by Geographic Solutions. The Integrity Director and Program specialist did the best they could during this time, which was the height of the pandemic. As stated during the audit, the data available for the ETA 9055 reports was correct, based on the date the report was pulled and submitted. Below is the explanation as to why the report changed when the audit was done. To correct the issue the ETA 9055 will now be archived in the Geographic Solutions report data warehouse. This is effective February 18, 2022. Geographic Solutions states: ?there are several factors at play here. The ETA 9055 is not run on the data warehouse so it?s a real-time report. In other words, for a particular time period, it pulls the report as the data stands now for that particular period. That said the factors that would impact the results over the period are: Timing - obviously the more time passes between running the report initially and then looking at it now is that there is opportunity for change. Data changes - that change is often manifested in changes to the data itself. During the pandemic there has been unprecedented number of data changes although not as numerous in appeals. Changes/updates in logic - whether by internal or externally derived questions or issues and we would research and revise as needed if the report required it. For example, for this report in August 2021 there are two OPCs that might impact the numbers: They are linked to the OPC. For these it was discovered that for some older appeals that were dismissed that had an unexpected most recent status that did not indicate they were dismissed (essentially status codes of either 5-Withdrawn; 6-Dismissed; 10-Canceled - some records for this client were showing up as not that status or without a notification of dismissal sent and thus were being picked up again as pending. So, we implemented some defensive coding for those kind of situations in the logic. The report would utilize that coding change post August 2021.?

Finding Number 2021-007 Assistance Listing Number 17.258, 17.259, and 17.278 Program Name Workforce Innovation and Opportunity Act Cluster Federal Agency Department of Labor State Agency Department of Labor and Workforce Development Federal Award Identification Number AA-30740-17-55-A-47, AA-32192-18-55-A-47, AA-33257-19-55-A-47, AA-34796-20-55-A-47 Federal Award Year 2017 through 2020 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A Workforce Services Division management did not have internal controls in place to ensure that American Job Center case managers recorded accurate exit dates and made accurate eligibility determinations Background and Criteria The Workforce Innovation and Opportunity Act (WIOA) cluster of federal programs helps participants overcome barriers to obtaining employment by providing education, training, job search, and other support services. The WIOA cluster consists of three core programs: Adult, Dislocated Worker, and Youth. The U.S. Department of Labor (USDOL) awards funding for these programs through formula grants to states. In Tennessee, the Workforce Services Division (WSD) within the Tennessee Department of Labor and Workforce Development administers WIOA programs. American Job Centers The WIOA cluster of programs provides employment services to individuals through a network of American Job Centers (AJCs). Individuals may visit an AJC to determine whether they are eligible to receive services and, if so, obtain free employment assistance. The WSD awards grants to nine subrecipients, known as Local Workforce Development Boards (LWDBs), to oversee the AJCs in their Local Workforce Development Area. Each LWDB serves multiple counties, contracts with a One-Stop Operator (OSO) to manage the operations of the AJCs, and appoints a Fiscal Agent who is responsible for the accounting and finances for the AJCs. The Workforce Investment Act of 1998 established One-Stop centers which were physical locations where individuals may visit and determine if they are eligible for employment assistance from a variety of federal programs. When WIOA repealed and replaced the Workforce Investment Act, it changed the name of One-Stop centers to American Job Centers. During the COVID-19 Pandemic, certain AJCs were closed or offered virtual services online. According to CFR 679.300, the Local Workforce Development Board ?is to serve as a strategic leader and convener of local workforce development system stakeholders.? Determining Eligibility and Documenting WIOA Services Each AJC employs AJC case managers who are responsible for determining applicant eligibility and documenting the types of services each participant receives and when these services occur. AJC case managers determine whether applicants meet the federal requirements for the Adult, Dislocated Worker, or Youth programs by collecting, verifying, and reviewing information and documentation required by federal regulations, such as a driver?s license for date of birth, proof of citizenship, and a mailing address. AJC case managers document their initial eligibility determinations in Virtual One-Stop (VOS), the division?s case management system, and then continue to use VOS to document the dates and types of services participants receive. Discontinuing (Exiting) WIOA Services USDOL?s Training Employment Guidance Letter (TEGL) 10-16, Change 1 allows states to develop a common exit policy to discontinue (or exit) participant services for a variety of federal programs administered by USDOL simultaneously. According to TEGL 10-16: [i]f a state chooses to retain or implement a common exit policy, the policy must require that a participant is `exited? when that individual has not received services for 90 days . . . from any of the [United States Department of Labor]-administered programs to which the common exit policy applies, in which the participant is enrolled. In compliance with this TEGL, the WSD established the Common Exit Policy from WIOA Partner Programs, which provides the common exit policy for the following federal programs: Adult, Dislocated Worker, Youth Activities (Title I), Wagner-Peyser Employment Service programs (Title III), Trade Adjustment Act/ Trade and Globalization Adjustment Act (TAA/TGAA), and Jobs for Veterans State Grants (JVSG). According to WSD management, AJC case managers are responsible for logging the types and dates of services provided to each participant. VOS uses that information to automatically exit participants from all programs (governed by the common exit policy) after 90 days have elapsed from the last date of service for any of these programs. Once VOS exits a participant from these programs, the system then retroactively records the participant?s exit date as the last date of service provided by any program in the common exit policy, in accordance with TEGL 10-16, Change 1, which states that the ?date of exit is applied retroactively to the last date of service.? Exit Dates and Federal Reporting To evaluate the effectiveness of the program, USDOL requires WSD to prepare performance reports which include key measures providing participant wages for the 2nd quarter and 4th quarter after their exit date. This allows USDOL to measure the effectiveness of the WIOA programs in getting participants into stable, long-term employment after they exit the program. WSD Management and staff use the VOS system to manage the underlying data for the USDOL performance reports. AJC case managers input the source data for each participant in the VOS system, and WSD staff retrieve the VOS data to prepare the USDOL performance reports. Internal Control over Compliance with Federal Requirements The federal government requires non-federal entities, including WSD, to design and implement internal controls over federal awards. According to Title 2, Code of Federal Regulations, Part 200, Section 303, ?Internal Controls,? a non-federal agency must (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. (c) Evaluate and monitor the non-Federal entity's compliance with statutes, regulations and the terms and conditions of Federal awards. Additionally, the U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government, Principle 10.03, states, ?Management designs appropriate types of control activities for the entity?s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system.? Condition and Cause Exit Date Reporting To determine whether participants exited the program in accordance with federal guidelines and department policies, we selected a nonstatistical, random sample of 60 participants from a total population of 6,107 participants who exited the 3 WIOA programs between July 1, 2020, and June 30, 2021, and tested these participants to ensure case managers exited the participants from the program in accordance with the WSD common exit policy. For 23 of 60 WIOA participants tested (38%), case managers exited participants between 98 and 963 days late, averaging 306 days late. Based on discussion with the WSD staff and review of guidance from USDOL?s website, we determined that the department did not provide adequate guidance or training to ensure AJC case managers correctly logged participants? last date of service in VOS. Based on our discussion with the Grants Program Manager and the Labor Workforce Development Division Director and our review of departmental guidance regarding exits, VOS automatically exits a participant 90 calendar days after the date the AJC case manager recorded as the last date the participant received services; however, case managers often entered a projected date of a participant?s last service in the VOS system. Case managers selected the projected date at the time they initially offered the services to participants. The case manager, however, failed to update the projected date when the actual last service date was determined. When AJC case managers do not update the projected date in VOS to reflect the actual last service date, VOS automatically calculates an incorrect exit date based on the projection. Eligibility Determinations To determine whether the WIOA program management and staff only provided services to eligible participants, we selected a stratified sample of 60 participants from a total population of 14,726 participants who were enrolled in one of the three WIOA programs between July 1, 2020, and June 30, 2021, and tested these participants to ensure program management determined participants? eligibility for the program according to federal guidance. Although our sample review of eligibility determinations identified only minor errors, we noted that WSD management and staff had not established control activities, such as programmatic monitoring or other eligibility determinations review procedures, including obtaining proper supporting documentation for the determinations, to ensure staff complied with the federal eligibility requirements. We also found that the department did not conduct programmatic monitoring for the Adult and Youth program and only limited monitoring for the Dislocated Worker program. This is discussed further in Finding 2021-003. Risk Assessment We also reviewed the department?s 2020 Financial Integrity Act Risk Assessment. We found the risk assessment did not include the risk that the department would not ensure proper eligibility determinations and exits for the Adult, Dislocated Worker, and Youth programs. Without an identified risk for eligibility and participant exits, management did not ensure staff entered updated exit dates into the VOS system and did not establish mitigating controls to address the eligibility determination risk and to ensure compliance with federal eligibility regulations. Effect When case managers do not accurately record the last day a participant receives services, management faces an increased risk that the department may report inaccurate information to USDOL, which relies on these reports to determine the effectiveness of WIOA?s programmatic goals. Additionally, when department management does not design and implement internal controls over eligibility determinations, management?s risk of ineligible individuals receiving benefits from WIOA programs is increased. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include requiring reimbursement instead of advance payments; not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; requiring additional, more detailed financial reports or additional project monitoring; requiring the agency to obtain technical or management assistance; or establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include temporarily withholding payments until the noncompliance has been corrected, denying the use of funds, partly or fully suspending or terminating the federal award, suspending or debarring the agency, withholding further awards for the project or program, or pursuing other available legal remedies. Recommendation The Commissioner of the Tennessee Department of Labor and Workforce Development should work with management in the Workforce Services Division to provide additional guidance and training to ensure AJC case managers record exit dates based on the last day participants actually receive services in accordance with federal guidelines and regulations. The Commissioner should also work with Workforce Services Division management to establish control activities, such as programmatic monitoring or other eligibility determinations review procedures, including obtaining proper supporting documentation for the determinations, to ensure AJC case managers comply with the federal eligibility requirements, including timely exits from the program. The Commissioner should assess all significant risks, including the risks noted in this finding, in the department?s documented risk assessment. The risk assessment and the mitigating controls should be adequately documented and approved by the Commissioner. Management?s Comment We concur. The Department of Labor and Workforce Development will provide training to all American Job Center case managers responsible for eligibility determinations and exiting workforce program participants by September 2022. This training will focus on compliance with requirements described in State Workforce Development Board Policy. The Workforce Services Division will revise the current program monitoring guide and update the current risk assessment by May 2022 to demonstrate how we will mitigate this risk and monitor participant eligibility and program exit moving forward.

Finding Number 2021-008 Assistance Listing Number 93.778 Program Name Medicaid Cluster Federal Agency Department of Health and Human Services State Agency Department of Finance and Administration Federal Award Identification Number 2005TN5ADM and 2105TN5MAP Federal Award Year 2020 and 2021 Finding Type Material Weakness and Noncompliance Compliance Requirement Matching Repeat Finding N/A Pass-Through Entity N/A Questioned Costs $3,612,265 Fiscal staff within the Division of TennCare did not ensure matching requirements were met for the Medicaid Cluster, resulting in questioned costs of $3,612,265 Background and Criteria TennCare is Tennessee?s Medicaid program that provides health insurance coverage to certain groups of low-income individuals, such as pregnant women, children, caretaker relatives of dependent children, and other adults with disabilities. Under the Medicaid program, the U.S. Department of Health and Human Services (HHS) provides federal funds to the Division of TennCare to cover a portion of the TennCare program?s medical assistance expenditures and administrative expenditures. The remaining funds are provided by the state based on the federal/state matching requirements. According to the provisions of Title 42, Code of Federal Regulations (CFR), Part 433, Section 10(a), the federal government, through Sections 1903 and 1905 of the Social Security Act, provides ?payments to States, on the basis of a Federal medical assistance percentage, for part of their expenditures for services under an approved State plan.? HHS uses the calculation outlined in 42 CFR 433.10(b) to determine the federal medical assistance percentage. HHS recalculates the federal medical assistance percentage each federal fiscal year, which runs from October 1 to September 30. The federal medical assistance percentage was 65.21% for federal fiscal year 2020 and 66.1% for federal fiscal year 2021. According to the provisions of 42 CFR 433.15(a), the federal government, through Section 1903 of the Social Security Act, provides ?payments to States, on the basis of specified percentages, for part of their expenditures for administration of an approved State plan.? HHS provides federal funds at the specified percentage rates of 50%, 75%, or 90%, depending on the type of expenditure. For example, the federal government provides 75% of the funding for ongoing information systems expenditures. When the Division of TennCare receives a new grant award from HHS, the division?s Contracts Unit enters the award, including the applicable federal percentages, in Edison, the state?s accounting system. The division?s Fiscal Office codes eligible expenditures to the appropriate grant award to ensure Edison applies the correct federal percentage to the expenditures and automatically calculates the federal portion and the state portion of the expenditures. The division?s Fiscal Office then requests federal reimbursement with the remaining portion secured through state matching funds. Condition and Cause We analyzed all TennCare program expenditures from July 1, 2020, through June 30, 2021, totaling $8,439,515,010, to determine if the division appropriately calculated the federal share of costs charged to the federal award. During this analysis, we identified two instances where the division?s Fiscal Office inappropriately charged state expenditures to the 2020 and the 2021 federal awards, resulting in a total of $3,612,265 in federal questioned costs. One overcharge resulted when the division?s Fiscal Office staff coded an adjusting journal entry to the incorrect grant award year. Specifically, staff made an adjusting journal entry intended to charge expenditures to the grant associated with federal fiscal year 2020, which had a federal medical assistance percentage of 65.21%. However, the division?s accountant incorrectly coded several line items of the journal entry to charge the federal fiscal year 2021 grant award. Since the federal fiscal year 2021 grant had a federal medical assistance percentage of 66.1%, the coding error resulted in an overcharge to the grant resulting in federal questioned costs of $3,610,433. See Table 1 for the details. See Scheduled of Findings and Questioned Costs for chart/table. The second overcharge occurred as a result of an Edison system coding error which affected how journal entries distribute administrative costs. Edison and division management were unaware that the system update created this coding issue. Once we identified the code error and discussed with division staff, staff recognized they had to manually search for and correct incorrect cost distributions. In this situation, division staff had not identified this one incorrect cost distribution, resulting in additional federal questioned costs of $1,832, as exhibited in Table 2: See Scheduled of Findings and Questioned Costs for the chart/table. According to the division?s Controller, as of December 22, 2021, the Edison team is currently testing a coding fix to correct this issue. We were able to review the entire population of transactions for our audit period and found these to be the only two overcharges related to matching. Title 2, Code of Federal Regulations (CFR), Part 200, Section 516(a)(3), requires us to report known costs greater than $25,000 for a type of compliance requirement for a major program. For this program, we determined that known questioned costs exceeded $25,000. Risk Assessment We reviewed the Division of TennCare?s December 2020 Financial Integrity Act Risk Assessment and determined that management listed the risk of transactions recorded at the wrong federal financial percentage. While management identified the risk, management?s control of the Controller?s or designee?s review and approval did not identify these two instances. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,? 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. Effect When the division?s Controller or designee does not identify expenditures that are incorrectly recorded, the division increases the risk of the state receiving federal awards in error, leading to questioned costs. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include requiring reimbursement instead of advance payments; not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; requiring additional, more detailed financial reports or additional project monitoring; requiring the agency to obtain technical or management assistance; or establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include temporarily withholding payments until the noncompliance has been corrected, denying the use of funds, partly or fully suspending or terminating the federal award, suspending or debarring the agency, withholding further awards for the project or program, or pursuing other available legal remedies. Recommendation The Division of TennCare?s Chief Financial Officer should ensure fiscal staff review program expenditures for the correct federal medical assistance percentage and the correct administrative percentage. The division?s Chief Financial Officer should ensure that fiscal staff who prepare and review manual journal entries are fully trained so that they are aware of their internal control responsibilities and can properly fulfill their duties. Additionally, division management should evaluate the effectiveness of the control activities for the risks identified in this finding, update the division?s annual risk assessment to reflect any new controls management implements as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur with the finding. We have a monthly process to analyze transactions to ensure the correct funding percentages are used. The journal in question normally would not have drawn federal funds, however, an error occurred, and the journal did draw federal funds in this instance. Our previous review process excluded journals that don?t draw federal funds, and therefore it was missed. We have revised our monthly review process to include all transactions, so this kind of event will not occur again. All federal funds drawn in error were immediately returned to the federal government as soon as they were found, and there was no negative impact to the TennCare budget.

Finding Number 2021-009 Assistance Listing Number 93.778 Program Name Medicaid Cluster Federal Agency Department of Health and Human Services State Agency Department of Finance and Administration Federal Award Identification Number 2005TN5MAP and 2105TN5MAP Federal Award Year 2020 and 2021 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Eligibility Repeat Finding 2020-008 Pass-Through Entity N/A Questioned Costs $14,352 As noted in the prior two audits, TennCare management did not promptly address TennCare?s Medicaid eligibility process deficiencies, resulting in $19,986 in federal and state questioned costs Background TennCare is Tennessee?s Medicaid program, funded at both the federal and state level, which provides health insurance coverage to certain groups of low-income individuals, such as pregnant women, children, caretaker relatives of dependent children, and adults with disabilities. In general, the Division of TennCare makes three types of payments on behalf of its members: capitation or administrative payments to managed care organizations that contract with the division to deliver services to members; fee-for-service claims paid directly to providers for services provided to certain members, such as children enrolled in the Department of Children?s Services? (DCS) foster care or adoption assistance program, or for certain costs relating to Medicare for members who are enrolled in both Medicaid and Medicare; and reimbursements to benefit managers for services, such as pharmacy, dental, and health services. The division contracts with three managed care organizations and only pays them a capitation rate per member per month to provide services to TennCare members. According to a separate contract with BlueCross BlueShield of Tennessee, TennCare Select is a benefits manager that manages and coordinates care and maintains a network of healthcare providers for a select group of TennCare members, such as immigrants ineligible for full Medicaid needing emergency services. For TennCare Select, the division pays BlueCross BlueShield an administrative rate per member per month and reimburses them for all services (claims) provided to TennCare members. The types of services provided include, but are not limited to, medical, behavioral health, and case management services. Division?s Eligibility Determination Process for Medicaid Applicants and Members Initial Eligibility Process The division uses the Tennessee Eligibility Determination System (TEDS) to determine an applicant?s eligibility. Applicants apply for eligibility using TennCare Connect, TEDS? public-facing web portal. In addition to TennCare Connect, the division continues to accept applications through each of following methods: by phone or online through the Federally Facilitated Marketplace; by phone or a paper application; online through the TennCare Access partner portal; or by visiting a Department of Human Services office for in-person assistance with applying online, by paper, or by phone. Whether an applicant applies by phone, paper, in-person, through the Federally Facilitated Marketplace, through TennCare Access, or through TennCare Connect, the applicant?s demographic, income, and household information is entered into TEDS for automated processing, thereby removing the need for human intervention in many cases. When TEDS requires human intervention for eligibility determinations, such as when the system identifies discrepancies in application information or cannot verify information, the system automatically assigns an eligibility caseworker to process the application manually in TEDS to determine if the applicant is eligible for any available TennCare eligibility category (including children, pregnant women, parents or caretakers of children, or other categories for certain adults). If the division determines that an applicant or member is not eligible for Medicaid benefits, the individual may appeal the division?s decision. Eligibility Renewals Paused Pursuant to the Families First Coronavirus Response Act, the division is not permitted to terminate members who were enrolled when the federal COVID-19 public health emergency period began. As such, the division paused Medicaid eligibility renewals, eligibility changes to lower categories, and terminations on March 18, 2020. During this pause, the division is only allowed to terminate Medicaid coverage for existing members due to the member?s death, when a member voluntarily terminates coverage, or when a member becomes a resident in another state. As of December 6, 2021, the public health emergency remains in effect. The U.S. Department of Health and Human Services operates the Federally Facilitated Marketplace, an organized marketplace of health insurance plans where individuals can apply for health insurance, including Medicaid. The division partners with the Department of Health, certain hospitals, and certain long-term care providers to assist an individual in the application process. According to division management, TEDS is a task-based system where an eligibility caseworker may have to manually verify an applicant?s information (such as Social Security Administration payment history or family composition) to continue processing eligibility. Prior Audit Results As noted in the prior audit, the division did not have an effective key internal control for determining eligibility. As a result, we reported the following compliance issues: TEDS errors and caseworker processing errors were affecting eligibility determinations, and division management did not have sufficient documentation to support eligibility determinations. In the division?s six-month follow-up report to the Comptroller?s Office, dated September 24, 2021, management stated that Our corrective actions for this finding are complete except for the cases that need an action that cannot be completed while the federal public health emergency is in place. . . . The remaining cases will be addressed as soon as possible once the federal public health emergency is lifted. TennCare has corrected all worker errors identified in the finding. TennCare has also corrected the three TEDS system errors. . . . Member Services has implemented a new monthly case reading tool and review process that requires eligibility operations supervisors, with assistance from the quality assurance review staff, to review and score at least five cases per eligibility caseworker per month. . . . We have made changes to Member Services staff training. . . . Additionally, we updated our eligibility related Risk Assessment. Current Audit Results For the current audit, we determined that division management did not resolve the eligibility issues noted in the prior audit. We performed testwork in three areas: TennCare members? eligibility, issuance of pseudo Social Security numbers, and emergency medical services for immigrants. Condition, Cause, and Criteria: TennCare Members? Eligibility According to the Rules of Tennessee Department of Finance and Administration Bureau of TennCare, Chapter 1200-13-13-.02(3), regarding Medicaid eligibility requirements, each TennCare member must meet the technical and financial requirements for medical assistance as listed in the Rules of the Tennessee Department of Human Services, or meet the Supplemental Security Income eligibility requirements and be approved for benefits by the Social Security Administration, or be an eligible woman diagnosed with certain types of cancer. In order to determine if the division made payments on behalf of individuals that met state and federal eligibility requirements for TennCare benefits, we selected random, nonstatistical samples from two different populations of capitation payments paid on behalf of members. From a population of 18,657,154 capitation payments, totaling $7,271,036,309, which the division paid on behalf of its members to managed care organizations during fiscal year 2021, we tested a sample of 60 capitation payments, totaling $27,878. To further explain our methodology, we vetted the population of capitation payments above and found that a segment of the population (467,506 capitation payments, totaling $171,144,894, during fiscal year 2021) included payments related to both the Medical Assistance Program and the Children?s Health Insurance Program. Due to the nature of the electronic documentation, however, we could not readily determine through our data matches the related eligibility category or the federal program associated with the payments. In order to determine if the division appropriately determined the member?s eligibility for this segment of the population, we selected an additional sample of 25 capitation payments, totaling $8,396. From the sample of 25 capitation payments, we determined the payments were for Medicaid members. Ultimately, our total 85 sample items included only capitation payments for Medicaid members. Based on our review, we determined that for 6 of 85 payments tested (7%), an eligibility caseworker did not verify eligibility prior to approving the member?s case for the capitation payments. We found the following errors: For 1 payment, an eligibility caseworker inappropriately approved benefits for 1 member in the household?s application. The division?s Eligibility Quality Control Director stated the caseworker processed coverage for the individual in error by indicating she was a caretaker of a minor child. As a result, we identified federal questioned costs totaling $2,373 and a remaining $909 in state questioned costs. For 1 payment, we determined the individual was still receiving Modified Adjusted Gross Income (MAGI) pregnancy coverage that should have ended on June 30, 2021. According to the division?s Eligibility Quality Control Director, an eligibility caseworker entered an override in error, which prevented the preterm notice from mailing at the end of her post-partum period. Due to the public health emergency, the division is not permitted to make eligibility changes to a lower category; therefore, we did not question any costs. For 3 payments, the caseworker should have requested proof of income from the members; however, the caseworker changed the income verification to show the member attested to income, and Caretaker Relative benefits were reapproved without proof of income documentation. According to the division?s Eligibility Quality Control Director, for 2 payments the cases were updated and reapproved; therefore, we did not question costs. For the third payment, we identified federal questioned costs totaling $205 and a remaining $78 in state questioned costs. For 1 payment, there was new proof of income documentation in the case, but the information had not been entered on the income screen. According to the division?s Eligibility Quality Control Director, the caseworker failed to input the information from the proof of income into TEDS. After we brought this to the director?s attention, the case was updated and reapproved; therefore, we did not question any costs. The 467,506 capitation payments, totaling $171,144,894, were not included in our population of 18,657,154 capitation payments, totaling $7,271,036,309, in our TennCare member sample. The division uses Modified Adjusted Gross Income (MAGI) to determine Medicaid eligibility. MAGI is adjusted gross income plus any untaxed foreign income, non-taxable Social Security benefits, and tax-exempt interest. Condition, Cause, Criteria: Issuance of Pseudo Social Security Numbers According to 42 CFR 435.910(f), the division cannot deny or delay services to otherwise eligible members pending issuance or verification of the member?s Social Security number (SSN). According to the division?s Assistant Commissioner of Member Services, an eligibility caseworker may have to assign a pseudo (temporary) SSN to a member upon enrollment in TennCare if the member cannot provide an SSN at the time of application. The division assigns pseudo SSNs when members meet one of the following conditions: a newborn who has not been issued a valid SSN, a child in DCS custody who qualifies for the federal adoption assistance program and may be applying for a new SSN, an immigrant who is ineligible for full Medicaid receives payments for emergency services, a person who is in the process of applying for an SSN, a person approved by the Federally Facilitated Marketplace who has incomplete SSN data, or a person who files an application without an SSN but can be approved based on information submitted. In order to determine if the division issued pseudo SSNs to eligible members, we tested a nonstatistical, random sample of 60 members from a population of 31,728 members who had a pseudo SSN and had a birthdate prior to July 1, 2019. Based on our review, we determined that for 4 of 60 members tested (7%), TEDS and an eligibility caseworker inappropriately approved eligibility, which caused the assignment of a pseudo SSN to individuals. We identified the following errors: As noted in the prior audit, 1 member initially applied for CoverKids pregnancy coverage and noted on her application that she was not a U.S. citizen, thus should only be eligible for the CoverKids pregnancy category. When cases were converted from the existing CoverKids system to TEDS, the person?s status was changed to a U.S. citizen. According to the Eligibility Quality Control Director, a caseworker corrected the information in TEDS; however, the member was approved for Caretaker benefits despite the correction. As a result, we identified federal questioned costs totaling $2,842 and a remaining $1,125 in state questioned costs. For 1 member, TEDS indicated that the individual was a non-U.S. citizen receiving Child MAGI benefits. According to the Eligibility Quality Control Director, the individual should have been approved for a reasonable opportunity period (ROP); however, they were approved for full Medicaid without pending for citizenship. She stated that the TEDS contractor corrected the system error through a data fix on February 21, 2022. As a result, we identified federal questioned costs totaling $2,216 and a remaining $872 in state questioned costs. For 1 member, TEDS indicated that the individual was a non-U.S. citizen receiving Hospital Presumptive Eligibility (HPE) pregnancy benefits. According to the Eligibility Quality Control Director, TEDS was unable to terminate the HPE coverage when it should have due to an open appeal. Once the appeals caseworker closed the appeal, an eligibility caseworker should have rerun eligibility, so coverage was not closed. As a result, we identified federal questioned costs totaling $2,011 and a remaining $792 in state questioned costs. For 1 member, TEDS indicated the individual was a non-U.S. citizen receiving Caretaker Relative benefits. According to the Eligibility Quality Control Director, an eligibility caseworker processed an emergency medical services application incorrectly. She stated this caused the individual to be tested for Caretaker Relative benefits and granted an ROP to provide citizenship. This appeal extended the eligibility from the November 30, 2019, application, which caused the case to continue pending for proof of citizenship due to the ROP. She stated benefits have been terminated effective November 5, 2021. As a result, we identified federal questioned costs totaling $4,596 and a remaining $1,816 in state questioned costs. Immigrants are individuals who may or may not be in the U.S. legally; certain immigrants, such as student visa holders, legal permanent residents with this status for less than five years, or undocumented individuals, do not meet the federal immigration requirements to receive TennCare. The division also operates CoverKids, the state?s Children?s Health Insurance Program, which is a federal program that provides health insurance to eligible children up to age 18 as well as eligible pregnant women. Pregnant women who are not U.S. citizens may be eligible to receive CoverKids benefits. Condition, Cause, Criteria: Emergency Medical Services for Immigrants The division provides payments for emergency medical services on behalf of immigrants who otherwise would not be eligible for Medicaid. According to the division?s Policy 020.005, ?Emergency Medical Services,? coverage will not begin prior to the date of application, and coverage will not begin prior to the date of admission. Coverage will be limited to the length of time required to stabilize the emergent episode. Only the services involved in the emergency itself will be reimbursed and coverage is only provided for the single episode of care. From a population of 107 immigrants who received an emergency medical service during fiscal year 2021, we tested a nonstatistical, random sample of 60 emergency medical service segments to determine that the correct begin and end dates were used for the eligibility segment. Based on our review, we determined that for 5 of 60 payments tested (8%), TEDS and TennCare staff approved payments for emergency medical services outside of the emergency medical services segment. We identified the following errors: For 3 immigrants who received emergency medical services during the audit period, the division did not limit coverage to the dates of the emergency medical services. According to the Eligibility Quality Administrator, these errors occurred when the caseworker did not follow the process or made mistakes. In the first case, the caseworker placed an override in TEDS in error using the public health emergency as justification to keep the benefits open. In the second case, the caseworker entered the end date incorrectly, which caused the eligibility benefits to close before they should have. For the remaining case, the caseworker approved benefits a day earlier than she should have. As a result, we identified federal questioned costs totaling $99 and a remaining $38 in state questioned costs. For 1 immigrant who received emergency medical services during the audit period, we noted no issues with the emergency services benefits received. However, based on our review of the case, we noted that when her emergency medical service segment ended, she was moved into CoverKids-Pregnant. According to the Eligibility Quality Administrator, on June 16, 2021, the individual submitted a member portal application indicating she was pregnant. When the eligibility caseworker processed the application, they failed to update the circumstance start and change dates, which caused TEDS to run the eligibility back to the emergency medical services application date of October 4, 2020. Given the caseworker error and control weakness, the division could have paid for additional coverage the individual was not eligible for. We determined that no payments were made between October 4, 2020, the date the emergency services ended, and June 15, 2021; therefore, we did not question any costs. For 1 immigrant who received emergency medical services during the audit period, TEDS did not approve the appropriate eligibility dates. The individual was approved for emergency services benefits beginning January 21, 2021, through February 4, 2021, although there was only medical documentation supporting services performed on January 21, 2021. According to the Eligibility Quality Administrator, the caseworker entered the correct beginning and end dates for the medical services, but a system error resulted in the eligibility span staying open. He stated the TEDS contractor will be correcting this issue in the 17.0 release, which is scheduled to be implemented on December 12, 2021. As a result, we identified federal questioned costs totaling $10 and a remaining $4 in state questioned costs. A reasonable opportunity period (ROP) is a 90-day period in which an applicant may provide proof of citizenship. The ROP is required by 42 CFR 435.956. An emergency medical service segment is the approved date range for healthcare coverage. Questioned Costs While total known questioned costs for the above errors related to the Medical Assistance Program totaled less than $25,000, Title 2, Code of Federal Regulations (CFR), Part 200, Section 516(a)(3), requires us to report known and likely questioned costs greater than $25,000 for a type of compliance requirement for a major program. For this program, we determined that likely questioned costs exceeded $25,000. Risk Assessment We reviewed the Division of TennCare?s December 2020 Financial Integrity Act Risk Assessment and determined that management listed two risks related to eligibility determinations. Management identified the risk of an eligibility caseworker or TEDS performing inaccurate eligibility determinations, member case changes, and redeterminations. Management identified two controls to mitigate these risks: TEDS will generate canned and ad hoc reports relating to system functionality and worker performance; and the Compliance and Policy Group will monitor the performance of the interfaces that feed information from, and into, TEDS. In addition, management identified the risk of the Member Eligibility Department being unable to sufficiently perform eligibility determinations, case changes, and redeterminations in TEDS. Management identified three controls to mitigate these risks: Member Services eligibility staff supervisors will review a sample of case entries during their case review made by each direct report on a monthly basis; the Compliance and Policy Group will provide training to new Member Eligibility employees, and to existing employees as requested, regarding system functionality; and the Eligibility Operations Group will perform quality checks on all case actions performed by new Member Eligibility employees during their new hire probationary periods. Management has informed us that once they can resume eligibility renewals, they expect the instances of noncompliance to be less. Management also indicated that during this year they were focused on rewriting training materials for caseworkers on how to use TEDS, working through the remaining legacy system conversion cases, and dealing with impacts from the ongoing public health emergency. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,? 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. Effect When division staff and TEDS do not process Medicaid eligibility determinations correctly, the division increases the risk of providing Medicaid benefits to ineligible individuals, thereby allowing them to receive a benefit they are not entitled to receive and rendering related costs unallowable. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include requiring reimbursement instead of advance payments; not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; requiring additional, more detailed financial reports or additional project monitoring; requiring the agency to obtain technical or management assistance; or establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include temporarily withholding payments until the noncompliance has been corrected, denying the use of funds, partly or fully suspending or terminating the federal award, suspending or debarring the agency, withholding further awards for the project or program, or pursuing other available legal remedies. Recommendation The Assistant Commissioner should ensure that eligibility workers are fully trained so that they understand their responsibilities relating to Medicaid eligibility and can properly determine if the members are eligible for benefits. In addition, the Assistant Commissioner should work with the TEDS contractor to continually monitor and reassess TEDS performance to ensure it correctly processes determinations and terminations. Additionally, division management should evaluate the effectiveness of the control activities for the risks identified in this finding, update the division?s annual risk assessment to reflect any new controls management implements as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. During the review period TennCare processed almost 350,000 applications and took action on hundreds of thousands of existing cases. Even though we now have a modern eligibility determination system that can automatically process much of this work, worker intervention is still necessary for many cases. To ensure that TennCare eligibility workers provide the highest quality for our applicants and members, TennCare currently has more controls in place than we ever have before. These include, but are not limited to, the following: Robust case reading process that includes monthly goals and scores, as well as targeted improvement On a monthly basis each manager of TennCare eligibility workers reviews cases determined by each staff member and inputs quality scores into a case reading tool. There are measures in place to ensure that managers are scoring cases uniformly and the items being reviewed are aligned with state and federal audits. Quality goals are incorporated in Individual Performance Plans and staff who consistently miss goals are put on Performance Improvement Plans. Each eligibility worker can review their findings in published reports, and those reports can be viewed at the unit or division level. Monthly conferences are held to discuss case read findings and broad findings can result in policy updates or new training materials. The Member Services Quality team reviews additional cases of workers who do not meet their quality goals in a given month. This is a process that began in December 2020 and has been praised by federal auditors who recently reviewed the TennCare eligibility process. During the last employee review cycle 97% of all cases reviewed within the TennCare Member Services Eligibility Operations Group met quality standards. New worker secondary review process Newly hired staff are not permitted to perform final case authorizations without supervisor review for the first three months of employment. If the underlying case action is not correct upon supervisor review, managers will provide targeted coaching to correct the behavior. This secondary review process is also used for seasoned employees whose quality case reading scores are not sufficient. This is a tool used while caseworkers are undergoing Process Improvement Plans. Process Improvement Plans (PIPs) Process Improvement Plans are used to help eligibility caseworker staff meet quality and production goals. They involve a focused support between the employee?s manager and a member of the TennCare Human Resources staff. Weekly meetings are held and the number of cases read are more than doubled until the employee has improved to an acceptable level. If performance does not improve, the employee may be dismissed. Reports The TennCare Eligibility Determination System provides a reporting dashboard that allows management more access to eligibility data than ever before. With this data we have created dashboards at multiple levels that display quality reviews and scores down to the individual worker level. We also have daily reports that identify pending cases by worker queue that managers review throughout the day. The system also allows management a real time view into task volume and age, which is used to ensure work is being completed in a timely manner and allows TennCare to identify problems or anomalies quickly. Although human error will never be fully eliminated in such a complicated program, one way we have been working towards that goal is by improving training for Member Services staff. As discussed in the FY2020 audit, we completed an overhaul of training materials in 2021. We have begun training new staff using the revised curriculum and retraining of existing Member Services staff to focuses on business processes and more hands-on system scenarios will begin in February 2022. By mid-year 2022 all staff responsible for processing cases will receive new computer-based training related to the processing of cases, including income determinations. The training will consist of assigned computer-based training, quizzes, and a virtual lab. During the lab, they will work independently to complete several practice scenarios followed by a final practice which serves as the assessment. There will be a facilitator available throughout the lab session to answer any questions. Once an assessment is passed, workers will proceed to the next section.

Finding Number 2021-010 Assistance Listing Number 93.767 Program Name Children?s Health Insurance Program (CHIP) Federal Agency Department of Health and Human Services State Agency Department of Finance and Administration Federal Award Identification Number 2005TN5021 and 2105TN5021 Federal Award Year 2020 and 2021 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Repeat Finding 2020-009 Pass-Through Entity N/A Questioned Costs $8,428 As noted in the prior audit, management of the Division of TennCare should continue to promptly address the division?s CoverKids eligibility process deficiencies, which resulted in $11,607 in federal and state questioned costs Background The Division of TennCare (division) oversees CoverKids, Tennessee?s Children?s Health Insurance Program (CHIP). Funded at both the federal and state levels, the program provides health insurance coverage to uninsured, low-income children and pregnant women not otherwise eligible for Medicaid. Prior to 2021, BlueCross BlueShield was the sole managed care organization (MCO) of CoverKids services. In general, the division made three types of payments on behalf of CoverKids members from July 1, 2020, through December 31, 2020: administrative payments to BlueCross BlueShield; fee-for-service claims paid to providers for services provided to members; and reimbursements to benefit managers for services, such as pharmacy, dental, and health services. Beginning January 1, 2021, the division amended its contracts with two MCOs, UnitedHealthcare and Amerigroup, to allow them to also serve CoverKids members. Additionally, the division stopped paying fee-for-service claims to providers and began paying MCOs capitation payments, and the MCOs now pay for health service claims provided to members. From January 1, 2021, through June 30, 2021, the division made two types of payments on behalf of CoverKids members: monthly capitation payments to the MCOs; and reimbursements to benefit managers for services, such as pharmacy and dental services. The division paid BlueCross BlueShield an administrative rate per member per month and reimburses the provider for all services (claims) provided to CoverKids members. The types of services provided include, but are not limited to, medical, behavioral health, and case management services. As part of its contract for fiscal year 2020, BlueCross BlueShield managed these claims on behalf of the division. The division contracts with three MCOs and only pays them a capitation rate per member per month to provide services to CoverKids members. Division?s Eligibility Determination Process for CoverKids Applicants and Members Initial Eligibility Process CoverKids applicants apply for eligibility using TennCare Connect, the public-facing web portal of the division?s Tennessee Eligibility Determination System (TEDS). In addition to TennCare Connect, the division continues to accept applications through each of following methods: by phone or online through the Federally Facilitated Marketplace; by phone or a paper application; online through the TennCare Access partner portal; or by visiting a Department of Human Services office for in-person assistance with applying online, by paper, or by phone. Whether an applicant applies by phone, paper, in-person, or online, the division enters the applicant?s demographic, income, and household information into TEDS for automated processing and verifies the applicant?s information against multiple state and federal databases. The verification determines if the applicant is eligible for any available TennCare or CoverKids eligibility category, thereby removing the need for human intervention in many cases. When TEDS requires human intervention for eligibility determinations, such as when the system identifies discrepancies in application information or cannot verify information, the system automatically assigns an eligibility caseworker to process the application manually in TEDS. Eligibility Renewals Paused Pursuant to the Families First Coronavirus Response Act, the division is not permitted to terminate members who were enrolled when the federal COVID-19 public health emergency (PHE) period began. As such, the division paused CoverKids eligibility renewals, eligibility changes to lower categories, and terminations on March 18, 2020. During this pause, the division may only terminate CoverKids coverage for existing members who die; voluntarily terminate coverage; become residents of another state; or, for members with pregnancy coverage, when their postpartum period ends. As of December 6, 2021, the PHE remains in effect. The U.S. Department of Health and Human Services operates the Federally Facilitated Marketplace, an organized marketplace of health insurance plans where individuals can apply for health insurance, including Medicaid and CoverKids. The division partners with the Department of Health, certain hospitals, and certain long-term care providers to assist individuals in the application process. According to division management, TEDS is a task-based system where an eligibility caseworker may have to manually verify an applicant?s information (such as Social Security Administration payment history or family composition) to continue processing eligibility. Prior Audit Results As noted in the prior audit, the division did not have an effective key internal control for determining eligibility. As a result, we reported the following compliance issue with TEDS errors and caseworker processing errors that were affecting eligibility determinations. In the division?s six-month follow-up report to the Comptroller?s Office, dated September 24, 2021, management stated: Our corrective action for this finding is complete except for the cases that need an action that cannot be completed while the federal public health emergency is in place. . . . We also updated the worker training curriculum to increase their understanding of business processes and policies being used in the eligibility determination process. Additionally, we updated our eligibility related Risk Assessment. Condition, Criteria, and Cause For the current audit, we determined that division management did resolve the TEDS system error affecting eligibility determinations but did not resolve the eligibility caseworker processing errors affecting eligibility determinations as noted in the prior audit. We also identified a new issue involving a TEDS system issue for postpartum members. Payment Testwork To determine whether management made administrative and capitation payments for eligible CoverKids members, we tested a random, nonstatistical sample of 30 administrative payments paid between July 1, 2020, and December 31, 2020, and 30 capitation payments made between January 1, 2021, through June 30, 2021, for a total of 60 payments worth $7,358. The sample was taken from a population of 542,052 administrative and capitation payments totaling $67,026,546. Based on our review, for 5 of 60 payments tested (8%), eligibility caseworkers and TEDS did not verify the members? eligibility. For 4 of 60 CoverKids payments tested, an eligibility caseworker and TEDS did not verify the members? household income before enrolling them in the CoverKids program. According to Title 42, Code of Federal Regulations, Part 457, Section 380(d), ?Eligibility verification,? if a state ?does not accept self-attestation of income, the State must verify the income of an individual by using the data sources and following standards and procedures for verification of financial eligibility. . . .? According to the division?s Policy 200.035, ?Verification,? the division must verify and document all of the member?s financial and non-financial information. This may occur through systematic verification in TEDS; however, if TEDS is unable to verify the member?s information, TEDS will trigger a notice requesting the member to provide proof of the information required for eligibility. For 2 payments, the division requested proof of income after TEDS could not automatically verify the reported household income of the members. One of the members returned insufficient documentation, which an eligibility caseworker incorrectly accepted as proof of income. The other member did not respond to the request for additional information; however, due to a system error, TEDS approved their renewal application anyway. As a result of these 2 errors, we identified $301 in federal questioned costs and an additional $75 in state questioned costs. For major programs, such as CHIP, 2 CFR 200.516(a)(3), ?Audit findings,? requires us to report known and likely questioned costs greater than $25,000 for a type of compliance requirement for a major program. Based on our review, we determined that likely questioned costs exceeded $25,000. For the remaining 2 payments, an eligibility caseworker approved the member?s eligibility without proper income verifications. In these instances, the caseworker noted ?Other Acceptable Verification,? which allowed TEDS to grant the member eligibility. However, no documentation of acceptable verification could be found in the system. After we brought the issue to management?s attention, the division verified the reported household income from the members? applications and determined they still qualified for CoverKids coverage; therefore, we did not question costs associated with these 2 payments. For 1 of 60 CoverKids payments tested, an eligibility caseworker did not verify that the member was a U.S. citizen, U.S. national, or eligible non-citizen. According to 42 CFR 457.380(b), states must verify that all applicants, except newborns, are either a U.S. citizen, U.S. national, or eligible non-citizen before granting coverage. For this member, an eligibility caseworker requested additional documentation to confirm citizenship on December 19, 2018, with a member response due back to the division by January 11, 2019. When the member?s guardian did not return this information, an eligibility caseworker denied the member for CoverKids. According to the Eligibility Quality Control Director, after his guardian filed an appeal, a division appeals worker changed the member?s citizenship status to ?U.S. Citizen/National? without obtaining any verifying information and approved the member for CoverKids. On November 19, 2021, the Assistant Quality Control Director stated that division management initiated termination for this member. We identified federal questioned costs totaling $72 and an additional $18 in state questioned costs associated with this member. As noted above, for major programs, such as CHIP, we are required to report known and likely questioned costs greater than $25,000 for a type of compliance requirement for a major program. Based on our review, we determined that likely questioned costs exceeded $25,000. Most noncitizen legal residents living in the United States cannot receive Medicaid for the first five years of residency, known as the ?five-year bar.? However, eligible noncitizens, such as asylees and refugees, do not have a five-year waiting period. Expanded Postpartum Member Testwork For 12 payments included in our sample, the members who received coverage qualified for the CoverKids program due to their pregnancy status. Based on the results of our initial testwork, all 12 payments in our sample were made while these members were eligible for CoverKids benefits. However, during our review, we noted that the division?s federal grantor, the Centers for Medicaid and Medicare Services (CMS), published guidance through a January 6, 2021, Frequently Asked Questions (FAQ) for the Family First Coronavirus Response Act. According to the FAQ, states should resume terminations during the public health emergency for members enrolled in CHIP who qualified for the program due to their pregnancy status at the conclusion of their postpartum period provided they do not qualify for another program. Therefore, we expanded our review to determine whether the division appropriately terminated CoverKids membership after the postpartum period for the 12 members included in our sample. Based on our review, for 7 of the 12 members tested (58%), we determined that the division did not terminate coverage after the member?s postpartum period ended, which resulted in payments on behalf of ineligible individuals. The division?s Eligibility Quality Control Director stated that the division implemented TEDS system updates to review and process terminations for postpartum members on February 28, 2021. On March 17, 2021, the division began an automated process to terminate the members? benefits. Based on our review, TEDS generated pre-termination notices to these individuals, but TEDS did not terminate benefits when the members did not respond to the notices. Representatives from the contractor responsible for TEDS maintenance stated that a subsequent TEDS update on April 1, 2021, unintentionally overrode the changes. Prior to the April 1, 2021, implementation of the TEDS update, management tested and approved the update, but the testing did not identify the issue. Prior to our audit engagement, management was unaware of the system error. According to division management, the TEDS contractor developed a new TEDS system update that was implemented on December 13, 2021, to correct the system issue to terminate the members? postpartum benefits. We will review management?s system fixes which were implemented after the end of our audit scope of June 30, 2021, during TennCare?s 2022 Single Audit. As a result of these errors, we identified $8,055 in federal questioned costs and an additional $3,086 in state questioned costs. For major programs, such as CHIP, 2 CFR 200.516(a)(3) requires us to report known and likely questioned costs greater than $25,000 for a type of compliance requirement for a major program. Because our 60-member sample included 12 members who were eligible based on pregnancy and 7 of those 12 (58%) should have been terminated, we believe likely questioned costs could exceed $25,000. Risk Assessment We reviewed the Division of TennCare?s December 2020 Financial Integrity Act Risk Assessment and determined that management listed the risk of an eligibility caseworker or TEDS performing inaccurate eligibility determinations, member case changes, and redeterminations. Management identified two controls to mitigate these risks: TEDS will generate standard and specialized reports relating to system functionality and worker performance; and the Compliance and Policy Group will monitor the performance of the interfaces that feed information from, and into, TEDS. However, based on the results of our review, these controls were not sufficient to address the identified risks. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,? 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. Effect When division staff and TEDS do not process CoverKids eligibility determinations correctly, the division increases the risk of keeping ineligible individuals on its membership rolls, thereby allowing them to receive a public benefit they are not entitled to receive and rendering related costs unallowable. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include requiring reimbursement instead of advance payments; not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; requiring additional, more detailed financial reports or additional project monitoring; requiring the agency to obtain technical or management assistance; or establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include temporarily withholding payments until the noncompliance has been corrected, denying the use of funds, partly or fully suspending or terminating the federal award, suspending or debarring the agency, withholding further awards for the project or program, or pursuing other available legal remedies. Recommendation The Assistant Commissioner of Member Services should ensure that eligibility caseworkers are fully trained so that they understand their responsibilities relating to CHIP eligibility and can properly determine if the members are eligible for CoverKids benefits. In addition, the Assistant Commissioner should work with the TEDS contractor to ensure the system fix is operating as designed. Furthermore, the division should determine any additional inappropriate payments made on behalf of members whose postpartum eligibility period had ended and return those payments to the federal government. Management should evaluate the effectiveness of control activities for the risks identified in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. During the review period TennCare processed almost 350,000 applications and took action on hundreds of thousands of existing cases. Even though we now have a modern eligibility determination system that can automatically process much of this work, worker intervention is still necessary for many cases. To ensure that TennCare eligibility workers provide the highest quality for our applicants and members, TennCare currently has more controls in place than we ever have before. These include, but are not limited to, the following: Robust case reading process that includes monthly goals and scores, as well as targeted improvement On a monthly basis each manager of TennCare eligibility workers reviews cases determined by each staff member and inputs quality scores into a case reading tool. There are measures in place to ensure that managers are scoring cases uniformly and the items being reviewed are aligned with state and federal audits. Quality goals are incorporated in Individual Performance Plans and staff who consistently miss goals are put on Performance Improvement Plans. Each eligibility worker can review their findings in published reports, and those reports can be viewed at the unit or division level. Monthly conferences are held to discuss case read findings and broad findings can result in policy updates or new training materials. The Member Services Quality team reviews additional cases of workers who do not meet their quality goals in a given month. This is a process that began in December 2020 and has been praised by federal auditors who recently reviewed the TennCare eligibility process. During the last employee review cycle 97% of all cases reviewed within the TennCare Member Services Eligibility Operations Group met quality standards. New worker secondary review process Newly hired staff are not permitted to perform final case authorizations without supervisor review for the first three months of employment. If the underlying case action is not correct upon supervisor review, managers will provide targeted coaching to correct the behavior. This secondary review process is also used for seasoned employees whose quality case reading scores are not sufficient. This is a tool used while caseworkers are undergoing Process Improvement Plans. Process Improvement Plans (PIPs) Process Improvement Plans are used to help eligibility caseworker staff meet quality and production goals. They involve a focused support between the employee?s manager and a member of the TennCare Human Resources staff. Weekly meetings are held and the number of cases read are more than doubled until the employee has improved to an acceptable level. If performance does not improve, the employee may be dismissed. Reports The TennCare Eligibility Determination System provides a reporting dashboard that allows management more access to eligibility data than ever before. With this data we have created dashboards at multiple levels that display quality reviews and scores down to the individual worker level. We also have daily reports that identify pending cases by worker queue that managers review throughout the day. The system also allows management a real time view into task volume and age, which is used to ensure work is being completed in a timely manner and allows TennCare to identify problems or anomalies quickly. Although human error will never be fully eliminated in such a complicated program, one way we have been working towards that goal is by improving training for Member Services staff. As discussed in the FY2020 audit, we completed an overhaul of training materials in 2021. We have begun training new staff using the revised curriculum. Beginning in February 2022 we will start retraining existing Member Services staff with a focus on business processes and more hands-on system scenarios. By mid-year 2022 all staff responsible for processing cases will receive new computer-based training related to the processing of cases, including income determinations. The training will consist of assigned computer-based training, quizzes, and a virtual lab. During the lab, they will work independently to complete several practice scenarios followed by a final practice which serves as the assessment. There will be a facilitator available throughout the lab session to answer any questions. Once an assessment is passed, workers will proceed to the next section. Additionally, all newly-hired staff attend facilitator-led training that includes both policy and systems focused learning. Guided practices and independent practices are included for each unit of training. New employees are also tested with independent practices. Furthermore, all eligibility caseworkers also receive unit-specific training, special trainings when problem areas are identified, and weekly meetings with subject matter experts to discuss refresher policies arising from case reading common errors. TennCare does work with the TEDS contractor to continually monitor and assess the TEDS system performance to ensure it correctly processes determinations and terminations. There are robust escalation channels for eligibility or appeals staff to identify issues and raise those both internally and to our systems vendor for analysis and resolution, including promotion of new code. TennCare continually assesses those escalation pathways to look for ways to improve the system. The global pandemic has impacted system performance in many ways. First, annual renewals which reassess member eligibility have been suspended due to the public health emergency since March 2020. Second, TennCare was required to hold most negative eligibility actions during the public health emergency and many of the systematic changes necessary to effectuate that moratorium was completed through temporary data fixes rather than coding changes. This decision was made in March 2020 when we believed the pandemic would be a short-term concern. These data fixes have been difficult to manage over the last two years but will allow TennCare to unwind the moratorium more quickly once the global pandemic ends. Based on late 2020 updated guidance from the Centers for Medicare and Medicaid Services, TennCare?s federal oversight partner, changes were made to the TEDS system in March 2021 to begin reviewing for continued eligibility then potentially terminating a portion of CoverKids members who recently gave birth. This process began in March 2021 and included all cases that had been held open since the COVID-19 public health emergency began. In April 2021 another change to system then negatively impacted the plans to close coverage based on no response to notices mailed to the 12 members in this audit. This systems issue was then corrected in December 2021. TennCare is working with the TEDS contractor to ensure this type of error does not occur in the future. A testing expert has joined the project to assess internal testing processes and to develop a plan to enhance regression testing that will automatically run after every new code release. This will help to confirm that a recent program or code change has not adversely affected existing systems processes. Further, TennCare has recently requested additional state staff to assist with testing within Member Services and has a plan to augment this testing team with contractors. Finally, the auditors have suggested that TennCare reimburse the federal government for the months when these new mothers retained coverage. Our accounting division will return funds as determined and required. TennCare does have a dedicated audit-focused team within the Member Services Compliance and Policy Group who is assigned to draft the annual risk assessment and monitor controls, along with leadership in various units in Member Services. We will review our risk assessment and make appropriate updates.

Finding Number 2021-011 Assistance Listing Number 93.767 and 93.778 Program Name Children?s Health Insurance Program (CHIP) Medicaid Cluster Federal Agency Department of Health and Human Services State Agency Department of Finance and Administration Federal Award Identification Number 2005TNIMPL, 2005TNINCT, 2005TN5MAP, 2005TN5ADM, 2105TNIMPL, 2105NV5MAP, 2105NV5ADM, 2105TNINCT, 2105TN5MAP, 2105TN5ADM, 2005TN5021, 2105TN5021 Federal Award Year 2020 and 2021 Finding Type Material Weakness and Noncompliance Compliance Requirement Other Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A The Division of TennCare did not implement adequate internal controls in two specific areas The Division of TennCare did not design and monitor internal controls in two areas. During our audit, we identified one internal control deficiency that was in violation of entity policies or industry-accepted best practices. Subsequent to our audit fieldwork, division management became aware of another internal control deficiency that was in violation of entity policies or industry-accepted best practices. We reviewed the division?s December 2020 Financial Integrity Act Risk Assessment and determined that management listed risks relating to these areas; however, the division did not have an effective control to mitigate the risks. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,??? 7.09?. . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions.? ?Ineffective implementation and operation of internal controls increases the likelihood of error, data loss, and unauthorized access to Division of TennCare information. Pursuant to Standard 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards, we omitted details from this finding because they are confidential under the provisions of Section 10-7-504(i), Tennessee Code Annotated. We provided the Division of TennCare with detailed information regarding the specific conditions as well as the related criteria, causes, and our specific recommendations for improvement. Recommendation Management should ensure that these conditions are corrected by the development and effective implementation of internal controls in these areas. Management should implement effective controls to ensure compliance with applicable requirements, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action when deficiencies occur. Management?s Comment We concur with this finding. A combination of ineffective communication in addition to human error led to the issues noted in these areas. However, at no point was there evidence of sensitive data used inappropriately or removed from any systems. As part of our corrective action, we will be implementing a new policy to address the one area in addition to new system functionality that will obtain more accurate information and improve processes in the future.

Finding Number 2021-012 Assistance Listing Number 21.019 Program Name Coronavirus Relief Fund Federal Agency Department of the Treasury State Agency Department of Finance and Administration Department of Military Federal Award Identification Number N/A Federal Award Year 2020 and 2021 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Allocable Costs/Cost Principles Repeat Finding N/A Pass-Through Entity N/A Questioned Costs $497,106 Management?s inadequate oversight of reallocation entries resulted in duplicate expenditure billings to the Coronavirus Relief Fund Background and Cause The State of Tennessee was awarded over $2.6 billion as a part of the Coronavirus Relief Fund (CRF). According to the program procedures overview for CRF in Part 4, Assistance Listing 21.019, ?Coronavirus Relief Fund,? of the uniform guidance compliance supplement, The purpose of the Coronavirus Relief Fund (the Fund) is to provide direct payments to state, territorial, tribal, and certain eligible local governments to cover: Necessary expenditures incurred due to the public health emergency with respect to Coronavirus Disease 2019 (COVID?19); Costs that were not accounted for in the government?s most recently approved budget as of March 27, 2020; and Costs that were incurred during the period that begins on March 1, 2020; and ends on December 31, 2021. The supplement also states that Governments otherwise have broad discretion to utilize payments for expenditures ranging from COVID-19 testing including, but not limited to, reimbursing small businesses for the costs of business interruption caused by required closures. In addition to CRF, the Department of Military also received funds for several other grants with the largest amount being the ?Disaster Grants ? Public Assistance (Presidentially Declared Disasters)? (FEMA Disaster Grants Program) from the Federal Emergency Management Agency (FEMA), a part of the United States Department of Homeland Security. Some costs incurred by the department were allowable under multiple programs, so management tried to allocate the costs to create the best financial benefit to the state. CRF is limited to the amount of funds sent to the state. Other programs such as the FEMA Disaster Grants Program have an unlimited amount of funds available due to approval of a major disaster declaration for Tennessee. There were several changes to policy for the FEMA Disaster Grants Program that prompted management to move costs from the CRF to the FEMA Disaster Grants Program. For example, page 1 of FEMA Policy 104-21-0003, Version 2, dated September 8, 2021, states, This updated interim policy retroactively extends the period of work eligibility to the beginning of the incident period. It also specifies that work conducted from the beginning of the incident period through December 31, 2021, will be reimbursed at a federal cost share of 100 percent. Prior to the issuance of this policy, the department was meeting the FEMA Disaster Grants Program match requirement through use of CRF funds, but this change allowed management to repurpose those funds previously used to meet the match for another purpose. These changing requirements caused the need for management to perform multiple adjustments with the last adjustments occurring in December 2021. In total, we observed over 300 summary reallocation journal entries adding or removing funds to the CRF program. We also saw examples of transactions moving back and forth between the programs more than once. Management uses Edison, the state?s accounting system, to track and account for federal funds. To differentiate between programs, management assigns project IDs to each expenditure entry. Ordinarily as allowable expenses are incurred, they are recorded in the system under one of the federal program?s associated project IDs. When management determined that a transaction initially recorded under one program could be funded by another program, management recorded a summary journal entry to reallocate costs from one program to another. One summary journal entry line may represent hundreds or thousands of underlying source transactions. Management attached as support for the summary entry the source transactions that were reallocated. Recording summary entries instead of reversing original entries means that to determine the true costs funded by a program, all reallocation journals must be considered in determining the true population. Since management?s process did not always evaluate prior reallocations, some original transactions were allocated multiple times to the CRF program as described in this finding. With increased reallocations, management should have implemented enhanced oversight of reallocation activities. This would include a more holistic approach of evaluating the effects of all previous journals when performing a reallocation. The volume of adjustments contributed to the late submission of the Schedule of Expenditures of Federal Awards (SEFA) to the Division of Accounts in the Department of Finance and Administration. The Division of Accounts is responsible for gathering SEFA information from each state agency and compiling the schedules to form the state?s SEFA. The division requested SEFA information by September 10, 2021. However, the SEFA was not submitted until January 2022. Condition and Effect Management did not have adequate procedures to ensure that items were not billed more than once to the CRF program. We identified source transactions that were allocated to the CRF program multiple times. As a result, questioned costs totaling $497,106 were noted relating to the duplicate billings to CRF. Criteria Title 2, Code of Federal Regulations, Part 200, Section 302(a), states, . . . the state?s and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the . . . tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. Recommendation Management should develop an adequate process to ensure expenditure entries are not billed to the program more than once. Management should consider a one-to-one reversal of individual Edison original transactions as opposed to the use of summary entries to adjust funding in Edison, as this would have greatly aided in the process of generating a detailed original listing of transactions ultimately billed to the program. This is especially true in cases involving a large number of adjustments such as with this program. If management does not use a one-to-one reversal process, they should consider maintaining a master list of all source transactions allocated or reallocated to the program. Management?s Comment We concur. The questioned costs totaling $497,106 have been returned to the CRF program in FY 2022, and additional Department of Military eligible costs totaling this same amount will be drawn against the CRF in FY 2022. Through this action the total CRF funds allocated and spent by the Department of Military will remain at $105,221,467. Regarding the recommendation to develop an adequate process to ensure expenditure entries are not billed to the same program more than once, the Department of Military?s accounting office, staffed by the Department of Finance and Administration, Division of Accounts, in collaboration with Department of Military (including the Tennessee Emergency Management Agency) staff have begun an enhancement and redesign of the control activities designed to address the risk of duplicate reallocations. The initial phase of this enhancement and redesign process includes the implementation of automated procedural searches of all journal entries to identify potential duplicates. For example, journal entry lines that were posted using the same key chartfields and amount are shown in the results. Additional enhancements include the consistent use of one-to-one posted Edison transaction reversals and reallocations versus summary level reversals and reallocations. This will assist in making automated procedural searches more complete. Efforts are also underway to review and improve the in-place process for the exchange of necessary reallocation data between program office and accounting office staff, as well as to explore cost effective methodologies/approaches to building and maintaining a shared database of the original source transactions underlying processed reallocations.

Finding Number 2021-013 Assistance Listing Number 21.019 Program Name Coronavirus Relief Fund Federal Agency Department of the Treasury State Agency Department of Finance and Administration Department of Human Services Federal Award Identification Number SLT0245 Federal Award Year 2021 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A The Departments of Finance and Administration and Human Services did not monitor Coronavirus Relief Fund subrecipients Background The Coronavirus Aid, Relief, and Economic Security (CARES) Act was signed into law on March 27, 2020. The CARES Act provided additional federal funds to offset the effects of the outbreak of the 2019 novel coronavirus (COVID-19) through already established federal programs, such as the Supplemental Nutritional Assistance Program (SNAP) and the Education Stabilization Fund. The CARES Act also established new programs to facilitate pandemic responses. Through the CARES Act, Congress created the Coronavirus Relief Fund (the Fund) to provide assistance to states, territories, tribes, and certain eligible local governments to cover necessary pandemic-related expenditures incurred from March 1, 2020, through December 31, 2021, that were not accounted for in the entities? most recently approved budgets. According to the ?Coronavirus Relief Fund Guidance for State, Territorial, Local, and Tribal Governments,? Volume 86, Federal Register, page 4183 (January 15, 2021), . . . a State, local, or tribal government may use payments from the Fund only to cover previously unbudgeted costs of necessary expenditures incurred due to the COVID-19 public health emergency during the covered period [March 1, 2020, through December 31, 2021].[. . .] The Direct Recipient of payments from the Fund is ultimately responsible for compliance with this limitation on the use of payments from the fund. The Department of Finance and Administration (F&A) received the Coronavirus Relief Fund award from the federal government and therefore, as the direct (or prime) recipient, was responsible for ensuring the state complied with applicable federal regulations when expending the CRF award. State leadership, through the Governor?s Financial Stimulus Accountability Group (FSAG), developed a spending plan for selected state entities, and F&A provided these entities with guidance on use of the funds, including interpretations of United States Treasury?s Federal Registers applicable to the Fund. F&A was responsible for reimbursement to these entities for eligible and allowable expenditures. Under the spending plan, FSAG directed $150 million from the Fund to the Department of Human Services (DHS) to establish the Tennessee Community CARES Program. To administer their portion of CRF for the Tennessee Community CARES Program, DHS contracted with third parties, known as grant administrators, to assist DHS with beneficiary eligibility determinations and with the review of allowable spending under the program. Condition and Cause F&A Responsibilities As the prime recipient, F&A management was ultimately responsible for ensuring the state agencies executed their responsibilities within CRF regulations, including identifying and monitoring subrecipients of the CRF federal award. F&A management informed DHS and other state agencies that the subrecipient monitoring requirement was applicable to Coronavirus Relief Fund; however, F&A management, as the prime recipient, did not ensure DHS complied with these responsibilities and fulfilled their obligations. DHS misclassified grant administrators as vendors rather than subrecipients and did not perform required subrecipient monitoring activities When DHS entered into the contract relationships with the six grant administrators, DHS classified the relationship between the state and the nonprofit entity as a vendor-type relationship. We reviewed the contracts and analyzed the nature of the grant administrators? responsibilities and found that these entities met the characteristics of a subrecipient listed in Title 2, Code of Federal Regulations, Part 200, Section 331(a), because their responsibilities aligned with those of a subrecipient and not a vendor. Under the subrecipient model, as established in 2 CFR 200.332, the pass-through entity must Evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraph (d). . . of this section [. . .] Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. On April 16, 2020, the Governor created the Financial Stimulus Accountability Group (FSAG) to aid in the proper fiscal management of stimulus funds, such as the $2.3 billion in Coronavirus Relief Funds, received by the state and created by the CARES Act. The goal of the Tennessee Community CARES Program is to provide funding to beneficiaries to allow them to respond to the impacts of COVID-19, specifically to be able to reach individuals that have lost wages and need financial, medical, housing, or food assistance, and to aid organizations in helping prevent the spread of COVID-19 through providing access to supplies. Based on the misclassification, DHS did not schedule monitoring activities through the Division of Audit Services for the grant administrators. We discussed the classification error with DHS management, and in response to this discussion, the department reviewed the characteristics of the contract and came to the same determination that the entities should have been subrecipients. DHS communicated this change to the Grant Administrators. Audit Services amended DHS?s subrecipient monitoring plan; however, the amended plan only included one of the six Grant Administrators because Audit Services only had time to monitor one Grant Administrator and did so in May 2021. Audit Services issued a report identifying instances of the Grant Administrator approving unallowable or unsupported costs that beneficiaries had included in their request for reimbursement. The department is currently pursuing the recovery of questioned costs related to this program. This was completed for the monitoring year October 1, 2020, through September 30, 2021. Effect Without an accurate determination of the subrecipient relationship, management cannot ensure established control activities are performed to ensure compliance with federal requirements. Furthermore, when F&A does not perform oversight of other state entities charged with administering the federal program, management increases the risk state agencies will not meet federal compliance requirements or fulfill their own responsibilities set for by F&A, thus increasing the risks of noncompliance with federal regulations as well as fraud, waste, and abuse in federal programs. Specifically, without these controls in place, F&A and DHS increased the risks that the Grant Administrators failed to administer the eligibility and allowable cost determinations within the federal Coronavirus Relief Funds requirements. Recommendation As the Prime Recipient of the federal award, the Commissioner of the Department of Finance and Administration should direct the department?s management and staff to design and implement internal controls to ensure that all agencies participating in temporary federal programs, such as Coronavirus Relief Funds, execute their responsibilities. F&A should develop a process to ensure subrecipients are accurately identified and properly addressed in agency risk assessments and monitoring plans when F&A collaborates with other agencies to execute a federal program. F&A and DHS management should also consider reviewing the risks identified in this finding, updating their agencies? risk assessment, and implementing controls when necessary. Management?s Comments Department of Finance and Administration We concur. As the prime recipient, F&A management will continue to communicate responsibilities and expectations to other state agencies to ensure they fulfill their federal award obligations. Specifically, F&A management will develop a process to ensure subrecipients are accurately identified and properly addressed in agency risk assessments and monitoring plans when F&A collaborates with other agencies to execute a federal program. Department of Human Services We concur. The Department concurs that the grant administrators were initially misclassified as vendors, rather than subrecipients. Management did correct the classification but agree that it was changed once the program was underway. The Department has subsequently implemented a process in which subrecipient determinations are made during the contract process ensuring accurate and timely classification. The Department concurs that required subrecipient monitoring did not completely occur during the award period. The Department?s Audit Services Division monitored two of the six grant administrators. The Department?s Audit Services Division issued the first monitoring report on August 27, 2021, the second monitoring report was issued on February 17, 2022.

Finding Number 2021-014 Assistance Listing Number 84.010, 84.027, 84.173, 84.367, 84.424, 84.425B, 84.425C, 84.425D, and 84.425R Program Name Title I Grants to Local Educational Agencies Special Education Cluster Supporting Effective Instruction State Grants Student Support and Academic Enrichment Program Grants Education Stabilization Fund Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number S010A170042, S010A180042, S010A190042, S010A200042, H027A180052, H027A190052, H027A200052, H173A180095, H173A190095, H173A200095, S367A180040, S367A190040, S367A200040, S424A180044, S424A190044, S424A200044, S425B200027, S425C200027, S425C210027, S425D200047, S425D210047, and S425R210005 Federal Award Year 2017 through 2021 Finding Type Material Weakness (84.010, 84.027, 84.173, 84.367, 84.424 and 84.425) and Noncompliance (84.010 and 84.367) Compliance Requirement Activities Allowed or Unallowed (Material Weakness ? 84.010, 84.027, 84.173, 84.367 and 84.424; Noncompliance 84.010 and 84.367) Allowable Costs/Cost Principles (Material Weakness ? 84.010, 84.027, 84.173, 84.367 and 84.424; Noncompliance ? 84.010 and 84.424) Subrecipient Monitoring (Material Weakness - 84.010, 84.027, 84.173, and 84.367, 84.424 and 84.425) Repeat Finding 2020-002 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.010 Federal Award Identification Number S010A190042, S010A200042 Amount $103,287 Questioned Costs Assistance Listing Number 84.367 Federal Award Identification Number S424A190044, S424A200044 Amount $380 As noted in the prior three audits, department management reimbursed subrecipients for costs that were unallowable or not adequately supported, resulting in $103,667 in federal questioned costs Background Education-Related Federal Program Funds The Department of Education (the department) is the pass-through entity for the following programs administered by the U.S. Department of Education: Title I Grants to Local Educational Agencies (Title I), Special Education Cluster, Supporting Effective Instruction State Grants (Title II), Student Support and Academic Enrichment Program Grants (Title IV), and Education Stabilization Fund (ESF). The department awards these federal program funds primarily to subrecipients, commonly known as the local educational agencies (LEAs). LEAs incur education-related costs, such as teacher salaries and benefits, and submit reimbursement requests to the department, using ePlan, the department?s grants management system. The ePlan system has edit checks that automatically compare an LEA?s reimbursement request line items to the LEA?s approved budget and reject any amounts that exceed the line items? budget by 10% or more. Additionally, after the LEA submits its reimbursement request, the Director of Local Disbursement or the Senior Director of Local Finance reviews the reimbursement request to ensure that ePlan correctly calculated the amounts on the reimbursement request. Once the department approves the reimbursement request, it is processed for payment. The department and the federal grantor do not require subrecipients to submit supporting documentation when filing reimbursement requests for education-related expenses; however, federal regulations require the LEAs to maintain all documentation to support their claims and to comply with federal guidelines during the reimbursement process. Title I Grants to Local Educational Agencies (Title I) is a federal program to improve the teaching and learning of children who are at risk of not meeting challenging academic standards and who reside in areas with high concentrations of children from low-income families. Pursuant to the federal Individuals With Disabilities Education Act, Special Education Cluster grants ensure that all children with disabilities receive a free, appropriate public education that emphasizes special education and related services designed to meet their unique needs. The grants also ensure that the rights of children with disabilities and their parents are protected; help states, localities, educational service agencies, and federal agencies provide for the education of all children with disabilities; and assess and ensure the effectiveness of efforts to educate children with disabilities. Supporting Effective Instruction State Grants (Title II) is a federal program to provide funds to state and local educational agencies to increase student achievement consistent with the state?s challenging academic standards; improve the quality and effectiveness of teachers, principals, and other school leaders; increase the number of teachers, principals, and other school leaders who are effective in improving student academic achievement in schools; and provide low-income and minority students greater access to effective teachers, principals, and other school leaders. The Student Support and Academic Enrichment Program is a federal program to improve students? academic achievement by providing all students with access to a well-rounded education, improving school conditions for student learning, and improving the use of technology to improve the academic achievement and digital literacy of all students. The Education Stabilization Fund is a federal program designed in part to provide state educational agencies and local educational agencies (LEAs), including charter schools that are LEAs, with emergency relief funds to address the impact that COVID-19 has had, and continues to have, on elementary and secondary schools across the nation. Department?s Responsibilities as a Grant Administrator As a pass-through entity of federal funds, the department is responsible for providing overall program oversight, which includes, but is not limited to, approving only eligible subrecipients who comply with the federal program requirements and guidelines; providing appropriate and effective training, technical assistance, and any other necessary support to facilitate a successful program participation; designing effective controls to ensure subrecipients receive reimbursement payments for expenditures that are fully compliant with program requirements and guidelines; and monitoring subrecipients? activities to provide reasonable assurance that the subrecipients administer these federal awards in compliance with federal requirements and guidelines. The department?s Division of Local Finance and Division of Federal Programs and Oversight monitor the subrecipients to ensure that the subrecipients reasonably complied with federal and state requirements. Throughout the year, the divisions monitor a sample of subrecipients for various fiscal and programmatic objectives, including a sample of reimbursement transactions the subrecipients submitted to the department and the department subsequently paid. Department?s Internal Controls for Allowable Costs As the non-federal entity, the department must implement internal controls over compliance requirements for federal awards; the controls must be designed to provide reasonable assurance that subrecipients comply with the federal grantor?s regulations. The department relies on its fiscal monitoring activities as its primary detective control to ensure subrecipients are submitting allowable expenditures for reimbursement. Prior Audit Results In the prior audit finding, we found that the department reimbursed subrecipients for unallowable and unsupported costs. The Division of Local Finance?s fiscal monitoring procedures did not require monitors to review subrecipient transactions and obtain supporting documentation for actual expenditures reimbursed. As a result, management could not ensure that LEAs complied with federal allowable activities/allowed cost reimbursements. Management concurred and stated the following: We will update the fiscal monitoring tool to implement more robust procedures for staff to follow in monitoring subrecipient transactions. The improved procedures will also require stricter controls about the adequacy of supporting documentation. Additionally, a monitoring tool will be developed allowing for more timely responses to issues and changes and requiring documentation for transactions reviewed. Management explained in their six-month follow-up that they plan to develop a new process to review, throughout the year, each LEA?s reimbursement requests for allowability and adequate supporting documentation. Management planned to roll out the new process to LEAs in July 2021, with reviews of reimbursement requests to begin in October 2021. Condition and Criteria Fiscal Monitoring Procedures Were Not Adequate to Ensure that Monitoring Activities Were Performed We found that the Division of Local Finance?s subrecipient monitoring process still did not include procedures to review the subrecipients? compliance with federal allowable activities and allowable cost requirements, including the underlying supporting documentation such as invoices and receipts for expenditure transactions. Additionally, management did not document the sampling methods used or maintain working papers or copies of other evidence to document work performed. The department relies on its fiscal monitoring activities as its primary detective control to ensure subrecipients are submitting allowable expenditures for reimbursement. However, the design of the subrecipient monitoring process as described in the background above does not ensure that, during monitoring visits, the department?s fiscal monitors review samples of supporting documentation for actual expenditures reimbursed to the LEA from federal awards. Therefore, neither management nor we could review the effectiveness of management?s control that ensures the department?s compliance with allowable costs requirements. Management is responsible for designing, implementing, and monitoring internal controls in accordance with Standards for Internal Control in the Federal Government (Green Book), which provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. The Green Book states, A deficiency in internal control exists when the design, implementation, or operation of a control does not allow management or personnel, in the normal course of performing their assigned functions, to achieve control objectives and address related risks. To achieve the department?s mission, management is responsible for establishing the necessary operational processes to carry out the department?s functions, objectives, and goals. These key operational processes should include effective internal controls activities, including management overseeing the processes that fulfill the department?s objectives for meeting federal program compliance. Department Reimbursed Subrecipients for Unallowable and Unsupported Costs We tested nonstatistical, random samples of reimbursements to LEAs. See Table 1 for the details of these populations and samples. Based on our testwork, we noted that the department reimbursed LEAs for unallowable and unsupported expenditures, resulting in $103,667 in federal questioned costs. See Schedule of Findings and Questioned Costs for chart/title. Department Reimbursed Subrecipients for Unallowable Costs Based on our testwork, we noted that department staff reimbursed subrecipients from two federal programs for unallowable expenditures, totaling $8,189 in federal questioned costs. See Table 2 for a summary of questioned costs for both of the programs. See Schedule of Findings and Questioned Costs for chart/title. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 403, Costs must meet the following general criteria in order be allowable under Federal awards: Be necessary and reasonable for the performance of the Federal award . . . [and] be adequately documented. In addition, the Tennessee Department of Education?s guidance to subrecipients, titled ?Using Federal Education Funds to Pay for Food,? states, ?Full meals for families/parents or students are not allowable for [parent engagement events] under any circumstances.? Department Reimbursed Subrecipients for Unsupported Costs Based on our review of underlying supporting documentation that the subrecipients provided for the reimbursement claims we selected for review, we noted that department staff reimbursed three subrecipients from the Title I and Title II programs for unsupported expenditures, totaling $95,478 in federal questioned costs. We asked the LEAs to provide us with documentation to support their claims to the department. The LEAs either did not provide any supporting documentation (such as paid invoices or receipts) for expenditures claimed for reimbursement, or provided supporting documentation that was incomplete. See Table 3 for a summary of questioned costs for each of the two programs. See Schedule of Findings and Questioned Costs for chart/title As noted above, 2 CFR 200.403 states that costs must be adequately documented in order to be allowable under federal awards. We questioned federal costs of $103,287 charged to the Title I program and $380 charged to the Title II program and found that likely questioned costs exceed $25,000 for both programs. Requirements in 2 CFR 200.516(a)(3) instruct us to report questioned costs when known or likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. Risk Assessment We reviewed the department?s December 2020 Financial Integrity Act Risk Assessment and determined that management listed the risk that costs charged to a federal grant are not allowable and not adequately documented under program regulations at the subrecipient level. Management listed three internal controls to mitigate the risk: Maintain a library of resources within ePlan for stakeholders and TDOE [department] staff to use, including on allowable uses; Regular technical assistance training on internal controls and program rules; and Annual risk-based monitoring for programmatic and fiscal requirements. In addition, management listed the risk that monitoring documents do not contain all the appropriate questions to determine if a district is not in compliance with state or federal law. Management listed three internal controls to mitigate the risk: The monitoring document was developed in collaboration with teams across the department; The monitoring document is updated annually in collaboration with teams across the department; [and] The monitoring document was crosschecked against the requirements outlined in ESSA [Every Student Succeeds Act] and IDEA [Individual With Disabilities Education Act]. While the listed controls are important, management did not design mitigating controls to ensure that monitors reviewed subrecipients? underlying records, based on an established sampling methodology and documentation protocol, for costs to federal programs that are not allowable or not adequately documented. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,? 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. Cause The Director stated that department staff reiterated to LEAs allowable cost guidance for issues identified in the prior finding, particularly food purchases. The Director agreed that subrecipient monitoring activities should include a review of LEAs? expenditures to ensure they are allowable and properly supported. Effect When management has not fully developed controls to ensure that monitors perform and document key activities to determine LEA compliance, management cannot ensure that subrecipients used program funds for authorized purposes. Additionally, management cannot ensure expenditures complied with federal statutes, regulations, and terms and conditions of the grant award; nor can management ensure that subrecipients achieved the subaward performance goals. The lack of mitigating controls increases the risk of noncompliance with the federal program requirements and may require the state to return these funds to the U.S. Department of Education. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include requiring reimbursement instead of advance payments; not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; requiring additional, more detailed financial reports or additional project monitoring; requiring the agency to obtain technical or management assistance; or establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include temporarily withholding payments until the noncompliance has been corrected, denying the use of funds, partly or fully suspending or terminating the federal award, suspending or debarring the agency, withholding further awards for the project or program, or pursuing other available legal remedies. Recommendation The Commissioner should ensure management implements procedures for fiscal monitoring staff to review subrecipient transactions and obtain adequate supporting documentation during monitoring activities to assist the monitors in achieving these key activities. These procedures should include clear monitoring tools and sampling methodologies to guide the monitoring activities. The Commissioner should also continue to ensure program staff train and provide technical assistance to subrecipients about allowable program expenditures and the requirement to maintain documentation to support reimbursed expenditures. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. The department?s Chief of Districts and Schools will ensure the Division of Local Finance and Division of Federal Programs and Oversight will implement effective controls to address the risks noted in this finding, update the department?s risk assessment as necessary, and take the necessary action if deficiencies are identified. As part of the department?s continuous improvement process, staff within the Division of Local Finance and Division of Federal Programs and Oversight staff will be assigned to continually monitor risks and assess mitigating controls. Procedures will be reviewed and revised as needed to ensure clear monitoring tools and sampling methodologies guide the agency?s monitoring activities and current best practices. In addition, the department?s Division of Local Finance and Division of Federal Programs and Oversight will continue to ensure program staff train and provide technical assistance to subrecipients about allowable program expenditures and the requirement to maintain documentation to support reimbursed expenditures.

Finding Number 2021-015 Assistance Listing Number 84.010, 84.367, 84.424, and 84.425D Program Name Title I Grants to Local Educational Agencies Supporting Effective Instruction State Grants Student Support and Academic Enrichment Program Education Stabilization Fund Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number S010A170042, S010A180042, S010A190042, S010A200042, S010A210042, S367A170040, S367A180040, S367A190040, S367A200040, S424A170044, S424A180044, S424A190044, S424A200044, S425D200047, and S425D210047 Federal Award Year 2017 through 2020 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility (84.010, 84.367, 84.424, 84.425) and Earmarking (84.010) Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A Department management did not appropriately calculate grant allocations to local educational agencies Background The Tennessee Department of Education (the department) is the pass-through entity for federal programs and distributes funds to the state?s 146 local educational agencies (LEAs) under the following programs administered by the U.S. Department of Education (USDOE): Title I Grants to Local Educational Agencies (Title I), Supporting Effective Instruction State Grants (Title II), Student Support and Academic Enrichment Program Grants (Title IV), and the Elementary and Secondary School Emergency Relief (ESSER) component of Education Stabilization Fund Title I Grants to Local Educational Agencies is a federal program to improve the teaching and learning of children who are at risk of not meeting challenging academic standards and who reside in areas with high concentrations of children from low-income families. Supporting Effective Instruction State Grants is a federal program to provide funds to state and local educational agencies to increase student achievement consistent with the state?s challenging academic standards; improve the quality and effectiveness of teachers, principals, and other school leaders; increase the number of teachers, principals, and other school leaders who are effective in improving student academic achievement in schools; and provide low-income and minority students greater access to effective teachers, principals, and other school leaders. The Student Support and Academic Enrichment Program is a federal program to improve students? academic achievement by providing all students with access to a well-rounded education, improving school conditions for student learning, and improving the use of technology to improve academic achievement and digital literacy of all students. The department received federal funding as presented in Table 1. See Schedule of Findings and Questioned Costs for chart/table. Department?s Responsibilities as a Grant Administrator As outlined in Title 2, Code of Federal Regulations (CFR), Part 200, Sections 303 and 329, as a grant administrator for federal funds, the department must establish and maintain effective internal control over the federal award that provides reasonable assurance that the department manages and complies with the federal award statutes, regulations, and terms and conditions; and evaluate and monitor the department?s compliance with statutes, regulations, and terms and conditions of federal awards. Overview of Allocation Distribution by Funding Source Title I Title I is comprised of four grant formulas: basic, concentration, targeted, and education finance incentive grants. USDOE determines the amount to allocate to each state and how much should be allocated to each LEA based on their formula children counts. When applicable, the department must then adjust the USDOE allocation amounts for 1. when LEAs consolidate or separate, when area boundaries are redrawn, or when changes have occurred since the Census Bureau updated its list of LEAs; and 2. special LEAs that are not on the list of traditional LEAs provided to the USDOE by the Census Bureau. For all students enrolled in special LEAs, the department must determine under which traditional LEA the student is counted. The department uses this information to transfer funding from the traditional LEA to the special LEA based on the formula children criteria. Once the department adjusts the original USDOE allocation for the special LEAs, it must then further adjust the allocations to ensure each LEA receives at least its hold-harmless amount. The department determines which LEA allocations do not meet the LEAs? hold-harmless amount and proportionately reduce or raise allocations to meet the hold-harmless amount. Title II USDOE provides the department with Title II funding totals but does not determine how much should be allocated to each LEA. To allocate Title II funding, the department reduces the total funding by the state?s administration and activities set-aside and then allocates the remaining funds to the LEAs. The amount allocated to each LEA is determined based on the following: 20% based on the number of children ages 5 to 17 residing in the LEA?s area; and 80% based on the number of children ages 5 to 17 residing in the LEA?s area with families below the poverty line. To determine the allocation to special LEAs, staff use population counts that they determined during the Title I allocation process as described above. Title IV and ESSER The department uses the Title I allocations to determine Title IV and ESSER allocations to LEAs. Title IV allocations should be proportionate to the Title I allocations the LEA received in the preceding fiscal year. ESSER allocations should be proportionate to Title I allocations for the most recent fiscal year. Federal Notice of Noncompliance Department?s Noncompliance In April 2021, the USDOE?s Office of Elementary and Secondary Education (OESE) conducted a performance monitoring review of multiple programs and found the department incorrectly calculated its funding allocations to LEAs under the Title I and Title II programs. Because the department must use the Title I allocations to determine Title IV and ESSER allocations to LEAs, the department also incorrectly allocated these programs. OESE stated in the Tennessee Consolidated Performance Review Report #2 of 2 FY 2021, dated November 30, 2021, that for the special LEAs, the department determines their allocations for [Title I and Title II] based on their enrollment. This approach is inconsistent with the requirements . . . for Title I, Part A because [the department] does not derive a Title I, Part A formula count for these LEAs or determine whether they meet the eligibility criteria under each formula. The approach is also inconsistent with the Title II, Part A requirements . . . because [the department] is allocating 100 percent based on the number of students in the LEA rather than 20 percent. OESE also found that the department did not apply hold-harmless requirements for Title I for each of the four formula grants. The department instead determined if LEAs met hold-harmless requirements based on the total Title I allocations. Department?s Planned Corrective Action The department began working with OESE in late summer/fall of 2021 to develop and implement corrective action. Management developed updated procedures to calculate Title I and Title II allocations and obtained approval from OESE to continue with allocation corrections for fiscal years 2018 through 2022 using those procedures. As of January 12, 2022, management was developing a plan to pay LEAs that were under allocated using other available federal funds. Once they develop this repayment plan, management indicated they must obtain approval from OESE before implementing it. Condition Noncompliance As part of our Single Audit, under the Office of Management and Budget Compliance Supplement, the following audit objectives are applicable for the Title I and Title II federal program: Eligibility ? Determine whether amounts provided to subrecipients were calculated in accordance with program requirements. Earmarking ? Determine whether minimum or maximum limits for specified purposes were met. During our audit fieldwork, department management informed us about OESE?s performance monitoring review results regarding the department?s incorrect calculations for Title I and Title II allocations, the effect the errors had on Title IV and ESSER allocations, and the department?s incorrect calculation of Title I hold-harmless earmarking requirement. As such, we did not perform further tests on these objectives based on the noncompliance reported in OESE?s review. See also Finding 2021-016 regarding the department?s noncompliance in calculating Title IV allocations, and how the Title I noncompliance further compounded that Title IV issue. Risk Assessment Because of the issues we identified, we reviewed the department?s December 2020 Financial Integrity Act Risk Assessment and determined that management listed the risk of inadequate controls over the data and the funding calculation for Every Student Succeeds Act allocation for school districts. Management listed ?experienced staff with detailed understanding of the mechanics? as a control to mitigate the risk; however, the control, as noted by management in our discussions, was adversely impacted due to turnover of experienced staff. Without having appropriate risk response to identify, analyze, and respond to changes, management fails to mitigate the risk and increases the likelihood of error and noncompliance. Cause and Effect The incorrect Title I allocations rendered Title IV and ESSER allocations incorrect, which resulted in the department over- or underfunding LEAs in four federal programs for each of the last five fiscal years. Federal requirements for these programs changed when the Every Student Succeeds Act (ESSA) was passed in fiscal year 2016, and department management indicated that they did not have to adjust allocations until fiscal year 2018. According to the department?s Chief of Districts and Schools, management failed to update their procedures based on new ESSA requirements because of experienced staff turnover and the remaining staff being unaware of federal program requirement changes; therefore, staff continued with the same allocation procedures until OESE notified them that their procedures were incorrect. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include requiring reimbursement instead of advance payments; not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; requiring additional, more detailed financial reports or additional project monitoring; requiring the agency to obtain technical or management assistance; or establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include temporarily withholding payments until the noncompliance has been corrected, denying the use of funds, partly or fully suspending or terminating the federal award, suspending or debarring the agency, withholding further awards for the project or program, or pursuing other available legal remedies. Criteria Title I In its review report, OESE summarized 34 CFR 200.72 and stated that for each special LEA, management must estimate the number of Title I, Part A formula children for that LEA by deriving the equivalent of the most recently available poverty estimates from the U.S. Census Bureau?s Small Area and Income Population Estimates (SAIPE) branch, which the Department provides to each [state]. [A state] must then use the derived formula count to determine whether the LEA meets the eligibility criteria under each Title I, Part A formula. In addition, 34 CFR 200.73 indicates that a state ?may not reduce the allocation of an eligible LEA below the hold-harmless amounts? and requires the state to ?apply the hold-harmless requirement separately for basic grants, concentration grants, targeted grants, and education finance incentive grants.? Title II OESE explained in their review that, according to ESEA, the department must allocate Title II funds in the following manner: 20 percent of these funds to LEAs based on the relative number of individuals ages 5 through 17 who reside in the area the LEA serves based on the most recently available data from the U.S. Census Bureau?s SAIPE branch or equivalent data derived by the [department] for LEAs for which SAIPE estimates are not available; and 80 percent of these funds to LEAs based on the relative numbers of individuals ages 5 through 17 who reside in the area the LEA serves and who are from families with incomes below the poverty line (based on the most recently available data from the U.S. Census Bureau?s SAIPE branch or equivalent data derived by the [state] for LEAs for which SAIPE estimates are not available). Risk Assessment The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,? 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. According to Principle 9, ?Identify, Analyze, and Respond to Change,? 9.03 Conditions affecting the entity and its environment continually change. Management can anticipate and plan for significant changes by using a forward-looking process for identifying change. Management identifies, on a timely basis, significant changes to internal and external conditions that have already occurred or are expected to occur. Changes in internal conditions include changes to the entity?s programs or activities, oversight structure, organizational structure, personnel, and technology. Changes in external conditions include changes in the governmental, economic, technological, legal, regulatory, and physical environments. Identified significant changes are communicated across the entity through established reporting lines to appropriate personnel. Recommendation Management should continue working with OESE to recalculate LEA allocations and make whole the underfunded LEAs. Management should also develop and implement procedures to ensure staff responsible for performing and reviewing federal award calculations are aware of current federal requirements. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. The department?s Chief of Districts and Schools will continue to work with the U.S. Department of Education to finalize and obtain approval of a corrective action plan and once approved will promptly address the LEAs Title I, II and Title IV allocations for fiscal years 2018 through 2022 as needed. The department?s Division of Local Finance and Division of Federal Programs and Oversight will implement revised controls to address the risks noted in this finding. This work will include updating the department?s risk assessment as necessary, professional development and taking the necessary actions if deficiencies are identified. Internal controls will be developed to ensure staff responsible for performing and reviewing federal award calculations are aware of current federal requirements. Moving forward, the department?s Office of Finance will serve as a secondary internal check prior to annual allocations being released.

Finding Number 2021-016 Assistance Listing Number 84.424 Program Name Student Support and Academic Enrichment Program Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number S424A170044, S424A180044, S424A190044 and S424A200044 Federal Award Year 2017 through 2021 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A Department management did not calculate and allocate Title IV funds to local educational agencies in accordance with federal regulations Background The Department of Education (the department) is the pass-through entity for the Student Support and Academic Enrichment program (Title IV), which is administered by the U.S. Department of Education. The state department awards Title IV funds primarily to subrecipients, commonly known as local educational agencies (LEAs). To be eligible for Title IV funds, the LEA must have received Title I allocations in the state?s previous fiscal year. Each fiscal year, based on a federal grant formula, the department?s Office of the Chief Financial Officer (OCFO) calculates how much to allocate to each LEA. Each eligible LEA receives a minimum of $10,000 in Title IV funding. Currently, the state has 146 LEAs, and because all receive Title I funds, they were all eligible for Title IV funding. The LEA can use the Title IV funds to accomplish the program?s objective to improve students? academic achievement, or the LEA can transfer the Title IV funds to other federal programs that improve the teaching and learning of children. If the LEA decides to use the funds for Title IV program objectives, the LEA must submit an application describing how it will use the funds to improve students? academic achievement. Criteria, Condition, and Cause Deficient Allocation Process Controls Result in Noncompliance with Federal Regulations The federal Every Student Succeeds Act (ESSA) requires the department to use prior fiscal year Title I LEA allocations as the basis for its calculation of Title IV funds. For state fiscal year 2021, the department?s allocation process involved the department?s OCFO calculation and allocation of Title IV funding totaling $21,696,793 to a population of 146 LEAs. From our review, we found that OCFO staff did not accurately calculate Title IV funds for 139 of 146 LEAs (95%), because OCFO staff used the current fiscal year?s Title I allocations, instead of the prior year. We reperformed the calculations and determined that the remaining 7 LEAs correctly received the $10,000 minimum allocation. We learned that OCFO staff has not correctly calculated the Title IV allocations since fiscal year 2018 when the Every Student Succeeds Act (ESSA) changed the allocation requirements. According to current management, the staff responsible for calculating the Title IV allocations misunderstood the federal guidance, and neither former (management in place for 2018) nor current management identified the calculation/allocation errors until we brought the errors to their attention. In addition, the Assistant Commissioner of Federal Programs and Oversight stated that the department experienced staff turnover in key management roles, which resulted in a disruption in recordkeeping and staff?s unfamiliarity with the new guidance from the U.S. Department of Education. In our effort to determine the impact of management?s errors in the LEA Title IV allocations, we were also informed by the former Chief Financial Officer that management had Title I funding errors which directly impacted the Title IV calculations/allocations. As discussed in Finding 2021-015 and reported in the U.S. Department of Education?s Tennessee Consolidated Performance Review Report, the department also incorrectly allocated Title I funds to LEAs for fiscal years 2018 through 2022. Since Title I allocations are the basis for Title IV allocations, and the prior fiscal year?s (fiscal year 2020 for the current audit) Title I allocations were incorrect, neither management nor we were able to recalculate or determine the correct Title IV allocations for fiscal year 2021. According to the Chief of Districts and Schools, as of January 12, 2022, management was developing a corrective action plan based on the issues noted in the performance report and a repayment plan to pay LEAs that were under allocated using other available federal funds; however, the department must obtain approval from the U.S. Department of Education before implementing. Once this approval is obtained, management plans to recalculate Title IV allocations using the prior year?s correct Title I allocations for fiscal years 2018 through 2022 to address the issues noted in this finding. Risk Assessment Because of the issues we identified during our audit, we reviewed the department?s December 2020 Financial Integrity Act Risk Assessment and determined that management listed the risk of inadequate controls over the data and the funding calculation for ESSA allocations for school districts. Management listed ?experienced staff with detailed understanding of the mechanics? as a control to mitigate the risk; however, the control, as noted by management in our discussions, was adversely impacted due to turnover of experienced staff. Without having an appropriate risk response to identify, analyze, and respond to changes, management fails to mitigate the risk and increases the likelihood of error and noncompliance. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,? 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. According to Principle 9, ?Identify, Analyze, and Respond to Change,? 9.03 Conditions affecting the entity and its environment continually change. Management can anticipate and plan for significant changes by using a forward-looking process for identifying change. Management identifies, on a timely basis, significant changes to internal and external conditions that have already occurred or are expected to occur. Changes in internal conditions include changes to the entity?s programs or activities, oversight structure, organizational structure, personnel, and technology. Changes in external conditions include changes in the governmental, economic, technological, legal, regulatory, and physical environments. Identified significant changes are communicated across the entity through established reporting lines to appropriate personnel. Effect When LEAs do not receive funding as intended by both the federal and state grantors, the underfunded LEAs may lose opportunities to accomplish the program?s objective to improve students? academic achievement. In addition, when the state department allocates LEA funding above the prescribed formula, management may have to identify new funding sources to avoid the potential negative consequences associated with asking LEAs to repay/refund the overallocation resulting from the department?s error . Recommendation The Commissioner should establish the necessary internal controls to ensure staff have the knowledge and expertise to carry out the objectives of the federal program. The Commissioner should also ensure that department staff perform the Title IV allocation calculations in accordance with program guidance and provide LEAs with the appropriate allocations as soon as feasible. Management and staff should continue to work with the U.S. Department of Education to finalize and obtain approval for their corrective action plan and, once approved, promptly address the LEAs Title I and Title IV allocations as needed. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. The department?s Chief of Districts and Schools will continue to work with the U.S. Department of Education to finalize and obtain approval of a corrective action plan and once approved will promptly address the LEAs? Title I, Title II, and Title IV allocations for fiscal years 2018 through 2022 as needed. The department?s Division of Local Finance and Division of Federal Programs and Oversight will implement revised controls to address the risks noted in this finding. This work will include updating the department?s risk assessment as necessary, professional development and taking the necessary actions if deficiencies are identified. Internal controls will be developed to ensure staff responsible for performing and reviewing federal award calculations are aware of current federal requirements. Moving forward, the department?s Office of Finance will serve as a secondary internal check prior to annual allocations being released.

Finding Number 2021-017 Assistance Listing Number 84.010, 84.367, 84.425C, 84.425D, and 84.425R Program Name Title I Grants to Local Educational Agencies Supporting Effective Instruction State Grants Education Stabilization Fund Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number S010A170042, S010A180042, S010A190042, S010A200042, S367A180040, S367A190040, S367A200040, S425C200027, S425D200047 and S425R210005 Federal Award Year 2020 and 2021 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A Fiscal staff for the Department of Education did not comply with Federal Funding Accountability and Transparency Act reporting requirements for the Education Stabilization Fund Background The Department of Education (the department) is the pass-through entity for the following programs administered by the U.S. Department of Education: Title I Grants to Local Educational Agencies (Title I), Supporting Effective Instruction State Grants (Title II), and Education Stabilization Fund (ESF). The ESF program combines federal disaster relief funding managed by the U.S. Department of Education from the Coronavirus Aid, Relief, and Economic Security (CARES) Act; the Coronavirus Response and Relief Supplemental Appropriations Act of 2021; and the American Rescue Plan Act of 2021. The ESF is composed of four primary subprograms: the Elementary and Secondary School Emergency Relief (ESSER) Fund, the Governor?s Emergency Education Relief (GEER) Fund, the Emergency Assistance to Non-Public Schools (EANS) Fund, and the Higher Education Emergency Relief Fund (HEERF). Reporting for the Federal Funding Accountability and Transparency Act The Federal Funding Accountability and Transparency Act (FFATA) requires the department to report subrecipient subaward financial information through the FFATA Subaward Reporting System (FSRS) for all subawards over $30,000. According to federal regulations, reports are due ?no later than the end of the month following the month in which the obligation was made.? The subaward information in FSRS is then available to the public on the USA Spending website for transparency. For the Education Stabilization Funds, the department?s fiscal staff determine the eligible award amount for each subrecipient and enter the amount in ePlan, the department?s grants management system. For the subrecipient to receive the grant awards, program staff require the subrecipient to submit an application through ePlan summarizing how the subrecipient plans to use the grant funds to achieve the program objectives. Once staff review and the applicable program?s director approves the application, the subrecipient can request reimbursement from the grant award. Program staff issue a Grant Award Notification letter to the subrecipients with the grant information and award amounts. Program staff provide fiscal staff with a copy of the Grant Award Notification letter, which includes the subrecipient?s name, award amount, Data Universal Numbering System (DUNS) number, and grant award terms and conditions. Fiscal staff use the Grant Award Notification Letter to report subawards that are over $30,000 in FSRS. Condition and Cause Reporting From ePlan, we obtained a population of 854 Title I, Title II, and ESF subawards. We then filtered the population to only include subawards over $30,000, to determine if the department complied with FFATA reporting requirements. See Table 1 for a breakdown of each program and subprogram. See Schedule of Findings and Questioned Costs for chart/table. From our filtered population of 748 subawards, we selected a nonstatistical, random sample of 87 subawards over $30,000. Based on our review, fiscal staff did not report subawards or did not timely report subaward information in FSRS as required; see Table 2. See Schedule of Findings and Questioned Costs for chart/table. Out of 87 subawards in our sample testwork, we found that fiscal staff did not report and did not timely report 25 subawards (29%) for the programs as shown in Table 3. See Schedule of Findings and Questioned Costs for chart/table. In addition to our sample results as noted in Table 3, we were also told by fiscal staff that they did not report any EANS subawards, including our 8 errors, for a total of 97, and they did not report 2 additional GEER subawards not included in our sample. As of December 9, 2021, fiscal staff still had not reported 1 EANS, 3 GEER, and 1 ESSER subawards. Based on discussion with fiscal staff, a lack of communication between fiscal and program staff resulted in the FFATA reporting errors. The department?s business practice allows subrecipients to use the grant funds once the program director approves the subrecipient?s application and the allocated amount is entered into ePlan, thus creating an obligation subject to FFATA reporting. According to fiscal staff, they report subaward information to FSRS based on information from the grant award notification letters they receive from program staff; however, program staff did not provide grant award notification letters to fiscal staff or did not provide the letters to fiscal staff timely to comply with FFATA reporting. Risk Assessment We reviewed the department?s December 2020 Financial Integrity Act Risk Assessment and determined that management listed the risks of inaccurate and untimely FFATA reporting to FSRS; however, management labeled the risk ?not applicable? to the department and did not include a mitigating control. Criteria Reporting Appendix A to ?Reporting Subaward and Executive Compensation Information,? Title 2, Code of Federal Regulations (CFR), Part 170, states: Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). Where and when to report. The non-Federal entity or Federal agency must report each obligating action described in [the previous paragraph] of this award term to http://www.fsrs.gov. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2010.) What to report. You must report the information about each obligating action that the submission instructions posted at http://www.fsrs.gov . . . Risk Assessment The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.09, ?Response to Risks,? Based on the selected risk response, management designs the specific actions to respond to the analyzed risks. The nature and extent of risk response actions depend on the defined risk tolerance. Operating within the defined risk tolerance provides greater assurance that the entity will achieve its objectives. Performance measures are used to assess whether risk response actions enable the entity to operate within the defined risk tolerances. When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. Effect Not meeting the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include requiring reimbursement instead of advance payments; not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; requiring additional, more detailed financial reports or additional project monitoring; requiring the agency to obtain technical or management assistance; or establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include temporarily withholding payments until the noncompliance has been corrected, denying the use of funds, partly or fully suspending or terminating the federal award, suspending or debarring the agency, withholding further awards for the project or program, or pursuing other available legal remedies. Recommendation The Commissioner should ensure that the appropriate staff members understand the FFATA reporting requirements and report applicable subawards in accordance with those reporting requirements. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. The department?s Chief of Districts and Schools will ensure that the appropriate staff members understand the FFATA reporting requirements and report applicable subawards in accordance with those reporting requirements. The department will implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and act if deficiencies occur. Additional internal controls will be developed to ensure staff responsible for this work are aware of current requirements. As part of this process, the department?s Chief of Districts and Schools and Chief Operating Officer will assign staff to continually monitor risks and assess mitigating controls.

Finding Number 2021-018 Assistance Listing Number 10.553, 10.555, 10.556, 10.579, 21.019, 84.010, 84.027, 84.173, 84.367, 84.424, 84.425B, 84.425C, 84.425D, and 84.425R Program Name Child Nutrition Cluster Coronavirus Relief Fund Title I Grants to Local Educational Agencies Special Education Cluster Supporting Effective Instruction State Grants Student Support and Academic Enrichment Program Grants Education Stabilization Fund Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number 202020N109945, 20212(0N11(1N11(1N10)9945, 202020N850345, 202121H170345, 201818N810345, 201919N810345, 202020N810345, CARESACTCOVIDRF, S010A170042, S010A180042, S010A190042, S010A200042, H027A170052, H027A180052, H027A190052, H027A200052, H173A180095, H173A200095, S367A180040, S367A190040, S367A200040, S424A180044, S424A190044, S424A200044, S425R210005, S425D200047, S425D210047, S425C200027, S425C210027, and S425B200027 Federal Award Year 2017 through 2021 Finding Type Significant Deficiency Compliance Requirement Other Repeat Finding 2020-001 Pass-Through Entity N/A The Department of Education did not provide adequate internal controls in one specific area The Department of Education did not provide adequate internal controls in one specific area related to state systems. This condition was in violation of state policies and/or industry-accepted best practices. We reviewed the department?s December 2020 Financial Integrity Act Risk Assessment and determined that management listed risks relating to this area; however, the department did not have an effective control to mitigate the risks. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,? 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. . . . Ineffective implementation and operation of internal controls increases the likelihood of error, data loss, and unauthorized access to (audit entity) information. Pursuant to Standard 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards, we omitted details from this finding because they are confidential under the provisions of Section 10-7-504 (i), Tennessee Code Annotated. We provided management with detailed information regarding the specific conditions we identified as well as the related criteria, causes, and our specific recommendations for improvement. Recommendation Management should ensure that these conditions are corrected by the development and effective implementation of internal controls in this area. Management should implement effective controls to ensure compliance with applicable requirements, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action when deficiencies occur. Management?s Comment We concur. Corrective actions and corresponding information have been sent under separate cover in accordance with Section 10-7-504(i), Tennessee Code Annotated, for this finding. Management will evaluate and continuously monitor all implemented controls to ensure the controls effectively mitigate the identified risks. The annual risk assessment will be updated to reflect the newly implemented controls and the mitigation of the identified risk.

Finding Number 2021-019 Assistance Listing Number 10.559 Program Name Child Nutrition Cluster Federal Agency Department of Agriculture State Agency Department of Human Services Federal Award Identification Number 205TN331N1099, 205TN331N8503, 215TN331N1150, and 215TN331N1199 Federal Award Year 2020 and 2021 Finding Type] Significant Deficiency and Noncompliance Compliance Requirement Allowable Costs/Cost Principles Repeat Finding 2020-014 Pass-Through Entity N/A Questioned Costs $141,741 For the eighth year, the Department of Human Services did not ensure Summer Food Service Program for Children subrecipients submitted accurate meal reimbursement claims, resulting in $141,741 of questioned costs Background The Summer Food Service Program for Children (SFSP) is a federal program under the U.S. Department of Agriculture that provides under-resourced children with nutritious meals when school is not in session?primarily during the summer months May through September?however, the program may also provide meals during school vacation breaks or during emergency school closures from October through April. As a pass-through entity for SFSP, the Department of Human Services (DHS) is responsible for approving and contracting with local private or public nonprofit organizations, called subrecipients, to provide the meals directly to children. In order to receive a grant award from DHS, the subrecipients must be eligible to participate in the program and must comply with federal requirements. DHS must also approve the number of feeding sites each subrecipient operates. Furthermore, DHS is responsible for providing sufficient qualified consultative, technical, and managerial personnel to administer the program and monitor performance to ensure that subrecipients comply with program rules and regulations. DHS management is responsible for monitoring the subrecipients? activities to provide reasonable assurance that they administer federal awards in compliance with federal requirements. Because SFSP program management does not review supporting documentation for meal reimbursement claims before issuing payments to the subrecipients, management must rely on its Division of Audit Services to ensure subrecipients comply with federal program requirements and spend grant funds accordingly. When monitoring staff find noncompliance, the Director of Operations for CACFP and SFSP must determine the next steps to remedy the subrecipient?s noncompliance. Specifically, the director may require the subrecipient participate in additional training, or she could determine the noncompliance rises to the level of a serious deficiency. If the noncompliance warrants a serious deficiency, then the Division of Audit Services must increase the frequency of monitoring visits to once a year until the subrecipient has corrected the serious deficiency. Approved Feeding Site Capacity As part of its internal control process, DHS program management established a subrecipient application process to provide oversight and accountability for subrecipients? operations. During the application process and before subrecipients can begin in the program, DHS program staff must approve various items pertaining to the subrecipients? meal services before the subrecipients can serve meals and submit claims for reimbursement. As part of the required items, subrecipients must provide program staff the maximum number of meals per meal type (breakfast, lunch, or snack service) that can be served at each site, known as site capacity. The capacity information is stored in the Tennessee Information Payment System (TIPS). It is important to note, however, that management has not updated the TIPS system functions to analyze, identify, and prevent subrecipients from exceeding their maximum daily capacity when submitting reimbursement claims. Subrecipients who submit claims which exceed maximum site capacity should be analyzed by staff to determine whether a billing error or other noncompliance has occurred with the meal claim submission. Meal Claim Reimbursement Process During each meal service, subrecipients must complete the department-approved meal count form to document the number of meals served to children. Subrecipients use these forms to calculate reimbursement claim requests to receive payment for the meals they serve to children. Subrecipients must enter and submit total monthly meal counts to DHS through TIPS so that DHS can then review and approve the subrecipients? claims of meal services. Currently the meal counts are entered based on each individual feeding sites. DHS does not require subrecipients to submit supporting documentation when filing claims; however, federal regulations require subrecipients to maintain all documentation to support their claims at their locations and to comply with federal guidelines during the reimbursement process. Prior Audit Results As reported in the seven prior audits, we reported that DHS program and monitoring staff did not ensure SFSP subrecipients complied with established federal regulations involving documentation required to support meal reimbursement claims. DHS management concurred in part with the prior audit finding and stated, DHS continues to work to improve the successful operation of the program and the overall integrity of the SFSP. This finding is based on test work from the summers of 2019 and 2020. The data crosses program years and does not show a contextualized picture of how the SFSP program operates. By reporting information with such a lag time and including information from two different SFSP program years DHS is unable to effectively show implemented changes. DHS hopes to continue working with the state auditors in a way where the information shared can be utilized productively and DHS can support the Tennessee children and families served by this program. Current Audit Results We identified 26 subrecipients in our testwork which had also been monitored by the Division of Audit Services since 2018. Based on our review of the division?s monitoring reports, the monitors found similar issues related to these subrecipients? meal reimbursement claims, which indicates that the subrecipients have not achieved permanent corrective action and have been allowed to continue in the program. We followed up with the Director of Operations for CACFP and SFSP to determine what additional actions she uses to ensure subrecipients take corrective action based on the monitoring activities. According to the director, program staff provide training to subrecipients to reiterate federal program requirements to address subrecipient noncompliance. While training can be effective, training alone may not achieve subrecipient compliance. We also discussed with program management the steps taken when training is not sufficient to correct subrecipient noncompliance. Based on our understanding of federal regulations, when training proves ineffective, the federal regulations provide for states to initiate a serious deficiency process to address continued subrecipient noncompliance. The serious deficiency notice is designed to notify a subrecipient that permanent corrective action is expected, or the state has the authority to terminate the subrecipient from the program when the subrecipient cannot or will not establish permanent corrective action. Condition and Criteria During the fiscal year ended June 30, 2021, DHS paid 44 SFSP subrecipients a total of $30,066,384 through 216 reimbursement claims. Of that population, we tested 1 haphazardly selected monthly reimbursement claim for the 44 subrecipients and an additional monthly reimbursement claim for 6 of those subrecipients that we identified as high-risk, totaling $9,537,126. We obtained meal count documentation from each subrecipient for the selected claims submitted in TIPS. Based on our review of the subrecipients? meal count documentation, we determined that for 36 of 50 claims (72%) tested, DHS reimbursed subrecipients based on inaccurate, questionable, and unauthorized (over site capacity) meal reimbursement claims. Claims Documentation Based on Inaccurate Meal Counts Based on our testwork, we noted that for 30 of 50 claims reviewed, subrecipients could not provide documentation that matched the number of meals they submitted in TIPS as meals served. According to Title 7, Code of Federal Regulations (CFR), Part 225, Section 15(c)(1), Sponsors shall maintain accurate records justifying all meals claimed . . . The sponsor?s records shall be available at all times for inspection and audit by representatives of the Secretary, the Comptroller General of the United States, and the State agency for a period of three years following the date of submission of the final claim for reimbursement for the fiscal year. As a result, we identified $62,223 in federal questioned costs. Subrecipients Provided Questionable Meal Count Documentation Based on our review of the meal count documentation forms, for 5 of 50 meal reimbursement claims tested, subrecipients used the same photocopied form instead of completing an original meal count form for each meal service as required. From our review of the forms, the meal count forms were duplicated from another meal service as to the actual counts of meals served (e.g., a form for a breakfast service was photocopied and used for the lunch service as we could clearly establish that the tally marks and meal count totals were identical). The only discernable difference we saw on the forms consisted of changes to meal service types (such as breakfast to lunch) or dates in the signature lines, which clearly shows that the subrecipients did not prepare original forms to capture the actual meals served during each meal services, as required by federal regulations. See Exhibit 1 for an example. When feeding site staff use photocopied forms rather than initiating a new form for each meal service, there is a heightened risk of potentially fraudulent activity. See Schedule of Findings and Questioned Costs for chart/table. The 2016 Summer Food Service Program State Agency Monitor Guide states, It is very important to ensure the accuracy of meal counts, as proper meal counts play a large role in program integrity. . . . Potential common meal count problems [or] red flags [include] Recording the same number of meals served day after day. According to 2 CFR 200.403(a), costs must meet the following criteria: Be necessary and reasonable for the performance and administration of the Federal award. As a result, we identified $38,292 in federal questioned costs. Subrecipients Served and Claimed Meals Above the Approved Site Capacity Based on our review of TIPS pertaining to daily meal serving capacity and our review of the meal count documentation we obtained from the subrecipients, we noted that for 15 of 50 claims reviewed, the subrecipients claimed meals above the approved maximum daily capacity for the subrecipients? feeding sites. According to 7 CFR 225.6(d), for subrecipients that prepare their own meals, DHS is required to ensure that sites are ?approved to serve no more than the number of children for which its facilities are adequate.? For subrecipients that use a food vendor, DHS is required to ?establish for each meal service an approved level for the maximum number of children?s meals which may be served under the program.? The 2016 Summer Food Service Program Administration Guide states, Sponsors may claim reimbursement only for those meals that meet SFSP requirements. Reimbursement may not be claimed for: Meals in excess of the site?s approved level of meal service (cap for vended sponsors) (SFSP Memorandum 16-2015: Site Caps in the Summer Food Service Program: Revised, April 21, 2015) . . . Meals over the cap. . . . As a result, we identified $41,226 in federal questioned costs. Risk Assessment We reviewed the department?s 2020 Financial Integrity Act Risk Assessment and determined that management listed the risk of subrecipients submitting unsupported claims. Management identified four controls to mitigate the risk: Subrecipients undergo annual program training; Management conducts pre-operational visits for all program applicants and subrecipients with serious deficiencies noted; Management reviews monthly claims prior to acceptance; and Subrecipient monitoring efforts. Although we saw improvement in the department?s subrecipient monitoring of SFSP during our audit (detective control), we found that management is not effectively utilizing the listed controls to mitigate the risk of paying subrecipients with unsupported claims. Management?s review of monthly claims (desk review) prior to acceptance is ideally an effective control. According to the Director of Operations for CACFP and SFSP, management recognizes desk reviews as an effective tool to reduce program noncompliance. Her staff have performed desk reviews when they encounter high-risk subrecipients, but due to staffing, her team cannot perform desk reviews and process payments timely due to a short window to approve subrecipients? reimbursement claims and issue payments. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,? 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. Cause DHS program management stated that the Division of Audit Services monitors identified the same issues during their monitoring visits. The director can initiate the serious deficiency (SD) process; however, we could not determine that the director followed the SD policies, and she did not document her consideration of noncompliant subrecipients for the SD process. See Finding 2021-020 for further details. Management stated that they are working with the TIPS vendor to develop system enhancements to allow feeding sites to enter meal counts into TIPS immediately. Also, according to the Director of Operations for CACFP and SFSP, management hopes the enhancements will reduce mathematical errors and help DHS identify questionable meal count patterns and red flags. In some of these situations, management stated it is hard to apply immediate fixes because they identify them after the summer has ended. In our discussions with subrecipients, they said the errors were caused by either human error or lack of adequate subrecipient review. Subrecipients also stated that additional training provided by DHS would help reduce these errors. Effect While monitoring provides management with detective controls to identify subrecipients? errors, program management must take additional actions beyond subrecipient training and monitoring, such as issuing serious deficiency notices and terminating subrecipients who fail to implement permanent corrective action as required by program requirements, to ensure the integrity of the program. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include requiring reimbursement instead of advance payments; not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; requiring additional, more detailed financial reports or additional project monitoring; requiring the agency to obtain technical or management assistance; or establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include temporarily withholding payments until the noncompliance has been corrected, denying the use of funds, partly or fully suspending or terminating the federal award, suspending or debarring the agency, withholding further awards for the project or program, or pursuing other available legal remedies. Recommendation As the pass-through entity, DHS has the responsibility to impose additional conditions upon subrecipients who demonstrate continued program noncompliance, or take other action as described in 2 CFR 200.208 and 200.339. We recommend that DHS take the additional steps to ensure it only pays subrecipients for actual meals served to children rather than allowing the subrecipients to (intentionally or unintentionally) continue overbilling the state for federal reimbursement. This includes terminating the subrecipients from the program. Management?s Comment We concur in part. The state auditors reviewed $9,537,126 of SFSP reimbursement claims and identified an approximate 1.5% error rate. The Department continues to work to improve the successful operation of the program and the overall integrity of the SFSP. This finding is based on test work from the summers of 2020 and 2021. The data crosses program years and does not show a contextualized picture of how the SFSP program operates. By reporting information with such a lag time and including information from two different SFSP program years, the Department is unable to effectively show implemented changes. Additionally, the summers of 2020 and 2021 were heavily impacted by COVID-19, and the nationwide waivers that were implemented to support feeding children during this time. The Department is unable to determine if these waivers were considered in this casework. The Department is in the process of implementing technology that will help support SFSP Sponsors and Sites in accurate claim reporting. This solution will be implemented for use in SFSP 2022. DHS believes that technology can help to mitigate sponsor claiming errors. Condition: Claims Documentation Based on Inaccurate Meal Counts The Department concurs that inaccurate meal counts occur in the SFSP program, as it is one of the frequent issues identified in the Department?s monitoring process and the primary focus of our new technology solution for SFSP 2022. It is important to note that six of the claims included in the questioned costs are below the state threshold for collection. Condition: Subrecipients Provided Questionable Meal Count Documentation The Department concurs that questionable meal count documentation can occur in the SFSP program; however, it does not necessarily indicate that meals were not served, or costs need to be questioned. New SFSP technology for use in 2022 will allow sites and sponsors to directly submit daily meal count data to the Department, eliminating the opportunity for duplication of meal count worksheets. Condition: Subrecipients Served and Claimed Meals Above the Approved Site Capacity The Department does not concur that meals served and claimed above the approved site capacity at self-prep sites must be disallowed, and therefore there should be no questioned costs associated with this condition. All of the sites identified in this condition are considered to be self-prep. USDA memo SFSP 16-2015 Site Caps in the Summer Food Service Program: Revised states that, ?Program regulations do not require State agencies to disallow meals served to children at self-preparation sites in excess of site caps.? The Department will continue to evaluate risks, update the Department-wide risk assessment forms, and employ effective procedures to mitigate identified risks.

Finding Number 2021-020 Assistance Listing Number 10.558 and10.559 Program Name Child and Adult Care Food Program Child Nutrition Cluster Federal Agency Department of Agriculture State Agency Department of Human Services Federal Award Identification Number 215TN331N1150, 215TN331N1199, and 215TN331N2020 Federal Award Year 2021 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Allowable Costs/Cost Principles Repeat Finding 2020-015 Pass-Through Entity N/A Questioned Costs 10.558 FY2021: $18,700 10.558 FY2022: $12,574 10.559 FY2021: $88,640 10.559 FY2022: $96,313 The Department of Human Services did not ensure that Summer Food Service Program for Children and Child and Adult Care Food Program subrecipients served and documented meals according to established federal regulations, resulting in $216,227 of federal questioned costs Background The Child and Adult Care Food Program (CACFP) is a year-round food program for eligible participants at childcare centers, day care homes, after-school care programs, emergency shelters, and adult day care centers. The Summer Food Service Program for Children (SFSP) provides under-resourced children with nutritious meals when school is not in session. While CACFP can operate year-round, SFSP primarily operates during the summer months??May through September?however, the program may also provide meals during school vacation breaks or during emergency school closures from October through April. Both programs are funded by the U.S. Department of Agriculture (USDA) and administered on the state level by the Department of Human Services (DHS). DHS contracts with locally based institutions, called subrecipients, who administer the programs by providing meals. Subrecipients can participate in both programs. As a pass-through entity, DHS is responsible for ensuring that subrecipients are eligible to participate in the programs and that the subrecipients comply with federal requirements. Meal Service To ensure they serve as many individuals as practical, subrecipients may operate the programs at one or more feeding sites. DHS requires subrecipients to count meals served and record this number on a daily meal count form. Subrecipients can claim reimbursement requests only for meals that comply with program requirements, such as meals served with all required components and within DHS-approved dates and timeframes. Meal components are the USDA-required minimum portions of food components that make up a reimbursable meal for the meal type (breakfast, lunch/supper, or a snack) served. USDA-issued COVID-19 waiver The Nationwide Waiver of Meal Service Time Restrictions for Summer 2021 Operations, in effect during our audit period, allowed subrecipients to serve multiple meal types at one meal service, thereby waiving the required amount of time that must elapse between one service and the next and the duration requirements of meal services. This waiver states that subrecipients must still comply with their DHS-approved application requirements to establish official meal service start and end times at each site. Claim Reimbursement Process After the meal service, feeding site personnel then submit the meal count forms to the subrecipient, who totals the meals served by meal type for the month. The subrecipient then enters the monthly totals and submits the monthly reimbursement claim in the Tennessee Information Payment System (TIPS). In TIPS, DHS management approves the claim reimbursement, and Edison, the state?s accounting system, processes the payments to subrecipients. Department?s Subrecipient Monitoring DHS does not require subrecipients to submit supporting documentation when filing claims; however, federal regulations require subrecipients to maintain all documentation to support their claims and to comply with federal guidelines during the meal reimbursement process. DHS?s Division of Audit Services is responsible for monitoring subrecipients to obtain reasonable assurance that both subrecipients and site personnel comply with state and federal requirements. According to the Director of Audit Services, on an annual basis he performs a subrecipient risk assessment to determine which subrecipients his team will monitor during the upcoming year. When DHS monitors identify that subrecipients have not complied with federal requirements, the Division of Audit Services sends the monitoring report to program management. DHS program management addresses these meal service violations by requiring subrecipients to submit a corrective action plan, which outlines actions and steps to prevent the noncompliance from reoccurring in the future. Corrective action could also include the repayment of disallowed federal funds the subrecipient received. Program Management?s Serious Deficiency Policies A serious deficiency (SD) is a process designed to address repeated subrecipient noncompliance and achieve permanent corrective action. In accordance with federal guidelines, program management established control policies and procedures to carry out the DHS Administrative Policies and Procedures 9.03, Serious Deficiency Process for Child and Adult Care Food Program (CACFP) and Administrative Policies and Procedures 10.06, Serious Deficiency Process for Summer Food Service Program, which requires program management to start termination procedures in order to remove the subrecipient from the program and disapprove the subrecipient?s application from future program participation unless the subrecipient takes appropriate permanent corrective actions to prevent the reoccurrence of the deficiencies. The control policies also outline guidance to Food Program staff when determining whether or not findings rise to the level of a SD. According to both programs? policies, if monitoring findings rise to the level of an SD, Food Program staff use the monitoring report to develop the SD notice and will route the notice to the department?s Office of General Counsel (for CACFP only) and the Commissioner?s designee. In general, the department?s policies allow subrecipients 30 days to implement full and permanent corrective actions of the SDs or monitoring findings, unless the SD notice requires a shorter period. When Food Program management and staff issue an SD to a subrecipient, the Division of Audit Services is required to increase monitoring for this subrecipient, which management ensures by adding them to the monitoring schedule for the next year. Prior Audit Results As noted in the prior seven audits, we reported that DHS did not ensure that SFSP subrecipients served and documented meals in accordance with federal regulations. Management concurred in part and stated, DHS is committed to the success and federal compliance of our SFSP sponsors. DHS will continue to provide technical assistance and training to the sponsors in question and monitor sponsors in accordance with the federal regulations. It is the responsibility of the sponsors to serve meals in compliance with the federal regulations and DHS will continue to support this responsibility and act accordingly when compliance with the federal regulations is not upheld. Because of the continuing issues with subrecipients in the SFSP, we expanded our current testwork to include CACFP subrecipients. During our current testwork, we concluded that DHS?s technical assistance and training alone are not sufficient to ensure the integrity of either program or to correct the continuing issues with subrecipients? meal reimbursements. We found the following SFSP and CACFP federal noncompliance. Current Audit Results We identified 23 subrecipients??18 SFSP and 5 CACFP??in our testwork which had also been monitored by the Division of Audit Services since 2018. Based on our review of the division?s monitoring reports, the monitors found similar issues related to these subrecipients? meal reimbursement claims for both programs, which indicates that the subrecipients have not achieved permanent corrective action and have been allowed to continue in the program. We followed up with the Director of Operations for CACFP and SFSP to determine what additional actions she uses to ensure subrecipients take corrective action based on the monitoring activities. According to the director, program staff provide training to subrecipients to reiterate federal program requirements to address subrecipient noncompliance. While training can be effective, training alone may not achieve subrecipient compliance. We also discussed with program management the steps taken when training is not sufficient to correct subrecipient noncompliance. Based on our understanding of federal regulations, when training proves ineffective, the federal regulations provide for states to initiate a serious deficiency process to address continued subrecipient noncompliance. The serious deficiency notice is designed to notify a subrecipient that permanent corrective action is expected, or the state has the authority to terminate the subrecipient from the program when the subrecipient cannot or will not establish permanent corrective action. Sample Selection Process Our audit period covered July 1, 2020, through June 30, 2021, the state?s fiscal year. Our audit results are based on our observations of meal services that occurred from June 2021 to September 2021, and our subsequent review of reimbursement claims; therefore, our work and any identified federal questioned costs related to our audit period as well as fiscal year ending June 30, 2022 (July 2021 through September 2021 impact our June 30, 2022, single audit scope). Summer Food Service Program for Children Meal Observations From a population of 42 subrecipients that DHS approved to participate in the SFSP from May 2021 to August 2021 that operated a total of 1,080 feeding sites, we selected a haphazard sample of 20 subrecipients to cover the west, middle, and east grand divisions. These 20 selected subrecipients operated a total of 698 feeding sites. We scheduled a total of 58 meal service visits at 46 different feeding sites. Child and Adult Care Food Program Meal Observations From a population of 273 subrecipients that DHS approved to participate in the CACFP from October 2020 to September 2021 that operated a total of 2,600 feeding sites, we selected 8 high-risk subrecipients for our testwork. These 8 subrecipients operated 119 feeding sites. We scheduled a total of 21 meal service visits at 16 different sites. Claim Review for Meal Observations At the conclusion of our on-site meal observations, we subsequently requested meal count documentation from the subrecipients to ensure that they claimed (through their reimbursement claim submitted in TIPS) the correct number of meals for the days of our scheduled meal service visits. Current Audit Results Based on our meal observation testwork, we identified for both programs, multiple instances of federal program noncompliance during our meal observations (see Condition A); CACFP subrecipients operating ineligible at-risk after-school feeding sites (see Condition B); and multiple SFSP subrecipients operating at the same feeding site locations (see Condition C). Based on our reviews of the reimbursement claims, we found that subrecipients did not maintain accurate meal reimbursement documentation for all meals for the day of our meal observation (see Condition D), did not maintain accurate meal reimbursement documentation for all meals served in the month we reviewed (see Condition E), did not perform point-of-service meal counts (see Condition F), and provided meal count documentation that exhibited questionable meal claiming patterns (see Condition G). Finally, based on our testwork and discussions with DHS program management, we found that program management did not follow control policies governing serious deficiencies to ensure subrecipients with repeated noncompliance achieved compliance through permanent corrective action (see Condition H). Condition and Criteria A (Observation): Meal Service Noncompliance (Repeat Condition) Based on our observations at subrecipient feeding sites, we identified the following errors during meal services for both SFSP and CACFP: At 31 of 35 SFSP meal services we observed (89%), feeding site personnel did not comply with up to 8 different federal program requirements per site while serving meals. See Table 1. At 9 of 12 CACFP meal services we observed (75%), feeding site personnel did not comply with up to 6 different federal program requirements per site while serving meals. See Table 1. In terms of subrecipients, these overlapping meal service issues were found at 19 SFSP subrecipients and 5 CACFP subrecipients. We used these resources to determine the federal program requirements governing the meal services for Summer Food Service Program for Children (SFSP) and the Child and Adult Care Food Program (CACFP): USDA?s 2016 Summer Food Service Program Administration Guide (the SFSP guide); Title 7, Code of Federal Regulations (CFR), Section 226, which governs the Child and Adult Food Program; and USDA-issued COVID-19 waivers in effect during our audit. See Schedule of Findings and Questioned Costs for chart/table. The above-mentioned instances of noncompliance substantiate grounds to disallow program payments. See Conditions D and E for the results of our review of the reimbursement claims that the subrecipients submitted and DHS approved and paid that correspond with our site visits as well as related federal questioned costs. Condition and Criteria B (Observation): Ineligible At-Risk After-school Programs During our meal service observations, we noted two subrecipients served meals to children at four total feeding sites; however, these sites did not meet CACFP?s at-risk after-school program requirements. According to the 2017 At-Risk Afterschool Meals: A Child and Adult Care Food Program Guide (page 9), Students who are part of school sports teams and clubs can receive Afterschool Snacks or Meals as part of a broad, overarching educational or enrichment program, but the Program cannot be limited to a sports team. Organized athletic programs that only participate in interscholastic or community level competitive sports (for example, youth sports leagues such as ?Babe Ruth? and ?Pop Warner? baseball leagues, community soccer and football leagues, area swim teams, etc.) may not be approved as sponsors or independent centers in the Program. Based on our observations at the first subrecipient?s two feeding sites, one feeding site was a community-level competitive youth football league. At the second site?a high school?we could not locate where the subrecipient served the meals. Based on discussion with a football coach, who was the subrecipient?s site supervisor, he gave the subrecipient-provided meals exclusively to the school?s football team in the fieldhouse. As a result, we identified the following federal questioned costs for CACFP: $18,700 related to FY 2021 and $7,690 related to FY 2022. Based on our observations at the second subrecipient?s two feeding sites, neither site offered enrichment activities on the day of our site visits. One site supervisor stated that she stopped offering enrichment activities because the children no longer sat down to eat. According to the second site supervisor, she ended enrichment activities at the start of the COVID-19 pandemic. Because we found this subrecipient in violation of other program requirements (see Condition D), we did not question costs for this condition. Condition and Criteria C (Observation): Multiple Subrecipients Served Meals at the Same Feeding Sites (Repeat Condition) During our meal observations and attempted meal observations, we noted the following problems: At four feeding sites we saw more than one subrecipient serving meals at the same time and/or at the similar physical location. As such, children were served more than the maximum of two meals per day. We scheduled two feeding site visits operated by one subrecipient. The first feeding site was located at a basketball court where we observed children exiting a community center, obtaining meals from a van at the basketball court, and returning to the center. For the second visit, the address listed in TIPS took us to a residence, rather than the specific name of the community center associated with this address in TIPS. We googled the center?s name and discovered that this community center was the same community center located next to the basketball court from our first site visit. We observed the subrecipient serving the same children in their center that were served during the first site visit (basketball court). Based on our review of TIPS and our visits, this subrecipient claimed breakfast, lunch, and supper on the day of our visit, thus exceeding the maximum of two meals per child per day. According to the 2016 SFSP guide (page 57), Sponsors may serve one or two meals a day at open, restricted open, and enrolled sites. With State agency approval, sponsors may serve two meals (including snacks) each day. . .. Meal services can be operated by different sponsors at the same site; however, the maximum number of meals allowed at a site under the regulations [7 CFR 225.16(b)] must not be exceeded (two meals for open, restricted open, and enrolled sites . . .). We considered the subrecipient DHS first approved to serve at the sites as serving allowable meals unless we noted other meal service noncompliance. We questioned the costs DHS paid to the other subrecipients who served and claimed meals at the same site. This resulted in $62,444 of federal questioned costs for FY 2021 and $46,146 in federal questioned costs for FY 2022, both for SFSP. Condition and Criteria D (Claim Review): Incorrect Number of Meals Claimed for the Day of Our Actual or Attempted Meal Service (Repeat Condition) Actual Meal Service Observations Performed We physically observed 35 SFSP meal services at 20 subrecipients, and we physically observed 12 CACFP meal services at 8 subrecipients. We compared the number of reimbursable meals we counted during our visits to the reimbursement claim the subrecipients submitted in TIPS for meals served. Based on our work, we found that 19 of 20 SFSP subrecipients (95%) did not claim the correct number of meals compared to the number of meals we counted, resulting in a difference of $5,730 of FY 2022 federal questioned costs. 4 of 8 CACFP subrecipients (50%) did not claim the correct number of meals compared to the number of meals we counted, resulting in a difference of $1,301 of FY 2022 federal questioned costs. Attempted Meal Service Observations We attempted to observe 23 additional SFSP meal services for 8 subrecipients, and 9 additional CACFP meal services for 2 subrecipients. During these attempted visits, however, we did not see any site personnel or children at these sites. We then reviewed the subrecipients? claims to ensure they did not claim these days. Based on our audit work, we determined that 4 SFSP subrecipients claimed meals for reimbursement on the days we attempted to observe a meal service, even though we saw no meal service took place, resulting in $2,575 of FY 2022 federal questioned costs. 2 CACFP subrecipients claimed meals for reimbursement on the days we attempted to observe a meal service, even though we saw no meal service took place, resulting in $699 of FY 2022 questioned costs. Condition and Criteria E (Claim Review): Meal Reimbursement Documentation Was Inaccurate for the Month of Meal Service (Repeat Condition) In addition to verifying whether subrecipients claimed meals and received reimbursements on the days we observed meal services, we also reviewed the subrecipients? claim for the entire month for corresponding feeding sites and meal types we visited to determine if DHS management reimbursed the subrecipients for claims that were not properly supported. Based on our testwork on actual meal service observations performed, we noted that 14 SFSP subrecipients did not maintain accurate documentation to support the monthly meal reimbursement for which DHS paid, resulting in $5,185 in FY 2022 federal questioned costs. For meal service observations we attempted to perform, our testwork revealed that 2 SFSP subrecipients did not maintain accurate documentation to support the monthly meal reimbursement claim, resulting in $2,772 in FY 2022 federal questioned costs. Based on our testwork on actual meal service observations performed, we found that 2 CACFP subrecipient did not maintain accurate documentation to support the monthly meal reimbursement for which DHS paid, resulting in $1,871 of FY 2022 federal questioned costs. For meal observations we attempted to perform, our testwork revealed that 1 CACFP subrecipient did not maintain accurate documentation to support the monthly meal reimbursement for which DHS paid, resulting in $1,013 of FY 2022 federal questioned costs. According to 7 CFR 225.15(c), [SFSP subrecipients] shall maintain accurate records justifying all meals claimed . . . Failure to maintain such records may be grounds for denial of reimbursement for meals served and/or administrative costs claimed during the period covered by the records in question. The [subrecipient?s] records shall be available at all times for inspection and audit by representatives of the Secretary, the Comptroller General of the United States, and the State agency for a period of three years following the date of submission of the final claim for reimbursement for the fiscal year. We find in 7 CFR 226.10(c), Claims for Reimbursement shall report information in accordance with the financial management system established by the State agency, and in sufficient detail to justify the reimbursement claimed and to enable the State agency to provide the final Report of the Child and Adult Care Food Program (FNS 44) required under ?226.7(d). In submitting a Claim for Reimbursement, each institution shall certify that the claim is correct and that records are available to support that claim. Condition and Criteria F (Claim Review): Subrecipient Did Not Perform Point-of-Service Meal Counts We noted one subrecipient did not use an allowable meal count form. On the day we observed the subrecipient?s meal service, we noted that the site personnel had no method of counting each meal given to children; when we asked site personnel about the counting during our visit, the site supervisor told us they maintain the count in their head. When we reviewed the subrecipient?s meal count documentation used to support the May/June and July/August 2021 claims they submitted to DHS, we noted that subrecipient?s documentation contained each feeding site location, date and time of the meal service, and a handwritten number to indicate the total number of meals served at each site. We also did not see a signature from the site supervisor, which is required. We would expect to see documentation of tally marks on meal count forms to indicate that feeding site personnel tracked the meals served at the point of service, as required by federal program requirements. According to the SFSP guide (page 120), ?Violations of Program requirements may result in withholding or recovery of reimbursements, corrective action, or termination and exclusion from future Program participation.? Such violations include ?Failure to count meals at point of service? (page 121). Furthermore, the guide instructs the site supervisor to sign the meal count form when taking a point-of-service meal count every day, which the site supervisors did not do. We questioned the costs related to our site visit date in Condition D. Condition and Criteria G (Claim Review): Subrecipients with a History of Serious Deficiencies Provided Meal Count Documentation Showing Questionable Meal Claim Patterns Based on the site visits we and DHS monitors performed, we identified two subrecipients that claimed significantly higher meal counts compared to the numbers we and DHS observed. Specifically, these subrecipients claimed that they served the same number of meals daily to children for an extended period of time, with no variances. Both subrecipients have a history of questionable meal claiming patterns and significant compliance issues. Subrecipient 1 For our current audit, Subrecipient 1 received funding from both SFSP and CACFP. We and DHS monitors counted a significantly lower number of meals served during our visits compared to the amount the subrecipient claimed. We reviewed the subrecipient?s reimbursement claims for the following periods and found no change in meal counts, which seems unreasonable to a prudent person. January 2021 through July 2021 ? claimed 80 meals at each meal service for this site for 139 straight days. The subrecipient was approved to serve a maximum of 80 meals at each meal service. We, as well as DHS monitors, visited the feeding site on the following dates and counted the following number of children served: July 14, 2021 ? DHS Visit ? 28 August 9, 2021 ? Comptroller Visit ?5 September 30, 2021 ? Comptroller Visit ? 12 We questioned costs based on the difference between the number the subrecipient claimed from January 2021 through August 2021 for this site and the highest number observed, which was from DHS?s site visit recorded on July 14, 2021?28. This resulted in federal questioned costs for SFSP totaling $26,196 for FY 2021 and $14,903 for FY 2022. Subrecipient 2 For Subrecipient 2, we performed a meal observation on the subrecipient?s largest feeding site and noted an extremely low number of children present compared to the total this subrecipient historically claimed for reimbursement for this site. We, as well as DHS monitors, visited the feeding site on the following dates and counted the following number of children served: June 23, 2021 ? Comptroller Visit ? 27 July 9, 2021 ? DHS Visit ? 25 July 13, 2021 ? DHS Visit ? 59 July 27, 2021 ? Comptroller Visit ? 20 Prior to July 13, 2021, the subrecipient claimed between 111 to 200 lunches and snacks per day. On July 13, 2021, the DHS monitor spoke with the subrecipient?s staff about reducing the number of meals delivered to the site to 75 lunches and snacks because the monitor believed the subrecipient was wasting food. Based on our review in TIPS on January 20, 2022, this subrecipient is currently approved to claim up to 403 lunches and snacks per day. We questioned costs for the difference between the number of meals the subrecipient claimed in June and July 2021 and the highest number of meals observed?59?per day for the same period for this site only. This resulted in the following federal questioned costs for SFSP: $19,002 for FY 2022. According to the SFSP guide, subrecipients ?may claim reimbursement only for those meals that meet SFSP requirements. Reimbursement may not be claimed for . . . [m]eals that were not served.? Prior Reported Issues with Subrecipients 1 and 2 Each subrecipient has participated in the SFSP and CACFP for at least five years and has undergone numerous DHS-provided trainings, corrective actions, and technical assistance. Each has received findings for various noncompliance issues by the Division of Audit Services. We have also reported both subrecipients in our findings each year for the last five years. In these findings, we have noted that they claimed the same number of meals each day; used photocopied meal count forms, instead of using a new meal count form for each meal service as required; claimed meals that we did not physically observe them serving; provided us with meal count documentation that did not support their claim for reimbursement; claimed meals served at ineligible sites; and served meals with incomplete meal components. Given the repeated noncompliance, DHS program management has issued both subrecipients serious deficiency (SD) notices. Program management issued SDs to Subrecipient 1 in 2017 and 2018 and issued SDs to Subrecipient 2 in 2018. We released a special report in 2020 involving Subrecipient 1 claiming and receiving payment for meals it did not serve. Based on those on-site visits, we found feeding sites that had locked doors; however, the subrecipient still filed a meal reimbursement claim for these sites. For Subrecipient 2, we released an investigative report in 2020 describing that the subrecipient overstated the number of meals served to children. In this report, we stated that cameras identified that the number of children present at a feeding site was less than the number of meals claimed for reimbursement. Despite repeated issues and the SD notices, both subrecipients remain in the food programs. See Condition H. Condition and Criteria H: Program Management Did Not Follow Control Policies Governing Serious Deficiencies Given the repeated subrecipient noncompliance identified in Condition G, we determined that program management is not effectively utilizing their control policies to ensure compliance with federal guidance or federal regulations. The policies describe guidelines for DHS program staff when determining SDs. They include, but are not limited to, a single new finding resulting in 35% or more of meals being disallowed (for example, insufficient quantities of milk purchased, meal count errors, applications with regulatory deficiencies, reclassification of participants, etc.); claiming reimbursement for meals not served to participants; claiming reimbursement for meals that do not meet program requirements; and a failure to maintain adequate records.

Finding Number 2021-021 Assistance Listing Number 10.558 Program Name Child and Adult Care Food Program Federal Agency Department of Agriculture State Agency Department of Human Services Federal Award Identification Number 205TN331N1099, 205TN331N2020, 205TN340N1050, 205TN331N8503, 215TN331N1150, 215TN331N1199, and 215TN331N2020 Federal Award Year 2020 and 2021 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Allowable Costs/Cost Principles Repeat Finding 2020-012 Pass-Through Entity N/A Questioned Costs $25,067 The Department of Human Services did not ensure that the Child and Adult Care Food Program subrecipients submitted accurate meal reimbursement claims, resulting in questioned costs totaling $25,067 Background The Child and Adult Care Food Program (CACFP) is a year-round food program for eligible participants at child care centers, day care homes, after-school care programs, emergency shelters, and adult day care centers. CACFP is funded by the U.S. Department of Agriculture and administered on the state level by the Department of Human Services (DHS). As a pass-through entity for CACFP, DHS is responsible for ensuring that these institutions, called subrecipients, are eligible to participate in the program and that the subrecipients comply with federal requirements. To receive payment for the meals they provide to eligible participant children, subrecipients enter and submit total monthly meal counts to DHS through the Tennessee Information Payment System. To fulfill federal requirements, DHS management is responsible for monitoring the subrecipients? activities to provide reasonable assurance that the subrecipients administer federal awards in compliance with federal requirements, and management must take proper actions to address subrecipient noncompliance when it occurs. Because the department does not require subrecipients to submit supporting documentation with their claims for reimbursement before initiating payment to the subrecipients, management relies on both the food program management and the Division of Audit Services to perform activities to address subrecipient noncompliance identified through monitoring activities. While food program management is responsible for approving subrecipients to participate in the program as well as reimbursement claims for payment, the Division of Audit Services monitors after the fact to ensure the subrecipients complied with federal requirements. If the Division of Audit Services determines a subrecipient failed to comply, food program management requires the subrecipient to submit a corrective action plan and to repay program funds. CACFP regulations require that the department?s Division of Audit Services monitor at least 33.3% of all subrecipients each year. Generally, as part of their monitoring plan, Audit Services monitors review one meal reimbursement claim, representing one month of the program year, at each subrecipient. Audit Services monitors perform regular monitoring visits at each subrecipient once every two or three years, depending on the type of institution. Prior Audit Results As noted in the six prior audits, we reported that CACFP program and monitoring staff had not ensured that subrecipients maintained accurate supporting documentation for meal reimbursement claims and that CACFP program staff had paid the subrecipients based on inaccurate claims for meal reimbursement. DHS management concurred in part with the most recent prior finding and stated, DHS continues to evaluate this finding and our own internal monitoring and has created training sessions to mitigate the identified programmatic weaknesses. All CACFP trainings are developed and conducted in conjunction with [the U.S. Department of Agriculture Food and Nutrition Service]. Current Audit Results We identified 20 subrecipients in our testwork which had also been monitored by the Division of Audit Services since 2018. Based on our review of division?s monitoring reports, the monitors found similar issues related to these subrecipients? meal reimbursement claims, which indicates that these subrecipients have not achieved permanent corrective action and have been allowed to continue in the program. We followed up with the Director of Operations for CACFP and SFSP to determine what additional actions she uses to ensure subrecipients take corrective action based on the monitoring activities. According to the director, program staff provide training to subrecipients to reiterate federal program requirements to address subrecipient noncompliance. In an effort to assist subrecipients so they can achieve compliance, the department began offering subrecipients CACFP training again in October 2021 to reiterate the requirements of the program. While training can be effective, training alone may not achieve subrecipient compliance. We also discussed with program management the steps taken when training is not sufficient to correct subrecipient noncompliance. Based on our understanding of federal regulations, when training proves ineffective, the federal regulations provide for states to initiate a serious deficiency process to address continued subrecipient noncompliance. The serious deficiency notice is designed to notify a subrecipient that permanent corrective action is expected, or the state has the authority to terminate the subrecipient from the program when the subrecipient cannot or will not establish permanent corrective action. Condition and Criteria From a population of 272 CACFP subrecipients, with reimbursements DHS paid totaling $50,187,456 during fiscal year ended June 30, 2021, we selected a nonstatistical, random sample of 55 subrecipients, a haphazard sample of 5 high-risk subrecipients, and tested 1 haphazardly selected monthly reimbursement for each subrecipient, totaling $1,988,853. To select the feeding site(s) to review for the claim, we haphazardly selected sites based on the following methodology: If the subrecipient had 10 or more feeding sites, we selected up to 10 sites. If the subrecipient had less than 10 feeding sites, we selected all sites. We then obtained the subrecipients? supporting documentation for their claims submitted in the Tennessee Information Payment System (TIPS). For the claim review, this documentation included daily meal counts for the month tested. Based on our testwork, we noted that for 20 of 60 claims reviewed, the subrecipients could not provide documentation to support the number of meals they submitted in TIPS as meals served. We found that 19 subrecipients submitted their claim for reimbursement in TIPS for more meals served than they were able to support with proper documentation. The remaining 1 subrecipient failed to provide any response to our documentation request. Although we, as well as DHS program and the Division of Audit Services management, reached out to the subrecipient to request documentation for the sampled meal claim tested, the subrecipient did not respond to any of the requests. As part of our review of claims and supporting documentation, we have accepted all available supporting evidence for the claim, and we only report errors when the subrecipient cannot provide accurate or complete documentation. When subrecipients cannot support any part of the reimbursement claims tested, then DHS has improperly reimbursed subrecipients who reported inaccurate or unsupported meal reimbursement claims, resulting in overpayments to the subrecipients totaling $25,067. According to 7 CFR 226.15(e), At a minimum, the following records shall be collected and maintained: . . . Daily records indicating the number of participants in attendance and the daily meal counts, by type (breakfast, lunch, supper, and snacks), served to family day care home participants, or the time of service meal counts, by type (breakfast, lunch, supper, and snacks), served to center participants. In addition, 7 CFR Part 226.10(c) states, Claims for Reimbursement shall report information in accordance with the financial management system established by the State agency, and in sufficient detail to justify the reimbursement claimed and to enable the state agency to provide the final Report of the Child and Adult Care Food Program (FNS 44) required under ?226.7(d). In submitting a claim for reimbursement, each institution shall certify that the claim is correct and that records are available to support that claim. Risk Assessment We reviewed the department?s 2020 Financial Integrity Act Risk Assessment and determined that management listed the risk of subrecipients submitting unsupported claims. Management identified four controls to mitigate the risk: Subrecipients undergo annual program training; Management conducts pre-operational visits for all program applicants and subrecipients with serious deficiencies noted; Management reviews monthly claims prior to acceptance; and Subrecipient monitoring efforts. Although we saw improvement in the department?s subrecipient monitoring of CACFP during our audit (detective control), we found that management is not effectively utilizing the listed controls to mitigate the risk of paying subrecipients with unsupported claims. Management?s review of monthly claims (desk review) prior to acceptance is ideally an effective control. According to the Director of Operations for CACFP and SFSP, management recognizes desk reviews as an effective tool to reduce program noncompliance. Her staff have performed desk reviews when they encounter high-risk subrecipients, but due to staffing, her team cannot perform desk reviews and process payments timely due to a short window to approve subrecipients? reimbursement claims and issue payments. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,? 7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. Cause While we found that the Division of Audit Services monitors identified the same issues during their monitoring visits, we did not see actions, other than training, by the program staff which would address subrecipients? lack of accurate support for meal claims entered and submitted in TIPS. Program management did not provide any additional information on how it plans to address the subrecipients? inaccurate claim reporting. The director can initiate the serious deficiency (SD) process; however, we could not determine that the director followed the SD policies, and she did not document her consideration of noncompliant subrecipients for the SD process. See Finding 2021-020 for further details. Effect While monitoring provides management with detective controls to identify subrecipients? errors, CACFP program management must take additional actions beyond subrecipient training and monitoring, such as issuing serious deficiency notices and terminating subrecipients who fail to implement permanent corrective action as required by program requirements, to ensure the integrity of the program. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include requiring reimbursement instead of advance payments; not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; requiring additional, more detailed financial reports or additional project monitoring; requiring the agency to obtain technical or management assistance; or establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include temporarily withholding payments until the noncompliance has been corrected, denying the use of funds, partly or fully suspending or terminating the federal award, suspending or debarring the agency, withholding further awards for the project or program, or pursuing other available legal remedies. Recommendation As the pass-through entity, DHS has the responsibility to impose additional conditions upon the subrecipients who demonstrate continued program noncompliance, or take other action as described in 2 CFR 200.208 and 200.339. We recommend that DHS take additional steps to ensure it only pays subrecipients for actual meals served to children rather than allowing the subrecipients to (intentionally or unintentionally) continue overbilling the state for federal reimbursement. This includes terminating the subrecipients from the program. Management?s Comment We concur in part. The state auditors identified 14 of the 20 subrecipients with questioned costs were below the department threshold and would not be pursued for recovery, 10 of those were questioned costs of less than $10.00. The Department does not concur with the recommendation to terminate subrecipients from the program that have errors that are correctable and result in minimal questioned costs. This area of noncompliance identifies, in total, $25,067 in questioned costs out of $1,988,853 of reviewed funds. This shows a 1% error rate in CACFP claim disbursement. The Department continues to evaluate findings identified in this report and in our own internal monitoring and has created training sessions to mitigate the identified programmatic weaknesses. All CACFP trainings are developed and conducted in conjunction with USDA FNS. The Department will continue to evaluate risks, update the Department-wide risk assessment forms, and employ effective procedures to mitigate identified risks.

Finding Number 2021-022 Assistance Listing Number 10.558 Program Name Child and Adult Care Food Program Federal Agency Department of Agriculture State Agency Department of Human Services Federal Award Identification Number 205TN331N1099, 205TN331N2020, 205TN331N8503, 205TN340N1050, 215TN331N1150, 215TN331N1199, and 215TN331N2020 Federal Award Year 2020 and 2021 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Eligibility Repeat Finding 2020-013 Pass-Through Entity N/A Questioned Costs $4,742 The Department of Human Services did not ensure that Child and Adult Care Food Program subrecipients maintained complete and accurate eligibility documentation, resulting in $4,742 in federal questioned costs Background The Child and Adult Care Food Program (CACFP), a year-round program, is federally funded by the U.S. Department of Agriculture (USDA) to provide nutritious meals and snacks to eligible children who receive care at eligible childcare centers, adult day care centers, day care homes, after-school programs, and emergency shelters. Eligible childcare centers provide nonresidential childcare services to children, primarily of preschool age, who receive care through day care centers, settlement houses, neighborhood centers, Head Start centers, or organizations who provide care for disabled children. The Department of Human Services (DHS) is the state agency responsible for administering CACFP. To carry out the CACFP program, DHS program management contracts with the eligible institutions listed above, called subrecipients. The subrecipients may either operate at one location or operate multiple locations, called feeding sites. Subrecipients receive a base rate for meals served to eligible children; however, they receive higher levels of reimbursement for meals served to children who meet the income eligibility criteria published by the USDA?s Food and Nutrition Services for free or reduced-priced meals. Subrecipients must determine each enrolled child?s eligibility for free and reduced-price meals to accurately claim reimbursement for the meals served to that child at the correct meal reimbursement rate by obtaining qualifying documentation from parents or guardians of the children they serve. Subrecipients may establish a participating child?s eligibility using either a household application or use proof of participation in another federal program, such as the Supplemental Nutrition Assistance Program (SNAP), Temporary Assistance for Needy Families (TANF), or Food Distribution Program on Indian Reservations (FDIR). Subrecipients are required to obtain updated income and household information for each eligible child annually to determine if the child?s meal classification changed, thereby changing the meal reimbursement rate the subrecipient can claim. In order to support their reimbursement claims to DHS, subrecipients are required to retain accurate and complete eligibility documentation for children served. DHS is ultimately responsible for ensuring that subrecipients and participating children are eligible in accordance with federal requirements. To ensure DHS reimburses subrecipients for eligible children at the correct meal rates, the department relies on its Division of Audit Services to monitor the subrecipients and, if applicable, their feeding sites to ensure subrecipients have met eligibility requirements based on the accurate and complete eligibility documentation retained by the subrecipients. Prior Audit Results As noted in the eight prior audits, DHS did not ensure that subrecipients determined and properly documented individual eligibility for participants. DHS management concurred in part with the prior finding. They stated, DHS continues to evaluate this finding and our own internal monitoring and has created training sessions to mitigate programmatic weaknesses including training subrecipients on participant eligibility and documentation. All CACFP trainings are developed and conducted in conjunction with USDA-FNS [Food and Nutrition Service]. Current Audit Results We identified 33 subrecipients in our testwork which had also been monitored by the Division of Audit Services since 2018. Based on our review of the division?s monitoring reports, the monitors found similar issues related to these subrecipients? eligibility determination and documentation errors indicating the subrecipients have not achieved permanent corrective action and have been allowed to continue in the program. We followed up with the Director of Operations for CACFP and SFSP to determine what additional actions she uses to ensure subrecipients take corrective action based on the monitoring activities. According to the director, program staff provide training to subrecipients to reiterate federal program requirements to address subrecipient noncompliance. In an effort to assist subrecipients so they can achieve compliance, the department began offering subrecipients CACFP training again in October 2021 to reiterate the requirements of the program. While training can be effective, training alone may not achieve subrecipient compliance. We also discussed with program management the steps taken when training is not sufficient to correct subrecipient noncompliance. Based on our understanding of federal regulations, when training proves ineffective, the federal regulations provide for states to initiate a serious deficiency process to address continued subrecipient noncompliance. The serious deficiency notice is designed to notify a subrecipient that permanent corrective action is expected, or the state has the authority to terminate the subrecipient from the program when the subrecipient cannot or will not establish permanent corrective action. Condition and Criteria From a population of 272 CACFP subrecipients and DHS reimbursements totaling $50,187,456 during fiscal year ended June 30, 2021, we selected a nonstatistical, random sample of 55 subrecipients, a haphazard sample of 5 high-risk subrecipients, and tested 1 haphazardly selected monthly reimbursement for each subrecipient, totaling $2,046,373. In addition to testing the subrecipients, we also selected a haphazard sample of 593 children served by the subrecipients in order to determine if the subrecipients correctly determined the children?s eligibility for free and reduced meals. We obtained documentation from the subrecipients for the sampled children. Based on the documentation subrecipients provided, we identified the following problems. Missing or Incomplete Eligibility Documentation According to Title 7, Code of Federal Regulations (CFR), Part 226, Section 23(e)(1)(ii), . . . the application for children shall contain a request for the following information: The names of all children for whom application is made; The names of all other household members; The last four digits of the social security number of the adult household member who signs the application, or an indication that the adult does not possess a social security number. The income received by each household member identified by source of income (such as earnings, wages, welfare, pensions, support payments, unemployment compensation, social security, and other cash income received or withdrawn from any other source, including savings, investments, trust accounts, and other resources); . . . Furthermore, 7 CFR 226.23 (e)(1)(iv) states, Households applying on behalf of children who are members of SNAP or FDPIR households; children who are TANF recipients; or for children enrolled in tier II day care homes, other qualifying Federal or State program, shall be required to provide: (A)For the child(ren) for whom automatic free meal eligibility is claimed, their names and SNAP, FDPIR, or TANF case number; . . . Based on our testwork, we found that 22 of 60 subrecipients did not have eligibility documentation or maintain complete documentation for participating children?s classified meal status. Specifically, we found the following issues: 8 subrecipients did not provide any documentation or provided inaccurate household size information for 19 children, and one of these subrecipients also did not provide any income information for 1 child; 18 subrecipients did not provide the parents?/guardians? last four digits of their social security number for 51 children?s applications; 3 subrecipients did not document a case number on 6 children?s applications even though the application indicated the households received benefits from another federal program; 5 subrecipients did not obtain the required annually updated income applications for 15 children during the fiscal year; and after we and DHS made repeated requests to one subrecipient for documentation, the subrecipient did not provide eligibility documentation for the 10 children we sampled. For the 22 subrecipients that lacked documentation, we identified $1,934 in federal questioned costs. Misclassified Children?s Meal Status Based on our review of the eligibility documentation provided, we found that 20 of 60 subrecipients did not correctly classify children or did not provide documentation demonstrating classification for free, reduced-price, or paid meal status. Specifically, 19 subrecipients incorrectly classified 29 children for free, reduced-price, or paid meal status; and the remaining subrecipient (the same subrecipient noted in the previous section) did not respond to our request for documentation for 10 children identified as participants in the program. The eligibility documentation errors of these 20 subrecipients resulted in $2,808 in federal questioned costs. Questioned Costs While total known questioned costs for the above errors related to CACFP totaled less than $25,000, 2 CFR 200.516(a)(3) requires us to report known and likely questioned costs greater than $25,000 for a type of compliance requirement for a major program. For this program, we determined that likely questioned costs exceeded $25,000. Risk Assessment Based on our review of DHS?s December 2020 Financial Integrity Act Risk Assessment, we determined that management did not identify the risk of subrecipients incorrectly determining eligibility requirements and maintaining documentation to support participant eligibility. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,? 7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Cause The Director of Operations for CACFP and SFSP stated the department has experienced challenges for years with some subrecipients not complying with CACFP requirements, especially during the COVID-19 pandemic. The director is also aware that the department?s monitors have identified the issues as well. The director can initiate the serious deficiency (SD) process; however, we could not determine that the director followed the SD policies, and she did not document her consideration of noncompliant subrecipients for the SD process. See Finding 2021-020 for further details. Effect While monitoring provides management with detective controls to identify subrecipients? errors, program management must also initiate additional actions when necessary, such as issuing serious deficiency notices and terminating subrecipients who fail to implement permanent corrective action from the program, to ensure the integrity of the program. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include requiring reimbursement instead of advance payments; not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; requiring additional, more detailed financial reports or additional project monitoring; requiring the agency to obtain technical or management assistance; or establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include temporarily withholding payments until the noncompliance has been corrected, denying the use of funds, partly or fully suspending or terminating the federal award, suspending or debarring the agency, withholding further awards for the project or program, or pursuing other available legal remedies. Recommendation The Commissioner should ensure that the Director of Operations of CACFP and SFSP addresses the areas where subrecipient deficiencies were identified by the department?s monitoring efforts, including those identified in this finding, and take appropriate actions to achieve compliance. Management should ensure subrecipients demonstrate a willingness to comply with program requirements and take appropriate actions. If they fail to do so, management should impose additional conditions upon the subrecipients or take other action, as described in 2 CFR 200.339, such as terminating subrecipients from the program. Management should identify and implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur in part. The state auditors? identified $4,742 of questioned costs represents a 0.2% error rate for the reimbursement claims sampled and a statistical 0.00% error rate for the total claims. The Department continues to evaluate findings identified in this finding and in our own internal monitoring and has created training sessions to mitigate programmatic weaknesses including training subrecipients on participant eligibility and documentation. All CACFP trainings are developed and conducted in conjunction with USDA FNS. Condition: Missing or Incomplete Eligibility Documentation We concur in part. The state auditors found error with eligibility applications due to all household member names not being listed. The Department does not concur that this as an error. The CACFP Meal Benefit Income Eligibility (Child Care) form provided by USDA for Child Care programs to use for CACFP does not require that all household member names be listed. The USDA form requires that all children in the daycare homes/centers and all adult household members be named on the form. This number can differ from the total number of household members if there are additional children in the home that do not attend the childcare homes/centers. The Department does concur that income eligibility applications are complicated and that errors with income information, partial Social Security numbers and guardian signatures are frequent findings identified in our monitoring process. USDA continues to evaluate the income eligibility application templates used for CACFP and the Department is continuing to provide training and technical assistance surrounding this area. Condition: Misclassified Children?s Meal Status We concur. The Department concurs that income eligibility applications are complicated and that errors with determining the category of meal status for their participants is a frequent finding identified in our monitoring process. USDA continues to evaluate the income eligibility application templates used for CACFP and the Department is continuing to provide training and technical assistance surrounding this area. The Department will continue to evaluate risks, update the Department-wide risk assessment forms, and employ effective procedures to mitigate identified risks.

Finding Number 2021-023 Assistance Listing Number 10.558 and 10.559 Program Name Child and Adult Care Food Program Child Nutrition Cluster Federal Agency Department of Agriculture State Agency Department of Human Services Federal Award Identification Number 205TN331N1099, 205TN331N2020, 205TN331N8503, 205TN340N1050, 215TN331N1150, 215TN331N1199, and 215TN331N2020 Federal Award Year 2020 and 2021 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A The Department of Human Services did not issue timely management decisions for audits of food program subrecipients as required Background The Child and Adult Care Food Program (CACFP) is a year-round food program for eligible participants at childcare centers, day care homes, after-school care programs, emergency shelters, and adult day care centers. The Summer Food Service Program for Children (SFSP) provides under-resourced children with nutritious meals when school is not in session. Both programs are funded by the U.S. Department of Agriculture (USDA) and administered on the state level by the Department of Human Services (DHS). DHS contracts with institutions, called subrecipients, who administer the programs by providing meals. As a pass-through entity, DHS is responsible for ensuring that subrecipients are eligible to participate in the programs and that the subrecipients comply with federal requirements. Pursuant to the Office of Management and Budget?s Uniform Grant Guidance and ?Audit Requirements,? Title 2, Code of Federal Regulations (CFR), Part 200, Section 501, (a) Audit required. A non-Federal entity [subrecipient] that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. Furthermore, as the pass-through entity, DHS is required by 2 CFR 200.332(f) to verify that all subrecipients that spend $750,000 or more obtain a Single Audit within nine months after the subrecipient?s fiscal year-end. As part of that Single Audit, if a subrecipient receives an audit finding, the department must issue a management decision within six months of the audit report?s release, indicate if the department agreed with the finding, and describe any corrective action the subrecipient must take. Based on discussions with DHS management, twice each fiscal year, the department?s Division of Audit Services? staff extracts expenditure information paid to subrecipients from Edison, the state?s accounting system. Staff then compiles the expenditures based on the subrecipients? fiscal year to determine if DHS paid the subrecipient more than $750,000 during the most recent fiscal year. According to management, once they identify the subrecipients who meet the audit threshold, the division?s Director of Internal Audit creates a tracker using Microsoft Excel. The director will track the receipt of required audit reports throughout the fiscal year and will note on the tracker if the audit reports identified findings relevant to the federal program. If a subrecipient?s audit report identified findings, the Director of Internal Audit is responsible for notifying the program responsible for ensuring the subrecipient?s compliance with federal requirements, including reviewing any findings and issuing management decisions. Condition, Criteria, and Cause No Management Decisions Issued From a population of two subrecipients whose audit reports included audit findings, the Director of Operations for CACFP and SFSP did not issue the required management decision within six months of the audit report?s issuance. According to the director, when she reads an audit report with a finding and the finding addresses corrective action, she will take no action if she agrees with the subrecipient?s planned actions. Otherwise, if she does not agree with the subrecipient?s planned corrective action or there is not a corrective action stated, she will request a corrective action. The director?s actions do not include issuing a management decision, which is required in 2 CFR 200.521(d), which states, (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC [Federal Audit Clearinghouse] [emphasis added]. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. The CPA firm issued one subrecipient?s 2020 audit report on February 4, 2021. This report states that the subrecipient received $1,918,994 in CACFP and $3,242,894 in SFSP funds in fiscal year 2020. The CPA firm for the second subrecipient issued its 2019 report on March 21, 2021; in this report, the subrecipient received $2,781,114 in CACFP and $433,250 in SFSP funds. The director was required to issue a management decision to the subrecipients by August 4, 2021, and September 21, 2021, respectively. In both reports, the independent auditors identified findings related to the lack of controls over both food programs? meal counts, which are the basis for reimbursements. Risk Assessment We reviewed the department?s 2020 Financial Integrity Act Risk Assessment and determined that management did not identify the risk of not issuing management decisions to subrecipients that received Single Audit findings. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,? Identification of Risks, 7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Effect When management does not issue management decisions to follow up on and document that the audited entity (the subrecipients) appropriately addressed findings identified in their Single Audits, DHS management increases the risk that their subrecipients may use federal grant funds for unauthorized purposes and fail to comply with federal statutes and regulations. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include requiring reimbursement instead of advance payments; not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; requiring additional, more detailed financial reports or additional project monitoring; requiring the agency to obtain technical or management assistance; or establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include temporarily withholding payments until the noncompliance has been corrected, denying the use of funds, partly or fully suspending or terminating the federal award, suspending or debarring the agency, withholding further awards for the project or program, or pursuing other available legal remedies. Recommendation Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. Specifically, the Director of Operations for CACFP and SFSP should formally request subrecipients take corrective action when independent audits identify findings in the audit reports. In addition, the director should issue timely management decisions in response to the subrecipients? corrective action plans as required by federal regulations. Management?s Comment We concur. The Department?s Food Programs? management was unable to find the requested documentation regarding management decisions for two audits. Beginning in 2022, food program management will develop a tracking log of all CACFP and SFSP program participants that have independent single audits that include findings pertaining to food programs. Food program management will follow up on all findings and issue the required management decision within 6 months. This will be evidenced in the tracking log. The Department will continue to evaluate risks, update the Department-wide risk assessment forms, and employ effective procedures to mitigate identified risks.

Finding Number 2021-024 Assistance Listing Number 93.558 and 93.575 Program Name Temporary Assistance for Needy Families Child Care and Development Fund Cluster Federal Agency Department of Health and Human Services State Agency Department of Human Services Federal Award Identification Number 1901TNTANF, 2001TNTANF, 2001TNCCDF, 2001TNCCC3, 2101TNCCDF, and 2101TNCCC5 Federal Award Year 2019 through 2021 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A Fiscal staff for the Department of Human Services did not comply with Federal Funding Accountability and Transparency Act reporting requirements for the Child Care and Development Fund and the Temporary Assistance for Needy Families programs Background The Department of Human Services (the department) administers the Child Care and Development Fund (CCDF) program and the Temporary Assistance for Needy Families (TANF) program, which are federal programs under the oversight of the U.S. Department of Health and Human Services (HHS). The Department of Finance and Administration (fiscal management and fiscal staff) is responsible for performing all fiscal-related duties on behalf of the department, including Federal Funding Accountability and Transparency Act (FFATA) reporting. The Department of Finance and Administration assumed responsibility for performing the department?s fiscal functions on April 11, 2016. FFATA requires the department to report subrecipient subaward financial information through the FFATA Subaward Reporting System (FSRS). The subaward information in FSRS is then available to the public on the USA Spending website for transparency. Condition and Cause Reporting CCDF We obtained from the Department of Human Services, the prime grant recipient, the population of 3 CCDF subrecipients? subawards totaling $148,738,072 and found that staff did not report the subrecipients? subawards in FSRS for the CCDF program for the year ended June 30, 2021. TANF We obtained from the Department of Human Services, the prime grant recipient, the population of the 38 TANF subrecipients? subawards totaling $130,157,592 and found that fiscal staff did not report the subrecipients? subawards in FSRS for the TANF program for the year ended June 30, 2021. Fiscal management was not aware they were responsible for the FFATA reporting for the CCDF and TANF programs. Fiscal management stated that they are working on a Corrective Action Plan and are in the process of filing the FFATA reports. We will audit the FFATA reporting requirements for the CCDF and TANF programs during the next audit. Risk Assessment We reviewed the Department of Human Services? and the Department of Finance and Administration?s December 2020 Financial Integrity Act Risk Assessment for the Department of Human Services? operations and determined that management did not identify the risk of noncompliance with FFATA reporting for the CCDF and TANF programs and as such did not establish control activities to ensure compliance with FFATA reporting requirements. Criteria Reporting Appendix A to ?Reporting Subaward and Executive Compensation Information,? Title 2, Code of Federal Regulations (CFR), Part 170, states, Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). Where and when to report. The non-Federal entity or Federal agency must report each obligating action described in [the previous paragraph] of this award term to http://www.fsrs.gov. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2010.) What to report. You must report the information about each obligating action that the submission instructions posted at http://www.fsrs.gov . . . Exemptions. If, in the previous tax year, you had gross income, from all sources, under $300,000, you are exempt from the requirements to report . . . subawards . . . Definitions. For purposes of this award term: Federal Agency means a Federal agency as defined at 5 U.S.C. 551(1) and further clarified by 5 U.S.C. 552(f). Non-Federal entity means all of the following, as defined in 2 CFR part 25: A Governmental organization, which is a State, local government, or Indian tribe; A foreign public entity; A domestic or foreign nonprofit organization; and, A domestic or foreign for-profit organization . . . Subaward: This term means a legal instrument to provide support for the performance of any portion of the substantive project or program for which you received this award and that you as the recipient award to an eligible subrecipient. The term does not include your procurement of property and services needed to carry out the project or program (for further explanation, see 2 CFR 200.331). A subaward may be provided through any legal agreement, including an agreement that you or a subrecipient considers a contract. Subrecipient means a non-Federal entity or Federal agency that: Receives a subaward from you (the recipient) under this award; and Is accountable to you for the use of the Federal funds provided by the subaward. Risk Assessment The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, ?Identification of Risks,? Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Effect CCDF and TANF Without establishing and implementing effective reporting controls over FFATA, the risk increases that the public will not have access to transparent and accurate information regarding expenditures of federal awards. TANF Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include requiring reimbursement instead of advance payments; not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; requiring additional, more detailed financial reports or additional project monitoring; requiring the agency to obtain technical or management assistance; or establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include temporarily withholding payments until the noncompliance has been corrected, denying the use of funds, partly or fully suspending or terminating the federal award, suspending or debarring the agency, withholding further awards for the project or program, or pursuing other available legal remedies. Recommendation The Commissioner of the Department of Human Services and the Department of Finance and Administration?s Controller for the Department of Human Services fiscal activities should ensure that the appropriate staff members understand the FFATA reporting requirements and report applicable subawards in accordance with those reporting requirements. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. The Department will continue to notify the Department of Finance and Administration, which provides fiscal services to the Department, of CCDF subrecipient subawards through its procurement process and preparation of subrecipient Federal Award Identification Worksheets to support timely and accurate FFATA reporting. The Department was not aware of this requirement. The Department will continue to notify the Department of Finance and Administration, which provides fiscal services, of TANF subrecipient and amended awards through its procurement process and preparation of subrecipient Federal Award Identification Worksheets to support timely and accurate FFATA reporting. Fiscal staff for the Department of Human Services began properly reporting the FFATA for CCDF and TANF when notified of the requirement by state auditors. Neither program nor fiscal was aware of the requirement. The initial reports were filed as of October 2021 and have been filed as required thereafter. Fiscal staff have developed a process to identify subrecipient subawards for both the CCDF and TANF programs to ensure the FFATA is reported accurately and timely going forward. The Department will continue to evaluate risks, update the Department-wide risk assessment forms, and employ effective procedures to mitigate identified risks.

Finding Number 2021-025 Assistance Listing Number 93.575 and 93.596 Program Name Child Care and Development Fund Cluster Federal Agency Department of Health and Human Services State Agency Department of Human Services Federal Award Identification Number 1801TNCCDF, 1901TNCCDF, 2001TNCCDF, 2001TNCCC3, 2101TNCCDF, 2101TNCCC5, and 2101TNCDC6 Federal Award Year 2018 through 2021 Finding Type Material Weakness and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2020-020 Pass-Through Entity N/A Questioned Costs N/A As noted in the five prior audits, the Department of Human Services and the Department of Education did not comply with the federal health and safety requirements for the Child Care and Development Fund program, and did not implement internal controls to ensure that providers complied with the necessary requirements Background The Department of Human Services (DHS) is Tennessee?s lead agency responsible for administering the Child Care and Development Fund (CCDF) cluster of programs, which is a federal program under the oversight of the U.S. Department of Health and Human Services. CCDF funds subsidize child care for low-income families for parents who are working or attending training or educational programs. Additionally, the program supports activities to promote overall child care quality for all children, regardless of subsidy receipt. Under the CCDF Block Grant and Title 45, Code of Federal Regulations (CFR), Part 98, Section 41, lead agencies have significant responsibility for ensuring the health and safety of children in child care through the state?s child care licensing system and for establishing health and safety standards for children who receive CCDF funds. Although DHS is the state?s lead agency, DHS has a Memorandum of Agreement with the state?s Department of Education (DOE) to ensure health and safety inspections of the state?s child care providers that meet certain education requirements. For all other in-state providers, DHS is responsible for performing inspections to ensure that the providers have met all health and safety requirements. The state?s child care providers participating in the CCDF program may be licensed or license-exempt. Licensed providers consist of family day cares, group child care homes, and child care centers. License-exempt providers consist of individuals that provide care for a small number of children, Boys and Girls Clubs, and other education-related providers assigned to DOE. Additionally, Tennessee?s children who are eligible for CCDF may receive child care from providers located outside the state. In that case, DHS staff obtain an up-to-date license from the providers? respective state regulators as assurance that those providers have met the health and safety requirements. Requirements Waived Due to COVID-19 Pandemic Normally, the Code of Federal Regulations requires lead agencies to verify and document that child care providers participating in CCDF meet eleven specific areas related to health and safety. In response to the global COVID-19 pandemic, DHS requested and was approved for waivers to reduce the number of health and safety requirements reviewed for inspections. The waiver was effective March 3, 2020, through September 30, 2021. Approved by the federal Administration of Children and Families? Office of Child Care, the waiver allowed the state to reduce the number of health and safety requirements from eleven to five and required child care providers to be inspected for the following five requirements: 45 CFR 98.41(a)(1)(iii) ? Administration of medication, consistent with standards for parental consent. 45 CFR 98.41(a)(1)(v) ? Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic. 45 CFR 98.41(a)(1)(vii) ? Emergency preparedness and response planning for emergencies resulting from a natural disaster or a man-caused event (such as violence at a child care facility). 45 CFR 98.41(a)(1)(viii) ? Handling and storage of hazardous materials and the appropriate disposal of biocontaminants. 45 CFR 98.41(a)(1)(xi) ? Recognition and reporting of child abuse and neglect. Emergency Preparedness and Response Planning As noted above, 45 CFR 98.41(a)(1)(vii) requires each child care provider to perform emergency preparedness and response planning. This planning is required to include preparations for a natural disaster or threat perpetrated by an individual. The child care provider must address procedures for evacuation; relocation; shelter-in-place/lock down; communication and reunification with families; continuity of operations; accommodations for infants/toddlers, children with disabilities, and children with chronic medical conditions; and staff/volunteer training and drills. Processes for Inspections of Child Care Providers Department of Human Services According to DHS Policy 13.02, ?Monitoring for Compliance,? providers must receive at least one announced visit per licensing year, and the number of unannounced visits per licensing year is determined by the provider?s star-quality rating and any complaints received. For non-licensed providers, licensing consultants perform health and safety inspections during their initial enrollment and annually thereafter. From our walkthroughs, we learned that DHS?s licensing consultants must complete the Child Care Agency Monitoring and Evaluation Check Sheet, a 12-page checklist with 15 high-risk areas encompassing various departmental rules. The checklist helps the consultants evaluate for compliance with federal and state regulations, including specific items for the health and safety requirements discussed above. At the conclusion of their inspection, the consultants upload the completed checklist into DHS?s shared drive and enter a summary of the results into the Tennessee Licensed Care System (TLCS). A supervisor then reviews the inspection by examining the checklist and narrative in TLCS and documents their review in TLCS. Department of Education According to DOE School-based Support Services? Procedures Booklet, Section 4.I, ?How to Conduct a Visit to a School/Program for Oversight,? providers must receive at least one announced and one unannouced visit per school year. From our walkthroughs, we learned that DOE?s Early Childhood Quality and Support Specialists must complete the Verification of Program Review, a five-page checklist to help verify compliance. The checklist encompasses various departmental rules and federal and state regulations, including those for health and safety requirements. During inspections, the specialists must check if the requirement was met or unmet. At the conclusion of their inspection, the specialists upload the completed checklist into DOE?s shared drive and enter a summary of the results into TLCS. A supervisor reviews the inspection by examining the checklist and narrative in TLCS and documents their review in TLCS. Federal Notice of Noncompliance The U.S. Department of Health and Human Services, Administration for Children and Families, Office of Child Care (OCC) monitors each state once every three years to determine if states are in compliance with federal CCDF regulations. On April 3, 2020, the U.S. Department of Health and Human Services issued a Preliminary Notice of Possible Non-Compliance to DHS. The noncompliance dealt with DHS?s inspections of child care providers and included violations in the following areas: Consumer Education (45 CFR 98.33(a)(4)) ? DHS did not post full monitoring and inspection reports for all licensed child care providers, and did not post any reports for child care providers inspected by DOE. Emergency Preparedness and Response Planning (45 CFR 98.41(a)(1)(vii)) ? Child care providers? emergency preparedness and response planning did not include all of the requirements. Inspections for Licensed Providers (45 CFR 98.42(b)(2)(i)) ? There was no evidence that the state inspected licensed child care providers for all emergency preparedness and response requirements. Inspections for License-Exempt Providers (45 CFR 98.42(b)(2)(ii)) ? There was no evidence that the state inspected license-exempt child care providers for all emergency preparedness and response requirements. After DHS provided a response to the report, OCC issued a Notice of Non-Compliance Extension on August 31, 2021, that stated Tennessee remained out of compliance with the areas noted above. Currently DHS is in communication with OCC about corrective actions to address the remaining compliance issues. Prior Audit Results In the prior audit finding, we found that DHS and DOE program staff did not consistently document whether child care providers complied with health and safety requirements, and that DHS and DOE supervisors did not have an adequate review process. We also found DHS and DOE staff did not ensure that providers included all required areas of disaster and emergency response in their emergency preparedness plans. DHS management concurred with the audit finding and stated that in November 2020 they revised the emergency preparedness checklist and template to include all elements specified in the federal regulations to ensure compliance with CCDF requirements. Management?s six-month follow-up stated that the ?department is in the process of child care modernization that is expected to be implemented in spring 2022.? DHS provided targeted technical assistance to providers whose Emergency Preparedness and Response Plans (EPRPs) were identified as deficient in the prior Single Audit. Before June 1, 2021, these providers were required to submit revised EPRPs to be reviewed for compliance by the department. DOE concurred with the prior audit finding and stated it planned to strengthen existing controls to ensure staff perform all child care provider site visits in accordance with federal regulations and internal policy, including health and safety checks. Sample Selection Process and Current Audit Results From a population of 1,934 licensed providers assigned to DHS and 459 providers assigned to DOE, we selected a nonstatistical, random sample of 60 child care providers from each population. We performed testwork to determine if DHS and DOE documented on their checklists and/or on the TLCS narratives that they had inspected the 5 health and safety regulations applicable during our audit period. We also performed testwork to determine if supervisors documented their reviews of those inspections in TLCS. For all 18 out-of-state providers that had received CCDF funds for providing child care to Tennessee children, we performed testwork to determine if DHS had obtained an active license issued to the child care provider by their home state regulators. We were unable to perform testwork on inspections of non-licensed providers because DHS had not performed any inspections during the audit period (see Condition C). Condition, Criteria, and Cause Condition A: DHS and DOE Did Not Ensure That Child Care Providers Included All Required Areas of Disaster and Emergency Response in Their Emergency Preparedness and Response Plans (Repeat Condition) Due to deficiencies identified in the prior audit and the Notice of Non-Compliance Extension from the HHS/OCC, we obtained the Emergency Preparedness and Response Plan (EPRP) from each of the providers in our samples of those inspected by DHS and DOE. We examined the EPRPs to determine if they included each of the areas required by 45 CFR 98.41(a)(1)(vii). Based on our testwork, we found that for 40 of 59 licensed providers (68%) inspected by DHS, the providers had not included all requirements in their EPRP. In response to the Preliminary Notice of Possible Non-Compliance, management created an EPRP template for providers as an option to use when creating their own EPRP. Management provided technical assistance to the providers that we reported in our prior audit. While these actions are a good start, DHS management has not demonstrated a plan to ensure all providers comply with the EPRP requirements. For DOE, we found that for 32 of 60 providers (53%), the providers did not include all required elements in their EPRP. In response to these errors, DOE management stated, the errors occurred due to changes to policy mid-year, unclear expectations regarding emergency plan checks (many staff misunderstood that it was our responsibility to check emergency plans and not DHS), contracted staff not completing required work, misunderstandings regarding items on the required [EPRP] list (infant/toddler information, medical conditions, disabilities ? programs and staff did not think these items were required if they do not serve these populations). Condition B: Supervisory Reviews at Both DHS and DOE Were Not Adequate to Ensure That Inspections Include All Required Areas Related to Health and Safety (Repeat Condition) We found that supervisory reviews of staff?s inspections for the health and safety requirements in 45 CFR 98.41(a)(1) did not identify deficiencies in the inspections. Despite documenting their review in TLCS, supervisors at both departments failed to identify when the inspection checklists did not document whether child care providers complied with the required health and safety regulations. For DHS, we found that for 17 of 60 licensed child care provider inspections (28%), the licensing consultant had not documented on page 2 of the checklist or in the TLCS narrative which requirements they inspected for at least 1 or more of the 5 federal health and safety requirements. Although the supervisors signed off on these inspections, the supervisors did not document in their review that any of the inspections omitted required elements. To explain the errors we identified, DHS management stated that the approved amended State Plan allowed them to apply discretion in enforcing the health and safety monitoring requirements; however, our interpretation of the federal regulations is that the lead agency must review the 5 health and safety requirements. For DOE, we found that for 18 of 60 licensed child care provider inspections (30%), the licensing specialist did not document in their inspections whether the provider met 1 or more of the 5 federal health and safety requirements. We also found that the supervisory reviews did not identify the omissions we observed. DOE management stated that time management can be a challenge for their staff who inspect child care providers because staff look at other requirements in addition to the federally required health and safety requirements. Additionally, the pandemic created challenges due to the nature of providers closing, operating virtually, and/or experiencing staffing issues that affected visits and follow-ups. As noted in Condition A, we found that 40 providers inspected by DHS and 32 providers inspected by DOE had deficient EPRPs, and the supervisors did not identify the deficiencies. Review Process Challenges We learned that the licensing consultants at DHS and the licensing specialists at DOE are not required to obtain a copy of the providers? EPRP when performing inspections; therefore, the supervisors do not have access to review the plans themselves. The only documentation that the licensing consultants and licensing specialists are required to upload into their shared drive are the completed checklists. Therefore, supervisors cannot be assured that the inspections were properly performed for all requirements. Additionally, neither department had written policies and procedures for the supervisory review process. Management is responsible for designing, implementing, and monitoring internal controls in accordance with Standards for Internal Control in the Federal Government (Green Book), which provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. The Green Book states, A deficiency in internal control exists when the design, implementation, or operation of a control does not allow management or personnel, in the normal course of performing their assigned functions, to achieve control objectives and address related risks. To achieve the department?s mission, management is responsible for establishing the necessary operational processes to carry out the department?s functions, objectives, and goals. These key operational processes should include effective internal controls activities, including management overseeing the processes that fulfill the department?s objectives for meeting federal program compliance. Condition C: Inspections Were Not Performed for Non-licensed Child Care Providers As Required (New Condition) DHS management informed us that during our audit period, none of the 16 non-licensed providers authorized to participate in CCDF received inspections for the health and safety requirements in 45 CFR 98.41(a)(1). According to the Director of Compliance for the Child Care and Community Services Division, management believed that the OCC waived those inspection requirements as part of the waiver approved on March 3, 2020. We reviewed the waivers and the approved amendment to the State Plan that the department submitted. According to the approved amendment effective for federal fiscal years 2019 through 2021, the State Plan states, ?In-person, virtual, or a combination of virtual and in-person visits resumed during the last week of July 2020.? Inspections for non-licensed providers should have restarted in July 2020, the same time they restarted for licensed providers. Risk Assessment We reviewed DHS?s and DOE?s December 2020 Financial Integrity Act Risk Assessments for department operations and determined that management listed the risk of noncompliance with federal health and safety requirements. Management identified the inspections of child care providers as the internal control to mitigate the risk. However, based on the results of our review, the inspections and subsequent supervisory reviews were not adequate to mitigate the risks of noncompliance. Additionally, management has not identified any risks related to their inspections of child care providers. According to Green Book Principle 7.02, ?Identification of Risks,? Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. According to Green Book Principle 7.09, ?Response to Risks,? When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. Effect When management does not ensure provider inspections are properly documented and reviewed, children in the providers? care are subjected to potential health and safety risks. When child care providers do not have a comprehensive EPRP, children may be at risk during a time of crisis. Additionally, in the event of an emergency evacuation or closure, the providers have not sufficiently addressed the likely risks related to communication and child/parent reunification. Recommendation Department of Human Services and Department of Education management should ensure that staff who perform inspections of child care providers understand their responsibilities for health and safety requirements as established in the approved State Plan. Management must establish the necessary controls, including written policies and procedures for adequate supervisory reviews. Because of their significant responsibilities for ensuring the health and safety of children in child care, management should establish a quality assurance process to evaluate the effectiveness of their inspection process, including the actual inspection and supervisory review. In addition, management of both departments should carefully evaluate their risk assessments to ensure they include all risks and implement effective controls to address the risks noted in this finding. Management should update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. Management?s Comment Department of Human Services Condition A: DHS and DOE Did Not Ensure That Child Care Providers Included All Required Areas of Disaster and Emergency Response in Their Emergency Preparedness and Response Plans (Repeat Condition) We concur. The Emergency Preparedness and Response Plans (EPRPs) of forty (40) child care providers did not fully comply with the requirements at 45 CFR ? 98.42(a)(1)(vii). The Department directed its quality contractors to deliver targeted technical assistance supporting remediation of identified EPRP deficiencies during the audit. Each deficient EPRP will be reviewed by the Department?s Child Care Services program to ensure corrective action is fully demonstrated before June 30, 2022. The Department continues its process of child care modernization that is expected to be implemented in May 2022, including a new eLicensing system to strengthen internal controls and monitoring supporting documentation. The Department will continue to identify opportunities that further enhance training and technical assistance opportunities in the topics of emergency preparedness and response available from its quality contractors and other subject matter experts. Condition B: Supervisory Reviews at Both DHS and DOE Were Not Adequate to Ensure That Inspections Include All Required Areas Related to Health and Safety (Repeat Condition) We concur. Documentation of monitoring visits conducted and not subject to the waiver approved by the Administration for Children and Families Office of Child Care at 45 CFR ?98.42(b)(2) and effective during the audit period of July 01, 2020, through June 30, 2021, do not itemize each health and safety requirement monitored. The Department is in the process of child care modernization, which is expected to be implemented in May 2022, including a new eLicensing system to strengthen processes for documentation. As part of modernization rollout, the Department will provide refresher training for all staff, frontline, and supervisors, that aligns with introduction of the new technology solutions that support capturing this information. Condition C: Inspections Were Not Performed for Non-licensed Child Care Providers As Required (New Condition) We do not concur. The Department conducts health and safety monitoring visits of license-exempt providers once annually per Policy 11.32 Authorized Child Care Professional Home Visits. In response to the COVID-19 health crisis, monitoring requirements at 45 CFR ?98.42(b)(2) were waived by the Administration for Children and Families Office of Child Care (OCC) in its approval letter to the Department dated June 08, 2020, with an effective date of March 03, 2020. OCC approved waiver renewal of monitoring requirements at 45 CFR ?98.42(b)(2) on April 22, 2021, effective through September 30, 2021. The Department applied discretion as authorized by Executive Order of the Governor and as further approved by OCC in Section 1.8.3 of the CCDF State Plan for 2019-2021. The Department is resuming monitoring visits of license-exempt providers in 2022. The Department will continue to evaluate risks, update the Department-wide risk assessment forms, and employ effective procedures to mitigate identified risks. Department of Education We concur. The department?s Chief Operating Officer will work collaboratively with the Department of Human Services and staff within the Department of Education to: Revise inspection protocols and training to ensure staff and law enforcement stakeholders who perform inspections of childcare providers understand their responsibilities for health and safety requirements as established in the approved State Plan; Establish the necessary controls, including written policies and procedures for adequate supervisory reviews; Establish a quality assurance process to evaluate the effectiveness of the Department of Education inspection process, including the actual inspection and supervisory review; Evaluate school risk assessments to ensure they include all risks and implement effective controls to address noted risks; and Update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and act if deficiencies occur.

Finding Number 2021-026 Assistance Listing Number 93.575 Program Name Child Care and Development Fund Cluster Federal Agency Department of Health and Human Services State Agency Department of Human Services Federal Award Identification Number 1801TNCCDF Federal Award Year 2018 through 2020 Finding Type Material Weakness and Noncompliance Compliance Requirement Matching, Level of Effort, Earmarking Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A The Department of Human Services did not establish adequate internal controls over Child Care and Development Fund earmarking, and as a result, management did not comply with the earmarking requirement Background The Department of Human Services (DHS) administers the Child Care and Development Fund (CCDF) cluster, which is a federal program under the oversight of the U.S. Department of Health and Human Services. The Department of Finance and Administration (F&A) is responsible for performing all fiscal-related duties on behalf of the department, including tracking expenditures for earmarking requirements. CCDF funds subsidize child care for low-income families for parents who are working or attending training or educational programs. Additionally, the program supports activities to promote overall child care quality for all children. CCDF consists of three main funding sources: discretionary funds, mandatory funds, and matching funds. Additionally, under the Temporary Assistance for Needy Families (TANF) program, a state may transfer TANF funds to CCDF; the transferred funds become part of the CCDF discretionary funds. The U.S. Department of Health and Human Services requires DHS to meet three earmarking requirements for CCDF: administrative earmarking, quality earmarking, and direct spending earmarking, which includes discretionary and mandatory funds. In response to the global COVID-19 pandemic, DHS requested multiple waivers from the federal Administration of Children and Families Office of Child Care (AFC) that affect how the department administers the CCDF cluster. AFC approved earmarking waivers effective for the period March 3, 2020, through September 30, 2021, which allowed DHS to waive the earmarking requirements for administrative, quality, and direct spending for discretionary funds. DHS did not request a waiver related to earmarking for direct spending for mandatory funds. As such, during the current audit scope, we tested earmarking expenditures charged to the CCDF grant award for the 2018 federal grant year under the direct spending for mandatory funds earmarking requirements. Criteria, Condition, and Cause Under the CCDF direct spending for mandatory funds earmarking requirements (Title 45, Code of Federal Regulations [CFR], Section 98.50[e]), states and territories must spend a minimum of 70% of mandatory funds to meet the needs of families who (1) receive TANF assistance; (2) are attempting through work to transition off TANF; and (3) are at risk of becoming dependent on TANF. Based on our review, we found that F&A?s Controller and DHS?s Child Care Services Program Directors did not ensure that DHS expended the minimum amount for mandatory funds during the required time period of October 1, 2018, through September 30, 2020, to meet earmarking requirements. DHS missed the earmarking requirement by over $2 million. (See Table 1.) See Schedule of Findings and Questioned Costs for chart/table. Although F&A?s Controller and DHS?s Child Care Services Program Directors had implemented a control process consisting of quarterly meetings to review CCDF program expenditures required to meet earmarking requirements, management did not include a review of expenditures to fulfill the direct spending for mandatory earmarking requirement. According to the F&A Controller, her staff will perform adjusting entries and submit revised financial reports to the federal government for the 2018 grant award. Additionally, the Controller stated that they are now tracking expenditures for direct spending earmarking to review in their quarterly meetings. Risk Assessment We reviewed DHS?s and F&A?s December 2020 Financial Integrity Act risk assessment for DHS operations and determined that management listed the risk of noncompliance with federal earmarking requirements; however, the risk did not identify all earmarking requirements. As a result, management?s identified control to mitigate these risks was not sufficient given that it did not address all earmarking requirements. According to Green Book Principle 7.02, ?Identification of Risks,? Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. . . . Specifically, in this audit period, management did not implement the control activity for the federal direct spending earmarking requirement. Effect The department cannot meet the federal award requirement and is less likely to achieve the grant?s purpose of helping families to improve their economic condition if they do not spend the required amounts on direct services for families who either qualify or are at risk of qualifying for TANF. Recommendation DHS?s Director of Child Care Services and F&A?s Controller for DHS fiscal activities should ensure they have implemented the necessary controls to monitor compliance with the direct spending earmarking requirements. In addition, management should carefully evaluate their risk assessment to ensure they include all risks and implement effective controls to address the risks noted in this finding. Management should update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. Management?s Comment We concur. The Department, along with the Department of Finance and Administration which provides fiscal services to the Department, will continue to meet regularly to evaluate expenses, review budget and spending strategies, assure appropriate allocation of funds, and review earmarking calculation and reporting requirements. The Department of Finance and Administration Controller and the Department?s Child Care Program Management review a schedule of federal earmarks quarterly, which was effective in March 2020. This specific earmark, direct spending for mandatory funds, had not been included in our quarterly review with Child Care Program Management. Fiscal reviews a schedule of all applicable child care and development fund earmarks with Child Care Program Management effective September 30, 2021. A correcting entry was recorded, and the 2018 final reports will be submitted to the federal agency by March 31, 2022. The Department will continue to evaluate risks, update the Department-wide risk assessment forms, and employ effective procedures to mitigate identified risks.

Finding Number 2021-027 Assistance Listing Number 93.575 and 93.596 Program Name Child Care and Development Fund Cluster Federal Agency Department of Health and Human Services State Agency Department of Human Services Federal Award Identification Number 1801TNCCDF, 1901TNCCDF, 2001TNCCDF, 2001TNCCC3, 2101TNCCDF, 2101TNCCC5, and 2101TNCDC6 Federal Award Year 2018 through 2021 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Repeat Finding N/A Pass-Through Entity N/A Questioned Costs $12,394 The Department of Human Services did not maintain documentation of children?s eligibility determinations and did not ensure that subrecipients established adequate controls over the eligibility determination process Background The Tennessee Department of Human Services (DHS) administers the Child Care and Development Fund (CCDF), a federal program that provides subsidies for child care. CCDF funds the state?s Child Care Certificate Program, which helps Families First (Temporary Assistance for Needy Families) participants, parents transitioning from the Families First program, teen parents, and other individuals obtain child care. To participate in the Child Care Certificate Program, children must be declared eligible by DHS staff or, for children in foster care or protective services, by Department of Children?s Services staff. In addition to income limits and other eligibility requirements, children must be under the age of 13 to participate in the program, unless they are incapable of self-care or are under court supervision. Under CCDF requirements, DHS is responsible for establishing child care provider payment rates and parent co-pay fees. DHS publishes a schedule of parent co-pay fees, which are based on household size and monthly income. DHS also publishes a schedule of provider payment rates, which are based on a variety of factors including the county where services are provided, the age of the child in care, and the type of child care provider. Providers? payment rates are also affected by the providers? star-quality rating. Child care providers request payment for services on a biweekly, semimonthly, or monthly basis by submitting child care Enrollment Attendance Verification forms for eligible children. The DHS Division of Fiscal Services staff use the forms, in conjunction with provider and client eligibility data, to process payments to each provider. Child Care for Children of Essential Workers After the COVID-19 pandemic began, DHS implemented a new focus of the program to help provide child care for children of essential workers. The program was available from April 2020 through August 31, 2021. The Coronavirus Aid, Relief, and Economic Security Act and the Coronavirus Response and Relief Supplemental Appropriations Act allowed states to use funding to provide child care to essential workers? children without regard to family size or income limits. Children had to be under 13 years of age (or up to age 19, if incapable of self-care or under court supervision) and have at least one parent who is an essential worker. As part of its responsibilities for this new focus of the program, DHS determined eligibility and subsidized child care for children of essential workers who received care at a provider that DHS had already certified to receive CCDF payments. Additionally, DHS contracted with two more subrecipients to provide child care across the state. The subrecipients were responsible for determining children?s eligibility and providing care for the children. DHS paid the subrecipients a flat daily rate per child, depending on whether the child received part-time or full-time care. The subrecipients submitted weekly invoices for reimbursement with a list of children served for the week. Condition and Cause Program Staff Did Not Maintain Documentation for Eligibility Determinations To determine whether program staff correctly determined eligibility, we selected a nonstatistical, random sample of 60 eligible individuals from a population of 87,946 eligible individuals with payments totaling $461,047,035 for the Child Care Certificate Program from July 1, 2020, through June 30, 2021. Based on our testwork, we found that for 3 of 60 eligible children (5%) tested, program staff did not maintain documentation supporting eligibility determinations. Documentation not on file included verification of the eligible child?s age and verification of the parent?s employment. We questioned the costs paid for these children during our audit period, totaling $12,394. According to the Director of Compliance, there was an increase in application volume for emergency child care for essential employees during the COVID-19 health crisis. Questioned Costs While total known questioned costs for the above errors totaled less than $25,000, Title 2, Code of Federal Regulations, Part 200, Section 516(a)(3), requires us to report known and likely questioned costs greater than $25,000 for a type of compliance requirement for a major program. For this program, we determined that likely questioned costs exceeded $25,000. Subrecipients Did Not Implement Internal Controls Over Eligibility Determinations We performed testwork to determine whether the children were eligible in accordance with program requirements for essential workers? children. From a population of 6,174 eligible children, totaling $19,138,980 payments to subrecipient 1; and a population of 24,609 eligible children, totaling $31,918,560 payments to subrecipient 2, we selected a nonstatistical, random sample of 25 children who received child care from each subrecipient from July 1, 2020, through June 30, 2021. From our testwork, we determined that the subrecipients could not provide verification of age for 50 of 50 children (100%) because DHS management did not provide any guidance to the subrecipients concerning the type of documentation to review and did not ensure that subrecipients established adequate controls for the age verification process. When we informed DHS management of our testwork results, management was able to obtain age verification and documentation through other means for all children in our sample testwork. As a result, although we identified control deficiencies, we did not have questioned costs for this condition. Additionally, on July 27, 2021, the department?s Division of Audit Services issued a subrecipient monitoring report for one of the subrecipients above. The monitoring report covered the period September 1, 2020, through November 30, 2020, and stated that the subrecipient provided child care for 17 children who did not meet the age requirements. As a result, the report questioned $7,260 in reimbursement costs paid to the subrecipient during this period. The report recommended the subrecipient implement internal controls to ensure that all children meet the program?s age requirements. Based on our discussions and walkthroughs with subrecipient management, neither subrecipient management nor staff obtained documentation (such as birth certificates or school records) to verify children met the age requirements when determining eligibility. Additionally, neither subrecipient documented the individuals that approved the children?s eligibility, and no one performed a supervisory review. Based on our discussion with DHS management, the subrecipients? process for registering children included recording the child?s stated age based on inquiry but did not include obtaining documentation to verify the child?s age. Risk Assessment We reviewed DHS?s December 2020 Financial Integrity Act Risk Assessment for department operations and determined that management did not identify the risk of subrecipients? noncompliance with eligibility determinations. As such, management did not establish control activities to ensure compliance with CCDF eligibility requirements. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides guidance to management for maintaining documentation of its internal control system. According to Green Book Principle 7.02, ?Identification of Risks,? Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Criteria Green Book Principle 3.10, ?Documentation of the Internal Control System,? states, Effective documentation assists in management?s design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel, as well as a means to communicate that knowledge as needed to external parties, such as external auditors. According to Title 45, Code of Federal Regulations, Part 98, Section 20(a), To be eligible for services under ? 98.50, a child shall, at the time of eligibility determination or redetermination: Be under 13 years of age; or, At the option of the Lead Agency, be under age 19 and physically or mentally incapable of caring for himself or herself, or under court supervision. Effect When management does not ensure supporting documentation was obtained or internal controls were in place for supervisory review, errors or mistakes can be made and go undetected. Unless DHS establishes and implements adequate controls to ensure the accuracy of CCDF Child Care Certificate Program eligibility determinations and redeterminations, DHS increases the risk of paying child care providers for services rendered to ineligible program participants. Recommendation The Commissioner should ensure that DHS?s internal controls are adequately designed and operating effectively to prevent or detect incorrect provider payments. The Commissioner should ensure program staff obtain and maintain supporting documentation for individuals who are determined eligible for CCDF funding. Although the program to provide child care to essential workers? children has ended, the Commissioner should ensure that DHS gives adequate guidance to subrecipients of any future programs to ensure that the subrecipients have internal controls in place to enforce and document all program requirements. In addition, management should carefully evaluate its risk assessment to ensure it includes all risks, and management should implement effective controls to address the risks noted in this finding. Management should update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur. Management?s Comment Condition: Program Staff Did Not Maintain Documentation for Eligibility Determinations We concur. The Department could not produce all supporting eligibility documentation for three (3) children. The Department addressed document retention requirements and use of technology solutions in a refresher training delivered to Child Care Certificate Program (CCCP) staff on August 25, 2021. The Department will include document retention requirements and use of technology solutions in future new employee and refresher CCCP trainings. The Department is in the process of child care modernization that will further address these issues. Condition: Subrecipients Did Not Implement Internal Controls Over Eligibility Determinations We do not concur. The Department established temporary/emergency child care services as an immediate response to the COVID-19 health crisis under the broad discretion afforded it by Executive Order of the Governor and approved waivers by the Administration of Children and Families Office of Child Care. The Department implemented internal controls through verification of parent eligibility documentation or other reasonable means such as examining a parent?s professional identification confirming status as an Essential Services worker as defined by Attachment A to Executive Order 22 was performed by each subrecipient consistent with the terms and conditions of their respective grant contract. Information regarding the child?s age was provided to and maintained by the subrecipients as part of the screening process once a parent?s eligibility as an Essential Services worker was verified. Given the emergency nature of services and the desire to support essential workers, while limiting administrative burdens, the Department did not require the contractors to collect additional documentation to verify a child?s age. Federal regulations do not specify any required method of verifying a child?s age. The Department will continue to evaluate risks, update the Department-wide risk assessment forms, and employ effective procedures to mitigate identified risks.

Finding Number 2021-028 Assistance Listing Number 10.568 and 10.569 Program Name Food Distribution Cluster Federal Agency Department of Agriculture State Agency Department of Agriculture Federal Award Identification Number 205TN817Y8105, 215TN817Y8105, 205TN800Y8703, and 215TN717J7003 Federal Award Year 2020 and 2021 Finding Type Material Weakness Compliance Requirement Eligibility Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A The Department of Agriculture did not have internal controls over inventory and household eligibility determinations for the Emergency Food Assistance Program Background The Department of Agriculture (the department), in partnership with the U.S. Department of Agriculture (USDA) and local organizations, operates the Emergency Food Assistance Program (TEFAP) to provide low-income households emergency food assistance. USDA purchases a variety of food items and makes them available to state distributing agencies. Subrecipients that have contracted with the department administer the program in compliance with the grant award on behalf of the department. The department places food orders with USDA on behalf of the subrecipients, and USDA delivers the food directly to the subrecipients? warehouses. By tracking food receipts and distributions, performing a physical inventory count at least annually, and documenting adjustments to inventory records such as losses due to spoilage, the subrecipients manage the inventory in their warehouses. Also, the subrecipients determine whether applicants meet income requirements and are residents of the state of Tennessee, and they provide food to households deemed eligible. The department reimburses the subrecipients to cover administrative costs, such as payroll costs associated with operating the TEFAP program. During our audit period, the department contracted with 22 subrecipients for the purpose of administering TEFAP. Condition and Cause Inventory Management and Household Eligibility To determine whether subrecipients of the TEFAP program followed federal requirements for inventory management and household eligibility determinations, we observed physical inventories, reviewed supporting inventory records and eligibility determination documentation, and interviewed management and staff of the department. Based on our review, we found that department management did not have internal controls in place to ensure compliance with TEFAP inventory and eligibility requirements. Given that management had no controls, we also performed compliance tests to determine compliance with federal regulations. We did not identify subrecipient noncompliance related to inaccurate inventory records or incorrect eligibility determination. Based on discussions with department management, in prior fiscal years, the department performed on-site subrecipient reviews to determine if subrecipients were accurately determining household eligibility and managing the inventory according to federal requirements. According to management, they stopped performing these reviews of subrecipients in March 2020 due to the effects of the COVID-19 pandemic. Without a federal waiver to alleviate the impacts of the health emergency, management was required to either continue their established control activities or implement alternative controls to ensure subrecipients complied with the federal requirements. The department had developed a monitoring schedule to review the subrecipients for federal fiscal year 2021; however, as of January 28, 2022, management has neither resumed their previous control activity review process nor implemented other control activities to ensure subrecipients reasonably complied with the federal regulations. Risk Assessment We reviewed the Department of Agriculture?s December 2020 Financial Integrity Act Risk Assessment for department operations and determined that management did not identify the risk of noncompliance with federal inventory and eligibility requirements and as such did not identify control activities to ensure compliance with these requirements. Criteria Inventory Management and Household Eligibility According to 2 CFR 200.303(a), a non-federal agency must Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, according to 7 CFR 251.10(e), Each State agency must monitor the operation of the program to ensure that it is being administered in accordance with Federal and State requirements. State agencies may not delegate this responsibility. Each review must encompass, as applicable, eligibility determinations, food ordering procedures, storage and warehousing practices, inventory controls, approval of distribution sites, reporting and recordkeeping requirements, and civil rights. Risk Assessment The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, ?Identification of Risks,? Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Additionally, Principle 9.04, ?Analysis of and Response to Change,? states, As part of risk assessment or a similar process, management analyzes and responds to identified changes and related risks in order to maintain an effective internal control system. Changes in conditions affecting the entity and its environment often require changes to the entity?s internal control system, as existing controls may not be effective for meeting objectives or addressing risks under changed conditions. Management analyzes the effect of identified changes on the internal control system and responds by revising the internal control system on a timely basis, when necessary, to maintain its effectiveness. Effect The lack of sufficient internal controls over inventory management and household eligibility determinations increases the risk of noncompliance with federal requirements and fraud, waste, and abuse in this federal program. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), ?Specific conditions,? these actions may include requiring reimbursement instead of advance payments; not allowing the agency to proceed to the next phase until it submits evidence of acceptable performance; requiring additional, more detailed financial reports or additional project monitoring; requiring the agency to obtain technical or management assistance; or establishing other prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, ?Remedies for noncompliance,? outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include temporarily withholding payments until the noncompliance has been corrected, denying the use of funds, partly or fully suspending or terminating the federal award, suspending or debarring the agency, withholding further awards for the project or program, or pursuing other available legal remedies. Recommendation The Commissioner of the Department of Agriculture should ensure that appropriate staff members establish and implement effective internal controls in response to changes in the operating environment to ensure compliance with inventory and eligibility requirements. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. Management?s Comment We concur. The department will establish control activities (review process) to ensure and document subrecipient compliance with inventory and eligibility requirements. The monitoring schedule the department had planned to implement in FY21 will be implemented during FY22, with an anticipated completion date of September 30, 2022, to coincide with the end of the federal fiscal year and the grant contract period. Monitoring activity will transition to a desk audit format with virtual visits incorporated as needed to maximize safety protocols and minimize disruption of the monitoring schedule due to public health or other emergency situations. If deficiencies are disclosed, the department will submit a report of findings to the subrecipient and ensure corrective action is taken. The commodity administrator will be responsible for monitoring risks and assessing controls.

Finding Number 2020-001CFDA Number 10.553, 10.555, 10.556, 84.010, 84.027, 84.048, 84.173, and 84.367Program Name Child Nutrition ClusterTitle I Grants to Local Educational AgenciesSpecial Education ClusterSupporting Effective Instruction State GrantsCareer and Technical Education ? Basic Grants to StatesFederal Agency Department of Agriculture, Department of EducationState Agency Department of EducationFederal Award Identification Number 201818(17)N109945, 201919N109945, 202020N109945, 202020N850345, S010A170042, S010A180042, S010A190042, H027A050052, H027A160052, H027A170052, H027A180052, H027A190052, H173A170095, H173A180095, H173A190095, S367A170040, S367A180040, S367A190040, V048A170042, V048A180042, and V048A190042Federal Award Year 2005, 2016 through 2020Finding Type Significant DeficiencyCompliance Requirement OtherRepeat Finding N/APass-Through Entity N/AQuestioned Costs N/AThe Department of Education did not provide adequate internal controls in one specific areaThe Department of Education did not provide adequate internal controls in one specific area related to state systems. This condition was in violation of state policies and/or industry-accepted best practices.We reviewed the department?s December 2019 Financial Integrity Act Risk Assessment and determined that management listed risks relating to this area; however, the department did not have an effective control to mitigate the risks.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.Ineffective implementation and operation of internal controls increases the likelihood of errors, data loss, and the inability to continue operations. Pursuant to Standard 4.40 of the U.S. Government Accountability Office?s Government Auditing Standards, we omitted details from this finding because they are confidential under the provisions of Section 10-7-504(i), Tennessee Code Annotated. We provided management with detailed information regarding the specific conditions we identified, as well as the related criteria, causes, and our specific recommendations for improvement.RecommendationManagement should ensure that these conditions are remedied by the prompt development and consistent implementation of internal controls in this area. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur. Corrective actions and corresponding information have been sent under separate cover in accordance with Section 10-7-504(i), Tennessee Code Annotated, for this finding.Management will evaluate and continuously monitor all implemented controls to ensure the controls effectively mitigate the identified risks. The annual risk assessment will be updated to reflect the newly implemented controls and the mitigation of the identified risk.

Finding Number 2020-002CFDA Number 10.553, 10.555, 10.556, 84.010, 84.027, 84.173, and 84.367Program Name Child Nutrition ClusterTitle I Grants to Local Educational AgenciesSpecial Education ClusterSupporting Effective Instruction State GrantsFederal Agency Department of AgricultureDepartment of EducationState Agency Department of EducationFederal Award Identification Number 201818(17)N109945, 201919N109945, 202020N109945, 202020N850345, S367A190040, H027A170052, H027A190052, and S010A190042Federal Award Year 2017 through 2020Finding Type Material Weakness (84.010, 84.027, 84.173, and 84.367) and Noncompliance (10.553, 10.555, 10.556, 84.010, 84.027, 84.173, and 84.367)Compliance Requirement Activities Allowed or Unallowed (Material Weakness ? 84.010, 84.027, 84.173, and 84.367); Noncompliance (10.553, 10.555, 10.556, 84.010, 84.027, 84.173, and 84.367)Allowable Costs/Cost Principles (Material Weakness ? 84.010, 84.027, 84.173, and 84.367; Noncompliance ? 10.553, 10.555, 10.556, 84.010, 84.027, 84.173, and 84.367)Subrecipient Monitoring (Material Weakness - 84.010, 84.027, 84.173, and 84.367; Noncompliance ? 84.010, 84.027, 84.173, and 84.367)Repeat Finding 2019-008Pass-Through Entity N/AQuestioned Costs: See Schedule of Findings and Questioned Costs for chart/tableAs noted in the prior two audits, department management reimbursed subrecipients for costs that were unallowable or not adequately supported, resulting in $1,171,435 in federal questioned costsBackgroundEducation-Related Federal Program FundsThe Department of Education (the department) is the pass-through entity for the following programs administered by the U.S. Department of Education:Title I Grants to Local Educational Agencies, (See Schedule of Findings and Questioned Costs for footnote)Special Education Cluster (See Schedule of Findings and Questioned Costs for footnote), andSupporting Effective Instruction State Grants. (See Schedule of Findings and Questioned Costs for footnote)The department awards these federal program funds primarily to subrecipients, commonly known as the local educational agencies (LEAs). LEAs incur education-related costs, such as teacher salaries and benefits, and submit reimbursement requests to the department, using ePlan, the department?s grants management system. The ePlan system has edit checks that automatically compare an LEA?s reimbursement request line items to the LEA?s approved budget and reject any amounts exceeding the line items? budget by 10% or more. Additionally, after the LEA submits its reimbursement request, the Director of Local Disbursement or the Senior Director of Local Finance reviews the reimbursement request to ensure that ePlan correctly calculated the amounts on the reimbursement request. Once the department approves the reimbursement request, it is processed for payment.Child Nutrition Cluster FundsThe department is also a pass-through entity for the following three Child Nutrition Cluster programs administered by the U.S. Department of Agriculture:School Breakfast Program,National School Lunch Program, andSpecial Milk Program for Children.The department awards federal funds to school food authorities (SFAs). SFAs submit claims monthly, based on the number of meals served, through the Tennessee: Meals, Accounting, and Claiming system (TMAC) and are reimbursed funds based on a set rate per meal served. TMAC has edit checks that automatically determine if the number of meals claimed exceeds the SFA-provided number of children in attendance and if the number of operating days claimed is greater than the number of operating days for the month. Once the claim is submitted, either the department?s Nutrition Services Compliance Director or the Nutrition Services Federal Reporting Specialist reviews the claim for propriety. Once the department approves the claim, it is processed for payment.Department?s Responsibilities as a Grant AdministratorAs a pass-through entity of federal funds, the department is responsible for providing overall program oversight, which includes, but is not limited to,approving only eligible subrecipients who comply with the federal program requirements and guidelines;providing appropriate and effective training, technical assistance, and any other necessary support to facilitate a successful program participation;designing effective controls to ensure subrecipients receive reimbursement payments for expenditures that are fully compliant with program requirements and guidelines; andmonitoring subrecipients? activities to provide reasonable assurance that the subrecipients administer these federal awards in compliance with federal requirements and guidelines.The department?s Division of Local Finance, Division of Federal Programs and Oversight, and School Nutrition staff monitor the subrecipients to ensure that the subrecipients reasonably complied with federal and state requirements. Throughout the year, the divisions monitor a sample of subrecipients for various programmatic and fiscal objectives, including reimbursement transactions the subrecipients submitted to the department and the department subsequently paid.Department?s Internal Controls for Allowable CostsAs the non-federal entity, the department must implement internal controls over compliance requirements for federal awards; the controls must be designed to provide reasonable assurance that subrecipients comply with the federal grantor?s regulations. The department relies on its monitoring activities as its primary detective control to ensure subrecipients are submitting allowable expenditures for reimbursement.Prior Audit ResultsIn the prior audit finding, we found that the department did not have an effective internal control over the monitoring and reimbursement process and that the department reimbursed subrecipients for costs that were unallowable or not adequately supported. Additionally, we questioned the sufficiency of the department?s monitoring process, noting that the monitors did not document the methods used to select expenditure items for review and did not maintain working papers or copies of other evidence to document the work performed or to support the monitoring reports issued. Management concurred and stated the following:For FY20, the department has updated the fiscal monitoring and procedures to include a deeper look at reimbursement requests from the districts monitored. . . . The fiscal monitoring process will be reviewed again over the summer of 2020, and any necessary revisions to the instrument and/or process will be made for the upcoming monitoring cycle.Current Audit ResultsBased on our discussion with the Division of Local Finance and the Division of Federal Programs and Oversight staff, the department updated monitoring procedures and required monitors to document their sampling methodology and retain documentation of reviewed transactions in the work papers; however, management did not update the monitoring tool to further scrutinize expenditures.Condition and CriteriaTo determine if department staff complied with federal requirements related to expenditures, including allowable activities and allowable costs/cost principles, we tested nonstatistical, random samples of reimbursements to LEAs and SFAs. See Table 1 for the details of these populations and samples. Based on our testwork, we noted that the department reimbursed LEAs and SFAs for unallowable and unsupported expenditures, resulting in $1,171,435 in federal questioned costs.See Schedule of Findings and Questioned Costs for chart/table.Department Reimbursed Subrecipients for Unallowable CostsBased on testwork performed, we noted that department staff reimbursed subrecipients from two federal programs for unallowable expenditures totaling $21,935 in federal questioned costs. See Table 2 for a summary of questioned costs including the unallowable cost description for both of the programs. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 403,costs must meet the following general criteria in order be allowable under Federal awards: Be necessary and reasonable for the performance of the Federal award . . . [and] be adequately documented.In addition, the Tennessee Department of Education?s guidance to subrecipients, titled ?Using Federal Education Funds to Pay for Food,? states, ?Full meals for families/parents or students are not allowable for [parent engagement events] under any circumstances.?See Schedule of Findings and Questioned Costs for chart/table.Department Reimbursed Subrecipients for Unsupported CostsBased on our review of underlying supporting documentation that the subrecipients provided for the reimbursement claims we selected for review, we noted that department staff reimbursed subrecipients from four federal programs for unsupported expenditures, totaling $1,149,500 in federal questioned costs. We asked the LEA or SFA to provide us with documentation to support their claims to the department. The LEA or SFAdid not provide any supporting documentation (such as paid invoices, receipts, or meal count documentation) for expenditures claimed for reimbursement;provided supporting documentation that was incomplete; orprovided supporting docuementation that included duplicated expenditures.See Table 3 for a summary of questioned costs for each of the four programs. We also noted that unsupported expenditures, totaling $1,148,448, charged to the Title I, Special Education, and Supporting Effective Instruction State Grants (SEI) programs were for reimbursements to MNPS, which, as noted in Finding 2020-004, the department?s monitoring staff did not monitor during fiscal year 2020. After our discussion with the Child Nutrition program management, department management requested and processed amended claims to recover $507 in unsupported costs from Huntingdon Special School District, Wayne County, and Sevier County.See Schedule of Findings and Questioned Costs for chart/table.As noted above, 2 CFR 200.403 states that costs must be adequately documented in order to be allowable under federal awards.Department?s Monitoring ToolBased on our review and discussion with department management, we believe that management?s current subrecipient monitoring process is ineffective because management still did not adequately scrutinize the subrecipients? supporting documentation for requests that the department paid. We reviewed the department?s monitoring tool and found that the tool does not ensure that the department?s fiscal monitors review supporting documentation for actual expenditures reimbursed to the LEA from federal awards during monitoring visits; thus, the tool is an ineffective control. Without this scrutiny, the department?s monitors cannot ensure that LEAs comply with federal allowable activities/allowed cost requirements.Furthermore, management has not sufficiently addressed the subrecipients? noncompliance involving expense reimbursements that violated federal program requirements, as we noted in this finding and Finding 2020-006.Risk AssessmentWe reviewed the Department of Education?s December 2019 Financial Integrity Act Risk Assessment and determined that management listed the risk that costs charged to a federal grant are not allowable and not adequately documented under program regulations at the subrecipient level. Management listed three internal controls to mitigate the risk:1. Maintain a library of resources within ePlan for stakeholders and TDOE [department] staff to use, including on allowable uses;2. Regular technical assistance training on internal controls and program rules; and3. Annual risk based monitoring for programmatic and fiscal requirements.While the listed controls are important, management did not design controls that sufficiently mitigated the risk that costs that are not allowable and adequately documented may be charged to federal programs at the subrecipient level.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,?7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions.CauseWe discussed the errors noted in this finding with department staff, and the Senior Director of Local Finance stated that the unallowable costs likely occurred because subrecipient staff did not notice the errors during the expenditure review and approval process. As to the undocumented and unsupported costs, MNPS was not able to provide the proper documentation from its new accounting system. The Director stated that monitoring and program staff have taken note of the issues discussed in this finding and will provide MNPS and the other LEAs with additional technical assistance regarding unallowable costs and maintaining support for expenditures.Based on our discussion with Child Nutrition staff, the Child Nutrition program errors were a result of (1) SFA mathematical errors when preparing the reimbursement request and (2) a former employee of the King?s Daughter School taking the meal count documentation with him when he separated from the school.EffectWhen department staff does not have an effective internal control in place to ensure the subrecipients used program funds for authorized purposes, management cannot ensure expenditures complied with federal statutes, regulations, and terms and conditions of the grant award; nor can management ensure that subaward performance goals were achieved. The lack of mitigating controls increases the risk of noncompliance with the federal program requirements and may require the state to return these funds to the U.S. Department of Education or the U.S. Department of Agriculture. As noted in 2 CFR 200.339, ?If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.208, ?Specific conditions,?1. Requiring payments as reimbursements rather than advance payments;2. Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period;3. Requiring additional, more detailed financial reports;4. Requiring additional project monitoring;5. Requiring the non-Federal entity to obtain technical or management assistance; or6. Establishing additional prior approvals.Furthermore, Section 200.339 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:a. Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.b. Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.c. Wholly or partly suspend or terminate the Federal award.d. Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).e. Withhold further Federal awards for the project or program.f. Take other remedies that may be legally available.RecommendationThe Commissioner should ensure management improves the monitoring tool and implements procedures for monitoring staff to review subrecipient transactions and obtain adequate supporting documentation during monitoring activities. The Commissioner should also ensure program staff train and provide technical assistance to subrecipients about allowable program expenditures and the requirement to maintain documentation to support reimbursed expenditures.Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur. The department is taking additional steps to address the concerns with the Title I, special education, SEI, and child nutrition programs. We will update the fiscal monitoring tool to implement more robust procedures for staff to follow in monitoring subrecipient transactions. The improved procedures will also require stricter controls about the adequacy of supporting documentation. Additionally, a monitoring tool will be developed allowing for more timely responses to issues and changes and requiring documentation for transactions reviewed.Also, department staff will be trained to conduct desktop reviews of LEA reimbursements to improve compliance with federal program regulations. The desktop reviews will require LEAs to provide adequate documentation supporting selected reimbursements. Issues that are identified will inform the LEA fiscal monitoring schedule and targeted technical assistance to prevent a recurrence of issues in future reimbursements.Finally, department management will continue to review and implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and remediate if deficiencies occur.

Finding Number 2020-003CFDA Number 84.010Program Name Title I Grants to Local Educational AgenciesFederal Agency Department of EducationState Agency Department of EducationFederal Award Identification Number S010A190042Federal Award Year 2020Finding Type Material Weakness and NoncomplianceCompliance Requirement Allowable Cost/Cost principlesRepeat Finding N/APass-Through Entity N/AQuestioned Costs $49,343Department staff incorrectly charged payroll expenditures to the Title I program, resulting in $49,343 of questioned costsBackground and CriteriaThe Department of Education administers federal grant awards which are subject to ?Uniform Administrative Guidance,? Title 2, Code of Federal Regulations (CFR), Part 200. Specifically, 2 CFR 200.430, ?Compensation?Personnel Services,? establishes standards for documenting employee time and effort when personnel expenditures are charged to federal awards. Charges to federal awards for salaries and wages must accurately reflect the work performed and must be based on records that are incorporated into the state?s official records. Most importantly, the records must (1) be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (2) encompass both federally assisted and all other activities compensated by the state on an integrated basis; (3) reflect the total activity for which the employee is compensated; and (4) comply with the state?s established accounting policies and practices.Employee Payroll ProcessWhen the department hires an employee or when an employee changes positions, the employee?s supervisor, the Commissioner, and the Chief Financial Officer complete an Employee Action Form, which defines the grant-funded duties and the amount of time the employee will spend on each cost objective (See Schedule of Findings and Questioned Costs for footnote). All employees enter their time in Edison, the state?s accounting system, which has a list of approved cost objectives (also known as task profile groups) in a drop-down box. The employee must manually choose the correct task profile group and enter the number of hours worked for each task profile group. After the employee has entered the time and submitted it for approval in Edison, the employee?s supervisor must approve the employee?s time. Then Edison automatically allocates the costs based on the speedchart codes (See Schedule of Findings and Questioned Costs for footnote) associated with the selected task profile group.In addition to the supervisory review and approval of the employee?s timesheet, the Budget Director performs a payroll reconciliation. During the reconciliation, he compares the Employee Action Form to the task profile group the employee selected to ensure employees charged their time to the correct task profile group. If any discrepancies are found, the Budget Director informs the employee?s supervisor and fiscal staff prepare a correcting journal entry in Edison.ConditionDuring our review of administrative expenditures, we found that an employee incorrectly charged time to a Title I cost objective. Based on our review of the employee?s Employee Action Form, Title I was not an approved cost objective for the employee. Specifically, the employee was set up as an Achievement School District employee on her Employee Action Form, with no federal cost objective listed. As a result, department staff incorrectly charged $49,343 to the Title I grant.CauseAccording to the department?s Budget Director, the employee?s salary should have been paid out of the Achievement School District funding; however, the employee changed positions and the new cost objectives were not updated in Edison. According to the Budget Director, he performed the payroll reconciliation for the period of July 1, 2019, through February 28, 2020, as a control to ensure employees charge time to the correct cost objectives; however, he did not perform the reconciliation for the period of March 1, 2020, through June 30, 2020. In addition, the supervisor who approved the employee?s time and the Budget Director who performed the reconciliation did not identify the error. On November 5, 2020, fiscal staff reallocated and corrected the expenditures that were incorrectly charged to the Title I grant during our audit period.EffectWhen department staff does not adequately review time and effort documentation during the reconciliation process to ensure employees charge their time to the proper grant award, management increases the risk that federal programs will be incorrectly charged for payroll expenditures. Failure to properly allocate payroll to cost objectives in accordance with actual activities can result in unallowable costs.RecommendationTo ensure program and fiscal staff accurately charge federal programs in accordance with federal requirements, the Commissioner should ensure staff adequately review employees? time and effort documentation, specifically during the reconciliation process. In addition, we recommend the department identify and use the appropriate funding sources related to departmental payroll and other administrative expenditure items.Management?s CommentWe concur. The department will be conducting more frequent reviews of payroll and updating our procedures to ensure adequate internal controls are in place to confirm employees charge the correct funding sources.

Finding Number 2020-004CFDA Number 84.010, 84.027, 84.173, and 84.367Program Name Title I Grants to Local Educational AgenciesSpecial Education ClusterSupporting Effective Instruction State GrantsFederal Agency Department of EducationState Agency Department of EducationFederal Award S010A190042, H027A170052,Identification Number H027A190052, and S367A190040Federal Award Year 2017 through 2020Finding Type Material Weakness and NoncomplianceCompliance Requirement Subrecipient MonitoringRepeat Finding N/APass-Through Entity N/AQuestioned Costs N/ADepartment management did not monitor a high-risk local educational agency during the audit period as requiredBackgroundThe Department of Education (the department) is the pass-through entity for the following programs administered by the U.S. Department of Education:Title I Grants to Local Educational Agencies (See Schedule of Findings and Questioned Costs for footnote),Special Education Cluster (See Schedule of Findings and Questioned Costs for footnote), andSupporting Effective Instruction State Grants (See Schedule of Findings and Questioned Costs for footnote).The department awards these federal program funds primarily to subrecipients commonly known as the local educational agencies (LEAs). LEAs incur education-related costs, such as teacher salaries and benefits, and submit reimbursement requests to the department, using ePlan, the department?s grants management system. The department and the federal grantor do not require subrecipients to submit supporting documentation when filing reimbursement requests for education-related expenses; however, federal regulations require the LEAs to maintain all documentation to support their claims and to comply with federal guidelines during the reimbursement process.Department?s Responsibilities as a Grant AdministratorProgram OversightAs a pass-through entity of federal funds, the department is responsible for providing overall program oversight, which includes, but is not limited to,approving only eligible subrecipients who comply with the federal program requirements and guidelines;providing appropriate and effective training, technical assistance, and any other necessary support to facilitate a successful program participation;designing effective controls to ensure subrecipients receive reimbursement payments for expenditures that are fully compliant with program requirements and guidelines; andmonitoring subrecipients? activities to provide reasonable assurance that the subrecipients administer these federal awards in compliance with federal requirements and guidelines.Department?s Subrecipient Financial Monitoring ActivitiesAccording to the department?s Executive Director of Local Finance, in order to meet these responsibilities for the Title I, Special Education Cluster, and Supporting Effective Instruction programs, the Division of Local Finance and the Division of Federal Programs and Oversight conduct risk-based joint fiscal monitoring of subrecipients, including LEAs. Each fiscal year, monitoring staff perform a risk analysis for each subrecipient to assess the subrecipient?s risk of noncompliance with federal programs. Monitoring staff categorize the assessed risks as significant (high), elevated (medium), and low. Monitoring staff perform annual on-site monitoring activities for subrecipients identified as high-risk. For subrecipients in the medium- or low-risk categories, monitoring staff either perform a desktop review or require the subrecipient to submit a programmatic self-assessment.Condition and CauseBased on our review and discussion with department management, we found that monitoring staff did not perform on-site financial monitoring for 1 of 14 LEAs (7%) during the audit period. Specifically, the monitoring staff did not monitor Metro Nashville Public Schools? (MNPS) financial compliance even though the department classified MNPS as a high-risk LEA, thus requiring annual financial monitoring. According to the Senior Director of Local Finance, because the COVID-19 pandemic closed district offices and schools, the department was unable to perform the on-site financial monitoring review. However, monitoring staff had the option to perform desktop monitoring of MNPS? financial activities but did not do so.The U.S. Department of Education did not waive the state?s requirement to conduct monitoring activities of its subrecipients during the COVID-19 pandemic. In addition, MNPS implemented a new accounting system during fiscal year 2020, which should have necessitated that monitoring staff conduct some form of monitoring activities to ensure MNPS?s accounting transactions complied with federal program requirements. Prior to the end of our fieldwork, monitoring staff began monitoring activities for MNPS for fiscal year 2021.Risk AssessmentWe reviewed the Department of Education?s December 2019 Financial Integrity Act Risk Assessment and determined that management listed the risk of federal award subrecipients not being monitored due to timing challenges with scheduling. The department included alternating between on-site and desktop monitoring for the large urban districts, including MNPS, as one of two controls to mitigate the risk. However, the department did not follow its established control to perform a desktop review when it could not schedule an on-site review at MNPS.CriteriaAccording to Title 2, Code of Federal Regulations (CFR), Part 200, Section 332, ?All pass-through entities must . . . Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved.?The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks? and Principle 8, ?Assess Fraud Risk,?7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. . . .8.07 Management responds to fraud risks through the same risk response process performed for all analyzed risks. Management designs an overall risk response and specific actions for responding to fraud risks. It may be possible to reduce or eliminate certain fraud risks by making changes to the entity?s activities and processes. These changes may include stopping or reorganizing certain operations and reallocating roles among personnel to enhance segregation of duties. In addition to responding to fraud risks, management may need to develop further responses to address the risk of management override of controls. Further, when fraud has been detected, the risk assessment process may need to be revised.EffectWhen department staff does not perform subrecipient financial monitoring or does not have sufficient financial monitoring activities, staff cannot ensure compliance with federal statutes, regulations, and terms and conditions of the grant award; nor can management ensure that subaward performance goals were achieved. During our review of reimbursement claims, we noted that during fiscal year 2020, MNPS charged $1,148,448 in unsupported expenditures to the Title I, Special Education, and Supporting Effective Instruction State Grants programs. For further details, see Finding 2020-002. Additionally, the lack of financial monitoring activities increases the risk of fraud, waste, and abuse.As noted in 2 CFR 200.339, ?If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.208, ?Specific conditions,?1. Requiring payments as reimbursements rather than advance payments;2. Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period;3. Requiring additional, more detailed financial reports;4. Requiring additional project monitoring;5. Requiring the non-Federal entity to obtain technical or management assistance; or6. Establishing additional prior approvals.RecommendationThe Commissioner should ensure fiscal monitoring staff conduct monitoring activities as required, especially for subrecipients that program staff have identified as high-risk for noncompliance.Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur. The department has since resumed monitoring LEAs in FY21. Going forward, the department will make greater use of desktop monitoring procedures to ensure that monitoring takes place even in exceptional situations.Additionally, we will continually assess our risk assessment, confirming the most efficient controls are in place, acting on these controls as prescribed.

Finding Number 2020-005CFDA Number 84.027 and 84.173Program Name Special Education ClusterFederal Agency Department of EducationState Agency Department of EducationFederal Award Identification Number H027A170052, H173A170095, H027A180052, and H173A180095Federal Award Year 2017 through 2019Finding Type Material WeaknessCompliance Requirement Matching, Level of Effort, EarmarkingRepeat Finding N/APass-Through Entity N/AQuestioned Costs N/ADepartment of Education management did not have an internal control over maintenance of effort requirementsBackgroundThe U.S. Department of Education provides federal grant funds through the Individuals with Disabilities Education Act to assist states in providing children with disabilities a free appropriate public education. The Tennessee Department of Education is subject to federal maintenance of effort requirements, which prohibit a state from reducing state financial support for special education below the amount of support for the preceding fiscal year. Known as maintenance of financial support (MFS), the requirement is intended to ensure that the state sets aside sufficient funds for special education and related services.To receive special education funds, the state is required to submit an annual application, which includes a section that allows the state to demonstrate compliance with maintenance of effort requirements. If the state fails to comply with this requirement, the U.S. Department of Education reduces the state?s allocation of special education and related funds for any subsequent fiscal year.In gaining our understanding of the process, we learned from the Senior Director of Strategic Supports that in order for the department to determine if the state maintained the appropriate level of support, she obtains the appropriate data and prepares the MFS workbook. After she prepares the workbook, the department?s Budget Director performs a partial review, which consists of reviewing only the budgetary information he provided. Finally, the Department of Finance and Administration (F&A) performs a high-level review, without verifying the detailed calculations, before the Department of Education submits the application to the U.S. Department of Education.Condition and CauseBased on our testwork, we found that the department met the overall maintenance of effort requirement for the program; however, based on discussion with management, we determined that department staff did not have internal controls over maintenance of effort. Department staff did not perform a complete and comprehensive supervisory review of the MFS workbook to ensure calculations were accurate. According to the Assistant Commissioner of Special Populations, the former Senior Director of Strategic Supports believed that an F&A employee performed a comprehensive review of these calculations; however, F&A staff, believing that Department of Education staff had verified the detailed calculations, only performed a high-level review.Risk AssessmentIn the department?s risk assessment, management identified the failure to comply with the state financial support requirement; however, the department did not identify a specific control to mitigate the risk other than the following:1. department staff have received training regarding maintenance of effort and the need to maintain the same level of funding from one year to the next;2. experienced staff with an understanding of maintenance of effort requirements and its importance to the special education cluster;3. written procedures for the collection and documentation of maintenance of effort to ensure consistency in data collection and reporting from one year to the next; and4. maintenance of effort data is collected and reported annually in the state?s application for federal special education funds.While training, knowledge, and written policies are important to management?s control environment, none of these identified controls involved ensuring management and staff reasonably complied with the federal grant maintenance of effort requirements.After we discussed the insufficient internal control system with department staff, the Assistant Commissioner of Special Populations stated that going forward, all individuals who contribute to preparing the MFS workbook will meet to ensure the department has a control process in place that will ensure the department complies with the maintenance of effort requirement.CriteriaAccording to ?Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,? Title 2, Code of Federal Regulations, Part 200, Section 62,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:a. Transactions are properly recorded and accounted for, in order to: (1) Permit the preparation of reliable financial statements and Federal reports; (2) Maintain accountability over assets; and (3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award;b. Transactions are executed in compliance with: (1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and (2) Any other Federal statutes and regulations that are identified in the Compliance Supplement; andc. Funds, property, and other assets are safeguarded against loss from unauthorized use or disposition.Additionally, the U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government, Principle 10.03, states, ?Management designs appropriate types of control activities for the entity?s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system.?EffectWithout a proper system of internal controls over maintenance of effort, which includes a complete and comprehensive review of the MFS workbook, the risk increases that department staff will miscalculate the state?s compliance with federal fiscal effort requirements. If a miscalculation results in the state?s noncompliance, the department risks a reduction of federal funding for special education activities in subsequent award years. This could diminish the department?s capacity to provide sufficient oversight, monitoring, and technical assistance to the local educational agencies that provide services to special education students.RecommendationManagement should implement appropriate internal controls to ensure that staff perform and document their review of staff?s compliance with maintenance of effort requirements. Additionally, management should evaluate the effectiveness of the control activities for this risk, update the department?s annual risk assessment to reflect any new controls management implements, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur. Department staff will document the process and reviews of all information needed to conform to maintenance of effort requirements.Further, we will evaluate the effectiveness of the existing control activities for this risk and update the department?s annual risk assessment to reflect any new or enhanced controls implemented.

Finding Number 2020-006CFDA Number 84.027 and 84.173Program Name Special Education ClusterFederal Agency Department of EducationState Agency Department of EducationFederal Award Identification Number H027A170052; H173A190095; H027A190052Federal Award Year 2017 and 2019Finding Type Significant Deficiency and NoncomplianceCompliance Requirement Period of PerformanceRepeat Finding N/APass-Through Entity N/AQuestioned Costs: See Schedule of Findings and Questioned Costs for chart/tableDepartment of Education management incurred expenditures, liquidated funds, and reimbursed local educational agencies for expenditures that occurred outside of the Special Education grants? periods of performanceBackgroundFederal funding for the Department of Education?s (department) federal programs is only available to the department and its subrecipients for a limited time (referred to as the grant?s period of performance). For U.S. Department of Education programs, the department has 15 months to charge expenditures to each grant award; however, these programs are governed by the requirements of the Tydings Amendment (Title 20, United States Code, Chapter 31, Section 1225[b]), which extends the period of performance 12 additional months, for a total of 27 months. Unless the U.S. Department of Education authorizes an extension, the department must liquidate all obligations incurred under the federal award no later than 90 calendar days after the end date of the period of performance.Department?s Process to Approve Administrative ExpendituresDepartment employees responsible for reviewing and approving expenditures, review the invoices, accounting data, and any other supporting documentation for the grants that they are responsible for to ensure the expenditure is an allowed cost and the accounting data is correct. The approver documents their approval by signing in the designated area on the front page of the documentation. To complete the process, the accounting department uploads the documentation into Edison, the state?s accounting system, and processes the expenditure for payment.Department?s Responsibilities as a Grant AdministratorAs a pass-through entity of federal funds, the department is responsible for providing overall program oversight, which includes, but is not limited to,approving only eligible subrecipients who comply with the federal program requirements and guidelines;providing appropriate and effective training, technical assistance, and any other necessary support to facilitate a successful program participation;designing effective controls to ensure subrecipients receive reimbursement payments for expenditures that are fully compliant with program requirements and guidelines; andmonitoring subrecipients? activities to provide reasonable assurance that the subrecipients administer these federal awards in compliance with federal requirements and guidelines.Based on our understanding of the federal regulations, the federal grantor expects the department and subrecipients to accurately claim only reimbursable expenses in compliance with program guidance. The department?s Division of Local Finance and the Division of Federal Programs and Oversight monitor the local educational agencies (LEAs) throughout the year based on selecting a sample of LEAs. The fiscal monitoring activities include a review of the process the LEA uses to determine expenditure?s compliance with federal award requirements, but does not include a review of expenditures the department reimbursed and subsequently paid to the LEA.Condition and CauseThe department had a key internal control in place to assess if an expenditure occurred within the applicable grant?s period of performance for both state administrative and LEA costs; however, we determined that this key internal control was not sufficient to prevent the department and LEAs from charging and liquidating special education grant costs outside the grant?s period of performance and liquidation periods.Methodology and Results of Testwork ? Administrative CostsWe performed testwork on a random, nonstatistical sample of 60 expenditures department staff charged to the special education (See Schedule of Findings and Questioned Costs for footnote) grants during fiscal year 2020 to determine if the expenditures occurred within the period of performance for grants that either began or ended during our audit period. Specifically, we tested20 expenditures department staff charged to the H027A170052 grant after the grant?s period of performance end date, September 30, 2019, to determine if department staff incurred the expenditures within the period of performance and department staff liquidated the expenditures by the liquidation end date, December 31, 2019;20 expenditures charged within the first three months of the H027A190052 grant?s period of performance, which began on July 1, 2019, to determine if department staff incurred these expenditures prior to the grant?s period of performance; and20 adjusting accounting entries made to the H027A160052, H027A170052 and H027A190052 grants during fiscal year 2020, to determine if the underlying expenditure occurred during the period of performance.We exhibit details of our sample in Table 1.Based on testwork performed, we determined that department staff did not liquidate 1 of 20 expenditures tested charged to the H027A170052 grant (5%) before the grant?s liquidation period end date. Staff paid the expenditure 17 days after the grant?s liquidation period ended, resulting in $12,946 in known questioned costs. We discussed this expenditure with department staff and reviewed supporting documentation in the state?s accounting system, and determined that department staff incurred the expenditure within the period of performance; however, the liquidation period ended before accounting staff obtained the necessary approvals to release payment. (See Schedule of Findings and Questioned Costs for chart/table.)Methodology and Results of Testwork ? LEA CostsWe performed testwork on a random, nonstatistical sample of 60 reimbursements the department paid to local educational agencies (LEAs) from special education grants during fiscal year 2020 to determine if the expenditures occurred within the period of performance for the grants that either began or ended during our audit period. We tested 30 reimbursements the department paid to LEAs from the H027A170052 and H173A170095 grants after the grants? period of performance end date, September 30, 2019, to determine if the reimbursements charged to the grants were for expenditures the LEA incurred within the period of performance and liquidated before the liquidation end date, December 31, 2019. We also tested 30 reimbursements charged within the first three months of the H173A190095 and H027A190052 grants? period of performance, which began on July 1, 2019, to determine if the reimbursements charged to the grants included LEA expenditures incurred within the grant?s period of performance. We exhibit details of our sample in Table 2.Based on testwork performed, we noted for 3 of 60 LEA reimbursements tested (5%) department staff reimbursed LEAs for expenditures that were not with the grants? period of performance. Specifically, we noted that department staff reimbursed 3 LEAs for 7 expenditures the LEAs incurred between 4 and 122 days before the grants? period of performance began, resulting in $2,487 of questioned costs. As noted in Finding 2020-002, since the department?s fiscal monitors do not review supporting documentation for actual expenditures the department reimbursed to the LEA from federal awards during monitoring visits, the department cannot be sure that LEAs it monitors are in compliance with period of performance requirements. (See Schedule of Findings and Questioned Costs for chart/table.)When we projected the errors from costs reimbursed to LEAs, $2,487, to the population of costs reimbursed to LEAs paid within the first three months of the period of performance, $1,281,775 from awards H027A190052 and H173A190095, and included the known questioned costs from our administrative expenditures sample, $12,946, we found that known and likely questioned costs exceeded $25,000. Title 2, Code of Federal Regulations, Part 200.516(a)(3) requires us to report known and likely questioned costs greater than $25,000 for a type of compliance requirement for a major program.Risk AssessmentIn the department?s 2019 risk assessment, the department identified the risk that it would not expend federal funds within the time frames established in the federal award at the state level but did not identify the risk that special education funds would be spent outside of the period of performance at the subrecipient level. The department listed two internal controls to mitigate the risk of expending special education funds outside of the period of performance at the department level:1. Maintain a library of resources within ePlan for stakeholders and TDOE [department] staff to use, including on allowable uses; and2. Experienced staff familiar with specific grants rules.While maintaining resources for stakeholders and staff to use and having experienced staff with knowledge of grant rules are important to management?s control environment, none of these identified controls involved ensuring management and staff reasonably complied with the federal grant period of performance requirements. To ensure compliance with period of performance requirements at the subrecipient level, management must identify and have in place appropriate internal controls to address the risk of subrecipient period of performance noncompliance. We also noted that as of August 2020 the department had multiple staff vacancies for positions that support the administration of the special education cluster grants.CriteriaTitle 2, Code of Federal Regulations, Part 200.62, states,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:a. Transactions are properly recorded and accounted for, in order to: (1) Permit the preparation of reliable financial statements and Federal reports; (2) Maintain accountability over assets; and (3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award;b. Transactions are executed in compliance with: (1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and (2) Any other Federal statutes and regulations that are identified in the Compliance Supplement; andc. Funds, property, and other assets are safeguarded against loss from unauthorized use or disposition.According to the U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government, Principle 10.03, ?Management designs appropriate types of control activities for the entity's internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system.?According to 2 CFR 200.309, ?A non-Federal entity may charge to the Federal award only allowable costs incurred during the period of performance??According to 2 CFR 200.343(b), ?Unless the Federal awarding agency?authorizes an extension, a non-Federal entity must liquidate all obligations incurred under the Federal award not later than 90 calendar days after the end date of the period of performance??EffectWhen the department does not have proper internal controls in place to ensure expenditures occurred within the grant?s period of performance and liquidation periods, management cannot ensure that expenditures are charged to the appropriate grant award, the department increases the risk that funds will be expended outside of the period of performance. The lack of mitigating controls increases the risk of noncompliance with the federal program requirements and may require the state to return these funds to the U.S. Department of Education.As noted in 2 CFR 200.339, ?If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.208, ?Specific conditions,?1. Requiring payments as reimbursements rather than advance payments;2. Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period;3. Requiring additional, more detailed financial reports;4. Requiring additional project monitoring;5. Requiring the non-Federal entity to obtain technical or management assistance; or6. Establishing additional prior approvals.Furthermore, Section 200.339 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:a. Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.b. Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.c. Wholly or partly suspend or terminate the Federal award.d. Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).e. Withhold further Federal awards for the project or program.f. Take other remedies that may be legally available.RecommendationManagement should develop adequate control procedures to ensure that both administrative expenditures and costs reimbursed to local educational agencies occurred during the grant award?s period of performance and are liquidated within the applicable time period. Additionally, management should update the department?s annual risk assessment to reflect any new controls the department adds to the process for expending federal funds within the timeframes specified in the federal award and any new procedures added to the fiscal monitoring process to ensure subrecipient compliance with period of performance requirements. Furthermore, management should take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur. TDOE will take additional steps to improve and strengthen period of performance internal controls. Changes will be reflected in the fiscal monitoring plan and will include ensuring that the risk times immediately before and immediately after grant periods of performance are reviewed. The department will also develop a monitoring tool to address issues noted during reviews of LEAs.Additionally, grants staff will be trained to conduct random desktop reviews of LEA reimbursements to strengthen internal controls related to period of performance compliance.Finally, we will update our risk assessment to address the items recommended above.

Finding Number 2020-007CFDA Number 16.575Program Name Crime Victim AssistanceFederal Agency Department of JusticeState Agency Department of Finance and AdministrationFederal Award Identification Number 2016-VA-GX-0053 and 2017-VA-GX-0051Federal Award Year 2016 and 2017Finding Type Material Weakness and NoncomplianceCompliance Requirement ReportingRepeat Finding 2019-012Pass-Through Entity N/AQuestioned Costs N/AFor the second year, management of the Office of Criminal Justice Programs did not design appropriate internal controls to ensure information provided to the federal grantor was complete and accurateBackgroundThe Department of Finance and Administration?s (F&A) Office of Criminal Justice Programs is responsible for administering the Crime Victims Assistance program, which is funded by and known as the Victims of Crime Act of 1984 (VOCA). While collaborating with other public and private nonprofit organizations, the office uses VOCA grants to provide services to victims of crime in Tennessee.The U.S. Department of Justice (DOJ) requires the Office of Criminal Justice Programs to file a Federal Financial SF-425 report quarterly for each open VOCA grant, which for our period was the 2016 and 2017 (See Schedule of Findings and Questioned Costs for footnote) VOCA grants. The federal quarterly reporting periods end December 31, March 31, June 30, and September 30. The cumulative report includes summary information on expenditures, unliquidated obligations, recipient share (match), program income, and indirect expenses for the duration of the grant. DOJ requires the Office of Criminal Justice Programs to submit the report 30 days after the end of the reporting quarter (See Schedule of Findings and Questioned Costs for footnote) through DOJ?s Grants Management System.F&A?s Office of Business and Finance performs all fiscal-related duties on behalf of the Office of Criminal Justice Programs, including the submission of financial reports to DOJ. At the close of each reporting period, the Accountant II in the Office of Business and Finance provides a trial balance for all VOCA awards and enters the VOCA program and administration expenditure totals into a spreadsheet used to track the available funds of each federal project. To calculate the current period expenditure total, he subtracts the current cumulative expenditure totals from the cumulative expenditure totals reported in the previous period. The Accountant II performs further calculations for lines 10i., ?Total recipient share required,? and 10j., ?Recipient share of expenditures,? which require fiscal staff to report the subrecipient?s match of VOCA expenditures.?Project Match Requirements,? Title 28, Code of Federal Regulations (CFR), Part 94, Section 118, requires subrecipients, such as recipients of the VOCA grant money, to match at least 20% of the ?total cost of each project? unless subrecipients obtain exception waivers from the Office of Criminal Justice Programs. DOJ allows for and grants full and partial match waivers to a portion of the subrecipients, based on an application process. Subrecipients must submit a written request for an exception waiver to the Office of Criminal Justice Programs? Senior Audit Manager, who typically considers factors such as local resources, annual budget changes, past ability to match, and whether the funding is for new or additional activities to determine whether to approve or deny the waiver request. A different match waiver amount can be approved for each year of the four-year grant period.Once the SF-425 is completed, the Office of Business and Finance?s Director of Fiscal Services reviews the report and directs the Accountant II to make any necessary corrections. The Director then approves the report, and the Accountant II submits the report through DOJ?s Grants Management System.Prior Audit ResultsThe prior audit finding reported that F&A?s Office of Business and Finance did not have written policies and procedures for the federal reporting process. Additionally, the prior finding reported that the Director?s review documentation for the SF-425 reporting process was not retained and that the accountant had inaccurately reported the amounts on the SF-425 for line item 10i., ?Total recipient share required.? The errors occurred because the accountant reported estimated matches, which did not take into consideration any partial-match waiver approvals. Also, staff did not report indirect costs as required by DOJ.Management in F&A?s Office of Business and Finance concurred with the prior finding and stated they updated and created written policies and procedures. These updates included requirements for maintaining documentation of the internal review. In F&A?s six-month follow-up report to the Comptroller?s Office, dated September 24, 2020, management stated that they had staff retrained by the federal partners on how to complete the report. Management also stated they had identified and addressed the risks noted in the prior finding.For the current audit, we found that management in F&A?s Office of Business and Finance had updated and created written policies and procedures in January 2020. The Director of Fiscal Services now documents her review of the SF-425 report through emails documenting changes and approval of the reports, but F&A did not have evidence of these emails. Management in F&A?s Office of Business and Finance also created SF-425 reporting procedures to use actual match amounts versus estimated, but these procedures were not sufficient to explain how the match should be calculated. Although management indicated that staff were retrained on report preparation, the reports still did not include the indirect cost information as required.Condition and CauseDeficiencies in the Report Preparation ProcessBased on our review of the Office of Criminal Justice Programs? SF-425 final report for September 2019 and quarterly reports for March 2020 and June 2020, we found that the process of the Accountant II in F&A?s Office of Business and Finance for compiling and calculating the match still resulted in inaccurate reporting. Instead of requesting, obtaining, and using the approved matching rates from the Office of Criminal Justice Programs, the Accountant II obtained the match rates from the subrecipients? reimbursement requests and approved budgets. Because match rates can change each year, the budget document is not a reliable source for obtaining the final approved match rate. Additionally, we found that the Accountant II?s calculations included rounding the matching rates to the nearest whole percentage, which led to further report inaccuracies.We recalculated line 10i., ?Total recipient share required,? by obtaining each subrecipient?s approved matching rate from Office of Criminal Justice Programs staff and multiplying the rate by the subrecipient?s amount of expenditures for the period. See Table 1. (See Schedule of Findings and Questioned Costs for chart/table.)The match calculation errors noted in line 10i., ?Total recipient share required,? for all three reports also resulted in the Accountant II inaccurately reporting line 10j., ?Recipient share of expenditures,? for the September 2019 report. See Table 2. (See Schedule of Findings and Questioned Costs for chart/table.)According to the Accountant II in F&A?s Office of Business and Finance, he was not aware of the effect of rounding on report accuracy or that he was using incorrect matching rates. Upon further review, we also found that in one case the Accountant II had inadvertently picked up matching rates for the wrong grant.Additionally, as a result of our reporting testwork, we found that the Accountant II did not report the financial information related to indirect costs on lines 11a-f of the SF-425 on the September 30 final report for the 2016 VOCA grant and the June 30 quarterly report for the 2017 VOCA grant despite the Office of Criminal Justice Programs charging indirect costs to the grant.According to management in the Office of Criminal Justice Programs, there was turnover in fiscal staff. The Accounting Manager responsible for the reporting process left the agency in December 2019, and the position remained open until October 2020.Inadequate Review ProcessBecause the Director of Fiscal Services in F&A?s Office of Business and Finance relied on the Accountant II?s match calculations and did not have a clear understanding of the reporting requirements, her review would not have identified the errors related to match. Management issued the September 30, 2016, report when the Office of Business and Finance was making changes to the reporting process, and the Director failed to notify the Accountant II to make the indirect cost correction for the June 30, 2017, quarterly report.Risk AssessmentWe reviewed F&A?s December 2019 Financial Integrity Act Risk Assessment and determined that management had identified the risks associated with reporting incomplete and incorrect information on federal reports. Management had also included in its assessment several control activities to address or reduce these risks. These control activities included a review process for federal reporting designed to ensure complete and correct information, but F&A?s report preparation procedures and review process were not sufficient to identify the inaccuracies and incomplete federal reports.Criteria?Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,? 2 CFR 200.62 states,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:a. Transactions are properly recorded and accounted for, in order to: (1) Permit the preparation of reliable financial statements and Federal reports;(2) Maintain accountability over assets; and (3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award;b. Transactions are executed in compliance with: (1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and (2) Any other federal statutes and regulations that are identified in the Compliance Supplement; andc. Funds, property, and other assets are safeguarded against loss from unauthorized use or disposition.Risk AssessmentAccording to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. . .7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions.EffectWithout establishing and implementing effective reporting controls, neither the Office of Business and Finance nor DOJ can properly track subrecipient matches and the Office of Criminal Justice Programs? indirect costs, which may result in loss of federal funds or other penalties resulting from reporting inaccurate financial data. Without accurate and complete financial reporting, DOJ is unable to effectively monitor the status of VOCA funds awarded to F&A.Additionally, federal regulations address actions that may be imposed by federal agencies in cases of noncompliance. As noted in 2 CFR 200.339, ?If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in section 200.208, ?Specific conditions?:1. Requiring payments as reimbursements rather than advance payments;2. Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period;3. Requiring additional, more detailed financial reports;4. Requiring additional project monitoring;5. Requiring the non-Federal entity to obtain technical or management assistance; or6. Establishing additional prior approvals.RecommendationThe Commissioner of Finance and Administration should ensure that the Office of Business and Finance?s management and staff, and the Office of Criminal Justice Programs? management and staff work together to ensure information used for the SF-425 report is accurate and complete. The Office of Business and Finance?s management should ensure their review process is documented and all necessary steps are taken to ensure the reports are accurate and complete.Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur. Through a combination of unexpected turnover resulting in extended staffing shortages and federal reporting system changes, minor errors were neither caught nor corrected prior to the audit commencing. Following the initial finding, the Office of Business and Finance (OBF) completed corrective action through updated written procedures for the internal steps involved in generating the SF-425. As a result of this audit we intend to further clarify those written procedures to specifically address the manner in which we maintain the documentation of the review of SF-425s prior to their submission. The errors that were identified during this audit were corrected in the subsequent submission of the SF-425 once the new federal system (JustGrants.gov) became available.In an effort to mitigate the risk of future communication issues between the Office of Criminal Justice Programs (OCJP) staff and OBF staff, an additional step has been added to the SF-425 review process to ensure that OCJP and OBF reconcile any differences in match rates, including rounding issues such as the one identified in this audit, and ensure that they are resolved prior to the submission of the SF-425. This additional review has been added to the internal review document to ensure we maintain documentation of OCJP?s review as well.Following the initial finding, staff in place at the time were retrained on the instructions for the SF-425 provided by our federal partners but turnover and staffing shortages created an environment that made the section more vulnerable to human error and increased the risk of reviewers missing those errors. The errors were not missed as a result a lack of knowledge of the remaining staff but merely human error from staff being spread too thin during the hiring freeze. Recently OBF was able to fill key vacant positions in the Grants Accounting section and began training them in these processes. Additionally, the Office of Business and Finance has begun the process of shifting and cross training additional staff to the Grants section, as needed, to mitigate the risks associated with staffing shortages and turnover in the future.The Office of Business and Finance has already begun and will continue an extensive review of all significant risks associated with the SF-425 reporting requirements and will update or add identified risks to the department?s documented risk assessment documents. Appropriate Office of Business and Finance staff will be assigned the ongoing monitoring of risks and controls and will act to correct any deficiencies that may occur.

Finding Number 2020-008CFDA Number 93.778Program Name Medicaid ClusterFederal Agency Department of Health and Human ServicesState Agency Department of Finance and AdministrationFederal Award Identification Number 1905TN5MAP and 2005TN5MAPFederal Award Year 2019 through 2020Finding Type Material Weakness and NoncomplianceCompliance Requirement EligibilityRepeat Finding 2019-015Pass-Through Entity N/AQuestioned Costs $77,169As noted in the prior audit, TennCare management did not promptly address TennCare?s Medicaid eligibility process deficiencies, resulting in $111,402 in federal and state questioned costsBackgroundTennCare is Tennessee?s Medicaid program, funded at both the federal and state level, that provides health insurance coverage to certain groups of low-income individuals, such as pregnant women, children, caretaker relatives of dependent children, and other adults with disabilities. In general, the Division of TennCare (TennCare) makes three types of payments on behalf of its members:capitation or administrative payments (See Schedule of Findings and Questioned Costs for footnote) to managed care organizations that contract with TennCare to deliver services to members;fee-for-service claims paid directly to providers for services (See Schedule of Findings and Questioned Costs for footnote) provided to certain members, such as children enrolled in the Department of Children?s Services? (DCS) foster care or adoption assistance program, or for certain costs relating to Medicare for members who are enrolled in both Medicaid and Medicare; andreimbursements to benefit managers for services, such as pharmacy, dental, and health services.TennCare?s Eligibility Determination Process for Medicaid Applicants and MembersInitial Eligibility ProcessTennCare uses the Tennessee Eligibility Determination System (TEDS) to determine an applicant?s eligibility. Applicants apply for eligibility using TennCare Connect, TEDS? public-facing web portal. In addition to TennCare Connect, TennCare continues to accept applications through each of following methods:by phone or online through the Federally Facilitated Marketplace (See Schedule of Findings and Questioned Costs for footnote);by phone or a paper application;by visiting a Department of Human Services office for in-person assistance with applying online, by paper, or by phone;by online through the TennCare Access partner portal (See Schedule of Findings and Questioned Costs for footnote); orby visiting a Department of Human Services office for in-person assistance with applying online, by paper, or by phone.?Whether an applicant applies by phone, paper, in person, through the Federally Facilitated Marketplace, through TennCare Access, or through TennCare Connect, the applicant?s demographic, income, and household information is entered into TEDS for automated processing, thereby removing the need for human intervention in many cases. If the applicant?s eligibility determination requires human intervention, a TennCare eligibility caseworker is assigned to process the application manually (See Schedule of Findings and Questioned Costs for footnote) in TEDS to determine if the applicant is eligible for any available TennCare eligibility category (including children, pregnant women, parents or caretakers of children, or other categories for certain adults). If TennCare determines that an applicant or member is not eligible for Medicaid benefits, the individual may appeal TennCare?s decision.Eligibility RenewalsPursuant to the Families First Coronavirus Response Act, TennCare is not permitted to terminate members who were enrolled when the federal COVID-19 emergency period began. As such, TennCare paused Medicaid eligibility renewals, eligibility changes to lower categories, and terminations on March 18, 2020. During this pause, TennCare is only allowed to terminate Medicaid coverage for existing members due to the member?s death, when a member voluntarily terminates coverage, or when a member becomes a resident in another state.Social Security Number RequirementsAccording to Title 42, Code of Federal Regulations (CFR), Part 435, Section 910(f), TennCare cannot deny or delay services to otherwise eligible members pending issuance or verification of the member?s Social Security number (SSN). According to TennCare?s Assistant Commissioner of Member Services, management may have to assign a pseudo (temporary) SSN to a member upon enrollment in TennCare if the member cannot provide an SSN at the time of application. Management assign pseudo SSNs when members meet one of the following conditions:a newborn who has not been issued a valid SSN,a child in DCS custody who qualifies for the federal adoption assistance program and may be applying for a new SSN,an immigrant (See Schedule of Findings and Questioned Costs for footnote) who is ineligible for full Medicaid receiving payments for emergency services,a person who is in the process of applying for an SSN,a person approved by the Federally Facilitated Marketplace who has incomplete SSN data, ora person who files an application without an SSN but can be approved based on the information submitted.Prior Audit ResultsAs noted in the prior audit, the division did not have an effective key internal control for determining eligibility. As a result, we reported the following compliance issues:TennCare did not appropriately determine member eligibility based on the member?s assigned eligibility category,management did not obtain changes to eligibility determination statuses relating to children in foster care or receiving adoption assistance from DCS,TennCare did not terminate eligibility for members who did not have an eligible citizenship or immigration status, andfor immigrants who are ineligible for full Medicaid who received emergency medical services, management did not initiate coverage when the emergency event began or terminate coverage when the emergency event ended.In TennCare?s six-month follow-up report to the Comptroller?s Office, dated September 17, 2020, management stated thatThe federal share of the questioned costs was returned on July 14, 2020. TEDS was programmed during development to automatically determine the correct outcomes and categories when eligibility is run, which has mitigated the errors noted of miscategorized eligibility using manual processes. The errors noted of payments made for emergency medical services (EMS) outside of the emergent period have also been mitigated. Manual worker processes were discontinued in the spring of 2019, and all EMS applications are now completed in TEDS. In addition, a defect in TEDS was corrected in October 2019 that caused the transmission of EMS eligibility segments to the Medicaid Management Information System (MMIS)? TennCare will review internal controls in place to address the risks noted by the auditors during the 2020 risk assessment process required by the Tennessee Financial Integrity Act, which will be completed by December 31, 2020.Current Audit ResultsFor the current audit (See Schedule of Findings and Questioned Costs for footnote), we determined that TennCare management did not resolve some of the eligibility issues that we noted in the prior audit. We also identified new conditions affecting eligibility decisions:a backlog (See Schedule of Findings and Questioned Costs for footnote) created from TEDS implementation, andTEDS and caseworker processing errors.Testwork MethodologyIn order to test TennCare?s compliance with Medicaid eligibility requirements, we selected a random, nonstatistical sample from two different populations and tested one entire population.Sample 1: To determine if TennCare appropriately determined members? eligibility for TennCare coverage, we tested a sample of 61 members and the related capitation payments, totaling $337,529 (See Schedule of Findings and Questioned Costs for footnote), from a population of 1,630,873 TennCare members, for whom TennCare paid capitation payments to managed care organizations totaling $6,976,685,061 during fiscal year 2020.Sample 2: We identified the population of TennCare members who had pseudo Social Security numbers (SSNs) for over one year and for whom management had not resolved the pseudo SSNs as of November 1, 2020. From a population of 1,401 members who had pseudo SSNs, we tested a nonstatistical, random sample of 41 members to determine if management identified a member who did not meet one of the applicable categories (a newborn, a child in DCS custody, an immigrant ineligible for full Medicaid receiving emergency services, a person applying for an SSN, or a person approved by the Federally Facilitated Marketplace who has incomplete data) to be assigned a pseudo SSN.Population: From a population of 103,780 members who had a pseudo SSN at any point during the year ended June 30, 2020, we filtered the population to identify and test all 64 ineligible immigrants classified as receiving emergency services.It is important to note that, based on our testwork from the 2 samples and 1 population, we identified 38 ineligible members from the 166 members tested; 25 ineligible members will continue to receive benefits until the COVID-19 pandemic emergency ends and TennCare already terminated coverage for the remaining 13 ineligible members.Condition, Criteria, and CauseConversion to TEDS in 2019 Created a Backlog of Medicaid Member Eligibility DeterminationsWhen TennCare management prepared to implement TEDS, TennCare moved existing member eligibility cases in the legacy systems into a conversion status (See Schedule of Findings and Questioned Costs for footnote) in TEDS. Otherwise, TennCare may have terminated the members? benefits and require them to reapply. Through discussions with TennCare management we learned that, as of February 5, 2021, they had 85,395 members in conversion status. The members who were still in conversion status were either in the Medicaid program (75,571), the CoverKids program (549) (See Schedule of Findings and Questioned Costs for footnote), or the Medicare Savings Program (9,275 - a program for Medicaid/Medicare dual eligible members to help pay Medicare premiums, deductibles, coinsurance, copayments, prescription drug coverage costs). According to TennCare management, members who are in conversion status include any cases transferred from the legacy system to TEDS which have not yet been reviewed for current eligibility and resolved. These cases could include members who are still eligible or members who are no longer eligible. Ineligibility could result from the following situations:members who aged out of eligibility for benefits,members whose post-partum period of eligibility has ended,members whose category at the time of conversion is now different, ormembers who may have Medicaid coverage in another state.All the above cases will remain in conversion status until either the case is selected for renewal or the member reports a change to TennCare that updates eligibility or results in termination.TEDS Errors and Caseworker Errors Affecting Eligibility DeterminationsWe identified seven types of errors in TennCare?s eligibility processes. Of the seven issues found, 2 were systems related, 4 were caseworker errors, and 1 was a combination of a system error and a caseworker error. We brought the following errors to management?s attention based on our eligibility, pseudo SSN, and emergency services testwork:TennCare appeals staff did not resolve 2 members? eligibility appeals within 90 days, as required, resulting in these 2 ineligible members retaining benefits. According to the Assistant Commissioner of Member Services, due to the high volume of appeals in 2019 TennCare allowed appellants to remain in the program past the 90 days if the appeal had not been resolved. Therefore, we questioned all costs after the date TennCare should have resolved their appeals, resulting in federal questioned costs totaling $5,082 and a remaining $2,260 in state questioned costs.See Schedule of Findings and Questioned Costs for chart/table.For 1 member who went through the renewal process, a TennCare eligibility caseworker processed the member?s eligibility determination without obtaining documentation that the member had an SSN or that the member was in the process of obtaining one. Because the member met all other eligibility requirements, we did not question costs.See Schedule of Findings and Questioned Costs for chart/table.For 19 members who originally received CoverKids (See Schedule of Findings and Questioned Costs for footnote) pregnancy coverage and were not U.S citizens, caseworkers did not correct the members? citizenship status when the members? cases were converted from the legacy eligibility systems to TEDS. During conversion, TennCare decided to load members? citizenship status to U.S. citizen but marked the verification status as conversion (See Schedule of Findings and Questioned Costs for footnote). According to the Assistant Commissioner of Member Services, caseworkers were responsible for correcting the citizenship status before TEDS could take further action on the case. Because caseworkers did not make the corrections, TEDS processed and approved the members for Medicaid benefits. As a result, we identified federal questioned costs totaling $63,296 and a remaining $27,942 in state questioned costs.See Schedule of Findings and Questioned Costs for chart/table.For 1 member, an eligibility caseworker processed the member?s application, even though the person was not applying for benefits. Although other household members applied for Medicaid, the member tested was not a U.S. citizen and noted on the application that he was not applying for benefits. TennCare?s Assistant Commissioner of Member Services stated the caseworker made a mistake. As a result, we identified federal questioned costs totaling $1,520 and a remaining $664 in state questioned costs.For 1 member TEDS erroneously extended the member?s reasonable opportunity period coverage instead of terminating the member?s benefits when the member failed to provide her verification of citizenship status. Under federal requirements, TennCare allows applicants a 90 day reasonable opportunity period to submit proof of citizenship (See Schedule of Findings and Questioned Costs for footnote). Apparently the member?s caseworker approved the original reasonable opportunity period, causing TEDS to erroneously extend the member?s reasonable opportunity period coverage instead of terminating the member?s benefits. As a result, we identified federal questioned costs totaling $5,171 and a remaining $2,421 in state questioned costs.For 11 immigrants who received emergency medical services during the audit period, TEDS did not limit benefit coverage to the dates of the emergency events, as required by policy. As a result, we identified federal questioned costs totaling $235 and a remaining $104 in state questioned costs. According to the Assistant Commissioner of Member Services, 10 members experienced 2 emergency events, and TEDS incorrectly backdated eligibility to the first event. The TEDS contractor implemented a system fix on December 30, 2020. We will review the system fixes management implemented after the end of our audit scope (June 30, 2020) during TennCare?s 2021 Single Audit. For 1 member, TEDS began benefit coverage on the wrong date. We brought the second issue to management?s attention in the prior audit; they corrected the system error through a data fix on October 30, 2019, and then TennCare discovered errors in the data fix, which were corrected on December 15, 2019.See Schedule of Findings and Questioned Costs for chart/table.For 2 immigrants who received emergency medical services during the audit period, TEDS did not terminate the coverage period on the last day the individual received the emergency service, resulting in $88 in federal questioned costs and a remaining $46 in state questioned costs. According to TennCare?s Assistant Commissioner of Member Services, the TennCare eligibility caseworkers either did not enter an end date in interchange (See Schedule of Findings and Questioned Costs for footnote) or did not enter the correct end date. The TEDS contractor corrected the system error through a data fix on December 10, 2019.TennCare Management Did Not Have Sufficient Documentation to Support Eligibility DeterminationFor one member who left the DCS custody in February 2019, TennCare did not obtain sufficient documentation to determine her eligibility after she left custody. TennCare did not obtain updated household income for the parent and member. According to TennCare?s Eligibility Quality Control Director, TennCare?s Business Improvement Team worked with DCS to review cases in TEDS where the child may have already left custody; they completed the project in November 2020. We will examine the effectiveness of the DCS data transfer during the next audit. As of March 2, 2021, the member is listed as having no income in TEDS and is presumably eligible; however, without sufficient documentation neither management nor we could determine the member?s eligibility. We identified federal questioned costs, totaling $1,777, and a remaining $796 in state questioned costs.Risk AssessmentWe reviewed the Division of TennCare?s December 2019 Financial Integrity Act Risk Assessment and determined that management listed the risk of an eligibility caseworker or TEDS performing inaccurate eligibility determinations, case changes, and redeterminations. While management identified the risk, management?s control of TEDS generating canned and ad hoc reports relating to system functionality and worker performance is not sufficient to mitigate the risk.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,?7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions.EffectWhen TennCare staff and TEDS do not process Medicaid eligibility determinations correctly and timely, the division increases the risk of keeping ineligible individuals on its membership rolls, thereby allowing them to receive a public benefit they are not entitled to receive and rendering related costs unallowable. Until TennCare management can significantly reduce or eliminate the backlog of conversion cases (cases which require caseworker intervention), management increases the risk of allowing ineligible members to remain on the program.Additionally, federal regulations address actions that federal agencies may impose in cases of noncompliance. As noted in 2 CFR 200.339, ?If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.208, ?Specific conditions,?1. Requiring payments as reimbursements rather than advance payments;2. Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period;3. Requiring additional, more detailed financial reports;4. Requiring additional project monitoring;5. Requiring the non-Federal entity to obtain technical or management assistance; or6. Establishing additional prior approvals.Furthermore, Section 200.339 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:a. Temporarily withhold cash payments pending corrective action of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.b. Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.c. Wholly or partly suspend or terminate the Federal award.d. Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).e. Withhold further Federal awards for the project or program.f. Take other remedies that may be legally available.RecommendationThe Assistant Commissioner should ensure that eligibility caseworkers are fully trained so that they understand their responsibilities relating to Medicaid eligibility and can properly and timely determine if the members are eligible for benefits. In addition, the Assistant Commissioner should ensure that the TEDS contractor?s system fix is operating as designed. Furthermore, the Assistant Commissioner should ensure the eligibility data for a member who is no longer in the Department of Children?s Services? custody is sufficient to determine eligibility.Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur.It is important to note that no member has been harmed by the issues raised in this finding. This audit covers the first full year of TennCare?s new eligibility system. Most of the issues identified are related to go-live activities of converting existing members into the new system. There were also examples of staff data entry errors noted during the review period. Finally, there were two TEDS system errors identified that have now been corrected and one more that will be corrected this spring. For context, we would like to supply some information about the implementation of our new eligibility system, then we will discuss the actions we have taken and will take to address the issues described in this finding.On June 3, 2019, TennCare?s modern eligibility system officially moved to production after pilot phases beginning on October 23, 2018. The implementation of the new system was a major, successful implementation that took three years from contract development to pilot go live. The system includes the main eligibility system TEDS, and its public-facing portals TennCare Connect, the TennCare Connect mobile app, and TennCare Access. The system now processes about 500,000 TennCare applications each year and is used by more than 700 state employees plus an additional 300 to 400 contractors each day.During conversion to the new system, it was not possible in many cases to automatically populate all the necessary fields from data in the systems and records that preceded TEDS. TennCare members? records that did not have complete information were marked as being in ?conversion status.? The conversion status prevented TEDS from making automatic eligibility decisions when the system had incomplete information from the conversion. This approach prevented the system from making potentially incorrect decisions until complete information could be gathered during a member?s first annual renewal period or some other contact with the state.In May 2019 after all existing Medicaid and CHIP members were loaded into TEDS, there were 420,000 individuals in this conversion status. In consultation with CMS, the federal Medicaid and CHIP oversight agency, TennCare planned to ramp up over time the number of renewals conducted each month in the new system to ensure proper systems processing and staff adoption of the new processes. TennCare was on target to have all conversion status cases renewed in the new system by late 2020, but those plans changed due to the declaration of a public health emergency and a moratorium on renewals, negative changes and terminations effective March 18, 2020. On February 5, 2021, approximately 85,000 individuals remained in conversion status.With the implementation of TEDS, TennCare applicants and members now have the ability to submit applications and renewals online and to manage their data at any time through the use of TennCare Connect. They can also view notices online or through a mobile app and can take pictures of documents requested by the state or the system to complete eligibility processing. This is a significant improvement over the pre-TEDS processes that required faxing or mailing documentation. In addition to the self-service functionality, TennCare can now process applications, changes and renewals in real time during an online session or overnight once the data is submitted to the state if automated data verifications are available.We have taken or are taking the following steps to address case worker and systems errors described in this finding.First, we improved our ability to process appeals within 90 days. At go-live of the new eligibility system TennCare had a high volume of appeals open both in TEDS and in a legacy appeals system. Since 2019 TennCare has identified, developed and implemented many changes to the TEDS appeals system and processes that have greatly improved efficiency. Staff have also become more efficient as they are now familiar with the new system. TennCare has greatly reduced the number of open appeals. Note that these open cases were always for members who were continuing to receive benefits during the appeal as required by law, so members were not harmed by the longer appeals processes. We note, however, that if external events such as the resumption of redetermination at the end of the public health emergency led to a high volume of appeals, we may again be required to let appeals continue beyond 90 days for members who are receiving continued coverage.Second, for the case where a child?s coverage was automatically extended even though the SSN was not in the record, the valid social security number has now been added to the case and the member remains eligible for TennCare.Third, we have also addressed the 19 cases the auditors identified where citizenship status was not available to be automatically loaded into the new eligibility system and so the cases were marked as being in conversion status requiring verification. Guidance was distributed to staff and made available in the TEDS system in early 2019 describing the process for authorizing cases in conversion status. The guidance specified to update each verification field in each case from conversion to an acceptable verification status (or to request verification if electronic sources were unable to verify). However, caseworkers incorrectly moved these cases from CoverKids to the Caretaker Relative category. The error would have been resolved through the normal process of renewals but the national pandemic resulted in a hold on that process. All potential cases have been identified and notices requesting verification of citizenship status have been sent.Fourth, we concur that a TennCare eligibility caseworker marked a family member on an application as applying for coverage and entered the immigration data into the system in error. We will take action on this case as soon as possible.Fifth, in the case of a member whose reasonable opportunity period was extended due to worker error, we will take action on this case as soon as possible.Sixth, we have corrected systems errors related to coverage dates for payment of hospital bills through emergency medical services. The first systems issue was corrected on December 30, 2020. The second issue was discovered during the prior single audit and was initially corrected through a systems data fix on October 30, 2019. It was later discovered that the data fix did not cover all possible scenarios and that was corrected on December 15, 2019.For the seventh and final test group, on December 10, 2019 a data fix was applied to correct the two cases where the system applied the incorrect end date for emergency medical service segments, and coverage for these individuals has been closed.As the auditors have explained, with our new eligibility system we have improved our eligibility process for children in foster care so that the eligibility is processed directly in TEDS by DCS child welfare benefit workers. As part of our conversion to the new system, by the end of calendar year 2020 TennCare completed work with DCS to redetermine children in state custody from the conversion period who may have left state custody prior to TEDS implementation, including the child referred to in this finding. We will continue to work on processes to capture updated information for eligibility reviews after a child has left DCS custody. While training can never eliminate human error, we will make additions to our already significant investment in upfront and ongoing training of our workers. We will increase the explanation of the business processes and policies used in the eligibility determination process. The first section of a curriculum revision is targeted for completion in June 2021 and the second section is targeted for completion in August 2021.

Finding Number 2020-009CFDA Number 93.767Program Name Children?s Health Insurance Program (CHIP)Federal Agency Department of Health and Human ServicesState Agency Department of Finance and AdministrationFederal Award Identification Number 1805TN5021 and 1905TN5021Federal Award Year 2018 through 2019Finding Type Material Weakness and NoncomplianceCompliance Requirement EligibilityRepeat Finding N/APass-Through Entity N/AQuestioned Costs $3,102Management should promptly address TennCare?s CoverKids eligibility process deficienciesBackgroundThe Division of TennCare (TennCare) oversees CoverKids, Tennessee?s Children?s Health Insurance Program. Funded at both the federal and state levels, the program provides health insurance coverage to uninsured, low-income children and pregnant women not otherwise eligible for Medicaid. In general, TennCare makes three types of payments on behalf of CoverKids members:administrative payments to BlueCross BlueShield, who contracts with TennCare to deliver services to CoverKids members;fee-for-service claims paid to providers for services (See Schedule of Findings and Questioned Costs for footnote) provided to members; andreimbursements to benefit managers for services, such as pharmacy, dental, and health services.TennCare?s Eligibility Determination Process for CoverKids Applicants and MembersInitial Eligibility ProcessWith the implementation of the Tennessee Eligibility Determination System (TEDS) on April 1, 2019, CoverKids applicants apply for eligibility using TennCare Connect, TEDS? public-facing web portal. In addition to TennCare Connect, TennCare continues to accept applications through each of following methods:by phone or online through the Federally Facilitated Marketplace (See Schedule of Findings and Questioned Costs for footnote);by phone or a paper application;online through the TennCare Access partner portal (See Schedule of Findings and Questioned Costs for footnote); orby visiting a Department of Human Services office for in-person assistance with applying online, by paper, or by phone.Whether an applicant applies by phone, paper, in-person, through the Federally Facilitated Marketplace, through TennCare Access, or through TennCare Connect, the applicant?s demographic, income, and household information is entered into TEDS for automated processing. The applicant?s information is verified against multiple state and federal databases to determine if the applicant is eligible for any available TennCare or CoverKids eligibility category, thereby removing the need for human intervention in many cases. If the applicant?s eligibility determination requires human intervention, a TennCare eligibility caseworker is assigned to process the application manually (See Schedule of Findings and Questioned Costs for footnote) in TEDS.Eligibility Renewals PausedPursuant to the Families First Coronavirus Response Act, TennCare is not permitted to terminate members who were enrolled when the federal COVID-19 emergency period began. As such, TennCare paused CoverKids eligibility renewals, eligibility changes to lower categories, and terminations on March 18, 2020. During this pause, TennCare is only allowed to terminate CoverKids coverage for existing members due to the member?s death, when a member voluntarily terminates coverage, or when a member becomes a resident in another state.Condition, Criteria, and CauseWe focused our audit objectives on TennCare?s process to determine that members were eligible for CoverKids coverage. To accomplish our objective, we tested two unique populations:1. members of the CoverKids program, and2. members who had their eligibility redetermined (renewed) during the fiscal year ended June 30, 2020.From a population of 64,186 CoverKids members, for whom TennCare paid administrative payments to BlueCross BlueShield totaling $14,554,018 in federal and state funds during fiscal year 2020, we tested a sample of 61 members and the related administrative payments, totaling $16,335 (See Schedule of Findings and Questioned Costs for footnote).In addition, from a population of 6,510 members who had their eligibility renewed during fiscal year 2020, we tested a nonstatistical, random sample of 60 members to determine if TEDS properly evaluated the members during the renewal process. It is important to note that, based on our testwork from the 2 samples, we identified 9 ineligible members from the 121 members tested; these 9 ineligible members will continue to receive benefits until the COVID-19 pandemic emergency ends.Conversion to TEDS in 2019 Created a Backlog of CoverKids Member Eligibility DeterminationsWhen TennCare management prepared to implement TEDS, TennCare moved existing member eligibility cases in the legacy systems into conversion status (See Schedule of Findings and Questioned Costs for footnote) in TEDS. Otherwise, TennCare may have terminated the members? benefits and require them to reapply. Through discussions with TennCare management we learned that, as of February 5, 2021, they had 85,395 members in conversion status. The members who were still in conversion status were either in the Medicaid program (75,571), the CoverKids program (549), or the Medicare Savings Program (9,275 ? a program for Medicaid/Medicare dual eligible members to help pay Medicare premiums, deductibles, coinsurance, copayments, prescription drug coverage costs).According to TennCare management, members who are in conversion status include cases transferred from the legacy system to TEDS which have not yet been reviewed for current eligibility and resolved. These cases could include members who are still eligible or members who are no longer eligible. Ineligibility could result from the following situations:members who aged out of eligibility for benefits;members whose post-partum period of eligibility has ended;members whose category at the time of conversion is now different; ormembers who are no longer a resident of Tennessee.All the above cases will remain in conversion status until either the case is selected for renewal or the member reports a change to TennCare that updates eligibility or results in termination.TennCare uses exception reports to identify case actions that were stopped due to an outstanding item in TEDS. The outstanding items could include conversion status cases and pending additional information requests. In 2019, TennCare began working these exception reports, and expanded their efforts in 2020. To understand the severity of the backlog of members in conversion status, we requested and obtained the following exception reports, which were subsets of the total members in conversion status, and found that:the postpartum and aged out exceptions from the batch exception report, dated June 15, 2020, listed 17,016 member cases, some over 500 days old; andthe additional information exceptions from the batch exception report, dated January 1, 2021, listed 2,469 member cases, some over 600 days old.Given that the backlog (See Schedule of Findings and Questioned Costs for footnote) relates directly to member eligibility, we believe that until it is resolved, outstanding eligibility determinations are likely to have a significant impact on CoverKids members losing benefits when management restarts the renewal process after the COVID-19 emergency period ends.For 8 of 121 members selected from our eligibility sample, TennCare management had not yet determined whether the members were eligible for CoverKids benefits as those members are still part of the unworked conversion backlog or on the batch exception report.For the four members categorized as CoverKids Pregnant, we found the members? cases on one of TennCare?s postpartum exception reports (See Schedule of Findings and Questioned Costs for footnote), which identifies cases where the postpartum period has ended. However, a caseworker had not reviewed the cases and the additional member information in TEDS. For these four members, TennCare should have terminated CoverKids coverage for the CoverKids Pregnant category at the end of the following months:November 2018,December 2018,January 2019, andJune 2019.As a result, we identified federal questioned costs totaling $1,753 and an additional $180 in state questioned costs (See Schedule of Findings and Questioned Costs for footnote).See Schedule of Findings and Questioned Costs for chart/table.For one member in the pregnancy category, TEDS scheduled a termination of the member?s coverage on August 22, 2019. A TEDS system process, however, stopped the member?s termination process on August 29, 2019, resulting in the case being recorded on the batch exception report. According to the Assistant Commissioner of Member Services, the case was not addressed before the public health emergency caused management to pause all member terminations. We identified federal questioned costs totaling $374 and remaining $36 in state questioned costs.For one member tested, while TEDS initiated the member?s eligibility renewal process in July 2019, the member also appeared on a PARIS report (See Schedule of Findings and Questioned Costs for footnote), alerting TEDS that the member had medical coverage in another state. Because TEDS had open requests for information related to the renewal, in addition to the PARIS report alert, the member?s case appeared on an exception report, thereby requiring caseworker intervention to resolve the open requests and allow the PARIS alert to update. As a result, we questioned federal costs totaling $54 and $1 in state questioned costs (See Schedule of Findings and Questioned Costs for footnote).For one member in the pregnancy category, an appeals caseworker working on this conversion case did not resolve an open task in TEDS, thereby preventing TEDS from processing the member?s eligibility at the end of the postpartum period (November 30, 2019). We identified federal questioned costs totaling $175 and a remaining $18 in state questioned costs (See Schedule of Findings and Questioned Costs for footnote).See Schedule of Findings and Questioned Costs for chart/table.For the one member tested during the renewal process on October 23, 2019, the eligibility caseworker assigned to work the conversion case used the member?s 2018 income information from the legacy system, instead of clicking a setting in TEDS to issue a request to the member to provide documentation of current income. We identified federal questioned costs, totaling $746, and a remaining $72 in state questioned costs (See Schedule of Findings and Questioned Costs for footnote).TEDS System Error Affecting Eligibility Determinations1. Based on our renewal sample testwork, we found one member for whom TEDS terminated the member?s CoverKids coverage on March 10, 2020, even though the member was still eligible. Based on our review of the member?s case in TEDS, TEDS processed the renewal and terminated the member?s eligibility for CoverKids based on an outstanding Medicaid-related request to the member. This open Medicaid request, however, should not have been a factor in determining the member?s CoverKids benefits. According to the Assistant Commissioner of Member Services, TennCare?s contractor implemented a system fix on July 12, 2020. We will review the system fixes management implemented after the end of our audit scope (June 30, 2020) during TennCare?s 2021 Single Audit.Risk AssessmentWe reviewed the Division of TennCare?s December 2019 Financial Integrity Act Risk Assessment and determined that management listed the risk of an eligibility caseworker or TEDS performing inaccurate eligibility determinations, case changes, and redeterminations. While management identified the risk, management?s control of TEDS generating canned and ad hoc reports relating to system functionality and worker performance is not sufficient to mitigate the risk.Management has not identified the risk of caseworkers not resolving the backlog of member eligibility determination contained on exception reports.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. . . .7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions.EffectWhen TennCare staff and TEDS do not process CoverKids eligibility determinations correctly and timely, TennCare increases the risk of keeping ineligible individuals on its membership rolls, thereby allowing them to receive a public benefit they are not entitled to receive and rendering related costs unallowable. Until TennCare management can significantly reduce or eliminate the backlog of conversion cases (cases which require caseworker intervention), management increases the risk of allowing ineligible members to remain on the program.Additionally, federal regulations address actions that federal agencies may impose in cases of noncompliance. As noted in Title 2, Code of Federal Regulations (CFR), Part 200, Section 338, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.208, ?Specific conditions,?1. Requiring payments as reimbursements rather than advance payments;2. Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;3. Requiring additional, more detailed financial reports;4. Requiring additional project monitoring;5. Requiring the non-Federal entity to obtain technical or management assistance; or6. Establishing additional prior approvals.Furthermore, Section 200.339 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:a. Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.b. Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.c. Wholly or partly suspend or terminate the Federal award.d. Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).e. Withhold further Federal awards for the project or program.f. Take other remedies that may be legally available.RecommendationThe Assistant Commissioner of Member Services should develop an adequate plan to work conversion cases and eliminate the backlog. In addition, the Assistant Commissioner should ensure that the TEDS contractor?s system fix is operating as designed. Furthermore, the Assistant Commissioner should ensure that eligibility caseworkers receive additional training so that they can properly determine if the members are eligible for CoverKids benefits.Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur.For this audit of the first full year in our new eligibility system, most of the issues identified are related to converting existing members into the new system and the planned protections put in place to ensure that members had an opportunity to provide updated information to TennCare before any negative actions were taken. There was also one case of worker error. Please see our response to the TennCare finding in this single audit report for context on TennCare?s conversion to a new eligibility system.During conversion to the new system, it was not possible in many cases to automatically populate all the necessary fields from data in the systems and records that preceded TEDS. TennCare members? records that did not have complete information were marked as being in ?conversion status.? The conversion status prevented TEDS from making automatic eligibility decisions when the system had incomplete information from the conversion. This approach prevented the system from making potentially incorrect decisions until complete information could be gathered during a member?s first annual renewal period or some other contact with the state.The Business Exception report was created to report cases that were held open for an extended period after they were flagged for intervention. A case can be held open for intervention for many reasons, including information that is in conversion status or conflicting information. This process was another way to prevent the system from making potentially incorrect decisions.The auditors identified cases that remained open for an extended period after being put on the Business Exception report. As noted in the finding, TennCare changed how the Business Exception report is worked in early 2020 and has improved this process since TEDS implementation. As a result, many of the cases on the Business Exception report that date from prior to the public health emergency have been addressed. However, open cases due to the moratorium on terminations during the public health emergency have grown. For example, of the 17,016 postpartum and age-out exceptions on the Business Exception report dated June 15, 2020, 82% are on the report not due to the case being in conversion status or having incomplete or conflicting information but as a result of federal requirements against taking negative eligibility actions or processing terminations during the public health emergency.We will implement a plan to address all conversion cases on the Business Exception report that can be worked outside of COVID restrictions, as the auditors suggest. We will update worker training to increase the understanding of business processes and policies behind the data being collected and used in the eligibility determination process. The first section of a curriculum revision is targeted for completion in June 2021 and the second section is targeted for completion in August 2021.For the case of a CoverKids enrollee going through renewal where a case worker made an error in the renewal process, proof of income has now been received and the enrollee remains eligible. The attested income during the renewal was the same as the income already listed in the TEDS record, but the caseworker error of not reverifying that income has now been resolved.To help ensure appropriate processing of TennCare eligibility casework, in late 2020 TennCare Member Services implemented a new monthly case reading tool and review process that requires eligibility operations supervisors, with assistance from the quality assurance staff, to review and score at least five cases per eligibility caseworker per month. This case reading tool will help to identify worker problem areas quickly and allow for targeted retraining of staff.We currently are following the auditors? suggestion that we ensure that the TEDS contractor addresses any identified system error after identifying the root cause.Finally, we will revise the eligibility-related risk assessment as recommended by the auditors.

Finding Number 2020-010CFDA Number 10.558 and 10.559Program Name Child and Adult Care Food ProgramChild Nutrition ClusterFederal Agency Department of AgricultureState Agency Department of Human ServicesFederal Award Identification Number 195TN331N1099, 195TN331N2020, 195TN340N1050, 205TN331N1099, 205TN331N2020, 205TN340N1050, and 205TN331N8503Federal Award Year 2019 and 2020Finding Type Significant Deficiency (10.559)Material Weakness (10.558)Noncompliance (Subrecipient Monitoring)Compliance Requirement Activities Allowed or UnallowedAllowable Costs/Cost PrinciplesSubrecipient MonitoringOtherRepeat Finding 2019-017Pass-Through Entity N/AQuestioned CostsSee Schedule of Findings and Questioned Costs for chart/table.Department of Human Services management has not taken sufficient action to prevent, detect, and address potential fraud in federal food programs, resulting in $505,961 of federal questioned costsBackgroundThe Department of Human Services (DHS), in partnership with the U.S. Department of Agriculture and local organizations, operates the Child and Adult Care Food Program (CACFP) and the Summer Food Service Program for Children (SFSP) to provide free, reduced-price, and paid meals to eligible participants. CACFP is a year-round program, and SFSP operates during the summer months when school is out. DHS contracts with subrecipients, who administer the programs and deliver the meals to eligible participants. DHS reimburses the subrecipients to cover the administrative costs and the costs of meals served.As outlined in Title 2, Code of Federal Regulations (CFR), Part 200, as a pass-through entity for federal funds, DHS is responsible for providing overall program oversight, which includes, but is not limited to,approving only eligible subrecipients who comply with the federal program requirements and guidelines;providing appropriate and effective training, technical assistance, and any other necessary support to facilitate successful program participation;designing effective controls to ensure subrecipients claim the correct number of meals and receive reimbursement payments for meals that are fully compliant with program requirements and guidelines;monitoring subrecipients? activities to provide reasonable assurance that the subrecipients administer these federal awards in compliance with federal requirements and guidelines; andmaintaining the integrity of the food programs by taking appropriate and prompt actions to address subrecipients? unwillingness and/or inability to comply with the federal requirements and guidelines, which may include performing stricter oversight of the noncompliant subrecipients and, if necessary, terminating them from the program.Inherent Risks of Food ProgramsFederal requirements establish a reimbursement model for food programs, where the pass-through entity, DHS, reimburses subrecipients after the meal service for the expenses of providing meals to participants. In Tennessee, the food programs include approximately 350 subrecipients that serve thousands of meals each day. Due to the volume of reimbursement claims, DHS cannot review each individual claim before reimbursement and cannot review supporting documentation for each claim after reimbursement.Given that DHS has no front-end control in place to prevent improper payments to subrecipients, DHS uses the Audit Services unit to provide a detective control through its monitoring process, which is DHS?s primary control for determining the accuracy of the reimbursement claims. Because of the nature of the food programs, DHS must establish a system of controls that can reasonably ensure the integrity of the programs, including systematically and proactively monitoring subrecipients to detect improper activities and performing more substantive reviews when Audit Services monitors and other reviewers identify indications of fraud, waste, and abuse.Results of Prior AuditsBased on our prior six audits, we have reported the following number of findings, outlined in Table 1, both for CACFP and SFSP, with corresponding questioned costs (See Schedule of Findings and Questioned Costs for footnote):See Schedule of Findings and Questioned Costs for chart/table.In addition, based on our prior audits, which include site reviews of subrecipients, we found that DHSreimbursed subrecipients for meals that were not served;reimbursed subrecipients with incomplete or missing documentation; andreimbursed subrecipients that did not follow the federal requirements for meal times, meal sites, meal components, and approved limits of meal site capacity.The instances described in our prior findings primarily included the following fraud indicators, signifying potential intentional misuse of federal funds by subrecipients of these federal meal service programs. We have reported in the annual Single Audit Report the following number of findings (listed in Table 2) that included subrecipients with fraud indicators and the corresponding questioned costs:See Schedule of Findings and Questioned Costs for chart/table.We identified these improper payments in these prior audits based on samples of transactions that we randomly selected for our testwork, which suggests that fraud and corresponding questioned costs are likely higher than we reported in our current and prior Single Audit Reports.Prior Audit Recommendations and Corrective ActionSince 2014, we have recommended that management develop a robust process over the food programs? administration, with an emphasis on strengthening controls within the monitoring and oversight activities for both CACFP and SFSP. Specifically, we recommended that management address staffing deficiencies and turnover, implement improvements in program systems, utilize available system functionality to search for improper payments and patterns of potential fraud and abuse, provide a quick follow-up response to identified risks, and take prompt action to ensure subrecipients comply or are terminated from the programs.In response to our prior-year findings, DHS management has taken the following steps to improve management?s oversight of the programs and remedy identified deficiencies:1. In 2016, DHS implemented the Tennessee Information Payment System (TIPS), an online application that allows subrecipients to submit both (1) applications to participate in the programs and (2) reimbursement claims to recover administrative costs and the costs of meals served. TIPS, which replaced the Tennessee Food Program system, streamlined the claim reimbursement processes and added enhanced capabilities that the previous system did not have. TIPS is also a record retention tool, eliminating the need for management to retain hard copies of applications and various program records.2. To improve monitoring processes within the Audit Services unit, DHS implemented the HighBond system, which replaced the previous pen-and-paper review system. HighBond provides electronic access to the working papers from any location and allows staff to retain program records electronically. In addition, Audit Services management revised monitoring tools to address inconsistencies with monitoring activities and federal monitoring requirements.3. During fiscal year 2018, management filled the food programs? vacant positions of auditors, monitors, and investigators so that staffing levels remained reasonably consistent. In the current audit, we found consistent retention levels, with no significant turnover for key management positions directly responsible for overseeing the administration of the food programs.4. To help subrecipients remedy identified deficiencies and improve compliance with federal requirements, DHS has provided increased training and technical assistance to subrecipients.ConditionBased on our follow-up of prior audits and the results of the current audit, we have determined that management has not taken sufficient action to prevent and detect fraud in food service programs. Management also has not addressed subrecipients with repeated deficiencies.Insufficient Action to Prevent and Detect Fraud in Food Service ProgramsIn our prior audits, we communicated to DHS management that they need to strengthen their oversight of the food programs to address continual weaknesses in program integrity. Despite management?s noted improvements to strengthen its monitoring and information system processes, management?s overall control process does not include routine procedures to consistently identify and follow up on subrecipients that exhibit increased fraud risks.Based on the results of our current review of the SFSP and CACFP food programs (See Schedule of Findings and Questioned Costs for footnote):, we identified 9 subrecipients that exhibited 1 or more fraud indicators. Specifically, we identified that5 SFSP subrecipients either claimed the same number of meals each day or regularly claimed numbers of meals in multiples of 5 (such as 50, 55, or 60). The 2017 Summer Food Service Program State Agency Monitor Guide identifies this pattern of claims as a potential red flag for abuse of the program since the practice may indicate that subrecipients are estimating or inflating the number of meals served. Based on our prior physical observations of other meal program sites, review of the U.S. Department of Agriculture?s guidance, and discussions with Audit Services monitors, we expect variance in the number of meals served each day and throughout the month.1 SFSP subrecipient photocopied meal count forms to create documentation for subsequent meal service events. Instead of starting with a blank form, the subrecipient staff used the photocopied form and only changed the date of the meal service; therefore, they did not capture the actual tally of number of meals served. SFSP requirements state that staff should start a new meal count form at each meal service to document the date and type of meal service provided (breakfast, lunch, snack, or dinner) and to record the tally of meals actually served at that particular meal service. As such, a photocopied meal count form from a prior meal service is not sufficient to record the actual meal counts as required.1 SFSP subrecipient used a photocopy of breakfasts served to create a count of lunches served each day. During summer 2020, federal guidance allowed the subrecipient to serve breakfast and lunch at the same time; however, staff were still required to maintain separate meal count forms for each type of service. On the day we physically observed operations at the subrecipient?s meal site, we noted that the subrecipient did not count the number of meals being served and stated that they would create the count later. Additionally, this subrecipient followed a pattern of claiming either the same number of meals each day or claiming numbers of meals in multiples of five at their other sites, as described above.2 CACFP subrecipients claimed every child was present all day for each meal service event. Our evaluation of 1 subrecipient?s sign-in/sign-out records for 2 claim months revealed that not every child was present for each meal service because children arrived after the breakfast service or left before the lunch and afternoon snack service. Based on our prior physical observations of other childcare centers and our discussions with Audit Services monitors, we expect variation in the sites? attendance due to absences, late arrivals, or early departures from the site. We believe it is unrealistic to claim the same number of children as present at all 3 meal services for a 2-month period.Table 3 summarizes the questioned costs for subrecipients exhibiting fraud indicators.See Schedule of Findings and Questioned Costs for chart/table.Again, as noted in this finding and Findings 2020-012, 2020-014, and 2020-015, federal regulations require that subrecipients prepare the meal counts during the actual meal services, at the point of service, so that the meal counts reflect actual meals served.System Control DeficienciesDHS management?s implementation of the Tennessee Information Payment System (TIPS) and HighBond has not addressed prior findings of noncompliance and control deficiencies in both SFSP and CACFP. While TIPS?s edit checks detect when subrecipients claim meals over the maximum approved numbers, the edit checks do not ensure that subrecipients accurately calculate meals and maintain accurate and complete documentation to support the reimbursement claims. Despite TIPS having the capability of retaining meal count documentation electronically, during our current audit we have noted instances of missing or lost meal count documentation, resulting in questioned costs.Repeat OffendersDuring our current audit, as noted above, we identified nine subrecipients that exhibited fraud indicators, and five of those nine subrecipients were included in our prior audit findings for exhibiting fraud indicators. Although we have communicated the results of our audit to DHS management, management has not taken sufficient action to ensure compliance or to remove those subrecipients that continually do not comply with program rules and regulations. Instead, management primarily relies on training the subrecipients and on the subrecipients? integrity to accurately self-report meals served. Even though DHS has provided subrecipients the opportunity to repeat training courses and technical assistance, both we and Audit Services continue to observe violations in food program operations, year after year. DHS staff continue to require corrective action plans from subrecipients, but these actions have not prevented continued noncompliance.Risk AssessmentWe reviewed DHS?s December 2019 Financial Integrity Act Risk Assessment and determined that management listed the risk of subrecipients submitting claims without supporting documentation; however, DHS did not include specific fraud risks relating to subrecipients that continue to bill DHS for meals not served or based on documentation exhibiting fraud indicators. In addition, management?s risk assessment did not include effective controls to mitigate these specific risks.CauseManagement has determined that its actions taken in response to prior findings are sufficient and comply with federal regulations, despite our repeated identification of systemic issues in operations and oversight. In its response to the fiscal year 2019 audit finding, DHS management stated, ?our costs to administer and monitor the Food Programs are reasonable and prudent and our efforts are in material compliance with federal requirements.? Management stated that further actions, including increased monitoring activities and increased reimbursement reviews, would be an undue burden on DHS?s staff and resources.CriteriaAccording to 7 CFR 226.10(c),Claims for Reimbursement shall report information in accordance with the financial management system established by the State agency, and in sufficient detail to justify the reimbursement claimed and to enable the State agency to provide the final Report of the Child and Adult Care Food Program (FNS 44) required under ?226.7(d). In submitting a Claim for Reimbursement, each institution shall certify that the claim is correct and that records are available to support that claim.According to 7 CFR 225.15(c),Sponsors shall maintain accurate records justifying all meals claimed . . . The sponsor?s records shall be available at all times for inspection and audit by representatives of the Secretary, the Comptroller General of the United States, and the State agency for a period of three years following the date of submission of the final claim for reimbursement for the fiscal year.In addition, according to the 2016 Administration Guide ? Summer Food Service Program,Sponsors may claim reimbursement only for those meals that meet SFSP requirements. Reimbursement may not be claimed for . . . [m]eals that were not served.According to ?Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,? 2 CFR 200.332, the pass-through entity?s monitoring of subrecipients must includeFollowing-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward.In addition, 2 CFR 200.62 states,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity [DHS] designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:a. Transactions are properly recorded and accounted for, in order to: (1) Permit the preparation of reliable financial statements and Federal reports; (2) Maintain accountability over assets; and (3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award;b. Transactions are executed in compliance with: (1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and (2) Any other federal statutes and regulations that are identified in the Compliance Supplement; andc. Funds, property, and other assets are safeguarded against loss from unauthorized use or disposition.Regarding design and implementation of internal control, Section OV3.05 of the U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) states,When evaluating design of internal control, management determines if controls individually and in combination with other controls are capable of achieving an objective and addressing related risks. When evaluating implementation, management determines if the control exists and if the entity has placed the control into operation. A control cannot be effectively implemented if it was not effectively designed. A deficiency in design exists when (1) a control necessary to meet a control objective is missing or (2) an existing control is not properly designed so that even if the control operates as designed, the control objective would not be met. A deficiency in implementation exists when a properly designed control is not implemented correctly in the internal control system.As noted in Green Book Principle 1, ?Demonstrate Commitment to Integrity and Ethical Values,? management establishes a ?tone at the top,? and should reinforce ?the commitment to doing what is right, not just maintaining the minimum level of performance necessary to comply with applicable laws and regulations.? Principle 1 goes on to state,1.05 Tone at the top can be either a driver . . . or a barrier to internal control. Without a strong tone at the top to support an internal control system, the entity?s risk identification may be incomplete, risk responses may be inappropriate, control activities may not be appropriately designed or implemented, information and communication may falter, and results of monitoring may not be understood or acted upon to remediate deficiencies.According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. . . .7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions.As noted in Green Book Principle 8, ?Assess Fraud Risk,?8.01 Management should consider the potential for fraud when identifying, analyzing, and responding to risk. . . .8.06 Management analyzes and responds to identified fraud risks so that they are effectively mitigated. Fraud risks are analyzed through the same risk analysis performed for all identified risks. Management analyzes the identified fraud risks by estimating their significance, both individually and the in the aggregate, to assess their effect on achieving the defined objectives.EffectThe lack of sufficient monitoring activities and corrective actions increases the risk of noncompliance and fraud, waste, and abuse in these federal programs. Without a robust risk response process to address high-risk subrecipients? noncompliance and questionable practices, DHS will continue tomake improper reimbursements to subrecipients,provide meals to ineligible participants,not detect noncompliance or fraud timely, andjeopardize federal funding because of noncompliance.Additionally, federal regulations address actions that federal agencies may impose in cases of noncompliance. As noted in 2 CFR 200.339, ?If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.208, ?Specific conditions,?1. Requiring payments as reimbursements rather than advance payments;2. Withholding authority to proceed to the next phase until receipt of evidence of evidence of acceptable performance within a given performance period;3. Requiring additional, more detailed financial reports;4. Requiring additional project monitoring;5. Requiring the non-Federal entity to obtain technical or management assistance; or6. Establishing additional prior approvals.Furthermore, Section 200.339 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:a. Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.b. Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.c. Wholly or partly suspend or terminate the Federal award.d. Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).e. Withhold further Federal awards for the project or program.f. Take other remedies that may be legally available.RecommendationThe Commissioner, the Director of CACFP and SFSP, the Inspector General, and the Director of Audit Services should ensure that DHS provides oversight of subrecipients receiving reimbursements through federal food programs. Management should reassess the risk of fraud within federal food programs, identify areas that require increased control activities, and design and implement such controls to reasonably mitigate the risk of fraud within the program. Management should include in its risk assessment specific fraud risks relating to subrecipients that continue to bill DHS for meals not served or that submit claims exhibiting fraud indicators. In addition, management should identify specific controls to mitigate these risks.Management should ensure subrecipients comply with program rules and regulations, including only seeking reimbursement for allowable costs. When Audit Services monitors identify deficiencies, they should perform procedures to evaluate and assess the extent of noncompliance and ensure that subrecipients implement corrective action and achieve compliance. If subrecipients displaying fraud indicators continue to not comply with program rules and regulations, management should impose additional conditions upon the subrecipients or take other action, as described in 2 CFR 200.208 and 200.339, including withholding federal awards from the subrecipient.To mitigate the inherent risks of fraud, waste, and abuse, DHS management should perform analytical procedures on meal claims. Management could benefit from enhancing preventive controls to identify and investigate fraud indicators before approving claims. To identify irregularities and questionable trends in meal reimbursement claim amounts, the Director of CACFP and SFSP should leverage historical data and systematic procedures using the available technology, institutional knowledge, and experience with the programs.Management?s CommentAs we stated in the prior year?s response, the Department of Human Services (DHS) has consistently and continuously taken extensive actions for robust internal controls and monitoring of the food programs through providing training to staff and sponsors? staff, revising the monitoring procedures, increasing the number of sponsors and feeding sites monitored, following up on non-compliant sponsors, and removing non-compliant sponsors from the food programs.This finding is a subjective executive summary of findings throughout this audit period as well as historical information of the food programs? findings that have been included in the previous Single Audit reports. DHS management provided comment to each finding noted herein and thus, will not repeat the management responses that are found within this report. However, certain and serious items reported within this finding require specific response.During the federal fiscal year (FFY) 2020, DHS Audit Services monitoring staff conducted and followed up on food program subrecipients that significantly exceeded the federal minimum requirements. The monitoring reports were provided to the Comptroller?s Office as they were released. Therefore, the state auditors already have access to the monitoring reports prior to or during their FY2020 Single Audit. As we explained below, DHS Audit Services already monitored and identified any noncompliance with the subrecipients on the state auditors? summary of questioned costs.The current staffing of DHS Audit Services of 21 is sufficient as an efficient and effective control for the food programs operation. There were 338 subrecipients for the food programs (sponsors) and over 3800 feeding sites operated during FFY2020. Of those 338 sponsors, DHS Audit Services monitored 135 sponsors, or 40% (see FFY 2020 Monitoring table below), in addition to over 500 feeding sites.See Schedule of Findings and Questioned Costs for chart/table.DHS Audit Services communicated to the state auditors and provided a walkthrough, during their fieldwork, of the monitoring procedures that include risk assessment of each subrecipient, how the subrecipients were selected for monitoring, the monitoring process, when the monitors follow up on high-risk subrecipients, and working papers and report reviews. Also, the state auditors were provided with a list of categories of red flags/fraud factors that the monitors consider during the monitoring of subrecipients. The list includes not only block claiming or questionable meal count forms, but also cost of food purchases, overclaiming, and other non-compliance categories.The inherent risk and the federal design of the requirements for the food programs administration and monitoring do not require 100% monitoring of claims or meals observation. The DHS Audit Services quality and effectiveness of the food program monitoring work is sufficient to maintain the integrity of the programs? operation.DHS Audit Services? monitoring reports are a matter of public record and can be viewed at the DHS website (www.tn.gov/humanservices) under DHS Office of Inspector General (https://www.tn.gov/humanservices/dhs-program-integrity.html).Condition: Insufficient Action to Prevent and Detect Fraud in Food Service ProgramsManagement?s Comment:To demonstrate DHS Audit Services? efficient and effective planning, monitoring, and detecting of fraud, waste, abuse, noncompliance, and our efforts to consistently identify and follow up on subrecipients that exhibit risk of fraud, we are providing a response to the state auditors? ?Table 3 summarizes the questioned costs for subrecipients exhibiting fraud indicators.?Subrecipient 1 is a City Government in East Tennessee.

Finding Number 2020-011CFDA Number 10.558 and 10.559Program Name Child and Adult Care Food ProgramChild Nutrition ClusterFederal Agency Department of AgricultureState Agency Department of Human ServicesFederal Award Identification Number 195TN331N1099, 195TN331N2020, 195TN340N1050, 205TN331N1099, 205TN331N2020, 205TN340N1050, and 205TN331N8503Federal Award Year 2019 and 2020Finding Type Significant Deficiency (10.559)Material Weakness (10.558)Noncompliance ? Subrecipient MonitoringCompliance Requirement Activities Allowed or UnallowedAllowable Costs/Cost PrinciplesEligibility (10.558)Subrecipient MonitoringRepeat Finding 2019-018Pass-Through Entity N/AQuestioned Costs N/AAs noted in the prior two audits, the Department of Human Services has inadequate internal controls over subrecipient monitoring of the Child and Adult Care Food Program and the Summer Food Service Program for Children and did not perform monitoring reviews in accordance with program requirementsBackgroundThe Child and Adult Care Food Program (CACFP) and the Summer Food Service Program for Children (SFSP) are funded by the U.S. Department of Agriculture and administered on the state level by the Department of Human Services (DHS). As a pass-through entity for CACFP and SFSP funds, DHS is responsible for providing sufficient qualified consultative, technical, and managerial personnel to administer the program and for monitoring performance to ensure that subrecipients comply with program rules and regulations.Subrecipients provide meals and supplements to eligible participants at approved feeding sites. To receive reimbursement payments for meals served to children, subrecipients submit reimbursement requests to DHS through the Tennessee Information Payment System, an online platform for the food programs? administration. Subrecipients self-report the number of meals claimed on reimbursement requests based on daily meal count documentation that site personnel prepare during each meal service. Subrecipients are required to retain all program records for at least three years and to provide records to authorities performing monitoring reviews or audits.DHS is required to monitor subrecipients? activities to obtain reasonable assurance that the subrecipients administer federal awards in compliance with federal and state requirements. Given that DHS has limited front-end control in place to prevent improper payments to subrecipients, DHS uses the Audit Services unit (Audit Services) to provide a detective control through its monitoring process, which is DHS?s only control for determining the accuracy of the reimbursement claims.Audit Services Unit Monitoring ProcessMonitors document their reviews in HighBond, an online platform to improve and streamline the monitoring processes during monitoring reviews. HighBond provides electronic access to the working papers from any location and allows management to maintain monitoring records in electronic formats.Monitors perform the following types of monitoring reviews:1. Site Reviews. Monitors visit feeding sites where the actual meal services take place and perform meal service observations to assess whether feeding site personnel comply with applicable rules and regulations. Federal regulations for each program outline the minimum required number of site reviews that monitors must perform.2. Sponsor Reviews. After the site reviews, monitors perform administrative reviews of the subrecipients to assess their compliance with the administrative requirements over the program operations. Monitors also review the subrecipients? meal count documentation to verify it matches the reimbursement requests submitted for meals served.3. Vendor Reviews, applicable to SFSP only. If the subrecipients use a food vendor for meals they serve to children, instead of self-preparing meals, monitors visit the food vendor?s facilities to evaluate the vendor?s compliance with applicable program rules.In HighBond, monitors document the results of the reviews on the applicable electronic site guide, sponsor guide, and vendor guide. Once the monitors complete the applicable reviews, they discuss their monitoring results with program staff to determine how to report and address the noncompliance. This multi-level review also serves as management?s quality assurance process to ensure monitoring activities are sufficient, documented, and support the final monitoring reports. During this multi-level review, program staff determine whether the identified noncompliance rises to the level of a serious deficiency or is reportable as a finding.Upon completing the review, Audit Services releases the monitoring report, which includes details of the noncompliance; all corresponding disallowed meal costs, if any; and instructions for corrective action. The instructions specifically inform the subrecipient how to submit payment for disallowed meal costs and how to submit a corrective action plan, which outlines steps to address and prevent the noncompliance from occurring in the future. Once the subrecipient submits the corrective action plan, DHS?s food program staff assess the plan for adequacy and track the recovery of disallowed meal costs.Serious Deficiency ProcessAs outlined in the federal regulations, DHS is required to identify and classify a subrecipient?s more serious program violations as serious deficiencies. The serious deficiency process requires DHS to begin actions to terminate the sponsor from the program, including denying the subrecipient?s future applications and program participation, unless the subrecipient takes appropriate corrective actions to address the serious deficiencies and repays all disallowed costs. Once a subrecipient is determined seriously deficient in the food program operations, DHS must perform monitoring reviews during the subsequent program year if the subrecipient is permitted to participate.Prior Audit ResultsIn the prior audit, we reported that DHS?s subrecipient monitoring was insufficient and that management did not ensure monitors performed and documented complete and accurate reviews of subrecipients. DHS management did not concur with the prior finding and did not provide a corrective action plan for the finding. Because DHS management did not take corrective action, we once again noted deficiencies with the subrecipient monitoring process.Current TestworkFor our CACFP testwork, from a population of 84 monitoring reports that Audit Services issued between July 1, 2019, and June 30, 2020, we randomly selected a sample of 60 monitoring reports and reviewed the supporting monitoring files. For our SFSP testwork, we reviewed all 30 monitoring reports (and the supporting monitoring files) that Audit Services issued between July 1, 2019, and June 30, 2020.Condition and CriteriaInsufficient Subrecipient MonitoringVarious program-specific guides for both CACFP and SFSP require DHS management to implement an adequate monitoring system with sufficient monitoring steps, effective follow-up processes, and adequate review practices to obtain reasonable assurance about subrecipients? performance and accountability of program funds. In addition, according to Title 2, Code of Federal Regulations (CFR), Part 200, Section 62,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:(a) Transactions are properly recorded and accounted for, in order to:(1) Permit the preparation of reliable financial statements and Federal reports;(2) Maintain accountability over assets; and(3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award;(b) Transactions are executed in compliance with:(1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and(2) Any other Federal statutes and regulations that are identified in the Compliance Supplement; and(c) Funds, property, and other assets are safeguarded against loss from unauthorized use or disposition.During the performance of our testwork, we noted several areas within the monitoring process in need of improvement.Opportunities to Improve the Multi-Level Review Process ? As described above, Audit Services and program staff consult with each other after they complete monitoring reviews to discuss the status of a subrecipient?s compliance with federal requirements. Based on our review of the monitoring process, we found that DHS management did not sufficiently design the multi-level review (which also serves as the quality review process for monitoring activities, documentation, and reporting) to achieve quality monitoring and subrecipient compliance. Instead, we found that the multi-level reviews did not detect monitoring deficiencies. The majority of the noncompliance noted in our testwork results below stems from monitors? inadequate and inconsistent monitoring activities and insufficient documentation.Lack of Consistent Procedures and Guidance During Monitoring Reviews ? We noted that DHS management has not developed sufficient procedures and guidelines to ensure that monitors perform consistent and uniform reviews. Based on our review of the monitoring files, we found instances where monitors may have misunderstood and inadequately assessed compliance requirements that they were responsible for verifying. DHS?s monitoring review guides include approximately 350 questions to assess subrecipients? compliance, but they do not provide any explanation or refer to additional details of the underlying federal requirements. Considering the programs? complexity, unique characteristics, and pre-established deadlines to complete the reviews, the monitors do not have adequate information and resources to perform quality reviews. Instead, the monitors appeared to use the guides as a checklist without expanding monitoring activities to address fraud indicators and compliance risks.Demanding and Deadline-Driven Workloads ? With approximately 350 subrecipients sponsoring thousands of meal feeding sites statewide, it is difficult for the 21 Audit Services monitors to adequately perform reviews that obtain reasonable assurance of subrecipients? compliance and/or to follow up on irregularities. To accomplish the activities they do, monitors have pre-established deadlines to submit monitoring files for further review, regardless of what they may find during the monitoring reviews. Deadlines are not adjusted if monitors find issues, such as potential fraud indicators that require further review. Even though management has been able to keep positions for food program monitors, auditors, and investigators filled, we question whether the current number of positions is adequate given the continuing problems and risks associated with the food programs.Inadequate Follow-up Procedures for Inconsistencies and Red Flags ? DHS management has not yet developed effective enhanced monitoring processes to follow up on questionable subrecipient billing practices and fraud schemes, such as claiming the same number of meals for long periods or claiming more meals on days when monitors were not present compared to days when monitors observed the meal service. See Finding 2020-010 for additional details on fraud indicators in the food programs that DHS could have detected had it developed targeted follow-up and enhanced processes to address questionable subrecipient billing patterns. For SFSP, our review found that workpapers for two subrecipients, Audit Services monitors identified red flags for claiming the same number of meals each day and noted that it was ?statistically implausible,? yet the monitoring staff did not include the red flag situations in the subrecipients? monitoring report.Noncompliance Noted During CACFP and SFSP Monitoring ReviewsCACFP Monitoring ReviewsBased on our review of CACFP monitoring files, we noted that DHS either did not assess or did not adequately assess subrecipients? compliance with operating the program in accordance with federal requirements. According to 7 CFR 226.6(m),(3) Review content. As part of its conduct of reviews, the State agency must assess each institution?s compliance with the requirements of this part pertaining to:(i) Recordkeeping;(ii) Meal counts;(iii) Administrative costs;(iv) Any applicable instructions and handbooks issued by FNS [Food and Nutrition Service] and the Department to clarify or explain this part, and any instructions and handbooks issued by the State agency which are not inconsistent with the provisions of this part;(v) Facility licensing and approval;(vi) Compliance with the requirements for annual updating of enrollment forms;(vii) If an independent center, observation of a meal service;(viii) If a sponsoring organization, training and monitoring of facilities;(ix) If a sponsoring organization of day care homes, implementation of the serious deficiency and termination procedures for day care homes and, if such procedures have been delegated to sponsoring organizations in accordance with paragraph (l)(1) of this section, the administrative review procedures for day care homes;(x) If a sponsoring organization, implementation of the household contact system established by the State agency pursuant to paragraph (m)(5) of this section;(xi) If a sponsoring organization of day care homes, the requirements for classification of tier I and tier II day care homes; and(xii) All other Program requirements.(4) Review of sponsored facilities. As part of each required review of a sponsoring organization, the State agency must select a sample of facilities, in accordance with paragraph (m)(6) of this section. As part of such reviews, the State agency must conduct verification of Program applications in accordance with ?226.23(h) and must compare enrollment and attendance records (except in those outside-school-hours care centers, at-risk afterschool care centers, and emergency shelters where enrollment records are not required) and the sponsoring organization?s review results for that facility to meal counts submitted by those facilities for five days.We noted the following during our review of the monitoring files.Meal Count Documentation ? We noted that for 14 of 60 monitoring files reviewed (23%), Audit Services monitors did not compare the number of meals served to attendance, did not identify that subrecipients claimed more meals than the number of children in attendance, and did not note any issues when subrecipients did not maintain documentation to support the meal reimbursement claims.Administrative Costs ? We noted for 1 of 5 monitoring files reviewed (20%) for subrecipients classified as sponsoring organizations, Audit Services monitors did not provide supporting documentation to determine if the monitors performed the necessary reviews and calculated the amount of administrative costs billed to the program to ensure the subrecipients complied with the requirement that administrative costs do not exceed 15% of meal reimbursements.Eligibility Documentation ? We noted for 8 of 53 monitoring files reviewed (15%), Audit Services monitors did not review the eligibility applications or enrollment forms.Training and Monitoring ? We noted for 17 of 24 monitoring files reviewed (71%) for sponsoring organizations, Audit Services monitors either did not identify the subrecipient?s noncompliance with the training and monitoring requirements, did not include identified noncompliance in the monitoring report, or did not perform a review.Serious Deficiency Process ? For 1 of 4 monitoring workpapers reviewed (25%), Audit Services monitors did not assess whether the sponsoring organizations of homes implemented the serious deficiency policy.Household Contact System (See Schedule of Findings and Questioned Costs for footnote) ? We noted for 23 of 23 monitoring files reviewed (100%) where the subrecipient was required to have a household contact system in place, Audit Services monitors could not assess compliance with the household contact system because DHS had no household contact system for sponsors. In 2019, DHS management implemented a household contact system for the Audit Services monitors to follow during their monitoring activities but did not distribute the procedures to subrecipients. The Audit Director stated that sponsors could develop their own household contact procedures, but monitors did not keep documentation to show they completed assessments of subrecipient household contact procedures.Tiering Classification of Day Care Homes ? We noted that for 3 of 4 monitoring working papers we reviewed (75%), Audit Services monitors did not keep documentation to support their assessment of the sponsoring organizations? compliance with tiering classification for day care homes.Five-Day Reconciliations ? We noted that for 10 of 17 monitoring files we reviewed (59%) for sponsoring organizations, Audit Services monitors did not perform the required 5-day reconciliations of meals and attendance, performed reconciliations that included less than 5 days, or did not always reconcile the meals to attendance.SFSP Monitoring ReviewsBased on our review of SFSP monitoring files, we noted that Audit Services monitors either did not assess or did not adequately assess the subrecipients? compliance with operating the program in accordance with federal requirements. According to the 2017 Summer Food Service Program State Agency Monitor Guide,The State agency must review sufficient records to determine whether the sponsor is in compliance with Program requirements as detailed in regulations. . . . These records include, but are not limited to:Program agreementProgram application (and supporting documents)Documents to support the sponsor?s eligibilityTax exempt status documentation to support nonprofit food statusTraining documentation (provided to and attended by staff)Sponsor site monitoring records (such as preoperational site visits, first week visits, and reviews conducted within the first four weeks)Accounting records, bank statements, check ledgers, and credit card statementsInvoices and receiptsMeal count recordsMenus and other food service recordsMeal delivery receiptsDocumentation of the nonprofit food service accountHealth and safety inspectionsFSMC [Food Service Management Companies] contracts, if applicableDocumentation of corrective action taken to correct any Program violations.According to 7 CFR 225.7(d)(6),As part of the review of any vended sponsor which contracts for the preparation of meals, the State agency shall inspect the food service management company?s facilities.We found the following:Meal Count Records ? For 10 of 30 monitoring files we reviewed (33%), we noted that although the Audit Services monitors performed procedures to assess the subrecipients? compliance with maintaining accurate and complete meal count records, the monitors did not always identify all meal service violations. We noted that the monitors did not identify and/or did not report in the monitoring report that subrecipients claimed meals outside of the subrecipients? approved dates of operation, that subrecipients served meals in excess of the site?s approved serving limits, that subrecipients? documentation indicated that they did not take point-of-service meal counts (See Schedule of Findings and Questioned Costs for footnote) during the meal observations, that subrecipients? site supervisors did not sign the meal count forms that were submitted to DHS for reimbursement, and that red flag indicators were present.Food Service Management Companies ? We noted that for 4 of 5 subrecipients (80%) who contracted with vendors to provide meals, the monitoring files did not include any documentation to indicate the monitors performed a review of the vendors.Additionally, while the Audit Services monitors indicated on the monitoring guides that they performed procedures to assess the subrecipients? compliance with program requirements, the monitoring files did not include documentation to support their assessment. Without the documentation, we could not be sure whether the monitors reviewed or correctly assessed the subrecipients? compliance with program requirements. Specifically, we noted the monitoring files did not include documentation of the following:a preoperational visit for 1 of 9 monitoring files of new subrecipients reviewed (11%);a subrecipient?s monitoring of its feeding sites for 1 of 30 monitoring files reviewed (3%);invoices and receipts used to assess the subrecipient?s nonprofit food service program for 2 of 30 monitoring files reviewed (7%);accounting records, bank statements, check ledgers, or credit card statements used to assess the subrecipient?s compliance with allowable costs for 14 of 30 monitoring files reviewed (47%); andmeal delivery receipts for 2 of 7 monitoring files reviewed for subrecipients who used vendors for meals (29%).Risk AssessmentWe reviewed DHS?s December 2019 Financial Integrity Act Risk Assessment and determined that management did not identify the risk of noncompliance with monitoring reviews. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. . . .7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions.CauseWe believe DHS?s inadequate review process, current staffing level, lack of follow-up procedures on red flags, and ineffective use of the serious deficiency process could have contributed to the conditions noted in this finding. See Finding 2020-010 for further details on issues related to the subrecipient monitoring process.EffectWhen top management does not ensure monitoring activities are sufficiently performed, documented, and reported, there is an increased risk that Audit Services monitors will fail to properly identify subrecipient noncompliance, that Audit Services and program staff will fail to recover improper payments to subrecipients, and ultimately that subrecipients will be allowed to continue participating in the food programs even though they repeatedly violate federal requirements because of lack of training or intentional fraudulent actions.Federal regulations address actions that federal agencies may impose in cases of noncompliance. As noted in 2 CFR 200.339, ?If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.208, ?Specific conditions,?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.Section 200.339 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:(a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.(b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.(c) Wholly or partly suspend or terminate the Federal award.(d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).(e) Withhold further Federal awards for the project or program.(f) Take other remedies that may be legally available.RecommendationThe Commissioner of DHS should ensure that the Audit Services Director implements controls to ensure the subrecipient monitoring process consistently complies with federal regulations. These controls should ensure that Audit Services staff fully understand all federal requirements, complete all review guides for all required monitoring activities, and prepare accurate monitoring reports that include all findings or issues noted during the monitoring review.Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe do not concur.As we stated in our response to the prior year?s finding, we do not concur that DHS has inadequate internal control over the subrecipient monitoring of the Child and Adult Care Food Program and Summer Food Service Program for Children and did not perform monitoring reviews in accordance with program requirements.Our monitoring consists of over 300 procedures for each subrecipient that direct DHS Audit Services staff to obtain, as necessary, review, and conclude on thousands of documents such as meal count sheets, enrollment information, subrecipients? staff training and monitoring, and food cost receipts. Procedures also include, among other requirements, civil rights, nondiscrimination, appeal rights, and compliance with the USDA meal pattern requirements. We follow up with unannounced visits to feeding sites with red flags or identified as high-risk subrecipients, provide technical assistance and training to feeding sites and subrecipients? staff. The monitoring reports are well documented and thoroughly reviewed to ensure that they contain detailed facts and information to benefit the DHS food program management and the subrecipients with corrective actions to remedy the findings and disallowed meals cost noted with the monitoring reports.The Director of Audit Services thoroughly reviews the monitoring reports for accuracy and completeness to ensure that the findings within the monitoring reports are supported by appropriate evidence that would sustain an appeal before a hearing officer or judicial review. Also, DHS Audit Services continues improvement of the monitoring process utilizing technology and providing staff with training and technical skills of auditing and monitoring.For those subrecipients identified as high risk of noncompliance, Audit Service staff conduct follow-up visits and/or expand the scope of the review. This information was provided to the state auditors during their fieldwork. Our monitoring of food programs? subrecipients far exceeds the minimum federal requirements outlined with Title 7 of the Code of Federal Regulations, Parts 225 and 226.The U.S. Department of Agriculture (USDA) monitoring officials conducted their management evaluation of the SFSP during the period of July 20-24, 2020, and issued their report in September 2020, also conducted their management evaluation of the CACFP during the period of August 24 to September 4, 2020, and issued their report in October 2020. The USDA monitoring officials reviewed the same monitoring working papers that the state auditors reviewed during their current Single Audit and concluded that DHS Audit Services? monitoring of food programs was in material compliance.In accordance with State Public Chapter 798, we provide the Legislature and the Comptroller?s Office with a confidential quarterly report on DHS?s monitoring efforts. In addition, we provide the Comptroller?s Office with the monitoring reports as we release them.

Finding Number 2020-012CFDA Number 10.558Program Name Child and Adult Care Food ProgramFederal Agency Department of AgricultureState Agency Department of Human ServicesFederal Award Identification Number 195TN331N1099, 195TN331N2020, 195TN340N1050, 205TN331N1099, 205TN331N2020, 205TN340N1050, and 205TN331N8503Federal Award Year 2019 and 2020Finding Type Material Weakness and NoncomplianceCompliance Requirement Activities Allowed or UnallowedAllowable Costs/Cost PrinciplesSubrecipient MonitoringRepeat Finding 2019-019Pass-Through Entity N/AQuestioned Costs $7,662For the sixth year, the Department of Human Services did not ensure that the Child and Adult Care Food Program subrecipients maintained accurate and complete supporting documentation for meal reimbursement claims and that subrecipients received reimbursements in accordance with federal guidelines, resulting in questioned costsBackgroundThe Child and Adult Care Food Program (CACFP) is a year-round food program for eligible participants at child care centers, day care homes, afterschool care programs, emergency shelters, and adult day care centers. CACFP is funded by the U.S. Department of Agriculture (USDA) and administered on the state level by the Department of Human Services (DHS). As a pass-through entity for the CACFP, DHS is responsible for ensuring that subrecipients are eligible to participate in the program and that the subrecipients comply with federal requirements. To receive payment for the meals they provide to eligible participants, subrecipients submit meal reimbursement claims to DHS through the Tennessee Information Payment System. DHS management is responsible for monitoring the subrecipients? activities to provide assurance that the subrecipients administer federal awards in compliance with federal requirements.Because management does not review supporting documentation for meal reimbursement claims before issuing payments to the subrecipients, management must rely on its Audit Services unit to ensure subrecipients comply with federal program requirements and spend grant funds accordingly. Audit Services is required to monitor at least 33.3% of all subrecipients each year. Generally, Audit Services reviews one meal reimbursement claim, representing one month of the program year, at each subrecipient. Audit Services staff perform regular monitoring visits at each subrecipient once every two or three years, depending on the type of institution. When staff find a serious deficiency during a monitoring visit, they increase the frequency of monitoring visits to once a year until the subrecipient has corrected the serious deficiency.Prior Audit ResultsAs noted in the five prior audits, we reported that CACFP staff had not ensured subrecipients maintained accurate supporting documentation for meal reimbursement claims and that CACFP staff had paid the subrecipients based on inaccurate claims for meal reimbursement. DHS management concurred in part with the most recent prior finding and stated,The department continues to evaluate findings identified in this report and in our own internal monitoring and has created training sessions to mitigate programmatic weaknesses. All CACFP trainings are developed and conducted in conjunction with USDA FNS [Food and Nutrition Service].Condition and CriteriaDuring our current testwork, we concluded that DHS?s training and monitoring efforts were still insufficient to correct the continuing issues related to subrecipients not maintaining accurate and complete supporting documentation.Because monitoring is DHS?s primary control to ensure subrecipients comply with program requirements, we tested the monitoring process and identified subrecipient monitoring process deficiencies regarding overall management oversight, which we have reported in detail in Finding 2020-010. In that finding, we noted that the monitoring process is not sufficient to identify and properly respond to fraud indicators and to address the underlying causes of subrecipients? noncompliance. We also found other CACFP federal noncompliance as described below in this finding.To determine whether DHS?s CACFP subrecipients complied with program requirements for proper meal reimbursement, we selected a nonstatistical, random sample of 60 subrecipients. We tested 1 meal reimbursement claim for each of the 60 subrecipients, for a total sample of 60 subrecipients? claims. To select the claim month, we haphazardly selected 1 month during the state fiscal year ended June 30, 2020. To select the feeding site(s) to review for the claim, we haphazardly selected sites based on the following methodology:If the subrecipient had 1 to 25 feeding sites, we selected up to 3 sites.If the subrecipient had 26 to 50 feeding sites, we selected 5 sites.If the subrecipient had 51 or more feeding sites, we selected 10 sites.We expanded our testwork to include additional months when we deemed it necessary due to questionable meal reimbursement documentation. Based on our review of the subrecipients? claims, we determined that DHS reimbursed subrecipients for inaccurate claims.Based on our testwork, we noted that for 36 of 60 claims reviewed (60%), the subrecipients did not maintain documentation to accurately support the number of meals requested on the meal reimbursement claim as required. For the 36 claims reviewed, we noted that5 subrecipients submitted their claim for reimbursement for more meals served than they had documentation to support,7 subrecipients submitted their claim for reimbursement for fewer meals served than they had reported on supporting documentation,8 subrecipients claimed more meals than children present on attendance records for 1 or more days in the claim month, and16 subrecipients exhibited a combination of the issues noted above.As such, DHS reimbursed subrecipients based on inaccurate meal reimbursement claims, leading to overpayments to the subrecipients totaling $6,741.We expanded our review of 3 subrecipients and reviewed a total of 5 claim months. Based on our expanded testwork, we noted that for 4 of 5 claims reviewed (80%), the subrecipients did not maintain accurate meal count and/or attendance documentation, resulting in $921 in overpayments to the subrecipients based on inaccurate claims. See Tables 1 and 2 for details of inaccurate documentation and questioned costs by subrecipient.See Schedule of Findings and Questioned Costs for chart/table.See Schedule of Findings and Questioned Costs for chart/table.According to Title 7, Code of Federal Regulations (CFR), Part 226, Section 10(c),Claims for Reimbursement shall report information in accordance with the financial management system established by the State agency, and in sufficient detail to justify the reimbursement claimed and to enable the State agency to provide the final Report of the Child and Adult Care Food Program (FNS 44) required under ?226.7(d). In submitting a Claim for Reimbursement, each institution shall certify that the claim is correct and that records are available to support that claim.In addition, 7 CFR 226.15(e) states,At a minimum, the following records shall be collected and maintained: . . .(4) Daily records indicating the number of participants in attendance and the daily meal counts, by type (breakfast, lunch, supper, and snacks), served to family day care home participants, or the time of service meal counts, by type (breakfast, lunch, supper, and snacks), served to center participants.Risk AssessmentWe reviewed DHS?s 2019 Financial Integrity Act Risk Assessment and determined that management listed the risk of subrecipients submitting unsupported claims; however, the controls DHS management put in place did not effectively mitigate the risk.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,?7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions.CauseBased on our discussion with management, DHS does not require the subrecipients to provide supporting documentation for each meal reimbursement claim before payment. DHS instead relies on Audit Services to review supporting documentation for meal reimbursement claims during monitoring visits. Audit Services routinely reviews only a very small sample of claims during a monitoring visit, which does not provide management with an effective preventive or detective control. DHS did not provide any additional information on how they plan to address the subrecipients? inaccurate claim reporting.According to 7 CFR 226.6(a)(5), as part of its pass-through responsibilities, DHS agrees to ensure that participating subrecipients effectively operate the program. Also, ?Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,? 2 CFR 200.62 states,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:a. Transactions are properly recorded and accounted for, in order to:(1) Permit the preparation of reliable financial statements and Federal reports;(2) Maintain accountability over assets; and(3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award;b. Transactions are executed in compliance with:(1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and(2) Any other Federal statutes and regulations that are identified in the Compliance Supplement; andc. Funds, property, and other assets are safeguarded against loss from unauthorized use or disposition.EffectFederal regulations address actions that federal agencies may impose in cases of noncompliance by a nonfederal entity, in this case DHS. As noted in 2 CFR 200.339, ?If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? as described in Section 200.208, ?Specific conditions,?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.Also, 2 CFR 200.339 states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:(a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.(b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.(c) Wholly or partly suspend or terminate the Federal award.(d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).(e) Withhold further Federal awards for the project or program.(f) Take other remedies that may be legally available.Questioned CostsOur testwork included a review of a nonstatistical, random sample of 60 subrecipient meal reimbursement claims, which resulted in $6,741 of known questioned costs; and expanded testwork on 3 subrecipients, which resulted in $921 of known questioned costs. We selected a nonstatistical, random sample of 60 meal reimbursement claims, totaling $664,755, from a population of 7,358 claims and adjustments, totaling $59,035,813, for the period July 1, 2019, through June 30, 2020. For major programs, 2 CFR 200.516(a) requires the auditors to report known and likely questioned costs greater than $25,000 for a type of compliance requirement. According to 2 CFR 200.84,Questioned cost means a cost that is questioned by the auditor because of an audit finding:(a) Which resulted from a violation or possible violation of a statute, regulation, or the terms and conditions of a Federal award, including for funds used to match Federal funds;(b) Where the costs, at the time of the audit, are not supported by adequate documentation; or(c) Where the costs incurred appear unreasonable and do not reflect the actions a prudent person would take in the circumstances.In accordance with 2 CFR 200.521, the federal grantor, USDA, must follow up on findings related to the program. USDA reviews the findings and determines if it will disallow any questioned costs and require DHS to pay back the federal grantor.RecommendationAs the pass-through entity, DHS has the responsibility to mandate subrecipients submit accurate claims for reimbursement and maintain sufficient supporting documentation as described in the federal regulations. If subrecipients continue to not maintain adequate meal reimbursement documentation, management should impose additional conditions upon the subrecipients or take other action, as described in 2 CFR 200.208 and 200.339.We recommend that DHS act on findings that we present and enforce the federal guidelines for all subrecipients, but especially for those subrecipients with enhanced fraud risks. DHS should request sufficient documentation to support claims for reimbursement before approving reimbursements to high-risk subrecipients. Additional steps may be necessary to ensure that DHS only pays subrecipients for actual meals served to children rather than allowing the subrecipients to (intentionally or unintentionally) continue overbilling the state for federal reimbursement.Management?s only control to avoid overpayments to subrecipients is their subrecipient monitoring activities, which involve a limited review of a small portion of the total amount of reimbursement claims. This limited control has not been sufficient to prevent or detect inaccurate claims for reimbursement or fraud from occurring in the CACFP. For more recommendations concerning the issues discussed in this finding, see Finding 2020-010 on overall management oversight.Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur in part.The state auditors identified 18 subrecipients as having inaccurate documentation who underclaimed meals for reimbursement and 7 of those subrecipients have no additional errors.We do not concur that unclaimed meals should be included as a DHS error. There is no federal requirement that subrecipients must claim all meals served. Including underclaimed meals as part of a notice of noncompliance misrepresents the scope and scale of the issue. Additionally, the state auditors identified underclaims as error, but did not take the underclaim in consideration when calculating questioned costs. This approach maximizes the questioned cost and the number of identified subrecipients with errors.There are 22 of the 29 subrecipients with identified questioned costs that are below the DHS threshold for recoupment and would not be pursued for recovery.DHS continues to evaluate this finding and our own internal monitoring and has created training sessions to mitigate the identified programmatic weaknesses. All CACFP trainings are developed and conducted in conjunction with USDA FNS.Auditor?s CommentWe include underclaimed errors in the finding to highlight inaccurate recordkeeping and not as a component in calculating questioned costs. We are responsible to report all known questioned costs for overpayments. Should the federal grantor determine any of the auditor?s questioned costs are federal disallowed costs for which the department should recover the disallowed costs (overpayments) made to a sponsor, management?s responsibility could include netting underpayments with overpayments as part of the disallowed costs recovery process.

Finding Number 2020-013CFDA Number 10.558Program Name Child and Adult Care Food ProgramFederal Agency Department of AgricultureState Agency Department of Human ServicesFederal Award Identification Number 195TN331N1099, 195TN331N2020, 195TN340N1050, 205TN331N1099, 205TN331N2020, 205TN340N1050, and 205TN331N8503Federal Award Year 2019 and 2020Finding Type Significant Deficiency and NoncomplianceCompliance Requirement EligibilitySubrecipient MonitoringRepeat Finding 2019-020Pass-Through Entity N/AQuestioned Costs $27,125For the eighth year, the Department of Human Services did not ensure that Child and Adult Care Food Program subrecipients claimed meals only for eligible participants; accurately determined participant eligibility; and maintained complete and accurate eligibility documentation as required by federal regulations, resulting in $27,125 in federal questioned costsBackgroundThe Child and Adult Care Food Program (CACFP), a year-round program, is federally funded by the U.S. Department of Agriculture (USDA) and administered on the state level by the Department of Human Services (DHS). As a pass-through entity for CACFP, DHS is responsible for ensuring that subrecipients are eligible and comply with federal requirements. Because management does not review supporting documentation for meal reimbursement claims before issuing payments to the subrecipients, management must rely on its Audit Services unit to ensure subrecipients comply with federal program requirements and spend grant funds accordingly. To ensure subrecipients? compliance, Audit Services staff perform monitoring visits at a subrecipient or feeding site. Monitors follow a DHS-provided review guide, which is a checklist that covers all federal requirements for the program, including ensuring subrecipients maintained participants? eligibility applications when required and properly determined participants? eligibility.A subrecipient is referred to as an institution; however, if the subrecipient is administratively responsible for two or more feeding sites, it is classified as a sponsoring organization. Sponsoring organizations can sponsor either homes (residential) or centers (non-residential). Feeding sites are actual locations where the institutions or sponsoring organizations (subrecipients) serve meals to participants in a supervised setting. Although these subrecipients receive federal cash reimbursement for all meals served, they receive higher levels of reimbursement for meals served to participants who meet the income eligibility criteria published by the USDA?s Food and Nutrition Services for meals served free or at a reduced price.Subrecipients must determine each enrolled participant?s eligibility for free and reduced-price meals in order to claim reimbursement for the meals served to that individual at the correct rate. Subrecipients may establish a participant?s eligibility using either a household application or proof of participation in another federal program, such as the Supplemental Nutrition Assistance Program, Temporary Assistance for Needy Families, or Food Distribution Program on Indian Reservations. Additional federal requirements apply to sponsoring organizations that sponsor childcare centers or institutions that operate as independent childcare centers; as such, these subrecipients must complete an eligibility addendum to document when and what meals a participant will eat while at the feeding site.Prior Audit ResultsAs noted in the seven prior audits, DHS did not ensure that subrecipients determined and properly documented individual eligibility for participants. DHS management concurred in part with the prior finding. They stated,The department continues to evaluate findings identified in this report and in our own internal monitoring and has created training sessions to mitigate programmatic weaknesses including training subrecipients on participant eligibility and documentation. All CACFP trainings are developed and conducted in conjunction with USDA-FNS [Food and Nutrition Service].During our current testwork, we concluded that these training and monitoring efforts were still insufficient to correct the continuing issues related to subrecipients not maintaining complete and accurate eligibility documentation.Condition and CriteriaFrom a population of 301 CACFP subrecipients, we selected a nonstatistical, random sample of 60 subrecipients. We tested the eligibility documentation to ensure the subrecipients correctly determined participants? eligibility and claimed the correct amount for meals served to participants as defined by federal regulations. We noted the following problems.Subrecipients Did Not Maintain Eligibility Applications and Enrollment Documentation or Did Not Maintain Complete DocumentationThe 60 subrecipients were required to keep eligibility documentation for 728 participants tested. We noted errors for 33 of the 60 subrecipients tested (55%), including errors for 292 of the 728 (40%) participants who required eligibility documentation.We also noted the 60 subrecipients were required to keep enrollment documentation for 698 participants tested. We noted errors for 19 of the 60 subrecipients (32%), including errors for 203 of the 698 participants (29%) who required enrollment documentation.For the eligibility applications and enrollment documentation errors, we noted that1 subrecipient reported that the eligibility and enrollment documentation were incomplete because parents did not fully complete the documentation;1 subrecipient did not respond to our request for eligibility documentation, and 1 subrecipient did not respond to our request for eligibility and enrollment documentation;1 subrecipient provided eligibility and enrollment documentation that parents did not fully complete and appeared altered;1 subrecipient destroyed the requested eligibility documentation for 125 participants; and28 subrecipients either did not maintain eligibility applications and enrollment documentation or did not maintain complete documentation.Either the applications were not updated annually, or they were missing one or more of the following required components:all household members,income information,the last four digits of the participant?s Social Security number, orthe signature of the participant?s guardian.Title 7, Code of Federal Regulations (CFR), Part 226, Section 10(d), states,All records to support the claim shall be retained for a period of three years after the date of submission of the final claim for the fiscal year to which they pertain, except that if audit findings have not been resolved, the records shall be retained beyond the end of the three-year period as long as may be required for the resolution of the issues raised by the audit. All accounts and records pertaining to the Program shall be made available, upon request, to representatives of the State agency, of the Department, and of the U.S. Government Accountability Office for audit or review, at a reasonable time and place.In addition, 7 CFR 226.15(e)(2) states,All types of centers, except for emergency shelters and at-risk afterschool care centers, must maintain information used to determine eligibility for free or reduced-price meals in accordance with ?226.23(e)(1). For childcare centers, such documentation of enrollment must be updated annually, signed by a parent or legal guardian, and include information on each child?s normal days and hours of care and the meals normally received while in care.Since the subrecipients did not maintain applications that supported free and reduced-price meal reimbursement, we reclassified the participants? eligibility category as ?paid? and questioned the difference in the reimbursement rates. See Table 1 for a summary of questioned costs.We did not question costs for the enrollment documentation errors noted above because the errors did not negate the participants? eligibility for the program.Subrecipients Incorrectly Determined the Category of Meal Status for Their ParticipantsThe 60 subrecipients were required to document the category of meal status for 694 participants tested. We noted errors for 15 of the 60 subrecipients (25%). We noted that the subrecipients did not keep information needed to classify the eligibility meal status (free, reduced-price, or paid) or incorrectly determined the eligibility meal status for 166 of the 694 (24%) participants. We found that information needed to classify the child for free or reduced-price eligibility was missing for 1 participant. Based on the information provided for the remaining participants, subrecipients incorrectly determined the eligibility meal status for 165 participants.7 CFR 226.23(e)(4) states,The institution shall take the income information provided by the household on the application and calculate the household?s total current income. When a completed application furnished by a family indicates that the family meets the eligibility criteria for free or reduced-price meals, the participants from that family shall be determined eligible for free or reduced-price meals. . . . When the information furnished by the family is not complete or does not meet the eligibility criteria for free or reduced-price meals, institution officials must consider the participants from that family as not eligible for free or reduced-price meals, and must consider the participants as eligible for ?paid? meals.Age Requirement ErrorsThe 60 subrecipients were required to keep documentation of age for 697 participants tested. We noted errors for 4 of the 60 subrecipients (7%), including errors for 136 of the 697 (20%) participants. Specifically, 1 subrecipient did not respond to our request for eligibility documentation for 2 participants, 1 subrecipient lost the documentation for 1 participant, 1 subrecipient did not maintain documentation for 8 participants, and 1 subrecipient destroyed documentation for 125 participants.For the last subrecipient listed, DHS management issued a notice of serious deficiency detailing the subrecipient?s failure to keep records to support its claim, disallowed payments for the months of October 2019 through April 2020, and removed the subrecipient from the program in October 2020. We tested the subrecipient?s August 2019 claim.The subrecipients claimed the participants were children; however, the eligibility applications did not include the participants? birth dates and/or ages, and none of the subrecipients provided any other supporting documentation of the children?s ages when we requested the data. Therefore, we could not determine if the participants met the program?s definition of a child.7 CFR 226.2 defines a child participant for the CACFP program as(a) Persons age 12 and under;(b) Persons age 15 and under who are children of migrant workers;(c) Persons with disabilities as defined in this section; [emphasis in original](d) For emergency shelters, persons age 18 and under; and(e) For at-risk afterschool care centers, persons age 18 and under at the start of the school year.Since the subrecipients did not maintain documentation of the participants? age, we reclassified the participants? eligibility category as ?paid? and questioned the difference in the reimbursement rates. See Table 1 for a summary of questioned costs.Risk AssessmentWe reviewed DHS?s December 2019 Financial Integrity Act Risk Assessment and determined that management did not identify the risk of subrecipients incorrectly determining eligibility requirements and maintaining documentation to support participant eligibility. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.CauseDuring our discussions, DHS management did not provide a cause for the issues. Based on the number and type of errors found in our testwork, as well as management?s partial concurrence with the prior-year findings, management?s training of subrecipients on properly completing and maintaining individual eligibility documentation is either ineffective or the subrecipients are unwilling to comply with program regulations.According to 7 CFR 226.6(a)(5), as part of its pass-through entity responsibilities, DHS agrees to ensure participating subrecipients effectively operate the program. Also, 2 CFR 200.62, ?Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,? states,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:a. Transactions are properly recorded and accounted for, in order to: (1) Permit the preparation of reliable financial statements and Federal reports; (2) Maintain accountability over assets; and (3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award;b. Transactions are executed in compliance with: (1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and (2) Any other federal statutes and regulations that are identified in the Compliance Supplement; andc. Funds, property, and other assets are safeguarded against loss from unauthorized use or disposition.EffectBecause the Director of CACFP and the Summer Food Service Program (SFSP) did not ensure subrecipients correctly determined the meal status of participants and maintained proper documentation to support eligibility determinations, DHS improperly reimbursed subrecipients for participants whose eligibility was unsupported. Until management implements sufficient controls and ensures corrective action at all levels, DHS will continue to have an increased risk of improper payments to subrecipients in the program.Federal regulations address actions that federal agencies and non-federal agencies may impose in cases of noncompliance. As noted in 2 CFR 200.339, ?If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? as described in Section 200.208, ?Specific conditions,?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.Also, 2 CFR 200.339 states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:(a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.(b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.(c) Wholly or partly suspend or terminate the Federal award.(d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).(e) Withhold further Federal awards for the project or program.(f) Take other remedies that may be legally available.Questioned CostsWe questioned costs totaling $27,125 for the conditions noted above. Meal reimbursement claims are calculated using a combination of reimbursement rates established by the USDA and a percentage of participants classified in the free, reduced-priced, or paid category. Because the errors noted above required us to reclassify participants into the paid category, we determined the questioned costs for each subrecipient after considering all errors we noted. See a summary of the known questioned costs in Table 1.See Schedule of Findings and Questioned Costs for chart/table.Our testwork included a review of a nonstatistical, random sample of 60 subrecipient meal reimbursement claims, which resulted in $27,125 of known questioned costs. We selected the nonstatistical, random sample of 60 meal reimbursement claims, totaling $519,962, from a population of 7,358 claims and adjustments, totaling $59,035,813, for the period July 1, 2019, through June 30, 2020 (the state?s fiscal year). 2 CFR 200.516(a)(3) requires us to report known and likely questioned costs greater than $25,000 for a type of compliance requirement for a major program. According to 2 CFR 200.84,Questioned cost means a cost that is questioned by the auditor because of an audit finding:(a) Which resulted from a violation or possible violation of a statute, regulation, or the terms and conditions of a Federal award, including for funds used to match Federal funds;(b) Where the costs, at the time of the audit, are not supported by adequate documentation; or(c) Where the costs incurred appear unreasonable and do not reflect the actions a prudent person would take in the circumstances.In resolution of this audit finding, DHS management will work with the federal grantor to determine the amount of any disallowed costs.RecommendationThe Commissioner and the Director of CACFP and SFSP should ensure all subrecipients (1) are properly trained to perform required eligibility determinations and (2) maintain proper documentation to support eligibility determinations. In addition, management should ensure sufficient controls are in place and corrective action is taken at all levels.If subrecipients continue to not maintain supporting documentation or correctly determine participant eligibility, management should impose additional conditions upon the subrecipients or take other action, as described in 2 CFR 200.208 and 200.339.Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur in part.There were 13 of the 33 subrecipients with questioned costs that were below DHS? threshold for recoupment. DHS continues to evaluate this finding and our own internal monitoring and has created training sessions to mitigate programmatic weaknesses including training subrecipients on participant eligibility and documentation. All CACFP trainings are developed and conducted in conjunction with USDA - FNS.Please note that subrecipient 27, who represents 62% of the questioned costs, has been terminated and disqualified from CACFP.Subrecipients Did Not Maintain Eligibility Applications and Enrollment Documentation or Did Not Maintain Complete DocumentationWe concur in part.The state auditors noted an error with eligibility applications due to all household member names not being listed. We do not concur that this is an error. The CACFP Meal Benefit Income Eligibility (Child Care) form provided by USDA for Child Care programs to use for CACFP does not require that all household member names be listed. The USDA form requires that all children in the day care and all adult household members be named on the form. This number can differ from the total number of household members if there are additional children in the home that do not attend the childcare.We concur that income eligibility applications are complicated and that errors with income information, partial Social Security numbers, and guardian signatures are frequent findings identified in our monitoring process. USDA continues to evaluate the income eligibility application templates used for CACFP and DHS is continuing to provide training and technical assistance surrounding this area.Please note that the subrecipient that destroyed the requested eligibility documentation for 125 participants has since been terminated from the program.Subrecipients Incorrectly Determined the Category of Meal Status for Their ParticipantsWe concur.We concur that income eligibility applications are complicated and that errors with determining the category of meal status for their participants is a frequent finding identified in our monitoring process. USDA continues to evaluate the income eligibility application templates used for CACFP and DHS is continuing to provide training and technical assistance surrounding this area.The subrecipient that did not provide eligibility applications for all 125 program participants has since been terminated from the program. This represents 76% of the identified errors.Age Requirement ErrorsWe do not concur.The state auditors stated that, ?the subrecipients claimed the participants were children; however, the eligibility applications did not include the participants? birth dates and/or ages, and none of the subrecipients provided any other supporting documentation of the children?s ages when we requested the data. Therefore, we could not determine if the participants met the program?s definition of a child.? There is no federal requirement that the child?s age be included on the eligibility application. The updated CACFP Meal Benefit Income Eligibility (Child Care) form provided by USDA for Child Care programs to use for CACFP does not include a location for the child?s age to be recorded.The state auditors indicated that they could not determine if the participants met the program?s definition of a child. The ages and birthdates of individuals attending childcare are maintained in multiple locations, including, but not limited to, the classroom rosters which are separated by age group; the meal counts, which are separated by age group; Head Start enrollment information; the individual information maintained on each child by the child care institution; and State licensing documentation. It is unreasonable to assume that these individuals did not meet the CACFP definition of ?child.?Please note that the subrecipient that did not provide eligibility applications for all 125 program participants has since been terminated from the program. This represents 93% of the identified errors.Auditor?s CommentSubrecipients Did Not Maintain Eligibility Applications and Enrollment Documentation or Did Not Maintain Complete DocumentationTitle 7, Code of Federal Regulations, Part 226.2(a), defines documentation as, ?The completion of the following information on a free and reduced-price application [including] names of all household members.? DHS uses the CACFP Meal Benefit Income Eligibility (Child Care) form provided by USDA for Child Care programs for CACFP which does not include all specific requirements identified in the CFR.Age Requirement ErrorsAlthough the subrecipients have the main responsibility to obtain and maintain the participants? ages as proof of eligibility, DHS management asked us to accept any evidence from any source to establish the participants? age. We accepted many forms of documentation, including immunization records, child care certificates, and day care applications, some of which DHS management provided on behalf of the subrecipients; however, neither the sponsors nor DHS management could provide all the documents in our sample.

Finding Number 2020-014CFDA Number 10.559Program Name Child Nutrition ClusterFederal Agency Department of AgricultureState Agency Department of Human ServicesFederal Award Identification Number 195TN331N1099, 205TN331N1099,and 205TN331N8503Federal Award Year 2019 and 2020Finding Type Significant Deficiency and NoncomplianceCompliance Requirement Allowable Costs/Cost PrinciplesRepeat Finding 2019-021Pass-Through Entity N/AQuestioned Costs $401,846As noted in the prior six audits, the Department of Human Services did not ensure that Summer Food Service Program for Children sponsors maintained complete and accurate supporting documentation for meal reimbursement claims and/or that sponsors claimed meals and received reimbursements in accordance with federal guidelines, resulting in $401,846 of questioned costsBackgroundThe Summer Food Service Program for Children (SFSP) is funded by the U.S. Department of Agriculture and administered on the state level by the Tennessee Department of Human Services (DHS). As a pass-through entity for SFSP funds, DHS is responsible for providing sufficient qualified consultative, technical, and managerial personnel to administer the program and monitor performance to ensure that subrecipients, known as sponsors, comply with program rules and regulations.SFSP typically operates during the summer months. This year, due to the COVID-19 pandemic, the state began SFSP operations in March 2020. Because the state operates on a July 1 through June 30 fiscal year, our audit of SFSP crossed two state fiscal years. Our audit scope was July 1, 2019, through June 30, 2020, and our SFSP review included the following periods:summer 2019 (May through August 2019, with the months of July through August falling within our audit scope); andsummer 2020 (March through August 2020, with the months of March, April, May, and June falling within our audit scope).DHS uses the Tennessee Information Payment System (TIPS) to document approvals of meal services at individual sites and to process reimbursement payments to sponsors for meals served to children. DHS does not require sponsors to submit supporting documentation when filing claims; however, federal regulations require sponsors to maintain all documentation to support their claims and to comply with federal guidelines during the meal reimbursement process. In addition, as the non-federal entity, DHS must implement internal controls over compliance requirements for federal awards designed to provide reasonable assurance that its subrecipients achieve compliance with the federal grantor?s regulations.As part of DHS?s internal control process, DHS management established a sponsor application process to provide oversight and accountability for sponsors? operations. During the application process and before sponsors can begin in the program, DHS staff approves various information pertaining to the sponsors? meal services before the sponsors can serve meals and claim reimbursement through the reimbursement request process. The information that DHS approves includes, but is not limited to,the physical locations of where actual meal services take place?sponsors are expected to serve SFSP meals at these locations during approved dates;the maximum number of meals sponsors can serve during individual meal services, known as the capacity;the meal types the sponsors serve; andthe approved dates of operation when site personnel serve meals to children.Sponsors can request to change previously approved information on the application to accommodate summer program operations. Once DHS has approved the changes, sponsors must abide by the newly approved information in order to claim meals for reimbursement.Sponsors use meal count forms to document the number of meals served to children during each meal service. Sponsors use these forms to calculate reimbursement requests and submit monthly reimbursement requests to DHS.DHS provides federal reimbursements to sponsors for eligible meals served to individuals who meet age and income requirements based on a combined rate, which covers meals and administrative components. The meal component of the combined reimbursement rate is applicable to all sponsors and their sites. The administrative component of the combined rate depends on whether sponsors prepare their own meals or obtain meals from a food vendor. If the sponsor obtains meals from a food vendor, then the geographical location of the feeding site, which can be either urban or rural, determines the administrative component of the combined reimbursement rate.Based on our understanding of the federal regulations, the federal grantor expects sponsors to administer the program with high integrity and to accurately claim only reimbursable meals served to children and in compliance with program guidance. The federal grantor also expects DHS to monitor the sponsors to obtain reasonable assurance that sponsors comply with federal and state regulations, and to follow up on program violations and inconsistencies.Prior Audit ResultsAs reported in findings in the six prior audits, we found that sponsors had not complied with established federal regulations involving documentation required to support the meal reimbursement claims. DHS management concurred in part with the prior audit finding and stated, ?The department continued with its effort of increasing and improving its training to food program sponsors to mitigate the risk of future noncompliance.?Condition and CauseDHS approved 53 sponsors for the 2019 SFSP. We haphazardly selected 1 monthly meal reimbursement claim for each of the 53 sponsors and 1 additional monthly meal reimbursement claim for the 7 largest sponsors. One sponsor did not have any documentation of meal counts to support the reimbursement claim for a selected month; we questioned the cost for the selected month, totaling $86,608, and selected an additional month for our review. We also selected a nonstatistical, haphazard sample of 61 meal reimbursement claims, totaling $7,673,556, from the population of 153 SFSP sponsors? meal reimbursement claims, totaling $16,463,704, paid during state fiscal year 2020.Based on our review of the sponsors? claims, we determined that DHS reimbursed sponsors for inaccurate and/or unsupported meal reimbursement claims. Specifically, we found thatA. sponsors did not maintain or could not provide complete and accurate supporting documentation for meal claims submitted to DHS for reimbursement,B. sponsors claimed meals above the approved serving limits,C. sponsors claimed meals outside the approved dates,D. DHS reimbursed sponsors using incorrect administrative rates, andE. sponsors did not use federally compliant meal count forms.We believe that management should improve its current control environment given the inherent risk of improper SFSP payments. See Finding 2020-010 for further information on management?s oversight responsibilities for repeat offenders.Condition A and Criteria: Claims Were Incomplete and/or Based on Inaccurate Meal CountsBased on our review of the DHS TIPS reimbursement payments to sponsors and corresponding supporting meal count documentation obtained from the sponsors, we noted that for 43 of 61 claims reviewed (70%) for 39 sponsors, DHS staff did not ensure the sponsors maintained complete or accurate documentation to support meal reimbursement claims filed with DHS.One sponsor did not maintain any meal count documentation for 1 selected claim, totaling $86,608. For 36 claims, the sponsors submitted claims for reimbursement for more meals served than the sponsors had documentation to support (see Table 1 for details of questioned costs for this condition). In 6 cases, the sponsors submitted claims for fewer meals served than were reported on supporting documentation (see Table 2).According to Title 7, Code of Federal Regulations (CFR), Part 225, Section 15(c),Sponsors shall maintain accurate records justifying all meals claimed . . . The sponsor?s records shall be available at all times for inspection and audit by representatives of the Secretary, the Comptroller General of the United States, and the State agency for a period of three years following the date of submission of the final claim for reimbursement for the fiscal year.Questioned Costs for This ConditionSee Schedule of Findings and Questioned Costs for chart/table.See Schedule of Findings and Questioned Costs for chart/table.Condition B and Criteria: Sponsors Served and Claimed Meals Above the Approved Serving LimitsBased on our review of DHS?s approved information in TIPS pertaining to serving limits and our review of the meal count documentation obtained from the sponsors, we noted that for 14 of 60 claims reviewed (23%), 12 sponsors claimed meals above the maximum number of approved meals for the sponsors? feeding sites.According to the Summer Food Service Program?s 2016 Administration Guide,Non-Reimbursable MealsSponsors may claim reimbursement only for those meals that meet SFSP requirements. Reimbursement may not be claimed for . . . [m]eals over the cap.Questioned Costs for This ConditionSee Schedule of Findings and Questioned Costs for chart/table.Condition C and Criteria: Sponsors Served and Claimed Meals Outside the Approved Dates of OperationBased on our review of DHS?s approved operation days in TIPS and our review of the meal count documentation obtained from sponsors, we noted that for 5 of 60 claims reviewed (8%), 5 sponsors served and claimed meals prior to DHS approval or claimed meals before or after the approved dates of operation.According to the Summer Food Service Program?s 2016 Administration Guide,Non-Reimbursable MealsSponsors may claim reimbursement only for those meals that meet SFSP requirements. Reimbursement may not be claimed for . . . [m]eals served outside of approved timeframes or approved dates of operation.In addition, 7 CFR 225.9(d) states,Reimbursements. Sponsors shall not be eligible for meal reimbursements unless they have executed an agreement with the State agency. All reimbursements shall be in accordance with the terms of this agreement. Reimbursements shall not be paid for meals served at a site before the sponsor has received written notification that the site has been approved for participation in the Program.Questioned Costs for This ConditionSee Schedule of Findings and Questioned Costs for chart/table.Condition D and Criteria: DHS Reimbursed Sponsors Using Incorrect Administrative RatesBased on our review of meal reimbursement information in TIPS, we noted that for 1 of 60 meal reimbursement claims tested (2%), DHS reimbursed 1 sponsor using incorrect administrative reimbursement rates, resulting in overpayments of $86. Our review found that DHS reimbursed 1 sponsor for 1 feeding site using the higher administrative rate applicable to vended sites located in a rural area. However, we found that the sites were actually located in an urban area, requiring the sponsors to be reimbursed at the lower administrative rate.According to the Summer Food Service Program?s 2016 Administration Guide,The SFSP has two different levels of administrative reimbursement rates. The higher reimbursement rates are for sponsors of sites that prepare or assemble their own meals and for sponsors of sites located in rural areas. The lower rate is for all other sponsors.Questioned Costs for This ConditionSee Schedule of Findings and Questioned Costs for chart/table.Condition E and Criteria: Sponsors Did Not Use Compliant Meal Count FormsBased on our review of the meal count documentation obtained from sponsors, we noted that for 4 of 60 claims reviewed (7%), 4 sponsors did not use an allowable meal count form. For 2 sponsors, the meal count forms did not have any site supervisor signatures, nor did they contain a line for a site supervisor to sign. For 2 sponsors, the sponsor uses a weekly meal count form instead of a daily meal count form and did not document point-of-service counts on the weekly form, as federally required.According to the Summer Food Service Program?s 2016 Administration Guide,Daily meal count sheets are required; however, the weekly consolidated meal count form is not.In addition, according to the guide,Each site must take a point-of-service meal count every day. . . . The site supervisor must sign and date the meal count form.Questioned Costs for This ConditionSee Schedule of Findings and Questioned Costs for chart/table.Risk AssessmentWe reviewed DHS?s December 2019 Financial Integrity Act Risk Assessment and determined that management listed the risk of subrecipients submitting claims that are not supported by documentation; however, DHS did not have an effective control to mitigate its risk.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,?7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions.CauseBecause DHS does not require subrecipients to provide supporting documentation for each meal reimbursement claim before payment, management and staff instead rely on the Audit Services unit to review supporting documentation during monitoring visits and to train sponsors about the federal program requirements. We discussed the issues presented in this finding with DHS management; however, DHS did not provide a cause for the issues we found. In our discussions with sponsors, they said the causes for the errors noted in the conditions above were human errors and the lack of an adequate sponsor review. Sponsors also stated that additional training from DHS would help reduce these errors. As noted above, we have repeatedly identified the same sponsors for noncompliance even though they have had years of DHS training on program operations.?Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,? 2 CFR 200.62, states,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:a. Transactions are properly recorded and accounted for, in order to:(1) Permit the preparation of reliable financial statements and Federal reports;(2) Maintain accountability over assets; and(3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award;b. Transactions are executed in compliance with:(1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and(2) Any other Federal statutes and regulations that are identified in the Compliance Supplement; andc. Funds, property, and other assets are safeguarded against loss from unauthorized use or disposition.EffectAs a pass-through entity for SFSP, DHS is responsible for ensuring that sponsors comply with federal and state requirements. When DHS management and staff do not establish and implement properly designed controls to comply with federal requirements, management will continue to reimburse sponsors for unallowable expenditures resulting from errors, noncompliance, fraud, waste, and abuse.Additionally, federal regulations address actions that federal agencies and non-federal agencies may impose in cases of noncompliance. As noted in 2 CFR 200.339, ?If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? as described in Section 200.208, ?Specific conditions,?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.Section 200.339 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:(a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.(b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.(c) Wholly or partly suspend or terminate the Federal award.(d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).(e) Withhold further Federal awards for the project or program.(f) Take other remedies that may be legally available.Summary of Questioned Costs for All ConditionsSee Schedule of Findings and Questioned Costs for chart/table.This finding, in conjunction with Finding 2020-015, resulted in total known federal questioned costs exceeding $25,000 for federal programs that were audited as major programs. When known questioned costs are greater than $25,000 for a type of compliance requirement for a major program, 2 CFR 200.516(a)(3) requires us to report those costs.According to 2 CFR 200.84, questioned costs are costs an auditor questions because the costs either (a) resulted from a violation or possible violation of federal requirements, (b) were not supported by adequate documentation, or (c) were unreasonable. In resolution of this audit finding, DHS management will work with the federal grantor to determine the amount of any disallowed costs.RecommendationThe Commissioner and the Director of Operations for the Child and Adult Care Food Program (CACFP) and SFSP should pursue actions to ensure both subrecipients and DHS comply with the federal requirements. The Director of Operations for CACFP and SFSP should develop stronger preventive and detective controls over SFSP. These controls should ensure that all sponsors maintain complete and accurate documentation to support the meals served and claimed for reimbursements and that sponsors follow federal guidelines when claiming meals on their meal reimbursements.When subrecipients continually fail to maintain adequate meal reimbursement documentation, management should impose additional conditions upon the subrecipients or take other action, as described in 2 CFR 200.208 and 200.339.Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur in part.DHS continues to work to improve the successful operation of the program and the overall integrity of the SFSP. This finding is based on test work from the summers of 2019 and 2020. The data crosses program years and does not show a contextualized picture of how the SFSP program operates. By reporting information with such a lag time and including information from two different SFSP program years DHS is unable to effectively show implemented changes. DHS hopes to continue working with the state auditors in a way where the information shared can be utilized productively and DHS can support the Tennessee children and families served by this program.Condition A: Claims Were Incomplete and/or Based on Inaccurate Meal CountsWe concur in part.DHS concurs that incomplete and/or inaccurate meal counts occur in the SFSP program, as it is one of the frequent issues identified in the DHS monitoring process. DHS monitored 14 of the 20 sponsors identified in this condition from SFSP 2019 and 2 of the 7 sponsors identified in this condition from SFSP 2020. Out of the monitored sponsors, DHS noted the same or similar instances of noncompliance and the sponsors have subsequently submitted corrective action addressing the issue and returned any identified overpayment or are in the process of completing the corrective action. DHS? monitoring was not taken into consideration during the audit process because the review month or sites selected varied from the state auditors? selection. If the state auditors selected the same months of review as DHS and compared outcomes, the review would provide a more nuanced look at the work DHS does to support SFSP sponsor compliance and program integrity.It is important to note that eight of the 34 claims identified in Table 1 resulted in questioned costs that are below the state threshold for collection.DHS does not concur with the identified noncompliance for the six sponsors noted in Table 2 of this finding. The identified noncompliance was that the sponsor did not claim enough meals. There are no federal regulations that require a sponsor to claim all eligible meals and including underclaimed meals in a finding of sponsor noncompliance is disingenuous.All SFSP trainings are developed and conducted in conjunction with USDA FNS. SFSP training materials and training requirements were reviewed by USDA as part of the 2020 DHS SFSP Management Evaluation and DHS was found to be in compliance with federal training requirements.Condition B: Sponsors Served and Claimed Meals Above the Approved Serving LimitsWe concur in part.DHS concurs that claiming meals above the approved daily serving limits occurs in the SFSP program, as it is one of the frequent issues identified in the DHS monitoring process. The questioned costs identified in this condition cross SFSP program years and therefore make direct comparison challenging. USDA provided waivers for SFSP 2020 due to the impact of COVID-19, allowing for enhanced flexibilities within the SFSP program.DHS? monitoring was not taken into consideration during the audit process because the review month or sites selected varied from the state auditors? selection or the timing of the monitoring report prevented comparison.It is important to note that 8 of the 14 claims with questioned costs are below the state threshold for collection.The Department?s continuous effort of increasing and improving its training to food program sponsors can mitigate the risk of future noncompliance but does not act as a complete preventative control.Condition C: Sponsors Served and Claimed Meals Outside the Approved Dates of OperationWe concur in part.DHS concurs that serving and claiming meals outside the approved dates of operation occurs in the SFSP program, as it is one of the frequent issues identified in the DHS monitoring process. DHS? monitoring was not taken into consideration during the audit process because the review month or sites selected varied from the state auditors? selection.It is important to note that 2 of the 5 sponsors with questioned costs are below the state threshold for collection.DHS continuous effort of increasing and improving its training to food program sponsors can mitigate the risk of future non-compliance but does not act as a complete preventative control.Condition D: DHS Reimbursed Sponsors Using Incorrect Administrative RatesWe concur.DHS corrected this error within the TIPS system in the transition from SFSP 2019 to SFSP 2020. The amount of identified questioned costs is below the state threshold for collection. This Sponsor did not participate in SFSP 2020.Condition E: Sponsors Did Not Use Compliant Meal Count FormsWe concur.DHS agrees that our monitoring process can result in disallowance of meal costs similar to what the state auditors noted in this condition. Compliant meal count forms are provided to all SFSP sponsors in the mandatory SFSP training and specific meal count training is available to all SFSP sponsors and site supervisors. Additionally, meal count forms are found in the back of the USDA SFSP Administrative Guide that is available to the public.DHS continuous effort of increasing and improving its training to food program sponsors can mitigate the risk of future non-compliance but does not act as a complete preventative control.Auditor?s CommentFor the audit period July 1, 2019, through June 30, 2020, (which covered Summer 2019 and Spring 2020) we audited this federal program in accordance with the Office of Management and Budget Uniform Guidance found in Title 2, Code of Federal Regulations (CFR), Part 200, and we considered all waivers resulting from the COVID-19 pandemic, as well as DHS Audit Services monitoring activities in evaluating our audit results. This is the sixth consecutive year of this finding, which shows a longstanding and systemic issue with DHS?s processes for training, monitoring, sponsor approval, and overall program oversight.We included underclaimed errors in the finding to highlight inaccurate recordkeeping and not as a component in calculating questioned costs. The department?s threshold for collecting overpayments from sponsors has no relevance to the auditor?s determination of questioned costs. We are responsible to report all known questioned costs for overpayments. Should the federal grantor determine any of the auditor?s questioned costs are federal disallowed costs for which the department should recover the disallowed costs (overpayments) made to a sponsor, management?s responsibility could include netting underpayments with overpayments as part of the disallowed costs recovery process.

Finding Number 2020-015CFDA Number 10.559Program Name Child Nutrition ClusterFederal Agency Department of AgricultureState Agency Department of Human ServicesFederal Award Identification Number 205TN331N1099 and 205TN331N8503Federal Award Year 2020Finding Type Significant Deficiency and NoncomplianceCompliance Requirement Allowable Costs/Cost PrinciplesRepeat Finding 2019-022Pass-Through Entity N/AQuestioned Costs FY 2020: $35,125 and FY 2021: $155,674For the seventh consecutive year, the Department of Human Services did not ensure that Summer Food Service Program for Children subrecipients served and documented meals according to established federal regulations, resulting in $190,799 of federal questioned costsBackgroundThe Summer Food Service Program for Children (SFSP) is funded by the U.S. Department of Agriculture (USDA) and administered on the state level by the Tennessee Department of Human Services (DHS). As a pass-through entity for SFSP funds, DHS is responsible for providing sufficient qualified consultative, technical, and managerial personnel to administer the program and monitor performance to ensure that subrecipients, known as sponsors, comply with program rules and regulations.Sponsors may operate the program at one or more feeding sites. DHS requires sponsors to count meals served and record this number on a daily meal count form. Sponsors can claim reimbursement requests only for meals that comply with program guidance, such as meals served with all required components and within DHS-approved timeframes. Site personnel then submit the meal count forms to the sponsor, who calculates monthly totals and submits reimbursement requests to DHS.DHS uses the Tennessee Information Payment System to process reimbursement payments to sponsors. DHS does not require sponsors to submit supporting documentation when filing claims; however, federal regulations require sponsors to maintain all documentation to support their claims and to comply with federal guidelines during the meal reimbursement process. DHS monitors subrecipients to obtain reasonable assurance that both sponsors and site personnel comply with state and federal requirements.When DHS monitors identify that subrecipients have not complied with federal requirements, DHS addresses these meal service violations by requiring subrecipients to submit a corrective action plan, which outlines actions and steps to prevent the noncompliance from occurring in the future. More serious violations, outlined in the federal guidelines, result in a process called a serious deficiency, which requires DHS to start terminating the sponsor from the program and disapprove the subrecipient?s application from future program participation unless the subrecipient takes appropriate corrective actions to prevent the recurrence of the deficiencies.SFSP typically only operates during the summer months (May through August). With the onset of the COVID-19 pandemic, however, many schools closed in March 2020 and sponsors began serving meals. The USDA issued SFSP program waivers to the states to minimize person to person contact during the pandemic while still providing children with access to meals. These USDA waivers included non-congregate feeding, parent meal pickup for their children, and approval for sponsors to serve two meals at the same time. We observed meal services from May 2020 through August 2020. Because the state operates on a July 1 through June 30 fiscal year, our audit of SFSP, including meal observation and subsequent follow-up claim review testwork, crossed two state fiscal years:2020 (July 1, 2019, through June 30, 2020, with the months of May and June falling during our review period); and2021 (July 1, 2020, through June 30, 2021, with the months of July and August falling during our review period).Prior Audit ResultsWe reported in the prior six audits that subrecipients had not complied with established federal regulations required for meal service at feeding sites and had not maintained accurate meal reimbursement documentation. DHS management concurred in part with the prior audit finding and acknowledged that noncompliance, errors, and inconsistencies between observed meals and claimed meals occur in administering the SFSP.As noted in our prior audit findings and again in this finding, we continue to find that the same sponsors have not complied with the federal requirements. See Finding 2020-010 for further details.Condition and CriteriaWe found that 12 of 19 sponsors noted in this finding had participated in the SFSP program in the past and were returning to participate as sponsors for the 2020 SFSP program year. These sponsors have participated in SFSP for 5 or more years and therefore have received repeated training on compliance requirements. Given the fact that these sponsors have multiple years of experience and an established relationship with DHS in this program, we believe that management has not effectively analyzed the causes for the sponsors? continued noncompliance and that the following may contribute to sponsors? continuous program violations:DHS has either not provided sponsors training or has provided insufficient or ineffective training,DHS has not identified the sponsors? continued noncompliance as serious deficiencies requiring corrective action,DHS has not identified that sponsors are incapable of administering the program in accordance with requirements, orDHS does not have a consistent process to react to fraud risk factors for sponsors that may have nefarious motives.We also found that even though DHS may place sponsors into a serious deficiency status based on its monitoring process and begin actions to terminate the sponsors from program participation, the serious deficiency process has its weaknesses. One such weakness involves sponsors with a history of repeat violations that continue to submit corrective action plans year after year, but either are unable to correct noncompliance issues or have no real intention to correct noncompliance issues. Seventeen of the 19 sponsors reported in this finding have been included in our prior audit findings. The 2 sponsors not included in prior audit findings were new to the program this year. On paper, the corrective action as described may seem sufficient to solve noncompliance issues; however, the sponsors continue to not follow the rules of the program or implement corrective action. As such, DHS?s monitoring and serious deficiency processes have not been sufficient to enforce or to ensure that habitually noncompliant sponsors come into compliance or are effectively removed from program participation.Conditions A, B, and C noted in this finding are repeated from the prior year. It is also important to note that DHS approved approximately 1,100 feeding sites statewide, under 47 participating sponsors, to serve meals during 2020 SFSP. The 64 meal services we observed or attempted to observe represent only a small fraction of SFSP operations. As such, given the numerous deficiencies we found in our limited sample review, we believe the deficiencies are pervasive throughout the entire program and sponsor population.Current Testwork PlanUsing a combination of systematic and haphazard selection methods, we selected 18 of the 47 sponsors that DHS approved for the 2020 program. We observed 23 meal services at 18 different sites, operated by 18 different sponsors. Our observations included 37 meal types (See Schedule of Findings and Questioned Costs for footnote) because many sponsors served 2 meal types at a time. We attempted to perform an additional 38 meal observations covering 52 meal types, but no meals were served during these observations.After the 2020 SFSP meal service program ended, we subsequently followed up with all the sponsors to ensure they claimed the correct number of meals on the reimbursement claims submitted to DHS for the 23 meal services we observed and the 38 meal services we attempted to observe. These 61 meal service follow-ups consisted of 66 monthly claims the sponsors submitted.Based on our audit testwork, we found the following conditions, which will be addressed in detail.We noted meal service noncompliance during our meal observations (see Condition A). Based on our follow-up reviews, we found that subrecipients did not claim the correct number of meals for the day of our observation and attempted observation (see Condition B). We found that subrecipients did not maintain accurate meal reimbursement documentation for all meals for the month we reviewed (see Condition C) and that subrecipients claimed meals over the approved capacity (see Condition D).Condition A: Meal Service NoncomplianceOverall, we noted 9 different types of meal service noncompliance at 20 of 23 meal services observed (87%), ranging from 1 to 5 SFSP violations per site. In our sample testwork, we observed the types of noncompliance with the SFSP program requirements noted in Table 1.See Schedule of Findings and Questioned Costs for chart/table.We reviewed all the USDA-issued COVID-19 waivers and reached out to the USDA?s Food and Nutrition Service (FNS) for additional clarification about the waivers. Based on our review, sponsors did not follow the USDA waiver guidelines.The Nationwide Waiver to Allow Parents and Guardians to Pick Up Meals for Children allowed non-congregate feeding during COVID-19 related operations, which allowed children to take meals home to eat rather than congregating. We observed adults picking up large amounts of meals at most sites and noted violations when parents told us they picked up meals for themselves or for people other than their children. Four separate site supervisors informed us that they served and claimed meals to adults at their sites. We also observed children taking multiple meals home, and site supervisors informed us it was for siblings, parents, and neighbors. According to FNS clarification, the waiver did not permit children to pick up meals for siblings or adults to pick up meals for individuals other than their own children. In addition, meals served to adults were not reimbursable.The Nationwide Waiver to Allow Meal Service Time Flexibility in the Child Nutrition Programs COVID-19: Child Nutrition Response #1 allowed sponsors to have flexibility for the meal service time, such as sponsors serving breakfast and lunch at the same time to reduce the number of visits a child needed to make to a site. However, the waiver states that the requirement for SFSP sponsors to establish meal service times remained in effect. We observed sponsors serving outside of the approved times.The Nationwide Waiver to Allow Meal Pattern Flexibility in the Child Nutrition Programs COVID-19 Child Nutrition Response #4 waived the requirement for sponsors to serve meals that met the USDA meal pattern requirements during the COVID-19 pandemic based upon disruptions to the availability of food products. The waiver required DHS staff to approve sponsors? participation under this waiver on a case-by-case basis and required DHS to report to the FNS Regional Office when and where the waiver was in effect and for what food components. The waiver stated that FNS expected and strongly encouraged sponsors to maintain and meet the nutrition standards to the greatest extent possible. DHS staff did not provide us with a list of sponsors that management had approved to operate under this waiver and what food components were waived. Furthermore, site supervisors did not cite any food shortages as a reason why they did not serve all meal components during our meal observations.The above-mentioned instances of noncompliance substantiated grounds to disallow program payments. We discussed each instance of noncompliance and its allowability for program reimbursement with sponsors? personnel at the time of our site visit. See Conditions B and C for the results of our follow-up review.Multiple Sponsors Served at the Same SitesDuring our meal observations and attempted meal observations, we noted instances of multiple sponsors serving at the same sites and serving more than the maximum two meal types per day. According to the Summer Food Service Program?s 2016 Administration Guide, (See Schedule of Findings and Questioned Costs for footnote)Sponsors may serve one or two meals a day at open, restricted open, and enrolled sites. With State agency approval, sponsors may serve two meals (including snacks) each day. . . .Meal services can be operated by different sponsors at the same site; however, the maximum number of meals allowed at a site under the regulations [7 CFR 225.16(b)] must not be exceeded (two meals for open, restricted open, and enrolled sites . . .).Based on our review of the sponsors? approved feeding site information in the Tennessee Information Payment System, the sponsors used variations of the sites? street address, even though the physical site locations were the same buildings or apartment complexes. In one instance, the site supervisors stated that multiple sponsors set up feeding sites next to each other. We considered the sponsor DHS first approved to serve at the sites as serving allowable meals unless we noted other meal service violations. We questioned the costs DHS paid to the other sponsors who served and claimed meals beyond the maximum two meals per day at the same sites. See Table 2.See Schedule of Findings and Questioned Costs for chart/table.Criteria (Applicable to Condition A)See Table 3 for applicable noncompliance criteria.See Schedule of Findings and Questioned Costs for chart/table.According to Title 7, Code of Federal Regulations (CFR), Part 225, Section 16(b)(3),Restrictions on the number and types of meals served. Food service sites other than camps and sites that primarily serve migrant children may serve either: (i) One meal each day, a breakfast, a lunch, or snack; or (ii) Two meals each day, if one is a lunch and the other is a breakfast or a snack.Condition B: Incorrect Number of Meals Claimed for the Day of Our Meal Service Observations and Attempted ObservationsMeal Service ObservationsOur sample testwork revealed that for the 23 meal services we physically observed, covering 37 meals, 15 sponsors did not claim the correct number of meals for 32 of 37 meals (86%). See Table 4 for details of the noncompliance and the questioned costs for the meal service observations.See Schedule of Findings and Questioned Costs for chart/table.Attempted Meal Service ObservationsWe attempted to observe 38 additional meal services (46 meal types) for 8 sponsors; however, we did not see any site personnel or children at the sites. We followed up with the sponsors to ensure the sponsor did not claim meals on the days we did not see any meals served. We noted that 4 sponsors claimed meals for reimbursement for the days of our observation for 28 of 46 meals (61%), even though we saw no meal service. See Table 5 for the details of the noncompliance and the questioned costs for these sponsors.See Schedule of Findings and Questioned Costs for chart/table.Condition C: Meal Reimbursement Documentation Was Inaccurate for the Month of Our Meal Service Observations and Attempted ObservationsIn addition to verifying the day of our meal service observations, we also verified the number of meals the sponsors claimed for the entire month for corresponding feeding sites and meal types. Based on our testwork, we noted that 7 sponsors did not maintain correct documentation to support the monthly meal reimbursement claims for 17 of 37 meals (46%). One of the sponsors did not provide meal count documentation to support its monthly claim for the meal type we performed or attempted to perform a meal service observation. See Table 6 for details of the noncompliance.See Schedule of Findings and Questioned Costs for chart/table.In addition to verifying the day of our attempted meal service observations, we also verified the number of meals the sponsors claimed for the entire month for the corresponding feeding sites and meal types. Our testwork revealed that for 12 of 29 meals reviewed (41%), 4 sponsors did not maintain correct documentation to support the monthly meal reimbursement claim for the meal type. See Table 7 for details of the noncompliance.See Schedule of Findings and Questioned Costs for chart/table.Criteria (Applicable to Conditions B and C)According to 7 CFR 225.15(c),Sponsors shall maintain accurate records justifying all meals claimed . . . The sponsor?s records shall be available at all times for inspection and audit by representatives of the Secretary, the Comptroller General of the United States, and the State agency for a period of three years following the date of submission of the final claim for reimbursement for the fiscal year.Condition D: Sponsors Served and Claimed Meals Above the Approved Serving LimitsBased on our review of DHS?s approved serving limit information in the Tennessee Information Payment System and our review of the meal count documentation obtained from the sponsors, we noted that 3 sponsors claimed meals above the maximum number of approved meals. See Table 8.See Schedule of Findings and Questioned Costs for chart/table.Criteria (Applicable to Condition D)According to the Summer Food Service Program?s 2016 Administration Guide,Non-Reimbursable MealsSponsors may claim reimbursement only for those meals that meet SFSP requirements. Reimbursement may not be claimed for . . . [m]eals over the cap.Risk AssessmentWe reviewed DHS?s December 2019 Financial Integrity Act Risk Assessment and determined that management did not identify the risk of sponsors repeatedly not following federal regulations while serving meals and did not implement a mitigating control.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.CauseDuring our discussions, DHS management did not provide a cause for the issues. In our discussions with site supervisors, they said the causes for the errors noted in the conditions above were human error and miscommunication or lack of communication between the site personnel, the sponsor, and DHS.EffectWhen sponsors do not comply with program requirements during meal services and fail to maintain complete and accurate supporting documentation for the number of meals claimed, DHS cannot ensure that reimbursements paid to sponsors are for allowable meals. As a pass-through entity for SFSP, DHS is responsible for ensuring that sponsors comply with federal and state requirements. When DHS cannot do so, it will continue to reimburse sponsors for unallowable expenditures resulting from errors, noncompliance, fraud, waste, and abuse.Additionally, federal regulations address actions that federal agencies may impose in cases of noncompliance. As noted in 2 CFR 200.339, ?If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? as described in Section 200.208, ?Specific conditions,?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.Section 200.339 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:(a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.(b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.(c) Wholly or partly suspend or terminate the Federal award.(d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).(e) Withhold further Federal awards for the project or program.(f) Take other remedies that may be legally available.Summary of Questioned Costs for All ConditionsWe questioned $190,799 for the noncompliance noted above. See Table 9 for the overall noncompliance and questioned costs noted at the sponsors.See Schedule of Findings and Questioned Costs for chart/table.This finding, in conjunction with Finding 2020-014, resulted in total known federal questioned costs exceeding $25,000 for federal programs that were audited as major programs. 2 CFR 200.516(a)(3) requires us to report known questioned costs greater than $25,000 for a type of compliance requirement for a major program.According to 2 CFR 200.84, questioned costs are costs an auditor questions because the costs either (a) resulted from a violation or possible violation of federal requirements, (b) were not supported by adequate documentation, or (c) were unreasonable.RecommendationThe Commissioner and the Director of Operations for the Child and Adult Care Food Program (CACFP) and SFSP should ensure that both DHS and its subrecipients comply with the federal requirements. DHS should initiate the process to remove any sponsors claiming meals for reimbursement when they do not in fact serve meals to children. The Director of Operations for CACFP and SFSP should develop stronger preventive and detective controls over SFSP. These controls should ensure that all sponsors follow federal guidelines when serving meals and claiming meals on their meal reimbursements.If subrecipients continue violating program guidelines, management should impose additional conditions upon the subrecipients or take other action, as described in 2 CFR 200.208 and 200.339.Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur in part.We do not concur with the assertion that management has not effectively analyzed the causes for sponsor non-compliance. DHS continually analyzes and evaluates the causes for program noncompliance. DHS addresses program noncompliance on an ongoing basis through training, technical assistance and corrective action as required by USDA.We do not concur with the state auditor?s assessment that DHS has either not provided sponsors training or has provided insufficient or ineffective training. All SFSP trainings are developed and conducted in conjunction with USDA - FNS. All SFSP training materials were reviewed by USDA as part of the 2020 DHS SFSP Management Evaluation and DHS was found to be in compliance with federal training requirements. COVID-19 and the timing of the onset of the public health emergency required that DHS pivot from in-person trainings to online trainings; however, all SFSP sponsors completed training as required. All SFSP sponsors completed a 4-part online training program; additionally, new SFSP sponsors completed a web-based training session. DHS is continuing to develop supplemental training opportunities for SFSP participants and provides individualized training upon request.The state auditors indicate that ?the serious deficiency process has its weaknesses,? and as discussed in last year?s audit, we concur that the serious deficiency process has its weaknesses. Despite its weaknesses DHS is federally required to follow the serious deficiency process as outlined in 7 CFR 225 and the USDA Summer Food Service Program State Agency Monitor Guide (2017), Part 8: Corrective Action, Serious Deficiency, and Termination. Management is acting in accordance with the guidance. The Serious Deficiency and Corrective Action processes were evaluated by USDA as part of the 2020 DHS SFSP Management Evaluation and DHS was found to be in compliance with federal requirements.When a sponsor fails to implement timely corrective action to correct serious deficiencies cited, the State agency must proceed with termination of the sponsor?s Program agreement as specified in SFSP regulations. However, the State agency must provide the sponsor with a reasonable opportunity to correct problems before termination. If an acceptable corrective action plan is received and it appears that the sponsor has permanently corrected the finding, a temporary deferral of the serious deficiency is issued. If, in the future, it is discovered that the sponsor failed to permanently correct the serious deficiency the serious deficiency process is reinitiated.The state auditors indicate that they believe that sponsors, ?continue to submit corrective action plans year after year but either are unable to correct noncompliance issues or have no real intent to correct noncompliance issues.? DHS is not able to base program denials off perceived intent of a sponsor. As stated above, if an acceptable corrective action plan is received the state agency must defer the serious deficiency and cannot use this as grounds for denial of an application.DHS is committed to the success and federal compliance of our SFSP sponsors. DHS will continue to provide technical assistance and training to the sponsors in question and monitor sponsors in accordance with the federal regulations. It is the responsibility of the sponsors to serve meals in compliance with the federal regulations and DHS will continue to support this responsibility and act accordingly when compliance with the federal regulations is not upheld.DHS has implemented additional front-end desk review processes to verify SFSP claim payments in instances of identified noncompliance. As noted in this audit report, no funds were questioned for Sponsor 4 because DHS reviewed and denied the SFSP claim for the period of review. This process highlights DHS additional internal controls that acted as intended to prevent disbursement of funds where significant instances of noncompliance exist.Condition A: Meal Service NoncomplianceWe concur in part.We agree that meal service non-compliance occurs in the SFSP program, as it is one of the frequent issues identified in the DHS monitoring process. DHS monitored 7 of the 15 sponsors identified in this condition. DHS noted the same or similar instances of noncompliance in the issued reports and the sponsors are in the process of addressing the issues through corrective action and returning any identified overpayment. DHS? monitoring was not taken into consideration during the audit process because the review month or sites selected by DHS varied from the state auditors? selection or the timing of the report issuance prevented comparison. It should be noted that no funds were disbursed to Sponsor 4 during the month of review and this Sponsor has been terminated from the program.Condition B: Incorrect number of meals claimed for the day of our meal service observations and attempted observationsWe concur in part.We agree that inconsistencies between observed meals and claimed meals occur in the SFSP program, as it is one of the frequent issues identified in the DHS monitoring process. DHS monitored 7 of the 15 sponsors identified in this condition. DHS noted the same or similar instances of noncompliance in the issued reports and the sponsors are addressing the issue through corrective action and returning any identified overpayment. DHS? monitoring was not taken into consideration during the audit process because the review month or sites selected varied from the state auditors? selection or the timing of the report issuance prevented comparison. It should be noted that no funds were disbursed to Sponsor 4 during the month of review and this Sponsor has been terminated from the program.Condition C: Meal reimbursement documentation was inaccurate for the month of our meal service observation and attempted observation

Finding Number 2020-016CFDA Number 84.126Program Name Rehabilitation Services - Vocational Rehabilitation Grantsto StatesFederal Agency Department of EducationState Agency Department of Human ServicesFederal Award Identification Number Federal Award Year H126A1900632019Finding Type NoncomplianceCompliance Requirement Matching, Level of Effort, EarmarkingRepeat Finding 2019-023Pass-Through Entity N/AQuestioned Costs N/AAlthough this finding is repeated for the third year, the Department of Human Services has increased spending for the pre-employment transition services under its 2019 Vocational Rehabilitations grant; however, the department fell just short of the required 15% spending thresholdBackgroundThe U.S. Department of Education provides Vocational Rehabilitation grants to assist states with operating comprehensive Vocational Rehabilitation programs to help individuals with disabilities gain, maintain, or return to employment. In Tennessee, the Department of Human Services (DHS) administers Vocational Rehabilitation through its Division of Rehabilitation Services. As part of administering Vocational Rehabilitation grants, Title 34, Code of Federal Regulations (CFR), Part 361, Section 65(a)(3)(i), requires DHS to reserve at least 15% of its allotted grant award to provide pre-employment transition services (Pre-ETS). For federal fiscal year 2019 (See Schedule of Findings and Questioned Costs for footnote), DHS received a grant award of $54,964,517 from the federal government, which meant management needed to reserve and expend $8,244,678 to provide Pre-ETS in order to comply with the federal compliance requirement for matching, level of effort, and earmarking.DHS, in collaboration with local educational agencies, must use these funds to provide or arrange for the provision of Pre-ETS to disabled students. DHS must ensure these services are available statewide for all students with disabilities, regardless of whether the student has applied for or been determined eligible for Vocational Rehabilitation services. Requirements in 34 CFR 361.48(a)(2) specify these services, including the following:(i) Job exploration counseling;(ii) Work-based learning experiences, which may include in-school or after school opportunities, or experience outside the traditional school setting (including internships), that is provided in an integrated environment in the community to the maximum extent possible;(iii) Counseling on opportunities for enrollment in comprehensive transition or postsecondary educational programs at institutions of higher education;(iv) Workplace readiness training to develop social skills and independent living; and(v) Instruction in self-advocacy . . . which may include peer mentoring.Federal guidance also specifies that administrative expenditures are allowable under the Vocational Rehabilitation grant, but DHS cannot classify administrative expenditures as Pre-ETS expenditures. The Department of Finance and Administration is responsible for performing all fiscal-related duties on behalf of DHS. A Controller is assigned to oversee DHS?s fiscal-related duties.Prior Audit ResultsIn the prior finding, we reported that DHS expended only $1,412,102 from the 2018 grant award to provide Pre-ETS, which was approximately 3% of grant fund expenditures and $5,725,883 less than the 15% requirement. Management concurred with the prior finding and stated they revised controls in their budgeting process to better manage the disbursement of funds and more closely align those disbursements with the federal funding award year. Management also stated they increased the number of providers to provide more services throughout the state.Condition and CauseTo verify that DHS met the earmarking requirement for Pre-ETS, we determined the total 2019 grant award (See Schedule of Findings and Questioned Costs for footnote) expenditures and calculated the percentage expended for providing Pre-ETS. For the 2019 grant award, DHS expended approximately $54.8 million of the $54.9 million awarded, including $7,719,233 for Pre-ETS, which was approximately 14% of grant award expenditures. DHS was required to spend $8,220,097 for Pre-ETS and was approximately $500,864 short of meeting the 15% requirement.According to program management, the department contracts with service providers to provide sufficient Pre-ETS services. Fiscal management conducts monthly budget meetings to review program budgets and tracks the department?s progress for each of their grant awards. Additionally, Vocational Rehabilitation program and fiscal management meet quarterly to discuss the program and reporting. Program and fiscal management initially thought they had met the 15% requirement for the 2019 grant award; however, during the December 2019 monthly budget meeting, fiscal management found they had classified unallowable expenditures as Pre-ETS expenditures. When management corrected the classification error, they found the department was still short in meeting the 15% earmarking requirement. Given the onset of the COVID-19 pandemic in March 2020, management was unable to find alternatives to expend additional Pre-ETS funds.CriteriaRegarding the use of Pre-ETS funds, 34 CFR 361.65(a)(3)(i) states,Pursuant to section 110(d) of the Act, the State must reserve at least 15 percent of the State?s allotment, received in accordance with section 110(a) of the Act for the provision of pre-employment transition services, as described in ?361.48(a) of this part.In addition, 34 CFR 361.48(a) states,Each State must ensure that the designated State unit, in collaboration with the local educational agencies involved, provide, or arrange for the provision of, pre-employment transition services for all students with disabilities, as defined in ?361.5(c)(51), in need of such services, without regard to the type of disability, from Federal funds reserved in accordance with ?361.65, and any funds made available from State, local, or private funding sources.EffectBy not expending earmarked funds as required, DHS increases the risk that Tennessee students eligible to receive Pre-ETS services will not receive services that could help them pursue opportunities to live more independently, including jobs and higher education.Additionally, federal regulations address actions that federal agencies may impose in cases of noncompliance. According to 2 CFR 200.339, ?If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? as described in Section 200.208, ?Specific conditions,?1. Requiring payments as reimbursements rather than advance payments;2. Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period;3. Requiring additional, more detailed financial reports;4. Requiring additional project monitoring;5. Requiring the non-Federal entity to obtain technical or management assistance; or6. Establishing additional prior approvals.Also, 2 CFR 200.339 states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:a. Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.b. Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.c. Wholly or partly suspend or terminate the Federal award.d. Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).e. Withhold further Federal awards for the project or program.f. Take other remedies that may be legally available.RecommendationThe Commissioner of DHS should ensure that Vocational Rehabilitation program management and staff continue to focus their efforts on increasing Pre-ETS spending to provide more services to disabled students in Tennessee.Management?s CommentWe concur.The Vocational Rehabilitation (VR) program continues to earmark the required 15% through its budgeting processes with the department?s budget team while working with community rehabilitation providers and Local Education Authorities (LEAs) to increase Pre-ETS availability through additional offerings outside the traditional school days including summer, evening or weekend sessions.As a result of previous efforts to address this finding and despite the challenges posed by the COVID-19 pandemic limiting access to students that required a significant pivot in service delivery to an online model during the 4th quarter of the state fiscal year, the department was still able to expend over 14% of the required 15% of the 2019 Vocational Rehabilitation final grant award for Pre-ETS and provide the required services to students across Tennessee.Additionally, beginning October 1, 2020, the department eliminated the local match requirement for LEAs that partner with the department through our Transition School to Work (TSW) contracts referred to as Third Party Cooperative Agreements (TPCAs) thereby increasing the allocation of each contract to 100% Pre-ETS earmark rather than the previous 78.7%. As a result of eliminating the local match requirement and LEA outreach efforts, the department increased the number of LEA contracted partners to provide Pre-ETS services by 9 to a total of 58 LEAs for federal fiscal year 2020 and is projected to be on track to expend the required 15% of the final grant award on Pre-ETS.

Finding Number 2020-017CFDA Number 93.575, and 93.596Program Name Child Care and Development Fund ClusterFederal Agency Department of Health and Human ServicesState Agency Department of Human ServicesFederal Award Identification Number 1801TNCCDF, 1901TNCCDF, 2001TNCCDF,and 2001TNCCC3Federal Award Year 2018 through 2020Finding Type Significant Deficiency and NoncomplianceCompliance Requirement Allowable Costs/Cost PrinciplesRepeat Finding 2019-025Pass-Through Entity N/AQuestioned Costs $979As noted in the four prior audits, the Department of Human Services did not ensure that child care providers maintained adequate documentation of child care services, resulting in federal questioned costsBackground and Current ProcessThe Department of Human Services (DHS) is permitted to use the federal Child Care and Development Fund (CCDF) to fund its Child Care Certificate Program, which provides child care assistance to low-income families to allow them to work and/or attend school, and to promote the physical, emotional, educational, and social development of children. DHS?s Family Assistance and Child Care Services staff are responsible for determining children?s eligibility for child care services. Parents receiving assistance through the Child Care Certificate Program may enroll their children in any child care provider of their choice. In order to receive payments for child care services through the Child Care Certificate Program, the providers must sign a provider agreement and comply with the program?s requirements.Child Care Provider Payment ProcessChild care providers must submit Enrollment Attendance Verification (EAV) (See Schedule of Findings and Questioned Costs for footnote) forms (electronically or via mail) in order to receive payment for child care services. Providers are paid the weekly rates determined by DHS, depending on various factors such asthe child?s age,the type of child care facility,the provider?s location within the state,whether the child care is full- or part-time,the child?s school enrollment, andthe provider?s participation in the star-quality rating program.DHS pays providers a higher reimbursement rate for younger children, who require longer hours of child care, and for school-age children when school is not in session (including holidays). DHS also supports the providers? fixed costs of child care services by providing the full payment as long as the child maintains an enrolled status and has not exceeded 20 consecutive days of being absent from the program. Once the absence allowance is exceeded, DHS continues payment to the provider, while following up with the child?s family to determine whether the child should be terminated from the Certificate Program.When providers submit EAV forms, fiscal services staff pay the providers based on each child?s daily rate and the number of days in the EAV payment cycle.DHS?s Oversight of Federal Award ActivitiesDHS is responsible for overseeing the operations of the federal award and must monitor providers? activities to assure compliance with federal requirements and performance expectations, as stated in Title 45, Code of Federal Regulations (CFR), Part 75, Section 342. DHS?s oversight includes local office staff, fiscal staff assigned to DHS from the Department of Finance and Administration, and Audit Services staff.The local DHS office staff are responsible for updating all school district calendars (noting which days schools are in session, out of session, or out for holidays) and loading the providers? rates (which are established for each eligible child) in the child care information systems Tennessee Licensed Care System (TLCS) and Tennessee Child Care Management System (TCCMS). Based on this data, the system generates provider payments for child care services provided.Upon receipt of a provider?s EAV, fiscal staff review the EAV for reasonableness and irregularities before approving the provider?s reimbursement. As support for the EAVs, DHS requires each provider to maintain at its location the attendance documentation (sign-in/sign-out sheets) for the past five years.DHS?s Provider Monitoring ActivitiesDHS?s Audit Services staff are responsible for monitoring child care providers to ensure they comply with the terms of the provider agreement and with federal and state rules and regulations. As part of their monitoring activities, Audit Services staff compare providers? EAVs to their attendance documentation (sign-in/sign-out sheets). Audit Services staff issue a report with a finding and question a provider?s reimbursed costs when they identify differences between the attendance documentation and the EAV and/or when the provider has not maintained the required documentation. When Audit Services staff note deficiencies, the provider must complete a corrective action plan (CAP). The provider has 15 calendar days from the date the report is issued to complete the CAP and return it via email to the Child Care Compliance unit. The Program Coordinator for the Child Care Compliance unit is responsible for reviewing the CAP and approving or accepting it as noted by an authorized signature.Additionally, program evaluators conduct both announced and unannounced visits to providers throughout the year. As part of their visit, program evaluators inspect the sign-in/sign-out sheets to ensure they are completed properly. The program evaluators document their visits and reviews on a checklist and in the TLCS system.Other CCDF Program ResponsibilitiesDHS is also responsible for planning and administering child care quality improvement activities for the CCDF program. DHS contracts with various agencies, Tennessee higher education entities, and state departments to provide training and technical assistance to parents, caregivers, and child care providers. CCDF program staff are responsible for monitoring the contractors to ensure they comply with the terms and conditions of agreements.Prior Audit ResultsThe prior audit determined that DHS management had not ensured that child care providers had adequately documented their services and, therefore, we questioned federal costs. DHS management concurred that the costs noted in the prior audit finding were not allowable and commented that the child care licensing and certificate staff?s monitoring efforts to ensure providers complied with documentation requirements. Management?s comments did not address whether they considered these monitoring efforts sufficient to ensure that providers were compliant. Moreover, management did not include any new actions relative to the lack of documentation, other than to recover the questioned costs noted in the prior finding. Management did state that they were exploring a new attendance tracking and payment processing system. That system was not implemented at the time of our current audit.The prior audit also determined that a contractor had charged unreasonable costs to the department. Management stated that they would require the contractor to revise its fiscal policies and would also work to recover any disallowed costs. Our follow-up during the current audit did not note any issues with contractors.Condition and CauseTo determine if management followed program requirements, we tested a nonstatistical, random sample of 60 (See Schedule of Findings and Questioned Costs for footnote) child care expenditures from July 1, 2019, to June 30, 2020, totaling $7,875,201, from a population of 103,906 transactions, totaling $217,757,017. We requested attendance documentation from the child care providers and supporting documentation from contractors to support child-care-related costs.To determine if the department?s monitoring activities were effective in identifying providers that had not adequately documented attendance for which they request reimbursements, we tested both Audit Services? monitoring activities and the program evaluators? inspection of providers. Audit Services released 19 monitoring reports of child care certificate providers during our audit period. We tested all 19 to determine if the documentation in Audit Services? working papers supported the reports? conclusions regarding the providers? attendance documentation. If the monitoring report noted a finding regarding attendance documentation, we requested the corrective action plan (CAP) from the department?s Child Care Compliance unit to determine if the plan had been received and properly accepted by the department.We also selected a nonstatistical random sample of 60 licensed child care providers and all 27 non-licensed providers. We then examined the program evaluators? documentation of their announced annual visits to determine if they examined the provider?s sign-in/sign-out sheets to determine if they were being properly used.Child Care Providers Did Not Maintain Adequate Attendance DocumentationBased on our testwork, for 2 of 46 provider payments tested (4%), we noted that DHS did not ensure that child care providers maintained adequate documentation of child care services. We found that for the two errors noted, although the providers maintained some attendance documentation, the documentation was not adequate to support the providers? reimbursement requests. Specifically, we noted the following problems with the attendance documentation:The provider had no sign-in/sign-out sheets for the children on the EAV. There was no evidence that the children were enrolled or were in attendance for the period for which the provider submitted attendance verification for reimbursement.The provider was missing several sign-in sheets for the children during the submitted EAV period.We questioned a total of $979 in federal funds for the days for which the child care providers did not maintain adequate documentation to support child care services. When we projected our sample errors to the population of child care provider reimbursements, the projection calculation triggered the federal finding reporting requirement. Requirements in 2 CFR 200.516(a)(3) instruct us to report questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program.Despite the repeated findings, management has relied solely on the inspections completed by Licensing and Audit Services to certify that providers maintain accurate and complete documentation to support charges to the CCDF Grant. We found, however, that the monitoring processes DHS uses to confirm compliance with federal regulations are not adequate to ensure that child care providers maintain adequate documentation (see Condition B). Management stated that they were continuing to explore a new attendance tracking and payment management system as part of a modernization plan.DHS Did Not Follow Its Monitoring Procedures for Corrective Action PlansWe examined the department?s internal controls to determine if they were effective to ensure providers maintained the required documentation. According to the department?s December 2019 Financial Integrity Act Risk Assessment, both the Audit Services Division and program evaluators perform monitoring visits to ensure sound fiscal management of program funds.The Audit Services Division issued 19 child care provider monitoring reports during our audit period. Based on our review of all 19 monitoring reports, we found that in all reports, monitors reported that the providers had insufficient attendance documentation. As a result, these monitored child care providers were required to complete a CAP, which is due 15 days after the report is issued.Based on our testwork, we found for 17 of 19 providers (89%), management did not ensure corrective action was taken. Specifically,7 providers did not submit the CAP to the department (as of January 21, 2021, these providers were between 205 and 554 days late); andDHS CCDF program management had not indicated with an authorizing signature that they had accepted 10 provider CAPs, and thus it is unclear that program management is pursuing corrective action by these 10 providers.According to the Director of Compliance, child care agencies contracting with the state did not submit a CAP in response to an audit review. Monitoring and management of CAPs was transferred to Child Care Compliance during the audit period immediately prior to the emergence of COVID-19, and Child Care Compliance staff need to follow up and monitor corrective action.Risk AssessmentWe reviewed DHS?s December 2019 Financial Integrity Act Risk Assessment and determined that management listed the risk of departmental noncompliance with program requirements as a risk; however, the control was not operating effectively to mitigate its risk.CriteriaAccording to 45 CFR 98.90,(d)(1) Lead Agencies and subgrantees shall retain all CCDF records, as specified in paragraph (c) of this section, and any other records of Lead Agencies and subgrantees that are needed to substantiate compliance with CCDF requirements, for the period of time specified in paragraph (e) of this section....(e) Length of retention period. (1) Except as provided in paragraph (e)(2) of this section, records specified in paragraph (c) of this section shall be retained for three years from the day the Lead Agency or subgrantee submits the Financial Reports required by the Secretary, pursuant to ?98.65(g), for the program period.In addition, Section A.8 of the provider agreement states,The Contractor (Provider) shall maintain documentation of daily attendance, hours and location of each child as required by the Department.a. The Provider shall document attendance by requiring each child to be signed in and out by an authorized person whose name is listed in the child?s record. The authorized person shall not be an employee of the Provider unless such person is the child?s legal guardian.b. The Provider understands and agrees that acceptable forms of documentation may include the following, but that the Department may, at its sole discretion, require different or additional form(s) of documentation of a child?s daily attendance:A daily attendance (sign in and out) record of the printed and legal signature of each individual authorized to pick up and/or drop off the child must be maintained. Each child listed must be on separate lines. Parent/guardian and/or signatures of individuals authorized to pick up and/or drop off the child should be located in the child?s file. Initials or nicknames are not acceptable as signatures on the attendance sheets/logs. If the Provider uses an electronic process, each person signing the child in and/or out should have a unique code or identifier on-site at all times. . . .g. The Provider further agrees that any failure to maintain such files at such location and to produce all such files immediately when requested by the Department or any other agency of the state or federal government may result in the denial of any and all payments for child care services for any children for whom payments may be or have been requested under this Contract.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides guidance to management for using quality information to achieve the entity?s objectives. The Green Book provides general guidance and standards regarding the concepts of internal controls that may be applied to specific areas. These standards can be used as best practices when assessing and designing internal controls.According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.09 ?When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions.Additionally, according to Principle 16, ?Perform Monitoring Activities,?16.01 Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results?. Additionally, Principle 16.04 states that ?management monitors the internal control system through ongoing monitoring and separate evaluations. Ongoing monitoring is built into the entity?s operations, performed continually, and responsive to change. Separate evaluations are used periodically and may provide feedback on the effectiveness of ongoing monitoring?16.09 Management evaluates and documents the results of ongoing monitoring and separate evaluations to identify internal control issues. Management uses this evaluation to determine the effectiveness of the internal control system. Differences between the results of monitoring activities and the previously established baseline may indicate internal control issues, including undocumented changes in the internal control system or potential internal control deficiencies.EffectDHS cannot ensure that providers are reimbursed correctly without carefully reviewing provider documentation and ensuring providers respond timely to any deficiencies noted during an inspection. Our results indicate that DHS is not adequately monitoring providers and following up on results of providers with deficiencies. When DHS does not ensure child care providers maintain adequate and complete documentation, management cannot ensure that payments to child care providers are for actual services. Without effective controls to ensure compliance, DHS increases its risk of noncompliance, errors, fraud, waste, and abuse.RecommendationThe Deputy Commissioner of Programs and Services should ensure that child care providers maintain sign-in/sign-out sheets in accordance with the provider agreements to support the services provided. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls. This includes ensuring staff monitor the status of any corrective action that providers are required to take following a monitoring visit. Staff should be assigned to ensure the providers submit their corrective action plans timely and work with them to fully correct any issues.Management?s CommentChild Care Providers Did Not Maintain Adequate Attendance DocumentationWe concur.The Department requires child care providers participating in the Child Care Certificate Program to maintain attendance documentation monitored during on-site visits by Child Care Licensing. Child care providers contracting with the Department did not fully adhere to document retention contract requirements. For the two (2) child care providers where this situation was found, the Department will issue management decision letters to recover any disallowed costs and establish corrective action before June 30, 2021. The Department is in the process of developing a new attendance tracking, billing and payment system as part of child care modernization that is expected to be implemented before December 31, 2021.DHS did not follow its monitoring procedures for corrective action plans.We concur.The time period covered in the audit was July 01, 2019 to June 30, 2020. During the audit period, the Department implemented procedures for reviewing, accepting, and monitoring contractor corrective action plans in January 2020. Child Care Compliance is reviewing contractor corrective action plans received by the Office of Inspector General and following up to assure successful implementation of appropriate corrective action. The Department is in the process of the child care modernization that will further address these issues.

Finding Number 2020-018CFDA Number 93.575, and 93.596Program Name Child Care and Development Fund ClusterFederal Agency Department of Health and Human ServicesState Agency Department of Human ServicesFederal Award Identification NumberG1701TNCCDFFederal Award Year 2017Finding Type Material Weakness and NoncomplianceCompliance Requirement Matching, Level of Effort, EarmarkingRepeat Finding 2019-027Pass-Through Entity N/AQuestioned Costs N/AFor the fifth consecutive year, the Department of Human Services did not establish adequate internal controls over Child Care and Development Fund earmarking and did not comply with one earmarking requirementBackgroundThe U.S. Department of Health and Human Services (HHS) provides funds to states, territories, and Indian tribes to increase the availability, affordability, and quality of child care services through the Child Care and Development Fund (CCDF) cluster of programs. CCDF funds subsidize child care for low-income families where the parents are working or attending training or educational programs, as well as activities to promote overall child care quality for all children, regardless of subsidy receipt.CCDF consists of three funding sources: discretionary funds, mandatory funds, and matching funds. Additionally, under the Temporary Assistance for Needy Families program, a state may transfer funds to CCDF; the transferred funds are treated as discretionary funds.HHS requires the Tennessee Department of Human Services (DHS) to meet two earmarking requirements for CCDF: administrative earmarking and quality earmarking.Under the administrative earmarking requirement, a state may not spend more than 5% of the aggregate amount of discretionary, mandatory, and federal and state shares of the matching funds on administrative activities.Under the quality earmarking requirements for the CCDF award for federal fiscal year (FFY) 2017, a state must spend at least 7% of the aggregate amount of discretionary, mandatory, and federal and state shares of the matching funds on quality activities. For FFY 2018 and 2019, the minimum quality spending requirement increased to 8%; for FFY 2020, the minimum requirement was raised to 9%. In addition, beginning with the CCDF award for FFY 2017, a state must spend at least 3% of the aggregate amount of discretionary, mandatory, and federal and state shares of the matching funds on activities to improve the quality of care for infants and toddlers. For the 2017 grant award, 3% of the aggregate amount for the Infant and Toddler Quality Activities was approximately $3.5 million.Prior Audit ResultsThe Department of Finance and Administration (F&A) is responsible for performing all fiscal-related duties on behalf of DHS. During the prior audit, we found that F&A?s Controller for DHS fiscal activities and DHS?s Director of Child Care Services had not established adequate internal controls over earmarking, and program staff had not complied with the earmarking requirements for administrative costs and targeted funds (See Schedule of Findings and Questioned Costs for footnote). Management concurred with the finding related to inadequate internal controls over earmarking and noncompliance with the earmarking requirements, and they stated they had implemented internal controls beginning with the 2019 grant award, which closes in 2021.For our current audit, to determine whether fiscal staff and DHS complied with federal earmarking requirements, we tested earmarking expenditures charged to the CCDF grant award provided for the 2017 grant year since that grant closed during our audit period. Subsequent grant awards were still available for use as of the end of our audit period, June 30, 2020, so we did not include them in this year?s audit procedures. While management stated they implemented internal controls, since those controls were not in place for grant awards prior to the 2019 grant award, we could not test them as part of our audit work. We will test the effectiveness of these new controls in future audits of the program.Condition, Criteria, and CauseBased on our review of accounting records and discussions with program and fiscal staff, we found that F&A?s Controller and DHS?s Child Care Services Program Directors did not have adequate controls in place to ensure that DHS expended a minimum of 3% of its aggregate 2017 grant award expenditures on Infant and Toddler Quality Activities, resulting in a $1.1 million deficit in required Infant and Toddler Quality Activity expenditures.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to ?Appendix I: Requirements? of the Green Book, ?Management should design control activities to achieve objectives and respond to risks? and ?should implement control activities through policies.?Title 45, Code of Federal Regulations, Section 98.50(b)(2) states ?No less than three percent in fiscal year 2017 and each succeeding fiscal year shall be used to carry out activities at ?98.53(a)(4) as such activities relate to the quality of care for infants and toddlers.? See Table 1 for the amounts of deficit in meeting the required spending thresholds for infant and toddler quality activities.See Schedule of Findings and Questioned Costs for chart/table.Risk AssessmentWe reviewed DHS?s and F&A?s December 2019 Financial Integrity Act risk assessment for DHS operations and determined that management did assess the risk of noncompliance with earmarking and a mitigating control.Program management agreed that controls were not in place over the 2017 grant year award; however, management stated they have implemented controls over earmarking beginning with the 2019 grant year award that closes in 2021.According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. . . .7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions.EffectBy not establishing and maintaining effective internal controls to meet federal requirements, management increases the risk that management and staff?s noncompliance will not be prevented or detected and corrected timely. Additionally, because the federal fiscal year 2017 grant award closed as of September 30, 2019, management no longer has access to expend those funds. In effect, the department did not use all available federal funding to fulfill the grant?s purpose to improve the quality of care for infants and toddlers.Additionally, federal regulations address actions that HHS may impose in cases of the non-federal entity?s noncompliance. As noted in 45 CFR 75.371, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the HHS awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 75.207, ?Specific award conditions,?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.Furthermore, Section 75.371 also states,If the HHS awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the HHS awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:(a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the HHS awarding agency or pass-through entity.(b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.(c) Wholly or partly suspend (suspension of award activities) or terminate the Federal award.(d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and HHS awarding agency regulations at 2 CFR part 376 (or in the case of a pass-through entity, recommend such a proceeding be initiated by a HHS awarding agency).(e) Withhold further Federal awards for the project or program.(f) Take other remedies that may be legally available.RecommendationDHS?s Director of Child Care Services and F&A?s Controller for DHS fiscal activities should continue to evaluate any new controls they have implemented, monitor the compliance with the earmarking requirements, and ensure that the earmarking requirements are met. This process should include developing a spending plan and budget for the minimum amounts to ensure DHS meets the Infant and Toddler Quality Activities spending requirement. Additionally, management should develop policies and procedures for periodically monitoring expenditures to ensure DHS meets federal earmarking requirements within the required timeframe.Management?s CommentDHS Child Care Services ProgramWe concur.In response to the prior audit, the Department, along with the Department of Finance and Administration which provides fiscal services to the department, implemented a process in March 2020 to monitor captured quality contract expenses incurred for infant-toddler activities. Child Care Services and Fiscal Services management continue to meet quarterly to evaluate captured expenses, to review budget and spending strategies, to assure appropriate allocation of funds, and review earmarking calculation and requirements.DHS F&AWe concur.As indicated in the finding, F&A?s Controller and DHS management implemented a process to monitor the status of earmarked expenditures on a quarterly basis to help ensure compliance with earmarking requirements effective March 2020. Support related to the earmarking discussions was provided to the auditors as proof of implementation.

Finding Number 2020-019CFDA Number 93.575, and 93.596Program Name Child Care and Development Fund ClusterFederal Agency Department of Health and Human ServicesState Agency Department of Human ServicesFederal Award Identification Number 1801TNCCDF, 1901TNCCDF, 2001TNCCDF, and 2001TNCCC3Federal Award Year 2018 through 2020Finding Type Significant Deficiency and NoncomplianceCompliance Requirement EligibilityRepeat Finding 2019-028Pass-Through Entity N/AQuestioned Costs N/AAs noted in the prior four audits, the Department of Human Services did not consistently perform case reviews of eligibility determinations and redeterminations; the department also lacks sufficient internal controls over manually adjusted rates, which resulted in incorrect payments to child care providersBackgroundThe Tennessee Department of Human Services (DHS) administers the Child Care and Development Fund (CCDF), a federal program that provides subsidies for child care. CCDF funds the state?s Child Care Certificate Program, which helps Families First (Temporary Assistance for Needy Families) participants, parents transitioning from the Families First program, teen parents, and other individuals obtain child care. To participate in the Child Care Certificate Program, children must be declared eligible by DHS staff or, for children in foster care or protective services, by Department of Children?s Services staff. In addition to income limits and other eligibility requirements, children must be under the age of 13 to participate in the program, unless they are incapable of self-care or are under court supervision.Child care providers request payment for services on a biweekly, semimonthly, or monthly basis by submitting child care Enrollment Attendance Verification forms for eligible children. DHS Division of Fiscal Services staff use the forms, in conjunction with provider and client eligibility data, to process payments to each provider.Under CCDF requirements, DHS is responsible for establishing child care provider payment rates and parent co-pay fees. DHS publishes a schedule of parent co-pay fees, which are based on household size and monthly income. DHS also publishes a schedule of provider payment rates, which are based on a variety of factors, including the county where services are provided, the age of the child in care, and the type of child care provider. Providers? payment rates are also affected by the providers? star-quality rating (See Schedule of Findings and Questioned Costs for footnote).DHS groups all counties in Tennessee into eight districts. Program staff within each district conduct case reviews throughout the year to ensure that DHS?s eligibility determinations for children are completed accurately and timely. Each month, the Child Care Compliance Division provides a random sample of cases per child care specialist, along with a link to a SurveyMonkey tool, to field supervisors for review (See Schedule of Findings and Questioned Costs for footnote). The sample includes both original eligibility determinations and redeterminations. Management uses the SurveyMonkey tool to record the results of the case review. The survey uses a point system to assign the case reading score, which denotes the child care specialist?s performance. When evaluating performance, division staff deduct points for any errors the child care specialist made during the determination or redetermination process. Division staff compile the results for scoring so that management and field supervisors can review the scores and discuss areas for improvement with the child care specialist during a monthly conference.Provider Payment RatesAccording to the Department of Finance and Administration?s Senior Business Analyst, when the Information Technology (IT) Division enters a new state provider rate in TCCMS, the payment calculation process uses this default rate and applies the default to all providers, unless there is a negotiated rate or provider exception rate (See Schedule of Findings and Questioned Costs for footnote), which must be manually entered. If a provider charges an amount lower than the state rate, TCCMS creates an exception, which has to be manually adjusted. The Tennessee Licensed Care System (See Schedule of Findings and Questioned Costs for footnote) notifies the child care specialist of providers that need manual adjustments in TCCMS based on how they are designated in the system. The child care specialist is then supposed to manually enter the correct rate into TCCMS.Because DHS determines the providers? payment rate for each child depending on various factors (such as the child?s age, whether school is in or out, and the provider?s quality rating) and because those factors can change periodically, it is critical that management?s internal control processes, such as the monthly case reviews, are properly designed and implemented to help management identify and correct instances of incorrect payments.Prior Audit ResultsWe reported in the prior audit, and management concurred, that DHS staff did not consistently perform case reviews of eligibility determinations and redeterminations and did not ensure staff calculated and made payments to child care providers in accordance with program requirements. Management stated that a new case reading tool would assist management and supervisors with the case file reviews across all categories of child care payment assistance and that long-term workflow technology tools would strengthen the case review process. Management also stated that they would explore a new payment system as part of child care modernization and have and will continue to conduct trainings as needed. According to the Director of Compliance, as of August 2020, supervisors now use a new tool called Formstack (See Schedule of Findings and Questioned Costs for footnote) to perform case reviews. DHS is working with a third-party contractor to implement a new payment system, with a target date of September 2021.Overall Condition and CauseTo determine if DHS complied with federal eligibility requirements for children receiving subsidized child care, we obtained a list of all eligible individuals and related child care provider payments, along with certain individual eligibility information contained in TCCMS, for the period July 1, 2019, through June 30, 2020, and performed procedures as detailed below. Based on the results of our testwork, we found that the Child Care Services Director did not ensure that program staff consistently performed case reviews of eligibility determinations and redeterminations. We also found that the Child Care Services Director did not ensure that manually entered provider rates were reviewed and did not ensure that staff calculated and made payments to child care providers in accordance with program requirements. Our testwork covered a period before DHS implemented the new case reading tool and system mentioned above.Condition A: Internal Controls Over Case Reviews Were Not Applied Consistently as Required by the CCDF State PlanBased on our discussion with program staff, as well as our review of the CCDF State Plan, DHS?s supervisory case review process is management?s key internal control to ensure staff perform eligibility determinations and redeterminations appropriately. As part of the CCDF State Plan, supervisors of the child care specialists who make the eligibility determinations are required to perform random monthly case reviews of at least 5 eligibility determination or redetermination cases assigned to each employee to ensure the determinations were accurate.We identified 31 employees who were responsible for conducting eligibility determinations and redeterminations for the Child Care Certificate Program during the scope of our audit. For each of the 31 employees, we selected a random, nonstatistical month and reviewed the employee?s assigned cases to determine if the employee?s supervisor performed at least 5 case reviews for the selected month.Based on our testwork, we noted that for 4 of 31 employees (13%), the supervisors did not perform at least 5 CCDF eligibility determination and/or redetermination case reviews for the month we tested. For 2 of the 4 employees, supervisors did not review any cases for the selected month. According to the Director of Compliance, the supervisors did not consistently perform the required number of reviews.Condition B: Incorrect Payment Rate Calculations and No Internal Controls to Review Manually Entered Provider RatesFrom a population of 49,659 eligible individuals with payments totaling $166,050,134 for the Child Care Certificate Program from July 1, 2019, through June 30, 2020, we selected a nonstatistical, random sample of 60 eligible individuals to determine whether program staff calculated and paid provider payments in accordance with program requirements. Specifically, we recalculated the expected payment amount for each provider for the eligible child based on the child?s age, the provider?s quality rating, the type of provider, and the other factors DHS used to determine the payment amount.Based on our testwork, we determined that for 10 of 60 eligible children tested (17%), DHS supervisors or management did not ensure that program staff correctly calculated provider rates in accordance with program requirements, resulting in underpayments to the 10 providers totaling $3,928. According to the Director of Compliance, 5 of the errors were due to program staff manually entering rates into TCCMS due to a negotiated rate or provider exception rate; however, management did not provide a cause for the remaining 5 errors.Based on our discussion with the Child Care Certificate Director, management does not have a process in place to review manually entered rates, and according to the Senior Business Analyst, management does not have the ability to run a report showing which providers received a manually entered negotiated rate or rate exception. Additionally, the Senior Business Analyst stated that the manually entered rates do not go through the quality assurance process the IT Division uses to ensure the default rates are correct.CriteriaCriteria for Internal Controls Over Case ReviewsThe U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides guidance to management for using quality information to achieve the entity?s objectives. According to Principle 13, ?Use Quality Information,?Management processes the obtained data into quality information that supports the internal control system. This involves processing data into information and then evaluating the processed information so that it is quality information. Quality information meets the identified information requirements when relevant data from reliable sources are used. Quality information is appropriate, current, complete, accurate, accessible, and provided on a timely basis. Management considers these characteristics as well as the information processing objectives in evaluating processed information and makes revisions when necessary so that the information is quality information. Management uses the quality information to make informed decisions and evaluate the entity?s performance in achieving key objectives and addressing risks.According to Title 45, Code of Federal Regulations (CFR), Part 98, Section 68(a),Lead Agencies are required to describe in their Plan effective internal controls that are in place to ensure integrity and accountability, while maintaining continuity of services, in the CCDF program. These shall include . . . (iii) Quality control or quality assurance reviews.According to the CCDF State Plan, supervisory reviews and quality assurance reviews should be conducted to ensure accurate eligibility determinations.Federal Criteria for Incorrect RatesAccording to 45 CFR 98.67(a), ?Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds.?According to 45 CFR 98.11(b), ?In retaining overall responsibility for the administration of the program, the Lead Agency shall . . . [e]nsure that the program complies with the approved Plan and all Federal requirements.? The approved State Plan identifies the provider payment rates that the state has established; therefore, 45 CFR 98.11(b) requires DHS to adhere to its established provider payment rates.Criteria for No Internal Controls Over Manually Entered Provider RatesThe U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides guidance to management for designing control activities to achieve objectives and respond to risks. According to Principle 10, ?Design Control Activities,?10.02 Management designs control activities in response to the entity?s objectives and risks to achieve an effective internal control system. Control activities are the policies, procedures, techniques, and mechanisms that enforce management?s directives to achieve the entity?s objectives and address related risks. As part of the control environment component, management defines responsibilities, assigns them to key roles, and delegates authority to achieve the entity?s objectives. As part of the risk assessment component, management identifies the risks related to the entity and its objectives, including its service organizations; the entity?s risk tolerance; and risk responses. Management designs control activities to fulfill defined responsibilities and address identified risk responses.EffectUnless DHS establishes and implements adequate controls to ensure the accuracy of CCDF Child Care Certificate Program eligibility determinations, DHS increases the risk of paying child care providers for services rendered to ineligible program participants. By improperly applying the state?s child care provider payment rate and lacking a review process for manually entered provider rates, DHS also increases the risk of under- or overpaying providers.RecommendationRecommendation for Internal Controls Over Case ReviewsThe Commissioner should ensure that DHS?s internal controls are adequately designed and operating effectively to prevent or detect incorrect provider payments. The control process should include ensuring that supervisors perform and document each employee?s monthly eligibility case reviews related to eligibility determinations and redeterminations, as required by federal regulations and the CCDF State Plan.Recommendation for Incorrect RatesThe Director of Operations for CCDF should ensure that program staff enter the correct provider payment rates for eligible children into TCCMS.Recommendation for Manual Entry of Provider RatesThe Commissioner should implement supervisory review controls to ensure child care specialists manually enter accurate provider rates. The control process should include ensuring supervisors perform and document a review of manual entries.Management?s CommentCondition A: Internal Controls Over Case Reviews Were Not Applied Consistently as Required by the CCDF State PlanWe concur.The time period covered in the audit was July 01, 2019 to June 30, 2020. As acknowledged by the auditors, implementation of the Department?s modified case reading tool occurred after the audit period in August 2020. The Department will continue to strengthen its internal controls for consistent application through training and performance management.Condition B: Incorrect Payment Rate Calculations and No Internal Controls to Review Manually Entered Provider RatesWe concur.As noted in its response to the prior audit, the Department is aware of the potential for errors that may result from manual data entry in the current payment system. The time period covered in the audit was July 01, 2019 to June 30, 2020. Since that time, the Department has revised the terms of its child care provider contracts thereby eliminating manual rate adjustment. The Department is in the process of child care modernization that will further address these issues.

Finding Number 2020-020CFDA Number 93.575, and 93.596Program Name Child Care and Development Fund ClusterFederal Agency Department of Health and Human ServicesState Agency Department of Human ServicesFederal Award Identification Number 1801TNCCDF, 1901TNCCDF, and 2001TNCCDFFederal Award Year 2018 through 2020Finding Type Material Weakness and NoncomplianceCompliance Requirement Special Tests and ProvisionsRepeat Finding 2019-029Pass-Through Entity N/AQuestioned Costs N/AAs noted in the four prior audits, Department of Human Services program staff did not comply with health and safety requirements for child care providers, and the Department of Human Services and the Department of Education had an inadequate review processBackgroundThe state?s Child Care Certificate Program, which is funded by the Child Care and Development Fund (CCDF), assists Families First participants, parents transitioning off Families First, teen parents, and other individuals to obtain child care. To participate in the program, children must be declared eligible by Department of Human Services (DHS) staff or, for children in foster care or protective services, by Department of Children?s Services staff. DHS establishes various child care provider payment rate schedules based on a variety of factors, including the county where services are provided, the age of the child in care, and the type of child care provider. Providers? payment rates are also affected by the providers? star-quality rating (See Schedule of Findings and Questioned Costs for footnote). DHS staff use the criteria in the payment rate schedules to assign a payment rate for each child. When providers submit Enrollment Attendance Verification forms, Fiscal Services staff pay the providers based on each child?s payment rate and the number of days the child received child care services.Under the CCDF Block Grant and Title 45, Code of Federal Regulations (CFR), Part 98, Section 41, lead agencies have significant responsibility for ensuring the health and safety of children in child care through the state?s child care licensing system and for establishing health and safety standards for children who receive CCDF funds. Also, 45 CFR 98.2 defines a lead agency as the legal entity to which the grant funds are awarded, which is the state. For Tennessee, DHS is the lead agency responsible for administering the program. The Department of Education (DOE) shares some responsibility with DHS for monitoring child care providers, which is reflected in a Memorandum of Agreement. Federal regulations in effect during the audit period did not specify how many site visits providers must receive, so DHS and DOE each followed their own internal policies.Under program regulations, child care providers are classified as either licensed or non-licensed. Licensed providers consist of group homes, centers, or family day cares. Non-licensed providers consist of Authorized Child Care Professionals, Boys and Girls Clubs, and DOE (See Schedule of Findings and Questioned Costs for footnote). DOE policy establishes that staff are responsible for monitoring the approved providers that meet certain education requirements by performing one announced and one unannounced site visit per provider per school year. In accordance with the terms of the Memorandum of Agreement, DOE staff enter their monitoring data into the Tennessee Licensing Care System (TLCS) (See Schedule of Findings and Questioned Costs for footnote) and contact DHS management in the event of a major violation (See Schedule of Findings and Questioned Costs for footnote). DHS is responsible for monitoring all other providers in the state. DHS policy requires Child Care Program Evaluators to perform announced and unannounced visits per provider licensing year (See Schedule of Findings and Questioned Costs for footnote) and to complete a child care evaluation form, which includes health and safety checks, for each visit. Providers must receive at least one announced visit per licensing year, and the number of unannounced visits per licensing year is determined by the provider?s star rating and any complaints received. Program evaluators complete health and safety checklists upon a non-licensed provider?s initial enrollment and annually thereafter.Additionally, based on discussion with DHS?s CCDF staff, some children who are eligible for CCDF and live in Tennessee may receive day care services from providers located in other states. If the provider is licensed by another state, CCDF staff collect the licensing information to ensure the provider meets health and safety requirements. DHS does not accept non-licensed out-of-state providers.Emergency Preparedness Plans45 CFR 98.1(a)(1) requires providers to maintain an emergency preparedness plan, which includes specific health and safety requirements. These plans assist providers with emergency planning caused by natural disasters or emergencies and include procedures for evacuating, sheltering in place and locking down, staff training and drills, and reuniting children with their families.On April 3, 2020, the U.S. Department of Health and Human Services (HHS) issued DHS a Preliminary Notice of Possible Non-Compliance, alerting management of possible noncompliance with the emergency preparedness plans. HHS specifically notified management that ?The Lead Agency does not have all of the requirements in place for CCDF-funded providers (appropriate to provider setting and age of children served) that include emergency preparedness and response planning.?Waiver Due to COVID-19 PandemicDHS received a waiver from HHS?s Administration for Children and Families to suspend in-person monitoring beginning March 2020 due to the COVID-19 pandemic and to submit an amended state plan. The federal waiver will remain in place until 60 days following the end of the state of emergency declared by the State of Tennessee, with a maximum duration until March 3, 2021. Our audit did not include monitoring visits that were suspended based on these waivers.Additionally, on March 3, 2020, the Middle Tennessee region experienced a tornado that destroyed a DHS office building in Nashville. According to program management, this building contained records of visits of some providers in our testwork sample that could not be located. We exempted these providers from our testwork and did not include this missing documentation as errors in our audit conclusions.Prior Audit ResultsIn the prior finding, we found that DHS staff did not complete the entire health and safety checklist for unregulated providers due to an inadequate supervisory review process (See Schedule of Findings and Questioned Costs for footnote). Additionally, DHS management did not ensure staff recorded licensing documentation for out-of-state providers. We also found that DOE did not perform supervisory reviews of the health and safety monitoring activities for the providers assigned to their supervision. DHS concurred with the prior finding and stated that Child Care Certificate Program management conducted training on expectations for completing health and safety checklists for unregulated providers in fall 2019. DHS also stated that the Child Care Certificate Program Director would monitor out-of-state license updates to ensure staff complete the updates in a timely manner. DOE management concurred with the prior finding and stated that beginning in January 2019, management implemented additional internal controls, including documenting supervisory approval and obtaining additional documentation to verify all sections of the health and safety checklist.Condition and CauseTo determine if management followed CCDF program requirements, we selected a nonstatistical, random sample of 60 licensed child care providers; all 27 non-licensed providers; and a nonstatistical, random sample of 60 DOE providers, to determine if DHS and DOE staff complied with CCDF?s health and safety requirements for providers. For each provider, we tested whether DHS and/or DOE program evaluators performed health and safety evaluations and documented the results of the visits, and whether management ensured that monitoring activities included supervisory reviews of the staff?s performance. We also tested providers? emergency preparedness plans to ensure providers complied with health and safety requirements. Based on our testwork, the departments did not ensure CCDF child care providers complied with the applicable health and safety requirements (see Conditions A and B).We also performed testwork to determine if DHS management ensured providers? emergency preparedness plans contained all the health and safety requirements after DHS received the Preliminary Notice of Possible Non-Compliance from HHS on April 3, 2020. We requested the emergency plans for licensed, non-licensed, and DOE-approved child care providers to review and determine if the plans contained all the necessary requirements. We found that providers did not include all health and safety requirements in their plans (see Condition C).Condition A: Staff Did Not Consistently Document That Licensed Providers Met Health and Safety RequirementsBased on our testwork, we found that for 3 of 60 (5%) visits conducted for licensed providers, program evaluators did not document whether providers met or failed to meet 1 or more of the 11 health and safety requirements. The monitors? description of their visit or the monitoring and evaluation checklist did not include all 11 required areas, and the supervisory review of the monitors? documentation did not identify the deficiencies in the descriptions or checklists. Our testwork results involved documentation deficiencies involving storage and disposal of hazardous materials and emergencies due to food and allergy reactions.We were told by a licensing supervisor that at each announced and unannounced visit, the program evaluator should evaluate health and safety requirements. Based on our testwork, we found inconsistencies in how the evaluators documented their evaluations of health and safety requirements. Specifically, we found the program evaluatorsdid not document evaluation results,documented evaluation results within the visit record in the system, anddocumented evaluation results on a checklist maintained outside the system.Given these inconsistencies, we are unsure how management ensures that program evaluators are sufficiently performing and documenting the health and safety evaluations.Condition B: DOE Staff Did Not Document That DOE-Approved Providers Met Health and Safety RequirementsBased on our testwork, for 44 of 60 (73%) visits conducted for DOE-approved providers, program evaluators did not document whether providers met or failed to meet 1 or more of the 11 health and safety requirements. The monitors? descriptions of their visits did not include all 11 required areas, and DOE did not take proper action to address child care providers? noncompliance with the applicable health and safety requirements. We found that 3 of 60 (5%) providers tested had a major violation during our period. DOE evaluators did not inform DHS management of the major violations for these 3 providers, as required by the Memorandum of Agreement, except to enter the violations into TLCS. Management stated they were not aware of this requirement in the agreement.We also noted that for 60 of 60 (100%) visits conducted by DOE staff, a supervisor did not properly document their review of the program evaluators? monitoring documentation; therefore, DOE management could not provide sufficient evidence that the supervisors reviewed the 11 health and safety requirements. According to the Senior Director of the Early Childhood Quality and Supports Early Childhood Education Division, management was unaware that reviewers needed to take additional steps in the system to properly document their review of a site visit.Condition C: DHS and DOE Staff Did Not Ensure That Providers Included All Required Areas of Disaster and Emergency Response in Their Emergency Preparedness PlansBased on our testwork, we determined that DHS and DOE management did not ensure that providers? emergency preparedness plans met all disaster and emergency response requirements including, but not limited to, accommodations for children with disabilities and chronic medical conditions. Specifically, we noted thatfor 48 of 54 (See Schedule of Findings and Questioned Costs for footnote) (89%) DHS licensed providers tested, we found that 40 providers did not meet all requirements, and the remaining 8 did not submit emergency preparedness plans;for 15 of 15 (100%) DHS non-licensed providers (See Schedule of Findings and Questioned Costs for footnote), we found that 3 providers did not meet all requirements, and the remaining 12 did not submit emergency preparedness plans; andfor 48 of 60 (80%) DOE certified providers tested, we found that 45 providers did not meet all requirements, and the remaining 3 did not submit emergency preparedness plans.According to the DHS Director of Compliance, DHS attempted but was unable to obtain emergency preparedness plans from some licensed and non-licensed providers. For those that were obtained, the Director of Compliance stated that the providers need technical assistance to ensure compliance. According to the DOE Senior Director of the Early Childhood Quality and Supports Early Childhood Education Division, management was unaware of each specific area of the plan that the federal regulations required.Risk AssessmentWe reviewed DHS?s December 2019 Financial Integrity Act Risk Assessment and determined that management listed the risk of not ensuring compliance with health and safety requirements; however, the controls identified were not operating effectively to mitigate the risk.CriteriaCriteria for All ConditionsThe U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. ?Appendix I: Requirements,? states, ?Management should design control activities to achieve objectives and respond to risks? and ?Management should implement control activities through policies.?The health and safety requirements for licensed and non-licensed child care providers are found in 45 CFR 98.41(a), which states,(a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to child care providers of services for which assistance is provided under this part. Such requirements, which are subject to monitoring pursuant to ?98.42, shall:(1) Include health and safety topics.Condition BAccording to the Memorandum of Agreement between Department of Education and Department of Human Services Concerning Monitoring Responsibilities for Child Care Development Fund Recipients,The Department of Education (DOE), in supporting DHS?s Implementation and monitoring for CCDF programs, is responsible for the following:Annual monitoring in accordance with the Rules of State Board of Education, Chapter 0520-12-01, Standards for School-Administered Child Care Programs to include health and safety requirements provided in Chapter 0520-12-10.Notifying DHS Child Care Certificate Program Director if any major health/safety violations occur in any CCDF participating schools as soon as practical.Encoding annual visits and violations in TLCS or other DHS child care licensing electronic case management system as soon as practical.In the event that DOE monitoring results in a substantiated health and safety violation, DOE will collaborate with DHS to address the violation and take appropriate action pursuant to T.C.A. 49-1-1101-1109 and the Rules of the State Board of Education, Chapter 0520-12-01.Condition CThe health and safety requirements for emergency preparedness plans are found in 45 CFR 98.41(a)(1)(vii), which states,Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a man-caused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5195(a)(1)) that shall include procedures for evacuation, relocation, shelter-in-place and lock down, staff and volunteer emergency preparedness training and practice drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions.According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions.EffectWhen management does not ensure that program evaluators properly review and document their review of provider health and safety requirements or that the providers? emergency preparedness plans include all required areas, children in the providers? care are subjected to potential health and safety risks.RecommendationDepartment of Human Services management should ensure that staff perform all child care provider site visits, including health and safety checks, in accordance with federal regulations and internal policy.Department of Education management should ensure that staff perform all child care provider site visits, including health and safety checks, in accordance with federal regulations and internal policy, and ensure that follow-up procedures are performed as required when staff note health and safety violations. Management should train supervisors on the proper procedures to document their supervisory reviews of the program evaluators.Both departments? managements should ensure that monitors determine if providers? emergency preparedness plans are complete and provide technical assistance when needed.Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentDepartment of Human ServicesCondition A: Staff Did Not Consistently Document That Licensed Providers Met Health and Safety RequirementsWe concur.The three (3) documentation errors noted by the auditors occurred prior to the Department?s revision of its tool for monitoring health and safety and mobile devices implementation in summer 2020, at which time all licensing program evaluators received training on the new tool, including consistency of practice for documentation. As part of child care modernization, the Department is exploring functionality with its new eLicensing system to support staff in meeting this expectation and to improve internal controls.Condition C: DHS and DOE Staff Did Not Ensure That Providers Included All Required Areas of Disaster and Emergency Response in Their Emergency Preparedness PlansWe concur.In its Preliminary Notice of Possible Non-Compliance to the Department on April 03, 2020, ACF identified emergency preparedness and response planning as an area of possible noncompliance. The Department?s response to ACF regarding emergency preparedness and response planning on May 29, 2020, was the following:The Lead Agency will revise the emergency preparedness checklist and template to include all elements specified within 45 CFR 98.41(a)(1)(vii) [evacuation, relocation, shelter-in-place and lock down, staff and volunteer emergency preparedness training and practice drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions]; and moving forward revise licensure rules for child care agencies to include any elements noted above that are not specifically addressed in the emergency preparedness statute (T.C.A. ? 71-3-517). The Lead Agency will include provisions for each of the specific missing requirements identified during the monitoring visit (shelter in place, lockdown, continuity of operations, accommodations of infants and toddlers, volunteer emergency preparedness training and drills). The aforementioned emergency preparedness checklist and template will be revised to coincide with the implementation of the mobile devices for use by all program evaluators (summer 2020). Licensing staff and providers will be trained on the use of the new tools in conjunction with implementation of the mobile devices.Consistent with its response, the Department revised its monitoring tool with the implementation of mobile devices for all licensing program evaluators who were trained on the tool before July 2020. An emergency preparedness checklist and template for child care providers were also revised to assure compliance with CCDBG requirements in November 2020. As part of child care modernization, the Department is exploring functionality with its new eLicensing system to support staff in meeting this expectation and to improve internal controls.Department of EducationWe concur. TDOE management will strengthen existing controls to ensure all child care provider site visits are performed in accordance with federal regulations and internal policy, including health and safety checks. When health and safety violations are noted, follow-up procedures will be performed as soon as practicable. Also, management will provide additional training to supervisors, stressing proper documentation procedures of supervisory reviews of program evaluators.Additionally, TDOE will ensure all providers not only submit appropriately documented emergency preparedness plans, but that each plan also fully meets all disaster and emergency requirements.Finally, management will assess the existing control structure placing an emphasis on implementing controls to be more effective in addressing the risks noted in this finding. Staff will be assigned to ensure risks are continually monitored and mitigating controls are continually assessed for effectiveness.

Finding Number 2020-021CFDA Number 17.225Program Name Unemployment InsuranceFederal Agency Department of LaborState Agency Department of Labor and Workforce DevelopmentFederal Award Identification Number UI-29869-17-55-A-47, UI-31319-18-55-A-47, UI-32627-19-55-A-47, UI-32730-19-55-A47, UI-32867-19-60-A-47, UI-34086-20-55-A-47, UI-34192-20-55-A-47, UI-34743-20-55-A-47, LWWTWKCOVIDFY20, LWEBCOVIDFY20, LWFPUCCOVIDFY20, LWPEUCCOVIDFY20, LWPUACOVIDFFY20, LWPCARESEURFY20, LWP100_PEBSFY10, LWP951STATEFY10, LWP953STATEFY10, LWPEUC895BSFY10, TUC-State ExpendituresFederal Award Year 2018 through 2020Finding Type Significant Deficiency and NoncomplianceCompliance Requirement EligibilityRepeat Finding N/APass-Through Entity N/AQuestioned Costs $6,000The Department of Labor and Workforce Development approved Unemployment Insurance claims without reviewing employers? disputing responses and did not provide written notice of claims determinations to interested partiesBackgroundThe Unemployment Insurance program is a federal-state partnership designed to ensure the economic security of workers who lose their jobs through no fault of their own. The U.S. Department of Labor provides grant funding for each state to design and administer its own Unemployment Insurance program within federal requirements. In Tennessee, the Division of Employment Security within the Department of Labor and Workforce Development (the department) operates the state?s Unemployment Insurance program to issue direct payments to individuals during times of involuntary unemployment.Employers pay quarterly state unemployment taxes into a trust fund from which the department distributes benefits to eligible claimants. Each employer?s unemployment tax rate is based in part on benefits collected by former employees. The department processes four general types of claims:Tennessee Unemployment Compensation, also known as ?regular? benefits, provides unemployment coverage for most of the state?s salary and wage earners.Combined Wage Claims are filed by workers who earned wages in Tennessee plus at least one other state.Unemployment Compensation for Federal Employees covers former employees of the U.S. government.Unemployment Compensation for Ex-servicemembers provides benefits to individuals separated from military service.Approval Process for Unemployment ClaimsAccording to state regulations, individuals filing Unemployment Insurance claims with the department must meet certain earnings (monetary) requirements from past employment and must be currently unemployed or earning less than the $275 maximum weekly benefit amount. The claimant must also meet other eligibility (non-monetary) requirements to qualify for benefits. In general, claimants must have separated from their most recent employer through no fault of their own. Claimants? circumstances generally fall into one of three non-monetary categories:1. lack of work ? the employer laid off the employee, or reduced his or her working hours;2. quit ? the employee voluntarily quit with just cause; or3. discharge ? the employer terminated the employee because of performance issues other than misconduct.To determine whether a claimant qualifies for benefits, the department sends a request letter to the separating employer notifying them of the claim and the reason the claimant gave for his or her separation. The employer has 7 days to respond to the letter to dispute the claim.Upon approving or denying a claim, the department sends a decision letter to the claimant and the employer explaining the reason for the determination and the parties? right to appeal the determination within 15 days of the decision letter?s mailing date. Claimants have the right to appeal if the department denies their claim for benefits. Likewise, employers may appeal approved claims to protect their state unemployment tax rate from future increases.Condition, Cause, and CriteriaSee Schedule of Findings and Questioned Costs for chart/table.We obtained the population of 4,972,913 Unemployment Insurance benefit payments that the department issued in fiscal year 2020. We grouped the payments by type of claim and selected a random, nonstatistical sample of each claim type (see Table 1) to test a total of 90 payments for compliance with eligibility requirements.See Schedule of Findings and Questioned Costs for chart/table.Decision Letters Not IssuedFederal regulations for each program require that the department provide written notice to all interested parties of each determination and redetermination of eligibility; however, we found that the department did not issue non-monetary determination letters (decision letters) to all claimants or separating employees. See the details in Table 2.See Schedule of Findings and Questioned Costs for chart/table.Based on our discussion with the Claims Center Director, not all claims require decision letters, such as lack-of-work claims that the claimant?s employer has verified. From management?s perspective, there is no question as to the claimant?s nonmonetary eligibility in these cases, so the department has no determination to communicate to the claimant and employer. We also found that when employers do not reply to a request for information related to a lack-of-work claim within 10 days, the unemployment system automatically approves the claim. The system, however, does not always generate and send a decision letter on an automatically approved lack-of-work claim without staff action.To ensure all parties are adequately notified of a claimant?s eligibility for benefits and have sufficient time to appeal, best practices dictate that the department should provide a written notice to the claimant and the claimant?s separating employer with the agency decision, even when that decision is system-generated.We did not question costs for this condition because the claimants were eligible for benefits, despite the absence of a decision letter.For Tennessee Unemployment Compensation, Section 50-7-304(b)(1)(B), Tennessee Code Annotated, states,The agency representative shall promptly give written notice to the claimant and all other interested parties of the nonmonetary determination and the reasons for the determination. The nonmonetary determination of the agency representative shall become final, unless an interested party files an appeal from the nonmonetary determination within fifteen (15) calendar days after the date of mailing of the written notification of the nonmonetary determination to the last known address of the party, or within fifteen (15) calendar days after the date the written notification is given to the party, whichever first occurs.Also, for Unemployment Compensation for Federal Employees, Title 20, Code of Federal Regulations (CFR), Part 609, Section 9, states,The provisions of the applicable State law which shall apply include, but are not limited to:(3) Notices to individuals and Federal agencies, as appropriate, including notice to each individual of each determination and redetermination of eligibility for or entitlement to UCFE [Unemployment Compensation for Federal Employees].Additionally, for Unemployment Compensation for Ex-servicemembers, 20 CFR 614.6(d) states,(1) The State agency promptly shall give notice in writing to the individual of any determination or redetermination of a first claim . . . Each notice of determination or redetermination shall include such information regarding the determination or redetermination and notice of right to reconsideration or appeal, or both, as is furnished with written notices of determinations and redeterminations with respect to claims for State unemployment compensation. . . .(2) A notice of claim filing and subsequent notices of monetary and nonmonetary determinations on a UCX [Unemployment Compensation for Ex-servicemembers] claim shall be sent to each Federal military agency for which the individual performed Federal military service during the appropriate base period, together with notice of appeal rights of the Federal military agency to the same extent that chargeable employers are given such notices under State law.System Failed to Identify Claims With Disagreeing Responses ClaimsFor 2 out of 60 (3%) Tennessee Unemployment Compensation payments tested, the department approved, without reviewing, claims in which the claimant and employer provided different reasons for separation (disagreeing responses). The claimants attested that they lost their employment due to lack of work, whereas their employers submitted disagreeing responses stating that the claimants had quit.The Claims Center Director said that for an unknown reason, the department?s unemployment benefits system experienced an issue and did not flag the claims as having disagreeing responses provided by the claimant and employer. Instead, the system automatically approved the claims.We questioned federal costs totaling $6,000 for this condition.Tennessee Unemployment Compensation regulations require the department to render a determination based on the issues presented and to transmit a decision upon the issues. Section 50-7-304(b)(1)(B), Tennessee Code Annotated, states,The agency representative shall then review the claim deemed valid monetarily and render a determination on the nonmonetary issues presented, except that in any case in which the payment or denial of benefits will be determined by ? 50-7-303(a)(4), the agency representative shall promptly transmit the agency representative's full findings of fact with respect to ? 50-7-303(a)(4) to the commissioner, who, on the basis of the evidence submitted and additional evidence that the commissioner may require, shall affirm, modify or set aside the findings of fact and transmit to the agency representative a decision upon the issues involved under ? 50-7-303(a)(4), which shall be deemed to be the nonmonetary determination of the agency representative.Risk AssessmentWe reviewed the department?s December 2019 Financial Integrity Act Risk Assessment and determined that management did not identify the risk of processing problems with the unemployment claims system, which led to improper claims determinations. Management did identify the risk of employees filing fraudulent claims and listed the agency decision letter sent to employers as the mitigating control; however, our testwork disclosed that this control was not operating effectively.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. . . .7.09 . . . When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions.EffectWhen department staff do not send written notifications of agency decisions of benefit determinations, claimants and employers may not be fully informed of the reason for the decision to approve or deny the claim for benefits. When the department does not send claimants and employers claims-related correspondence, the department increases the risk of paying benefits to claimants who are ineligible or have filed fraudulent claims.When the unemployment claims system does not flag claims with disagreeing responses for staff to review, the department increases the risk of paying benefits to claimants that should have been disqualified from receiving benefits. The department also risks improperly increasing the employer?s unemployment insurance tax liability.Questioned CostsThis finding, in conjunction with Finding 2020-022, resulted in total known federal questioned costs exceeding $25,000 for federal programs that were audited as major programs. When known questioned costs are greater than $25,000 for a type of compliance requirement for a major program, 2 CFR 200.516(a)(3) requires us to report those costs.According to 2 CFR 200.84, questioned costs are costs an auditor questions because the costs either (a) resulted from a violation or possible violation of federal requirements, (b) were not supported by adequate documentation, or (c) were unreasonable. To resolve this audit finding, department management will work with the federal grantor to determine the amount of any disallowed costs.RecommendationThe issues we identified in this finding included improper payments the department issued in the first three months of the COVID-19 pandemic. Without prompt corrective action, these problems may become more significant or pervasive as the department continues to handle increased claims volume into the 2021 fiscal year.The Commissioner and the Administrator for the Employment Security Division should direct the unemployment system vendor to configure the system to generate agency decision letters on all claim determinations, as required by state law and federal regulations. Management should also analyze the unemployment system?s benefit payment processes to identify the root cause of system processing errors, and ensure the vendor implements necessary updates to prevent the system from automatically approving claims with disagreeing responses instead of flagging the claims for staff review.Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur.With the massive influx of unemployment claims due to COVID-19, the department faced an impossible task of reviewing all unemployment claims. Because of the volume, the department relied on a system indicator to notify staff when a conflicting response is received from the separating employer. When a conflicting employer response is received, the system is supposed to prevent auto approval of the claim and stop payment until it can be reviewed by staff. Multiple tickets have been entered with the systems vendor over the past 4 years to correct issues with this functionality. The business rules were re-specified by the department in August 2020 and were implemented by the vendor in December 2020. The department continues to monitor the effectiveness of the new business rule.The department?s policy is that the system must generate determination letters on lack of work claims when there is not a response from the employer, and the system is designed to function in that way. This ensures that employers are notified of potential charges to their account in the event that they did not receive or did not see a request for separation information when the claim was filed. The only time decision letters are not required is when the employer responds and verifies that the separation was lack of work. This was discussed and agreed upon with the Comptroller?s office in the prior audit. In September 2020, the department discovered that the UI system had not sent the required decision letters on 78,000 claims. Once this was discovered, the department instructed the vendor to retroactively send the decision letters. The department continues to monitor the sending of decision letters to ensure that the system is functioning properly and that all required letters are sent.

Finding Number 2020-022CFDA Number 17.225 and 97.034Program Name Unemployment InsuranceDisaster Unemployment AssistanceFederal Agency Department of Homeland SecurityDepartment of LaborState Agency Department of Labor and Workforce DevelopmentFederal Award Identification Number FEMA-4476-DR-TN, FEMA-4541-DR-TN, LWFPUCCOVIDFY20, LWPUACOVIDFFY20Federal Award Year 2020Finding Type Material Weakness and NoncomplianceCompliance Requirement EligibilityRepeat Finding N/APass-Through Entity N/AQuestioned Costs See Schedule of Findings and Questioned Costs for chart/tableThe Department of Labor and Workforce Development did not properly pay Disaster Unemployment Assistance and Pandemic Unemployment Assistance benefits due to ineffective internal controls, management override of existing controls, and information processing errorsBackgroundIn 2020, the Tennessee Department of Labor and Workforce Development (the department) administered two emergency unemployment benefit programs for workers affected by a major disaster:Pandemic Unemployment Assistance (PUA) provided federally funded unemployment benefits to individuals unable to work due to the COVID-19 pandemic.Disaster Unemployment Assistance (DUA) provided federally funded unemployment benefits to individuals unable to work because the President has declared a major disaster (see Table 1).See Schedule of Findings and Questioned Costs for chart/table.The PUA and DUA programs are administratively similar and share two key eligibility requirements. To qualify, a claimant1. must have lost employment as a direct result of the major disaster; and2. must not be eligible for regular unemployment benefits (for example, because he or she is self-employed), or must have exhausted entitlement to regular unemployment benefits.Eligible DUA and PUA claimants receive a minimum weekly benefit amount of $120 up to a maximum of $275, depending on past earnings. Claimants must provide proof of earnings as follows:DUA claimants must submit documentation of their employment, self-employment, or past earnings, so that department staff can determine the appropriate weekly benefit amount. DUA claimants who fail to submit this documentation within 21 days of filing are ineligible for benefits.For the PUA program, claimants may self-report their past earnings without providing supporting documentation. However, claimants who do not substantiate their self-reported past earnings qualify only for the minimum weekly benefit amount of $120.In addition to the weekly benefit based on past earnings, some DUA and PUA claimants qualified for a temporary emergency increase in benefits under the Federal Pandemic Unemployment Compensation (FPUC) program. For each week that a claimant was eligible for at least $1 in unemployment benefits from March 29 to July 31, 2020, the department issued the claimant an additional $600 in FPUC benefits.Claimants file claims, including details of the separation and documentation of wages, through the department?s Geographic Solutions Unemployment System (GUS). The claimant completes an initial application form online, and GUS generates the type of claim (regular, DUA, PUA, or another type) based on the claimant?s responses. Department staff are responsible for reviewing and approving the claim for benefits within GUS.Overall Condition and CauseManagement designed controls for normal operating conditions for department staff to review DUA and PUA claims to ensure claimants met emergency unemployment compensation program eligibility requirements. These controls were inadequate to address the high volume of claims requested as a result of the three major disasters that impacted Tennessee in rapid succession: two tornadoes and the COVID-19 pandemic. Management elected to override existing controls and discontinue staff review of claims to address the high volume of claims more quickly. The department misclassified or improperly processed claims due to limitations and deficiencies in the GUS application, and, without the critical review process operating effectively, the department did not detect the errors. As a result of these control and system deficiencies, the department improperly paid DUA benefits to ineligible claimants, overpaid and underpaid PUA claimants? benefits, and did not issue written determinations on DUA and PUA claims to claimants and employers.Based on discussion with the Unemployment Program Specialist, department staff should have manually reviewed and approved DUA claims to ensure that claimants met eligibility criteria. Staff had just begun processing DUA claims for the Middle Tennessee tornado in early March when an outbreak of COVID-19 emerged in the state. Tennessee, like many states across the country, took action to prevent the spread of COVID-19 by closing nonessential businesses and encouraging citizens to shelter in place. Many citizens lost their jobs or were laid off, and the number of workers filing claims for unemployment benefits surged (see Exhibit 1).See Schedule of Findings and Questioned Costs for chart/table.On March 27, 2020, two weeks after the influx of claims related to COVID-19 started, the President signed the Coronavirus Aid, Relief, and Economic Security Act, establishing the PUA program and extending unemployment relief to self-employed workers and others not eligible for regular benefits. Management spent approximately three weeks overseeing an upgrade to the department?s unemployment claims system to accommodate the new program and developing processes for handling PUA claims. To distribute program payments as soon as possible, management elected to initially pay all PUA claimants the minimum weekly benefit of $120. For claimants who submitted documentation of wages, management planned for department staff to recalculate and finalize the claimant?s weekly benefit amount and issue retroactive backpay, if necessary (See Schedule of Findings and Questioned Costs for footnote).The department began processing PUA claims on April 22, 2020. Two days later, the President declared the Southeast Tennessee tornado a major disaster, triggering DUA eligibility for a new class of affected workers.The historic spike in claims volume and challenges of adopting the new PUA program amid consecutive major disasters placed pressure on the department?s resources for handling unemployment claims, prompting management to override the established controls. The Unemployment Program Specialist said that the department lacked manpower to carry out staff reviews and approvals of all DUA claims. Similarly, the Claim Center Director said that due to the influx of claims, department staff could not carry out manual reviews of each PUA claim.See Schedule of Findings and Questioned Costs for chart/table.Results of TestworkWe obtained the population of 2,315 DUA payments totaling $298,054 and the population of 945,192 PUA payments totaling $131,277,067 the department issued during the 2020 fiscal year. We selected random nonstatistical samples of 25 DUA payments and 60 PUA payments to determine the department?s compliance with program eligibility requirements. Based on a review of claimants? applications for benefits and supporting claims documentation, we determined the department improperly paid DUA and PUA benefits and did not comply with federal regulations surrounding claims determination notices. Specifically, we found thatA. Claimants affected by the COVID-19 pandemic received DUA benefits.B. Claimants eligible for regular unemployment compensation received DUA benefits.C. Claimants did not show good cause for late DUA filing.D. The department did not collect documentation to substantiate DUA claimants? past employment or earnings.E. Claimants did not receive the correct PUA weekly benefit amount.F. The department did not issue written determinations for DUA and PUA claims.Condition A and Criteria: Claimants Affected by COVID-19 Pandemic Received DUA BenefitsFor 9 of 25 DUA payments tested (36%), the department paid DUA benefits to claimants who attested to losing their jobs as a direct result of the COVID-19 pandemic, not the Middle Tennessee tornado or Southeast Tennessee tornado. The majority of the nine claimants lived and worked outside the tornado-affected counties shown in Table 1 on page 2. Claimants who lose their jobs for a COVID-19 related reason are not eligible for DUA benefits on that basis and instead must file under the regular unemployment compensation or the PUA program.Based on discussion with management, workers affected by the COVID-19 pandemic started filing unemployment claims at about the same time that the Middle Tennessee tornado occurred. The departments unemployment system, GUS, appeared to confuse some claimants because it included a question asking if the claimant lost employment due to a recent disaster or pandemic. When a claimant answered ?yes? to that question, the system prompted the claimant to select the specific disaster from a list. Initially, ?Middle Tennessee tornado? was the only option claimants could select to proceed with the application process, because the federal government had not yet established the PUA program. Management subsequently updated the online application to reflect PUA benefits on April 21, 2020, but many claimants affected by COVID-19 had already inadvertently filed for DUA benefits. Without the department?s manual claim review and approval controls operating effectively, these misfiled claims proceeded to payment undetected.In July 2020, management discovered that claimants unemployed due to COVID-19 had misfiled for DUA benefits, several months before we commenced our testwork and identified the same problem. Upon management?s original discovery of this, they promptly notified the state?s regional contact at the U.S. Department of Labor about the misclassified claims and swept DUA applications to identify approximately 1,000 claimants affected by the COVID-19 pandemic. The department?s Fiscal unit made correcting journal entries in August to reallocate DUA funding the department received for these claimants to the PUA program. The nine errors we identified in our testwork, however, were not included among the payments that management identified as misclassified and thus were not part of the correcting journal entries.According to Title 20, Code of Federal Regulations (CFR), Sections 625.5(a) and 625.5(c), ?The unemployment of an unemployed worker is caused by a major disaster if?unemployment is a direct result of the major disaster.?For this condition, we questioned the cost of $12,480 in federal DUA benefits the department issued to the nine claimants whose unemployment was not the direct result of the Middle Tennessee tornado or the Southeast Tennessee tornado.Condition B and Criteria: Claimants Eligible for Regular Unemployment Benefits Received DUA BenefitsFor 2 of 25 DUA payments tested (8%), the department paid DUA benefits to claimants who were eligible for regular unemployment benefits. Based on review of claims documentation, the claimants were unemployed as a direct result of a major disaster but met the eligibility requirements for regular unemployment benefits. Since the DUA program only provides benefits for claimants who are ineligible for regular unemployment benefits, disaster-affected claimants who qualify for regular unemployment compensation must file under that program.According to the Unemployment Program Specialist, the claims system erroneously determined the claimants lacked sufficient past earnings to qualify for regular unemployment benefits and processed the application as a DUA claim instead. Because staff were not manually reviewing and approving DUA claims, the processing error went undetected and the system automatically paid the claims.Concerning DUA payments, 20 CFR 625.4 states,An individual shall be eligible to receive a payment of DUA with respect to a week of unemployment, in accordance with the provisions of the Act and this part if:(i) The individual is not eligible for compensation (as defined in ?625.2(d)) or for waiting period credit for such week under any other Federal or State law?.For this condition, we questioned the cost of $6,325 in federal DUA benefits the department issued to the two claimants who met eligibility requirements for regular unemployment compensation.Condition C and Criteria: System Did Not Generate Claimant Late DUA Filing FormsFor 2 of 25 DUA payments tested (8%), claimants submitted their initial application for DUA benefits after the filing deadline (more than 30 days after the announcement date of the major disaster). DUA regulations allow the department to accept and pay late claims if the claimant shows good cause for filing late. Based on our review of claims documentation, the department?s unemployment claim system did not offer an opportunity for claimants to document the reason for their late filing.The Unemployment Program Specialist said the unemployment claims system should have automatically generated a late filing form on claims filed after the 30-day initial filing window. A late filing form allows a claimant to explain his or her reason for filing late and stops payment on the claim until a staff member manually reviews and approves the late filing. Since the system failed to generate late filing forms on these claims, and management suspended staff review of all DUA claims, the department had no mechanism to identify and properly process claims received after the filing deadline.On filing deadlines, 20 CFR Section 625.8 (a) states,An initial application for DUA shall be filed by an individual with the State agency of the applicable State within 30 days after the announcement of the major disaster of which the individual became unemployed.An initial application filed later than 30 days after the announcement date of the major disaster shall be accepted as timely by the State agency if the applicant had good cause for filing late.For this condition, we questioned the cost of $2,880 in federal DUA benefits and $10,800 in FPUC benefits the department issued to the two claimants who filed for benefits after the application deadline without showing good cause for the late filing.Condition D and Criteria: No Documentation Substantiating DUA Claimants? Past Employment or EarningsFor 5 of 25 DUA payments tested (20%), the department did not ensure claimants provided documentation to substantiate employment, self-employment, or wages earned within 21 days of the claim filing date. DUA regulations require the department to disqualify and discontinue payment on DUA claims without evidence of the claimant?s employment or earnings history.The Unemployment Program Specialist said the department was so inundated with claims that they lacked sufficient manpower to review all DUA claims for proof of employment or earnings. Had a staff member reviewed these claims and noticed missing documentation, they would have stopped payment after 21 days and established an overpayment, if necessary.In addition, 20 CFR 625.6(e)(1) requires that claimants furnish documentation to substantiate the employment or self-employment or wages earned within 21 days of filing of the initial DUA application. Furthermore, Section 625.6(e)(2) states,Any individual who fails to submit documentation to substantiate employment or self-employment?shall be determined to be ineligible for payment of DUA for any week of unemployment during the disaster.For this condition, we questioned the cost of $9,800 in federal DUA benefits and $35,400 in FPUC benefits the department issued to the five claimants who did not provide proof of income, employment, or self-employment, within 21 days of filing for benefits.Condition E and Criteria: Claimants Did Not Receive the Correct PUA Weekly Benefit AmountFor 16 of 60 PUA payments tested (27%), the department did not ensure claimants received their correct weekly benefit amount. Of the 16 errors we identified,8 claimants received the minimum weekly benefit of $120. Based on our review of the supporting evidence of past earnings, these claimants should have received weekly benefits of $132 to $275.3 claimants received between $222 and $275 in weekly benefits, $102 to $155 above the minimum amount. Because these claimants never submitted documentation to substantiate the higher benefit amount, these claimants should have received the minimum weekly benefit of $120.4 claimants received between $236 and $275 in weekly benefits. Based on our review of the supporting evidence of past earnings, these claimants should have received lower weekly benefits of $120 to $200.1 claimant received $217 in weekly benefits. Based on our review of the supporting evidence of past earnings, the claimant should have received a weekly benefit of $233.Based on discussion with the Claims Center Director, department management designed a control process for PUA claims where department staff would manually review and adjust claimants? weekly benefit amounts based on documentation provided. Due to the overwhelming volume of PUA claims received, however, management lacked sufficient staffing to execute the control process as designed to ensure timely manual eligibility reviews of PUA claims.The U.S. Department of Labor issued PUA implementation guidance to stage agencies in Unemployment Program Letter 16-20, Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020 ? Pandemic Unemployment Assistance (PUA) Program Operating, Financial, and Reporting Instructions (UIPL 16-20). According to UIPL 16-20,States must accept documentation of income to determine a claimant?s eligibility for a higher PUA [weekly benefit amount] at any time during the Pandemic Assistance Period?The state must take into account any existing wage records and consider the individual?s declaration of self-employment and other wages at the time of initial claim filing to calculate the [weekly benefit amount]. The individual will then have 21 days to submit documentation substantiating the declaration to continue receiving a [weekly benefit] above the minimum PUA [weekly benefit amount].If, at the time of implementing the PUA program, the state processed claims using the minimum PUA [weekly benefit amount], the state must provide a monetary determination for all PUA claims and include notice that the individuals may submit documentation to be considered for a higher PUA [weekly benefit amount] at any time during the Pandemic Assistance Period. The state must immediately issue a monetary redetermination if the state determines the documentation is sufficient to permit a re-computation for a higher PUA [weekly benefit amount]... The state must recalculate the PUA [weekly benefit payment] for any weeks previously paid and provide supplementary payment as appropriate.For this condition, we questioned costs of $11,846, representing the excess federal PUA benefits the department paid to seven claimants who did not provide evidence to substantiate a higher weekly benefit amount.Condition F and Criteria: Department Did Not Issue Written Determinations for DUA and PUA ClaimsFor 20 of 25 DUA payments tested (80%) and 55 of 60 PUA payments tested (92%), the department did not issue a written determination of the claimant?s application for benefits. A written determination provides the claimant with the department?s reason for approving or denying a claim for benefits.Based on discussion with the Claims Center Director and the Unemployment Program Specialist, management has elected not to routinely generate written determinations for certain types of approved and uncontested claims, which included most of the DUA and PUA claims we tested. The department does issue written determinations for contested claims and claims with potential issues as to the claimant?s eligibility for benefits.As prescribed in 20 CFR 625.9(d),Notices to individual. The State agency shall give notice in writing to the individual, by the most expeditious method, of any determination or redetermination of an initial application, and of any determination of an application for DUA with respect to a week of unemployment which denies DUA or reduces the weekly amount initially determined to be payable, and of any redetermination of an application for DUA with respect to a week of unemployment.Although management has not complied with federal regulations, we did not question costs for the missing written determinations because the errors we noted did not negate the claimants? eligibility for benefits.Risk AssessmentWe reviewed the department?s December 2019 Financial Integrity Act Risk Assessment for the Employment Security Division and determined that management listed the risk of natural disaster or pandemic disrupting services, resulting in eligible claimants not receiving benefits. Management cited the department?s Business Resumption Plan and Human Resources Emergency Workforce Management Plan as controls to mitigate disruptions to the department?s systems and workforce. Management did not identify the risk and mitigating controls to address rapid, unexpected spikes in claims volume. Management?s risk assessment also did not address the risk of improper payments due to claims processing errors in GUS or management overriding established controls to expedite payment to claimants.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,? and Principle 8, ?Assess Fraud Risk,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.7.09 ? When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. . .8.07 . . . In addition to responding to fraud risks, management may need to develop further responses to address the risk of management override of controls.EffectWithout a strong control process built to withstand and adapt to periods of high unemployment, the department cannot ensure that only qualified claimants receive DUA or PUA funding. Until management implements sufficient controls to handle large claims volumes and ensures corrective action to fix claims processing errors within GUS, the department has an increased risk of improper DUA and PUA payments to ineligible claimants.Furthermore, when the department?s claims system does not reliably generate written notifications of department determinations of eligibility for DUA and PUA benefits, claimants may not be fully informed of the reason for the decision to approve or deny the claim for benefits. The department risks paying benefits to claimants who are ineligible or have filed fraudulent claims if it does not send claims-related correspondence to all interested parties.Questioned CostsThis finding, in conjunction with finding 2020-021, resulted in total known federal questioned costs exceeding $25,000 for federal programs that were audited as major programs. When known questioned costs are greater than $25,000 for a type of compliance requirement for a major program, 2 CFR 200.516(a)(3) requires us to report those costs.According to 2 CFR 200.84, questioned costs are costs an auditor questions because the costs either (a) resulted from a violation or possible violation of federal requirements, (b) were not supported by adequate documentation, or (c) were unreasonable. In resolution of this audit finding, department management will work with the federal grantor to determine the amount of any disallowed costs.RecommendationThe issues we identified in this finding included improper payments the department issued in the first three months of the COVID-19 pandemic. Without prompt corrective action, these problems may become more significant or pervasive as the department continues to handle increased claims volume into the 2021 fiscal year.Management of the Employment Security Division should ensure that GUS is able to accurately process all unemployment claims to the correct program type. Management should identify the systematic cause of known processing errors and inconsistencies (such as failure to generate late filing forms on DUA claims) and direct the vendor to deploy system patches as necessary.Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur.The auditor?s assessment regarding the department?s internal controls and the typical process is correct. The DUA program is not something that occurs often, and when it does, the department is typically able to handle it with a small team of experienced staff members. With the massive volume that resulted as a result of the COVID-19 pandemic, and the fact that there were two additional disasters declared as a result of tornados, and all three of these events occurred in less than two months, it was not possible to process all of these claims manually. Had the department processed all of these hundreds of thousands of claims manually, we would still be working on claims filed in early April or possibly even late March 2020. The department relied on queries and on statements provided by the claimants to process the claims. The department also does not have sufficient staff to manually review documents provided by claimants and manually add wages to claims. So, the decision was made to start the claimants off at the minimum and allow them to self-certify to the wages that they earned, in order to properly set their weekly benefit amount. The department contracted with third party vendors; however, they were limited in the activities they could perform due to USDOL regulations regarding non-merit staff. The department was limited in hiring merit staff, due to the statewide hiring freeze. The department will conduct audits on all of these claimants and establish overpayments and adjustments where necessary. This process has not yet begun as claims filings remain high and processing and paying eligible claims is currently the department?s highest priority.The claims that were processed as DUA and should have been PUA were largely the result of a timing issue. The Middle Tennessee Tornados occurred on March 2, 2020, and the DUA program was set up and active within the system on March 9, 2020. When a disaster is declared, a question is added to the unemployment application to determine if an individual was separated due to a natural disaster or pandemic. A ?Yes? answer to this question generates the disaster portion of the application and flags the claim as being filed due to a disaster or pandemic. We began to see claims being filed because of COVID-19 on March 15, 2020, prior to the PUA program being created. This resulted in claimants filing due to the pandemic, but inadvertently selecting the tornado as the reason for filing.The department detected the error in claims type in June 2020 and attempted to correct the claims, including paying them from the correct program. However, it appears that not all of the claims were corrected.

Finding Number 2020-023CFDA Number 17.801Program Name Employment Service ClusterFederal Agency Department of LaborState Agency Department of Labor and Workforce DevelopmentFederal Award Identification Number DV-32916-19-55-5-47, DV-34235-20-55-5-47Federal Award Year 2019 through 2020Finding Type Significant Deficiency and NoncomplianceCompliance Requirement EligibilityRepeat Finding N/APass-Through Entity N/AQuestioned Costs N/ADisabled Veterans Outreach Program personnel did not document participants? eligibility for services, and discontinued participants from the program earlier or later than required by federal regulationsBackground and CriteriaJobs for Veterans State Grants is part of the Employment Service, a cluster of federal programs established to improve the functioning of the nation?s labor markets by bringing together individuals who are seeking employment and employers who are seeking workers. Jobs for Veterans State Grants provides funding for states to hire Disabled Veterans Outreach Program (DVOP) specialists to deliver career services to eligible veterans. DVOP specialists work in the Department of Labor and Workforce Development?s career centers throughout Tennessee to provide eligible veterans vocational guidance and support, such as job referrals and interview skills training.Eligibility CriteriaAccording to Title 38, United States Code, Chapter 41, Section 4211(4), veterans eligible for DVOP specialist services are those whoserved on active duty for more than 180 days and were released from service with other than a dishonorable discharge,were released from active duty because of a service-connected disability,were members of a reserve unit who were called to serve on active duty and were subsequently released with other than a dishonorable discharge, orwere discharged from active duty due to sole survivorship (the only surviving child in a family of servicemembers).Furthermore, to receive DVOP specialist services, an eligible veteran must attest to having at least one or more or the following significant barriers to employment:a service-connected disability,homelessness,recent separation from the armed forces, with 27 or more consecutive weeks of unemployment within the last 12 months,release from incarceration within the last 12 months,no high school diploma or equivalent certificate, orlow income.To verify an individual is a veteran eligible for DVOP specialist services, the department asks the veteran to provide his or her Department of Defense Form 214 (DD-214), ?Certificate of Release or Discharge from Active Duty?. If the veteran does not have his or her DD-214 form, the department requests a copy from the National Archives and Records Administration. The department also requires the individual to complete a Military Services Form, attesting to his or her significant barriers to employment.The National Archives and Records Administration suspended its DD-214 printing services on March 23, 2020, due to the coronavirus pandemic. Subsequently, the U.S. Department of Labor?s State Director of Veterans? Employment and Training Service advised department management that an individual applying for DVOP specialist services may self-attest to his or her veteran status on the Military Services Form in lieu of providing a DD-214.Program Exit CriteriaAccording to federal guidance and department policy, participants are discontinued or ?exited? from DVOP specialist services when a participant has not received services for at least 90 calendar days, and no future services are planned for the participant. DVOP specialists record case notes with dates and descriptions of services provided to each participant in the department?s Virtual OneStop system. When a participant obtains and maintains employment for 90 days, or cannot be contacted after multiple attempts, the DVOP specialist logs the participant?s most recent service as his or her last activity and closes the participant?s file in Virtual OneStop.Condition and CauseBased on discussion with the Veterans? Service Coordinator and the Intensive Service Coordinator, we determined that division management did not provide proper guidance and training for DVOP specialists to adequately document participants? eligibility for services and exit from services. Although the Veterans Service Coordinator stated that career center team leaders reviewed new participants? case files to ensure that DVOP specialists appropriately determined eligibility, this process was not formalized in the department?s policies or procedures, and team leaders did not document their review.We reviewed case files of participants who received services and participants who exited from services during the fiscal year to determine the department?s compliance with federal eligibility and exit regulations. We found that the department?s inadequate internal controls over DVOP specialist training and monitoring led to noncompliance with the program?s eligibility requirements. Specifically, DVOP specialists did not adequately document participants? eligibility for services and did not properly record services provided to ensure participants exited the program 90 days after their last service.Eligibility DeterminationsWe selected a random nonstatistical sample of 60 participants from the population of 864 individuals who received DVOP specialist services between July 1, 2019, and June 30, 2020. Based on our testwork, DVOP specialists did not ensure that 9 of 60 participants (15%) were eligible for services. Specifically,8 participants did not have a Military Services Form attesting to one or more significant barriers to employment, and1 participant did not have a DD-214 form or a self-attestation as evidence of eligible veteran status and did not have a Military Services Form attesting to one or more significant barriers to employment.Untimely Program ExitsWe selected a random nonstatistical sample of 60 participants from a total population of 891 participants who exited the program between July 1, 2019, and June 30, 2020. Based on our testwork, DVOP specialists exited 9 of 60 participants (15%) from services earlier or later than 90 days from the last service date:The DVOP specialists exited five participants prematurely from the program. Those exits occurred between 1 and 42 days before 90 days from the participant?s last service date had passed. According to the Intensive Service Coordinator, DVOP specialists did not properly update the last service date. Based on our review of case files in Virtual OneStop, we found that DVOP specialists recorded the last service date for participants but provided subsequent services without updating the date of in the system, resulting in premature exits.The DVOP specialists exited four participants late from the program. Those exits occurred between 4 and 125 days after 90 days from the participant?s last service date had passed. According to the Intensive Service Coordinator, DVOP specialists inappropriately extended program participation because they identified follow-ups with participants as the last service date; however, based on our review of federal guidance, follow-ups should not extend participation in the program. Furthermore, when DVOP specialists became aware that the participant?s last service date was earlier than scheduled in the system, they did not update the system to reflect this earlier date.Risk AssessmentGiven the problems identified during our fieldwork, we also reviewed the department?s June 2019 Financial Integrity Act Risk Assessment. We determined that management identified the risks of inadequate policies, inadequate documentation for participant eligibility determinations, and inadequate documentation of service provision for establishing participant exit dates in its risk assessment. Although department management identified mitigating controls for these risks, our inquiries of management and testwork revealed that the controls were not sufficient to prevent noncompliance with eligibility determination and exit regulations.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.09 Based on the selected risk response, management designs the specific actions to respond to the analyzed risks. The nature and extent of risk response actions depend on the defined risk tolerance. Operating within the defined risk tolerance provides greater assurance that the entity will achieve its objectives. Performance measures are used to assess whether risk response actions enable the entity to operate within the defined risk tolerances. When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions.EffectWhen DVOP specialists do not document eligibility determinations, there is an increased risk that ineligible participants will improperly receive program services. As a result, the division will have fewer resources to provide services to eligible participants.When DVOP specialists exit participants too early, participants lose access to supports they may need to obtain and keep employment. When participants remain in the program past their exit date, the department commits its limited resources to individuals who may no longer require specialized DVOP services. Additionally, early and late exits could cause the department to report inaccurate information to the U.S. Department of Labor, which relies on these reports to determine the effectiveness of DVOP?s programmatic goals.RecommendationManagement in the Workforce Services Division should provide guidance and training to ensure DVOP specialists support eligibility determinations with adequate documentation and properly record services provided to establish accurate participant exit dates.Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur. The exit date was extended based on untimely input of case notes. As written case notes were entered into the system untimely, this pushed the service date beyond the 90 days. As a result, management is taking the following steps to ensure the proper recording of services being provided to establish participant exit dates:The Intensive Services Coordinator has started individual meetings with each DVOP and their Team Lead to properly train them on job duties including: proper exiting of a participant, related check lists, and required information to be included in case notes. Additionally, case notes must be entered into the VOS file within three (3) business days preventing extension of participation.We revised the monitoring check list that provides step by step instruction of how to ensure all the required documentation and case notes are included in the case file.To ensure eligibility and services to a non-Vet does not occur, we have provided the Military Service Form to the One-Stop Operators in our American Job Centers (AJC) to include guidance ensuring that all individuals entering our doors for service are given the form to complete to self-attest to having a barrier to employment, to be assessed whether a DVOP or Career Specialist needs to be seen, and the document must be uploaded into the individual?s VOS document file. This document is included on the check list to ensure it is in the file.Because jobs for veteran state grants are a staffing grant and we provide individualized career services/case management only (no direct funds spent on veterans), we can use self-attestation for enrollment purposes. Form DD-214 is not required for DVOP services. However, in training the DVOPs, we do stress that they need to try to get a copy of the DD-214 when possible and put it in the participant?s file so the participant does not encounter any issues when trying to enroll in any other programs.A virtual Teams meeting took place with our AJC Team Leads on February 16, 2021, to discuss the findings from the Comptroller?s Audit. Training sessions will be scheduled for the near future to provide additional guidance to Team Leads on how to properly review and monitor the DVOP case file, as well as how to accurately complete the Manager?s Quarterly Report that is sent to U.S. Vets.Training has been provided to DVOPs on how to run a Non-Vet report for themselves ensuring they are not providing this service inadvertently in the system.Where the additional need has been determined, we will provide additional Technical Assistance (TA) through guidance provided by our State Director for Veterans? Employment and Training Services (VETS).Leadership will ensure that appropriate staff monitor these activities to help mitigate risks and improve case management operations.

Finding Number 2020-024CFDA Number 17.207, 17.225, and 17.801Program Name Unemployment InsuranceEmployment Service CenterFederal Agency Department of LaborState Agency Department of Labor and Workforce DevelopmentFederal Award Identification Number UI-29869-17-55-A-47, UI-31319-18-55-A-47, UI-32627-19-55-A-47, UI-32730-19-55-A47, UI-32867-19-60-A-47, UI-34086-20-55-A-47, UI-34192-20-55-A-47, UI-34743-20-55-A-47, LWWTWKCOVIDFY20, LWEBCOVIDFY20,LWFPUCCOVIDFY20, LWPEUCCOVIDFY20, LWPUACOVIDFFY20, LWPCARESEURFY20, LWP100_PEBSFY10, LWP951STATEFY10, LWP953STATEFY10, LWPEUC895BSFY10, TUC-State Expenditures, ES-29439-16-55-A-47, ES-31014-17-55-A-47, ES-31876-18-55-A-47, ES-33456-19-55-A-47, DV-32916-19-55-5-47, DV-34235-20-55-5-47Federal Award Year 2017 through 2020Finding Type Significant DeficiencyCompliance Requirement OtherRepeat Finding 2019-034Pass-Through Entity N/AQuestioned Costs N/AAs noted in the prior five audits, the Department of Labor and Workforce Development did not provide adequate internal controls in one specific areaThe Department of Labor and Workforce Development did not provide adequate internal controls in one specific area related to four of the department?s systems. We are reporting internal control deficiencies in this area because department management did not implement sufficient corrective action. These conditions were in violation of state policies and/or industry-accepted best practices. In their response to the prior-year finding, management agreed that internal controls needed improvement and provided details of corrective action. However, the conditions continued to exist during the audit period.We reviewed the department?s December 2019 Financial Integrity Act Risk Assessment and determined that management listed risks relating to this area; however, the department did not have an effective control to mitigate the risks.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.09 Based on the selected risk response, management designs the specific actions to respond to the analyzed risks. The nature and extent of risk response actions depend on the defined risk tolerance. Operating within the defined risk tolerance provides greater assurance that the entity will achieve its objectives. Performance measures are used to assess whether risk response actions enable the entity to operate within the defined risk tolerances. When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions.Ineffective implementation and operation of internal controls increases the likelihood of errors, data loss, and the inability to continue operations. Pursuant to Standard 4.40 of the U.S. Government Accountability Office?s Government Auditing Standards, we omitted details from this finding because they are confidential under the provisions of Section 10-7-504(i), Tennessee Code Annotated. We provided management with detailed information regarding the specific conditions we identified, as well as the related criteria, causes, and our specific recommendations for improvement.RecommendationManagement should ensure that these conditions are remedied by the prompt development and consistent implementation of internal controls in this area. Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur.The department delivered a confidential response to the Office of the Comptroller.

Finding Number 2020-025CFDA Number 20.106Program Name Airport Improvement ProgramFederal Agency Department of TransportationState Agency Department of TransportationFederal Award Identification Number VariousFederal Award Year VariousFinding Type Significant Deficiency and NoncomplianceCompliance Requirement Special Tests and ProvisionsRepeat Finding 2019-039Pass-Through Entity N/AQuestioned Costs N/AFor the second consecutive year, Aeronautics Division management did not ensure compliance with prevailing wage rate requirements in the Davis-Bacon ActBackground and CriteriaThe Davis-Bacon Act requires laborers and mechanics employed by contractors or subcontractors on federal contracts to be paid no less than the prevailing wage rate that the U.S. Department of Labor has established for that location. In order to ensure that contractors and subcontractors are paying workers the applicable prevailing wage rate, Title 29, Code of Federal Regulations (CFR), Part 5, Section 5.5(a), states that the act?s prevailing wage rate requirement must be included ?in any contract in excess of $2,000 which is entered into for the actual construction, alteration and/or repair, including painting and decorating, of a public building or public work, or building or work financed in whole or in part from Federal funds.?In addition, 29 CFR 3.4 stipulates that contractors and subcontractors must submit weekly certified payrolls to the state agency (that is, the Department of Transportation) within seven days after the regular payment date of the payroll period. Furthermore, 48 CFR 22.406-6(b) states that if the contractor fails to submit certified payrolls promptly, the department will withhold payments to protect the interest of the government and construction workers.According to the Aeronautics Division?s Project Managers, they oversee compliance with the Davis-Bacon and related acts by documenting when they receive the certified payrolls and verifying the accuracy of the wage scale rates.Prior Audit ResultsIn the prior finding, we found that the Aeronautics Division?s management did not have written policies and procedures to ensure Davis-Bacon Act compliance; therefore, staff did not document or maintain the date the contractors and subcontractors submitted the certified payrolls and did not include the act?s prevailing wage requirement in contracts. After we presented management with the finding in February 2020, management concurred, and they created and implemented the Davis-Bacon Act Policies and Procedures in April 2020. The policies and procedures require staff to save certified payrolls, save correspondence to document receipt of certified payrolls, ensure they receive certified payrolls within seven days of the contractor?s pay period payment, and withhold reimbursement requests until contractors submit all certified payrolls.Condition, Cause, and EffectWe obtained and analyzed a list of construction contract expenditures for fiscal year 2020 and identified 145 unique projects. Using the 145 unique projects, we created a population of each project paired with each week in a year; this resulted in a population of 7,685 possible payroll periods (See Schedule of Findings and Questioned Costs for footnote). We then selected a random and systematic sample of 60 payroll periods to test. If no construction work was performed during the randomly selected week, we tested the next available payroll period when construction work was performed. Management implemented corrective action in April 2020, which was near the end of our audit period. Our random and systematic sample included 53 payroll periods before management?s corrective action and 7 payroll periods after management?s corrective action. We determined that the 60 payroll periods tested resulted from 32 unique projects.Testwork ResultsOur testwork revealed that for 9 of the 32 projects tested (28%), the department had not included the prevailing wage rate requirement in the construction contracts because those contracts were executed before management updated the contract template to include the prevailing wage rate requirement. As of December 1, 2020, the department had closed 5 of these contracts, and 4 remain active. For 1 of the active contracts, management amended the contract to include the prevailing wage rate requirement.Although management could not implement corrective action until April 2020, we found issues during the audit period concerning the department?s compliance with federal and state wage rate requirements prior to this date, as described below.For 50 of 60 payroll periods tested (83%), the department did not ensure that contractors submitted payrolls at all or did not ensure they complied with the 7-day submission deadline. Specifically, we found the following:For 24 payroll periods, the contractor never submitted the documentation. These payroll periods occurred before management implemented corrective action.For 26 payroll periods, the contractor submitted the certified payrolls between 42 to 485 days late.Internal Control DeficienciesFor the majority of the audit period, we found management had not established controls to comply with 29 CFR 3.4. Management did not have an effective internal control in place to ensure staff maintained documentation of correspondence with the contractors when following up for unsubmitted payroll records, and management did not ensure that staff adequately documented when the department received the payroll records and whether they were received within the required timeframe.As noted above, although our testwork covered the entire period, we emphasize that all 50 errors occurred before April 2020, the month management implemented correction action. We did not find any errors after management?s corrective action and, according to management, they expect to see continued improvement in the next audit cycle given the corrective actions to achieve compliance with Davis-Bacon Act Policies and Procedures.Risk AssessmentGiven the problems identified during our fieldwork, we also reviewed the department?s December 2019 Financial Integrity Act Risk Assessment and determined that management?s risk assessment did not identify the specific risks and mitigating controls associated with ensuring that contractors or subcontractors complied with prevailing wage rate requirements.The U.S. Government Accountability Office?s Standards for Internal Controls in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.RecommendationAeronautics Division management should ensure that all construction contracts in excess of $2,000 contain the prevailing wage rate provisions; for older, active contracts, management should amend the contracts to include the required provisions. Division management should ensure that all contractors and subcontractors understand the contract requirement to submit certified payrolls within seven days of the payroll payment.Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur. We understand this finding is related to the entire fiscal year and that the items noted in the finding for fiscal year ended June 30, 2020 all occurred prior to implementation of the fiscal year ended June 30, 2019 corrective action. We have confidence that the corrective action is effective and did establish controls to comply with the central prevailing wage requirements in the Davis-Bacon Act.Aeronautics will review all construction contracts in excess of $2,000 to ensure the prevailing wage rate provisions are included in the contracts and discuss the potential for amending contracts that do not contain the required provisions. Management will schedule additional training for staff to ensure they are following the established policies and procedures and enforcing the regulations. Additional communication will be developed for engineering firms to provide to contractors regarding the contract requirements to submit certified payrolls within seven days of the payroll payment. The division will request Contractors and Subcontractors to provide a TIMELY CERTIFIED PAYROLL SUBMITTAL ATTESTATION form for each active contract, to ensure understanding of the requirement. These actions will be completed by May 1, 2021. Additionally, the division will assign a staff member to conduct a self-audit of the fourth quarter of FY 2021 (April-June) by September 1, 2021 to identify risks and implement further mitigating controls if needed.

Finding Number 2020-026CFDA Number 20.106Program Name Airport Improvement ProgramFederal Agency Department of TransportationState Agency Department of TransportationFederal Award Identification Number VariousFederal Award Year VariousFinding Type Material Weakness and NoncomplianceCompliance Requirement ReportingRepeat Finding 2019-037Pass-Through Entity N/AQuestioned Costs N/AFor the second consecutive year, the Department of Transportation?s Aeronautics Division management did not submit or submitted incomplete and inaccurate information on financial reports to the Federal Aviation AdministrationBackgroundThe Department of Transportation (the department), as the administrator of the Airport Improvement Program participating in the State Block Grant Program (See Schedule of Findings and Questioned Costs for footnote), is required to submit financial reports to summarize grant expenditures and the status of project funds. The department is required to submit the financial reports or approved equivalent reports to the federal government via the Memphis Airport District Office (Memphis ADO). The Memphis ADO operates in the Federal Aviation Administration?s (FAA) Southern Regional Office and serves Tennessee. As stated in the State Block Grant Program Advisory Circular 150/5100-21, Chapter 3.10, ?Federal Financial Reporting,? the department is required to submit the following financial reports:1. Standard Form (SF)-425, Federal Financial Report[The SF-425] report, or an ADO/RO [Airport District Office/Regional Office] approved equivalent, must be submitted annually for each open grant (See Schedule of Findings and Questioned Costs for footnote) to monitor outlays and program income on a cash or accrual basis. This report is due 90 days after the end of each federal fiscal year and must also be submitted as a final financial report during closeout (See Schedule of Findings and Questioned Costs for footnote).2. SF-270, Request for Advance or Reimbursement[The SF-270 report], or an equivalent ADO/RO approved equivalent report, must be submitted annually to summarize requests for block grant reimbursements for non-construction projects.3. SF-271, Outlay Report and Request for Reimbursement for Construction Program[The SF-271 report], or an ADO/RO approved equivalent report, must be submitted annually to summarize requests for reimbursements for construction projects.ADO-Approved Equivalent ReportsTo determine if the department was approved to submit any equivalent reports, as allowed by the advisory circular, we verified reporting requirements with the Memphis ADO. According to the Program Manager at the Memphis ADO, the ADO has not approved an equivalent report for the SF-425 reports; thus, the department must submit the SF-425 reports annually for each open grant and at closeout (a final SF-425).The Program Manager did confirm, however, that the ADO had approved the department?s Memorandum of Agreement (MOA) Annual Report as an approved equivalent report for both the SF-270 and SF-271 reports. As stated in the department?s 2006 MOA with the FAA to administer Airport Improvement Program funds under the State Block Grant Program, the reporting requirement, including the six key report items, for the MOA Annual Report is as follows:? MOA Annual Report (in lieu of SF-270 and SF-271)TDOT will provide an annual report to MEM-ADO [Memphis ADO] by December 15th of each year outlining program activity for the preceding fiscal year. The annual report shall include [1] a brief summary of each project, [2] percentage of completion, [3] problems encountered and [4] funds expended and [5] balances, and [6] why the project was needed.Prior Audit ResultsIn the prior audit finding, Aeronautics management did not submit to the FAA the SF-425 annual reports for eight open grants that were due on December 29, 2018. We also found that although Aeronautics management submitted all four SF-425 closeout reports, three reports were incomplete. In addition, for the MOA Annual Report, due by December 15, 2018, the department did not include three of six required key report line items. In response to our prior finding, management concurred and stated they would implement new policies and procedures by September 2020.Current Audit ResultsFor the current audit, we found that management implemented reporting policies and procedures effective March 1, 2020, and properly submitted the only SF-425 closeout report. For the audit period, management had problems with their submission of the SF-425 annual reports for open grants and the MOA Annual Report. As described below, management submitted the reports prior to implementing the reporting policies and procedures in March 2020. We also identified a new issue involving the accuracy of the information reported on the MOA Annual Report. We followed up with management in January 2021 and verified that management submitted SF-425 annual reports timely in December 2020. In addition, we verified that management submitted the MOA Annual Report in December 2020 and included the three missing key report line items. Because our fieldwork had concluded, we could not determine the sufficiency of management?s corrective action related to the accuracy of the reports. We will follow up on management?s corrective actions during the next audit.ConditionBased on our testwork, management did not have effective internal controls in place to ensure Aeronautics staff submitted accurate financial and program activity reports to the Memphis ADO by the required due dates.Untimely Report SubmissionsSF-425 Annual Financial Report Submission For Open GrantsAs of September 30, 2019, the federal fiscal year-end, the department had seven open grants with the FAA. We found that the Aeronautics Director and Assistant Director did not submit to FAA any of the seven (100%) SF-425 annual reports due on December 29, 2019. The reports related to the following open grants:1. 3-47-SBGP-50-2016,2. 3-47-SBGP-52-2017,3. 3-47-SBGP-53-2017,4. 3-47-SBGP-54-2018,5. 3-47-SBGP-56-2018,6. 3-47-SBGP-57-2019, and7. 3-47-SBGP-58-2019.Deficiencies in the Report Preparation and Review ProcessMemorandum of Agreement (MOA) Annual ReportFor the MOA Annual Report, due by December 15, 2019, although management submitted the report, management did not include three of the six required key report line items (50%). Specifically, the Aeronautics Assistant Director did not include ?the percentage of completion,? ?the problems encountered,? or ?why the project was needed.? As of April 30, 2020, management stated that they had notified staff to collect the missing report information so that they can report all key report line items on the next MOA Annual Report.Based on our review of the MOA Annual Report, we found that the Aeronautics Assistant Director?s report preparation process resulted in inaccurate reporting. Additionally, we found that Aeronautics management did not have a review process in place to ensure that the Aeronautics Assistant Director accurately prepared the ?Summary of Open Projects? section of the MOA Annual Report before submitting the report to the Memphis ADO. We recalculated the report lines. See Table 1.See Schedule of Findings and Questioned Costs for chart/table.Risk AssessmentWe reviewed the department?s December 2019 Financial Integrity Act Risk Assessment and determined that Aeronautics Division management did not identify the risk of submitting inaccurate federal reports.Criteria?Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,? Title 2, Code of Federal Regulations, Part 200, Section 62, states,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:a. Transactions are properly recorded and accounted for, in order to:(1) Permit the preparation of reliable financial statements and Federal reports; (2) Maintain accountability over assets; and (3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award;b. Transactions are executed in compliance with: (1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and (2) Any other federal statutes and regulations that are identified in the Compliance Supplement; andc. Funds, property, and other assets are safeguarded against loss from unauthorized use or disposition.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7, ?Identify, Analyze, and Respond to Risks?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis of designing risk responses.CauseSF-425 Annual Financial Report and MOA Annual Report SubmissionsThe Aeronautics Assistant Director stated that the division did not implement corrective action to track and collect information and properly complete the required reports until March 2020. Because the financial reports in our audit period were due to FAA before management implemented corrective action, the department missed the December 29, 2019, report submission deadline for the SF-425 annual reports and did not include the missing key report lines in the MOA Annual Report submitted in August 2019.Inaccurate Financial Information on MOA Annual ReportThe Aeronautics Assistant Director stated that he uses an Excel spreadsheet to prepare the MOA Annual Report; however, he converts the report to a PDF and submits it to the Memphis ADO. After we brought the inaccuracies to management?s attention, the Aeronautics Assistant Director reviewed his spreadsheet and found that it did not contain a formula to automatically calculate the balance remaining for project 57555012819.According to the Aeronautics Assistant Director, management interpreted the ?Summary of Open Projects? grand totals to include all open and closed projects; however, this should only report open projects. Additionally, the Aeronautics Assistant Director agreed that the Summary of Open Projects information would have been clearer if it separately listed the grand total for open projects only and a grand total for open and closed projects or included a note that explained the grand totals included both open and closed projects.EffectWithout establishing and implementing effective reporting controls, neither the state nor the federal awarding agency can make appropriate programmatic decisions based on the contents of the reports.RecommendationThe Commissioner should ensure that Aeronautics Division management and staff prepare and submit accurate and complete financial and program activity reports as required. Aeronautics Division management should establish and document an adequate report review process.Management should implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. As part of this process, management should assign staff to continually monitor risks and assess mitigating controls.Management?s CommentWe concur. The division was informed of the original finding in January 2020. Management developed and implemented a corrective action plan on March 1, 2020, to improve the reporting process for the following year?s reporting cycle due December 2020. Therefore, no reports were submitted by the Aeronautics Division using the new procedures during the 2020 audit period.Upon a second review of FY 2019 reporting an error was identified. The Aeronautics Division submitted a corrected report to the FAA on February 18, 2020, and received an email from the FAA Memphis ADO accepting the truncated FY 2019 report as an equivalent TN SBGO MOA report even though the report is missing three additional fields listed in the MOA. The division believes its procedures implemented March 2020 have corrected the condition noted in the 2020 audit findings. However, the Aeronautics Division will, by May 1, 2021, review and update internal reporting policies and procedures originally implemented on March 1, 2020, to ensure compliance with federal reporting requirements.

Finding Number 2020-027CFDA Number 84.063Program Name Student Financial Assistance ClusterFederal Agency Department of EducationState Agency Northeast State Community CollegeFederal Award Identification Number P053P192666Federal Award Year 2020Finding Type Significant Deficiency and NoncomplianceCompliance Requirement Special Tests and ProvisionsRepeat Finding N/APass-Through Entity N/AQuestioned Costs $397College Staff Did Not Adequately Monitor Attendance for Pell RecipientsConditionNortheast State Community College instructors did not adequately monitor and report attendance for students receiving Pell. We reviewed a sample of 40 students who received Title IV Student Financial Assistance during the 2019-2020 award year. Errors were noted for four of 40 students tested (10%) who either never attended; or withdrew, dropped out, or were terminated from classes prior to completing 60% of the term for which the award was made, resulting in federal questioned costs of $397.One student was charged and paid the full amount of tuition and fees for the Fall 2019 semester. Because the instructor did not report that the student never attended class, the student was incorrectly awarded a Pell grant of $243 for the class after the census date. The student officially withdrew prior to completing 60% of the term. Financial Aid staff discovered the error in the initial award while calculating the Title IV return of funds in November 2019. The $243 amount was properly returned to ED on November 8, 2019.A second student was awarded and received $3,098 in a federal Pell award for the Fall 2019 semester. Because the instructor did not report that the student never attended one of her classes, the student?s Pell award was not properly reduced. Because of the lack of attendance, the student should have only received $2,323 in Pell resulting in a $775 overaward. College staff corrected the error and remitted the $775 to ED after we discovered and reported it to them.A third student officially withdrew from all classes on the census date (14th day of class) in the Spring 2019 semester. This was the date the Business Office released excess balances to the students. The following day, college staff removed the entire Pell award amount from the student?s account, thereby creating a balance due from the student. Our audit determined that the student had attended classes and was, therefore, due a partial award. The student was underpaid $203.89. After we brought the error to staff?s attention, college staff corrected the error by calculating a post-withdrawal distribution. Investigation of this student by our auditors and Financial Aid staff found that the ?Purge Report? used by the school did not identify students who attended class but dropped on/or prior to the census date and would have earned some money for both the school and the student. College staff corrected the programming of the ?Purge Report? during the audit to include the students who withdrew on or prior to the census date. Staff then calculated the amount of missed post-withdrawal distributions for all students caused by the report error as totaling $2,150.04 ($515.71 for nine students in the Fall 2019 semester plus $1,634.33 for twelve students in the Spring 2020 semester.)An instructor incorrectly reported that one student ceased attending classes in the Fall 2019 semester. As a result, Financial Aid staff treated the student as an unofficial withdrawal and incorrectly calculated and returned funds of $378 to ED. However, we determined that the student attended class for the full semester and took the final exam.CauseThree errors were caused because instructors did not properly monitor and report attendance. The final error was caused because the report used to determine students purged from school, but having attended classes, was not originally programmed to indicate students who withdrew on or prior to the census date.CriteriaPer the 2019-2020 Federal Student Aid Handbook, volume 3, page 92, ?Your school must have a procedure in place to know whether a student has begun attendance in all classes for purposes of the Federal Pell Grant Program. The Department does not dictate the method a school uses to document that a student has begun attendance, however, a student is considered not to have begun attendance in any class in which the school is unable to document that attendance.?Per the 2019-2020 Federal Student Aid Handbook, volume 5, page 4, ?Title IV funds are awarded to a student under the assumption that the student will attend school for the entire period for which the assistance is awarded. When a student withdraws, the student may no longer be eligible for the full amount of Title IV funds that the student was originally scheduled to receive.?EffectNot properly determining if a student began attendance or attended throughout a semester could result in adverse actions against the institution. In addition, not properly monitoring and reporting attendance could lead to overpayments or underpayments to ED by the college or students and potential underpayments and overpayments to students.The total amount of questioned costs for the transactions noted above is $775 less the overpayment to ED of $378, for net questioned costs of $397. We tested a sample of $90,502 from a total population of $10,705,318.89.RecommendationNortheast State Community College should provide additional training to instructors to ensure that the instructors document and report attendance properly. The training should emphasize that the information is necessary to determine the amounts of Title IV awards and potential returns of Title IV funds. The college should also continue to use its recently modified Purge Report.Management?s CommentManagement concurs that attendance was not adequately monitored during the audit period, and the college?s Purge Report was not adequately designed to identify students who attended, but dropped or withdrew, on or prior to the census date. In order to correct this deficiency, Northeast State will provide training to all faculty members responsible for recording student attendance. Training will initially be provided to all academic Deans during the Academic Council meeting, and then to faculty members within each academic discipline during individual division meetings. The training will include the potential impacts on the students and institution if attendance is not accurately tracked and the appropriate methods to record and communicate class attendance. The training will be conducted each academic year and provided to new faculty members during the onboarding process. Management will monitor the recording of attendance through division reports at the census date to ensure attendance has been recorded for all students. As described in the audit finding, management corrected the Purge Report programming during the audit. Northeast State will continue to use the updated Purge Report.

Finding Number 2020-028CFDA Number 84.007, 84.033, and 84.063Program Name Student Financial Assistance ClusterFederal Agency Department of EducationState Agency Northeast State Community CollegeFederal Award Identification Number P007A195420, P033A195420, P063P192666Federal Award Year 2020Finding Type Significant Deficiency and NoncomplianceCompliance Requirement Special Tests and ProvisionsRepeat Finding N/APass-Through Entity N/AQuestioned Costs N/ANortheast State Community College did not provide adequate internal controls in one areaFindingNortheast State Community College did not design and monitor internal controls in one specific area. For this area, we found an internal control deficiency related to the college?s information technology control environment that was not in compliance with industry-accepted best practices. This deficiency is considered a significant deficiency in internal control.Ineffective implementation of internal controls increases the likelihood of errors, data loss, and unauthorized access to college information. Pursuant to Standard 4.40 of the U.S. Government Accountability Office?s Government Auditing Standards, we omitted details from this finding because they are confidential under the provisions of Section 10-7-504(i), Tennessee Code Annotated. We provided the college with detailed information regarding the specific condition we identified, as well as the related criteria, cause, and our specific recommendation for improvement.RecommendationManagement should ensure that this condition is corrected by promptly developing and consistently implementing internal controls in this area. Management should implement effective controls to ensure compliance with applicable requirements; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentManagement concurs with the finding. We have already begun to implement controls to address the finding.

Finding Number 2020-029CFDA Number 84.007, 84.063, and 84.268Program Name Student Financial Assistance ClusterFederal Agency Department of EducationState Agency Tennessee State UniversityFederal Award Identification Number P063P190381(Pell), P007A193927(SEOG), P268K200381(DL)Federal Award Year 2020Finding Type Significant Deficiency and NoncomplianceCompliance Requirement Special Tests and ProvisionsRepeat Finding N/APass-Through Entity N/AQuestioned CostsSee Schedule of Findings and Questioned Costs for chart/tableTennessee State University did not return Title IV funds in compliance with federal regulationsConditionWe selected a sample of 11 students from a population of 120 Title IV aid recipients who officially or unofficially withdrew from classes at Tennessee State University during the 2019?2020 award year. When we reperformed the return of Title IV funds calculations, we found that the university did not perform its return of Title IV funds calculations in compliance with federal regulations for 6 of the 11 Title IV aid recipients tested (54.5%). Based on the high error rate for the original 11 students tested, we did not expand our testwork.For 6 of 11 students tested, management made the following errors:1) For the fall 2019 semester, the university did not exclude the fall break from the total number of calendar days in the period of enrollment and the number of calendar days completed; as a result, an additional 8 class days were included in the calculation. Because the days in the semester were incorrectly calculated, the date on which the student had earned his or her financial aid was incorrect for the return of funds calculation. These errors resulted in the university returning more funds than required for 3 of the students tested.2) When calculating summer term returns, the university incorrectly used the first day of the May term as the start of the summer term, regardless of which summer term the student attended. Because the days in the semester were incorrectly calculated, the date on which one student had earned financial aid was incorrect for the return of funds calculation. This error resulted in the university not returning enough required funds for 1 of the students tested.3) The university did not calculate the return of funds for 2 students who did not attend class. This error resulted in the university not returning enough required funds for these 2 students.In addition, for the 3 students discussed in items 2 and 3 above, financial aid personnel did not return Title IV funds to the Department of Education (ED) in a timely manner. After we brought these errors to management?s attention, the institution stated that they had returned the funds for 2 of the 3 students on December 20, 2020. These funds were returned to ED over 489 days late. The funds for the final student who withdrew during the summer of 2020, have not been returned as of January 12, 2021.CriteriaAs a general rule, students earn all financial aid awarded when they have completed 60% of each applicable term. Prior to that 60% completion date, a calculation is required to determine what, if any, funds need to be returned. Title 34, Code of Federal Regulations (CFR), Part 668, Section 22(f)(2)(i), states thatThe total number of calendar days in a payment period or period of enrollment includes all days within the period that the student was scheduled to complete, except that scheduled breaks of at least five consecutive days are excluded from the total number of calendar days in a payment period or period of enrollment and the number of calendar days completed in that period.The 2019?2020 Federal Student Aid (FSA) Handbook, Volume 5, page 5?80, provides the following guidance on determining the length of a scheduled break: ?[d]etermine the last day that class is held before a scheduled break?the next day is the first day of the scheduled break. The last day of the scheduled break is the day before the next class is held.?Furthermore, according to Volume 3, page 3?6 of the FSA handbook, ?The number of weeks of instructional time is based on the period that begins . . . on the first day of classes in the academic year and ends on the last day of classes or examinations.?Regarding returning unearned funds, Volume 5, page 5?108 of the FSA handbook states, ?[a] school must return unearned funds for which it is responsible as soon as possible but no later than 45 days from the determination of a student?s withdrawal? [emphasis in original].CauseThe university did not have adequate procedures in place to ensure the Financial Aid Office properly and timely calculated the return of Title IV funds in compliance with federal regulations.For the fall 2019 semester, the Registrar?s Office did not exclude fall break dates from the ?Days in Period? amounts in Banner, the student information system. Although the Financial Aid Office did notice that break days were not excluded and had the Registrar?s Office update the information in Banner, no one ensured that Banner recalculated the previously prepared return of funds calculations.For the summer 2020 terms, the Registrar?s Office recorded all students? start date as the first day of the May term. When calculating the return of funds, the university made no adjustments based on each student?s enrollment in summer terms. Because the Financial Aid Office miscalculated the number of days in the payment period, they also did not return these funds timely because the error caused the 60% completion date to also be incorrect.Lastly, when the Registrar?s Office identified that students were not attending, it did not promptly notify the Financial Aid Office. The Registrar stated that these errors were due to oversight. These errors also caused funds to not be returned timely.EffectThe university calculated a total return of $119,193 in Title IV funds for the 2019?2020 award year. For our sample of 11 students, the university calculated a total return of $15,543 in Title IV funds. The corrected total for the 11 students was $18,547.15, which is $3,004.15 more than the university returned to the U.S. Department of Education. When the university does not timely return Title IV funds to the U.S. Department of Education, it could result in adverse actions against the university.RecommendationThe Registrar?s Office and the Financial Aid Office should follow federal regulations. Although the Registrar?s Office is responsible for entering the number of days, including breaks, in the period of enrollment into the Banner information system, the Financial Aid Office should verify that the Registrar?s Office entered the information correctly. Management should ensure that the Financial Aid Office reperforms all return of Title IV funds calculations and makes necessary corrections to student and federal fund accounts for the 2019-2020 academic year. Management should ensure that the Registrar?s Office communicates any status changes to the Financial Aid Office.Management?s CommentManagement concurs with the finding. To ensure that the university is in compliance with federal regulations regarding Title IV funds, the following actions will be taken:Necessary adjustments will be made to student accounts identified during the performance of the audit for differences not considered immaterial by auditors. Tennessee State University Office of Financial Aid staff will make the corrections by March 15, 2021.Reports developed in conjunction with our Office of Technology are currently being used to identify students who have withdrawn or stopped attending. These reports are reviewed weekly after census date each term, and the Return to Title IV calculation is performed for each student. These reports also help to identify and confirm if an enrolled student ever attended classes. (If it is determined the student never attended classes, this is not considered a Return of Title IV situation. For students in this category, all federal aid is cancelled.)Beginning spring 2021, we will continue to remove aid for students identified as having never attended. Notification will be made to the Records Office and the Bursar?s Offices. The Records Office is responsible for the removal of any classes for which the student was enrolled but never attended. Further, Records Office will update Clearinghouse regarding student?s enrollment status. The Bursar?s Office staff will determine whether the student owes any funds back to the university. If there is a balance owed, the Records Office will not remove enrolled classes until the student returns any outstanding funds.Beginning spring 2021, we will continue communicating monthly with the Tennessee State University Records Office and the Tennessee State University Financial Aid Office. Prior to the start of each term, the Assistant Vice President of Financial Aid confirms with the Registrar that any break of five or more days has been recorded in the Banner system by Records Office personnel and any changes in start and end dates for the terms have been made prior to the start of classes.Effective July 1, 2021, procedures regarding drawdown of federal funds will be modified. Instead of drawing down 100% of funds available at the time, the University will leave a cushion of approximately 10% not drawn down. This will help ensure that the University maintains compliance with returning Title IV funds to the Department of Education (ED) in a timely manner. The need to initiate refunds to ED should be greatly diminished as there will always be a cushion of funds that have not been drawn down.

Finding Number 2020-030CFDA Number 84.268Program Name Student Financial Assistance ClusterFederal Agency Department of EducationState Agency Tennessee State UniversityFederal Award Identification Number P268K200381Federal Award Year 2020Finding Type Significant Deficiency and NoncomplianceCompliance Requirement Special Tests and ProvisionsRepeat Finding N/APass-Through Entity N/AQuestioned Costs N/AThe Financial Aid Office did not adequately reconcile its Direct Loan records to the Direct Loan Servicing System?s records, as required by federal regulations, and did not resolve discrepancies timelyConditionThe United States Department of Education (ED) requires a mandatory Direct Loan reconciliation be performed monthly. The reconciliation should compare Direct Loan data between the school?s financial aid office and business office, and between school data, ED?s Common Origination and Disbursement (COD) System, and ED?s Grants Management (G5) System. The Financial Aid Office at Tennessee State University did not properly reconcile and document the university?s Direct Loan financial records with the federal Direct Loan Servicing System. The Financial Aid Office did perform informal monthly reconciliations for August and September. After noting a large discrepancy in October 2019, however, they prepared an informal aggregated reconciliation for the remaining academic year. As of January 14, 2021, the Financial Aid Office has not been able to resolve all discrepancies from the academic year.CriteriaTitle 34, Code of Federal Regulations, Part 685, Section 300(b)(5), states that to participate in the Direct Loan program, a school must ?on a monthly basis, reconcile institutional records with Direct Loan funds received from the Secretary and Direct Loan disbursement records submitted to and accepted by the secretary.?The 2019-2020 Federal Student Aid Handbook, Volume 4, page 4?129, gives additional information regarding the reconciliation process:A school that participates in the Direct Loan Program is required monthly to reconcile cash (funds it received from the G5 system to pay its students) with disbursements (actual disbursement records) it submitted to the Common Origination and Disbursement (COD) system.In addition, the handbook further states on page 4-134,A school has completed its monthly reconciliation when all differences between the Direct Loan SAS and the school?s internal records (Direct Loan system, financial aid office, and business office system) have been resolved or documented and the school?s ending cash balance is zero. Schools should clearly outline their method of documentation in both business office and financial aid office procedures.Finally, while the handbook does not specify a particular format or reconciliation method, it does require that the school maintains ?documented results of its monthly reconciliation to provide to auditors and reviewers at their request? (page 4-135).CauseThe Assistant Director of Loans stated the Financial Aid Office had not experienced large discrepancies between their records and COD, and therefore, she did not consider it necessary to document the reconciliations given the lack of discrepancies. However, after noting discrepancies in the October 2019 reconciliation, the Assistant Director of Loans determined aggregating the months into a single reconciliation would assist in identifying the discrepancies. As previously stated, Financial Aid personnel have not resolved the differences as of January 14, 2021.EffectPerforming documented monthly reconciliations and retaining all supporting documentation enable Financial Aid staff to ensure that all Direct Loan funds disbursed to students are received from ED and that disbursements to students are made timely and for the correct amounts. Without documented reconciliations, the university cannot demonstrate it has met the federal reconciliation requirement, and supervisors cannot review the reconciliations to ensure they have been completed correctly and on a timely basis.RecommendationThe Director of Financial Aid should ensure that the required monthly reconciliations are prepared based on instructions in the Federal Student Aid Handbook and yearly training documents. If any items on the School Account Statement do not agree to the institution?s financial records, Financial Aid staff should investigate and resolve these differences in a timely manner. In addition, the Director of Financial Aid should ensure that reconciliations are documented. The Director of Financial Aid and a member of the Business Office should review the reconciliation each month and at award year-end to ensure accuracy and completeness. The Financial Aid Office and the Business Office should develop policies and procedures for the reconciliation process.Management?s CommentManagement concurs with the finding. Effective April 1, 2021, within the first 10 days of each month, the Assistant Director of Loans will reconcile the university?s Direct Loan records to the Direct Loan Servicing System?s records for the prior month. The reconciliation will be prepared using instructions in the Federal Student Aid Handbook. The Assistant Director of Loans will ensure that the reconciliations are documented and complete. Any identified variances will be investigated and resolved at the time of reconciliation. The Assistant Vice President of Financial Aid will review the completed monthly reconciliations and verify the accuracy and completeness of the reconciliations.The Director of Financial Aid (or designee) and a member of the Business Office will review each reconciliation each month and at award year-end to ensure accuracy and completeness. This reconciliation and review will be documented and maintained for audit purposes. The Financial Aid Office and the Business Office will develop policies and procedures for the reconciliation process.

Finding Number 2020-031CFDA Number 84.063 and 84.268Program Name Student Financial Aid ClusterFederal Agency Department of EducationState Agency Tennessee Technological UniversityFederal Award Identification Number N/AFederal Award Year 2020Finding Type Significant Deficiency and NoncomplianceCompliance Requirement Special Tests and ProvisionsRepeat Finding N/APass-Through Entity N/AQuestioned Costs N/ATennessee Technological University did not have adequate procedures to prevent, or to detect and correct, errors in enrollment reporting for the federal Direct Loan ProgramConditionWe tested a sample of 25 Direct Loan borrowers at Tennessee Technological University (TTU) who had a status change during the year, and we found that for 3 of the 25 students tested (12%), the student status reported by the Registrar?s Office to the National Student Loan Data System (NSLDS) did not agree with the status reported in Banner, TTU?s information system. The Registrar?s Office incorrectly reported one student as withdrawn, rather than graduated. For this student, the Associate Registrar corrected this error with NSLDS on September 16, 2020, 100 days late. The other two students had withdrawn from some of their classes, so their statuses changed from full-time to half-time and three-quarter time. While the Registrar?s Office reported changes for these students, the changes reported were inaccurate. The Associate Registrar did not report the corrected statuses until January 19, 2021?132 and 226 days late, respectively.CriteriaThe Federal Student Aid Handbook, Volume 2, page 2?66, states that institutions ?must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that roster file.?In the introduction to Chapter 1, the NSLDS Enrollment Reporting Guide states, ?Accurate and timely Enrollment Reporting to NSLDS is essential to the Department of Education?s successful delivery of Title IV aid.?CauseFor the first student, the Associate Registrar stated her staff believed the submission of a particular file for graduating students was sufficient information for the Clearinghouse. After we identified this issue and TTU staff reached out to the Clearinghouse, they learned that submission of that particular file alone was not a sufficient method of ensuring timely submission to the Clearinghouse. For the other two students, the Associate Registrar stated that they discovered that a computer process run by TTU?s IT staff was not operating properly. When asked why staff did not correct these two students? status when we brought it to TTU staff?s attention, the Associate Registrar said that she had tried to upon discovery but was unable to submit to the NSLDS. She did not realize that staff still had not corrected the students? status until we asked when the staff had submitted the corrections.EffectA student?s enrollment status determines eligibility for in-school status, deferment, and grace periods. Enrollment reporting in a timely and accurate manner is critical for effective management of the programs. Not accurately reporting enrollment status changes could result in the inappropriate granting of an in-school deferment or the failure to start the grace period or properly initiate the loan repayment process.RecommendationThe Registrar should revise procedures to ensure that the Registrar?s Office uploads and submits the correct information to NSLDS. The Registrar should ensure that computer processes run by the university?s staff are operating effectively. In addition, the Registrar should ensure that staff are aware of reporting deadlines and the importance of reporting enrollment status changes.Management?s CommentWe concur. The section of the Records and Registration procedural manual that specifically addresses the process and steps to upload enrollment data to Clearinghouse, which then updates NSLDS, will be revised by April 1, 2021. This revision will include a statement that makes it clear that all enrollment changes made in a term that has ended will not update in the scheduled data load and must be made directly to the Clearinghouse database. The revision will detail that all individual changes to the Clearinghouse database will be recorded by capturing a screenshot of the submission and saving that screenshot in the students? academic file. The procedural manual will include the specific criteria for compliance as presented in the Federal Student Aid Handbook, Volume 2, page 2-66, which states institutions ?must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that roster file.?By April 1, 2021, the procedural manual will be revised to address the computer process that runs to update the time status on students that have added or dropped courses that affect enrollment status to ensure the process is operating effectively. Additionally, by April 1, 2021, Records and Registration will secure confirmation from Information Technology Services that the process, when executed, is running properly by updating appropriate fields.By April 1, 2021, the exception form used to gain approval for out-of-term enrollment changes will be revised to include a required area to indicate if/when the student?s Clearinghouse record will need to be corrected (for retroactive withdrawals or approved registration changes that affect enrollment status) and to include a field to document when the Clearinghouse is notified of the change.The Registrar and Associate Registrar completed training with Clearinghouse titled Compliance Reporting: Avoiding Common Enrollment Audit Findings on February 10, 2021.

Finding Number 2020-032CFDA Number 84.007, 84.063, 84.268Program Name Student Financial Assistance ClusterFederal Agency Department of EducationState Agency University of Tennessee at ChattanoogaFederal Award Identification Number P007A193936, P063P192249, P26K202249Federal Award Year 2020Finding Type Significant Deficiency and NoncomplianceCompliance Requirement Special Tests and ProvisionsRepeat Finding N/APass-Through Entity N/AQuestioned Costs N/AThe University of Tennessee at Chattanooga did not comply with return of funds requirements for federal student financial aidCondition and CriteriaThe University of Tennessee at Chattanooga (UTC) did not comply with return of funds requirements for federal student financial aid. We selected a sample of 40 students from a population of 407 Title IV aid recipients who withdrew, dropped out, or were terminated from classes prior to completing 60% of the term for which the award was made. We found that the university did not perform its return of Title IV funds calculations in compliance with federal regulations for 21 of the 40 Title IV aid recipients tested (53%).For all 21 of the students, staff in the Office of Financial Aid calculating returns for official or unofficial withdrawals incorrectly counted the number of days in the term used in return of funds calculations for the spring 2020 semester, as they did not count both weekends adjacent to the break. Per Title 34, Code of Federal Regulations, Part 668, Section 22(f)(2)(i) and (ii)(B), breaks of five or more consecutive days are excluded from the return calculation, as well as any adjacent weekend days when classes are not held. (See also the 2020 Federal Student Aid Handbook, Volume 5, page 5?80). Because of COVID-19, there were two spring break schedules at UTC during 2020. In the first scenario, the term began on January 6, 2020, and ended on April 28, 2020, and included a week of spring break from March 7 through March 15, 2020 (9 days, including adjacent weekends), for a term length of 105 days. Staff at UTC mistakenly calculated this term length to be 107 days since they deducted only 7 days for the break. In the second scenario, the term also began on January 6, 2020, but included an extended spring break of 16 days (March 7 through March 22), and ended on May 1, 2020, for a total term length of 101 days. Staff mistakenly calculated this term length to be 103 days since they counted the break as 14 days instead of 16.Due to these errors, the university calculations for our sample of 40 students called for a net amount of $1,037 more than was necessary to be returned to the U.S. Department of Education (ED). Due to provisions of the CARES Act, the university was not required to make most monetary returns to ED related to withdrawals in the spring 2020 semester. Nevertheless, UTC failed to perform return calculations correctly, as required, and as noted above. Absent the CARES Act provision (COVID-19 waiver), the university would have returned too much money to ED in each case because Financial Aid Office staff based their calculations on an inflated number of days in the term, resulting in an unearned percentage greater than (and an earned percentage less than) the amount that would have been determined had the calculation been done correctly. Likewise, the amount of Title IV aid earned by the student based on his or her earned percentage of the initial award would have been less than the correct amount.In another instance, the university did not make the required return of funds to ED within the required timeframe. Instead, the funds were returned 125 days after the student?s withdrawal. Per the 2020 Federal Student Aid Handbook, Volume 5, page 5?108, ?A school must return unearned funds for which it is responsible as soon as possible but no later than 45 days from the determination of a student?s withdrawal.?CauseFinancial aid personnel performed the return calculations for the withdrawals using the Banner system, which allows the user to adjust for the breaks discussed above. However, the adjustments were not made correctly. According to the Director of Financial Aid, the staff member was unaware of the details of the requirements pertaining to breaks of more than five days, as described above.The Director of Financial Aid explained that the late return was due to an oversight. The student was a distance learning student and was not subject to the COVID-19 waiver. When this was discovered, the funds were returned.EffectNot making the prescribed allowance for spring break distorted the calculated percentage of federal aid earned by withdrawing students, and therefore caused errors in the calculations of amounts to be returned to the federal student aid programs. Due to the COVID-19 crisis and the resulting waiver by ED, returns to ED were not actually required for most withdrawals in the spring 2020 semester. Actual returns were required only for withdrawing students enrolled completely in on-line classes that did not withdraw due to COVID-19 related circumstances. (Schools still had to complete the refund calculation for students for whom the calculation would normally be required, and report calculated refund data to ED.) Because of this waiver, only one of the calculation errors in our sample above required an actual return of funds, and only six actual returns were required in the spring 2020 semester.RecommendationThe Director of Financial Aid should ensure that staff members are aware of the requirements promulgated by the U.S. Department of Education to accomplish correct and timely returns to the financial aid programs. The Director should see that controls are in place to monitor return calculations, ensuring correct data entry and propriety of calculations.The Director should review refunds calculated during the spring 2020 semester to ensure that in the limited cases where the COVID-19 waiver was not applicable, students were properly awarded earned aid and that any amounts refunded to ED were correct. In addition, the Director should develop procedures to ensure that student refunds are returned within 45 days of determination of a student?s withdrawal.Management?s CommentWe concur. Regarding the miscalculation on the number of days, UTC had a few classes that were held on the Saturday before the Spring Break, thereby impacting any potential refund amounts for these students. UTC will review student refunds for the spring 2020 semester and ensure that all of these were properly calculated and reported. The staff have been made aware of the proper way to calculate the days related to breaks in the semester.Regarding the 45-day requirement for refunds, this error was discovered during our internal audit process of institutional charges. Upon finding the error, we reprocessed and returned additional aid on May 15, 2020. The correction was reprocessed outside of the 45-day timeframe. We have revised our internal auditing procedures to ensure errors will be caught and corrected prior to the 45-day deadline.

Finding Number 2020-033CFDA Number 84.268Program Name Federal Direct Student LoansFederal Agency Department of EducationState Agency University of Tennessee at KnoxvilleFederal Award Identification Number P268K192250Federal Award Year 2020Finding Type Significant Deficiency and NoncomplianceCompliance Requirement Special Tests and ProvisionsRepeat Finding N/APass-Through Entity N/AQuestioned Costs N/AStudent Financial Aid Office staff at the University of Tennessee at Knoxville did not prepare federal Direct Loan reconciliations on a timely basisConditionThe United States Department of Education (ED) requires a mandatory Direct Loan reconciliation to be performed monthly. The reconciliation should reconcile Direct Loan data between the school?s financial aid office and business office, and between school data, ED?s Common Origination and Disbursement (COD) System, and ED?s Grants Management (G5) System. At the University of Tennessee at Knoxville, during the fiscal year ended June 30, 2020, 9 of 12 reconciliations (75%) were not completed timely at the end of each month. For example, reconciliations for August through November 2019 were not completed until January 21, 2020, and reconciliations for January 2020 through March 2020 were not prepared until May 20, 2020. Also, the July 2019 reconciliation was completed 33 days after month-end, and the May 2020 reconciliation was completed on July 28, 2020.CauseThe Student Financial Aid Office?s Reconciliation Coordinator left employment to assume another job within the university system in September 2019. The office contracted with the former employee for a three-month period to complete the reconciliations and extended this contract through July 2020, as the Reconciliation Coordinator position remained unfilled during the remainder of the year ended June 30, 2020. Because of this employee?s other responsibilities, reconciliations were not prepared timely.CriteriaPer Title 34, Code of Federal Regulations, Part 685, Section 300(b)(5), to participate in the Direct Loan program, a school must ?on a monthly basis, reconcile institutional records with Direct Loan funds received from the Secretary and Direct Loan disbursement records submitted to and accepted by the secretary.?The 2019-2020 Federal Student Aid Handbook, Volume 4, page 4-129, adds additional information regarding the reconciliation process and states:A school that participates in the Direct Loan Program is required monthly to reconcile cash (funds it received from the G5 system to pay its students) with disbursements (actual disbursement records) it submitted to the Common Origination and Disbursement (COD) system.EffectIf the school does not reconcile Direct Loan data on a monthly basis, there could be irreconcilable differences between the institution?s Direct Loan data and Direct Loan data on the federal COD system and federal G5 system. Issues not resolved on a timely basis could also lead to unaccounted for cash balances and difficulties in performing the final required closeout reconciliation.RecommendationThe Student Financial Aid Office staff at the University of Tennessee at Knoxville should ensure staff assigned to perform Direct Loan reconciliations complete the reconciliations timely at the end of each month.Management?s CommentWe concur. The University of Tennessee Knoxville has a designated staff member assigned to complete the monthly reconciliation of financial aid funds. The employee assigned to this position accepted another job within the University in September 2019, but was contracted to continue reconciliation duties through the fiscal year, as the time required to repost and rehire the position was delayed, due to the pandemic. The employee?s new job duties impacted the timeliness of the reconciliations. A new staff member was hired in September 2020 and was able to bring all federal reconciliations current by the October 2020 ledger. In addition, an additional team member will be trained to serve as back-up to this position.

Finding Number 2020-034CFDA Number 84.425Program Name Education Stabilization FundFederal Agency Department of EducationState Agency University of Tennessee at ChattanoogaFederal Award Identification Number P425E202342Federal Award Year 2020Finding Type NoncomplianceCompliance Requirement ReportingRepeat Finding N/APass-Through Entity N/AQuestioned Costs N/ACARES Act information was not included or was inaccurate in a required 30-day report at UT ChattanoogaConditionOn April 25, 2020, the University of Tennessee at Chattanooga (UTC) received a Grant Award Notification under the Education Stabilization Fund under the Coronavirus Aid, Relief, and Economic Security (CARES) Act Higher Education Emergency Relief Fund (84.425E ? Student Aid Portion) in the amount of $4,756,890 from the U.S. Department of Education (ED).Per review of UTC?s website and inquiry of management, management did not report one of the required items, ?the total amount of Emergency Financial Aid Grants distributed to students under Section 18004(a)(1) of the CARES Act as of the date of submission,? on a required 30-day report. (The posted website report included information as of May 15, 2020.)In addition, management underreported the number of students who received an Emergency Financial Aid Grant on or prior to May 15, 2020, by 18 students.CauseThe CARES Act is a new and evolving program. UTC management relied upon their contact at ED for guidance as to required items to be posted and overlooked the total amount of Emergency Financial Aid Grants distributed to students that was included in the ED response. Per the Executive Director of Budget and Finance, this oversite ?will be corrected both going forward and on previously posted documents.?The Dean of Students provided the Vice Chancellor for Finance and Administration an inaccurate report as to the number of students receiving Emergency Financial Aid Grants on or prior to May 15, 2020. The Vice Chancellor for Finance and Administration then used this inaccurate information in the 30-day report posted to the university?s website.CriteriaBeginning May 6, 2020, ED, via an electronic announcement (EA), initially required each school who received a Higher Education Emergency Relief Fund (HEERF) [18004(a)(1) Student Aid Portion] award to publicly post certain information on their website no later than 30 days after the award, and then update the information every 45 days thereafter. On August 31, 2020, ED revised the EA by decreasing the frequency of reporting after the initial 30-day period from every 45 days thereafter to every calendar quarter.ED required a total of seven items to be reported on each required report. The electronic announcement identified the following four items as critical information each school was required to report:a. The total amount of Emergency Financial Aid Grants distributed to students under Section 18004(a)(1) of the CARES Act as of the date of submission.b. The estimated total number of students at the institution eligible to participate in programs under Section 484 in Title IV of the Higher Education Act of 1965 and thus eligible to receive Emergency Financial Aid Grants to Students under Section 18004(a)(1) of the CARES Act.c. The total number of students who have received an Emergency Financial Aid Grant under Section 18004(a)(1) of the CARES Act.d. The method(s) used by the institution to determine which students receive the Emergency Financial Aid Grants and how much they would receive under Section 18004(a)(1) of the CARES Act.The other required items are as follows:a. An acknowledgement that the institution signed and returned to the Department the Certification and Agreement and the assurance that the institution has used, or intends to use, no less than 50 percent of the funds received under Section 18004(a)(1) of the CARES Act to provide Emergency Financial Aid Grants to students.b. The total amount of funds that the institution will receive or has received from the Department pursuant to the institution?s Certification and Agreement for Emergency Financial Aid Grants to Students.c. Any instructions, directions, or guidance provided by the institution to students concerning the Emergency Financial Aid Grants.EffectThe university did not comply with reporting requirements on this interim report. The failure to comply with ED reporting requirements could impact future CARES funding to the university. In addition, required information was not provided to the public via the university?s website.RecommendationManagement at the University of Tennessee at Chattanooga should ensure CARES Act reporting is complete and accurate by thoroughly reviewing CARES Act submission requirements to ensure all required elements have been reported. The Dean of Students should also ensure information provided to the Vice Chancellor for Finance and Administration is accurate.Management?s CommentWe concur. In an effort to be compliant and adhere to all the reporting requirements, one requirement was misinterpreted in the university?s report and published website information. The university reported the total amount available to be distributed rather than the amount distributed. This was an unintended oversite that has since been corrected both on the report and website publishing.As mentioned above in the Cause, this has been an evolving process for both the university and ED. In the early stages of implementing processes and reporting, communication and manual processes between the Dean of Students Office and Budget and Finance were heavily relied on to be compliant. To reduce the potential risk of error in reporting, student information is now available to report through an ad hoc automated report instead of manual record keeping. All amounts related to student counts have been verified and accurately reported.

Finding Number: 2019-004CFDA Number: 14.228Program Name: Community Development Block Grants/State?s Program and Non-Entitlement Grants in HawaiiFederal Agency: Department of Housing and Urban DevelopmentState Agency: Department of Economic and Community DevelopmentFederal Award Identification Number: B-18-DC-47-000Federal Award Year: 2018Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: ReportingRepeat Finding: 2018-004Pass-Through Entity: N/AQuestioned Costs: N/AFor the second year, management has not established proper controls over CDBG report preparation and report review processes and has reported inaccurate information to federal grantorBackgroundThe primary mission of the Department of Economic and Community Development (the department), as a pass-through entity, is to provide federal funding from the U.S. Department of Housing and Urban Development (HUD) to communities across the state to promote economic and community development. These cities and counties, also known as grantees, use the Community Development Block Grant (CDBG) funds for projects that align with one of the three national objectives to? principally benefit low- and moderate-income people;? eliminate or prevent slums and blight; or? address a serious and immediate threat to the health or welfare of the community.The CDBG grants provide funds for various types of projects, including housing rehabilitation, purchase of emergency equipment, construction/repair of water and sewer lines and systems, and commercial facade upgrades. HUD requires the department to prepare and submit the HUD 60002 Report, ?Economic Opportunities for Low- and Very Low-Income Persons,? annually to report the uses of the federal funding for low- or very low-income residents.In order for the department to prepare the HUD 60002 Report, the department requires its grantees to provide a Section 3 Summary Report (paper form) for all CDBG funding they received if it is cumulatively greater than $200,000. Upon receipt of the Summary Reports from each of the 79 grantees the department?s Grants Analyst enters the data into the department?s Customer Relationship Management (CRM) system. The Grants Analyst uses the information from the CRM system to prepare the HUD 60002 report, which is reviewed by the CDBG Director. According to the CDBG Director, after he reviews the report, he submits it to the Tennessee Housing and Development Agency (THDA), (See Schedule of Findings and Questioned Costs for footnote) and THDA submits (See Schedule of Findings and Questioned Costs for footnote) the final report to HUD on behalf of the department.The department concurred with the prior year finding, and management stated they would implement written procedures for the HUD 60002 reporting process before the next submission of the report. In response to the prior finding, the CDBG Director implemented a checklist to document the review process for the report but did not develop written procedures addressing the entire report preparation and review process. We found that the checklist was not sufficient to ensure that reported information was complete and accurate.Condition and CauseFor the current audit, we reviewed the report preparation and review process for the HUD 60002 report which was submitted to meet the September 28, 2019, due date. To determine whether the key line items were reported accurately we traced the data in the HUD 60002 report to the grantees? Summary Report data by recompiling the grantees? summary information and comparing the results to the key line items on the HUD report.For the second year, we found that the department still did not have written policies and procedures governing the preparation of the HUD 60002 report or management?s report review process and that the checklist developed in response to the prior audit finding was not sufficient to prevent report inaccuracies. We also found that department management did not ensure that they obtained all required information from the grantees for inclusion in the report. We believe these reporting deficiencies were significant.Key Line ItemsWe found that department staff did not accurately report the information submitted by the grantees related to total CDBG funding (see Table 1):See Schedule of Findings and Questioned Costs for chart/table.According to the CDBG Director, the errors we noted were the result of the Grants Analyst?s transposition and typographical errors when entering grantee information into the system. Management has not established a process to review/reconcile the report to the original source documentation once the data is keyed into the system, nor a process to ensure that grantee information keyed into the system is accurate. A sufficient review process should have detected the errors before the department submitted the report to THDA.Incomplete InformationWhen CDBG program income is used to fund Facade Improvement Grants (FIG) to improve facades in communities? downtown areas, the CDBG Director must also include relevant FIG grants for HUD reporting; however, we found that the department did not ensure grantees reported on all CDBG funding received when CDBG funding exceeded $200,000. Specifically, the Director did not understand that the CDBG regulations required grantees to include the FIG grants on the Summary Reports when the funding threshold to report is met. As a result, grantees did not self-report the required grant information (see Table 2).See Schedule of Findings and Questioned Costs for chart/table.The Director stated that it was the department?s understanding that the FIG grants did not need to be reported on Summary Reports when the individual grants were under the $200,000 threshold; however, he was not aware that the threshold is based on total CDBG funding during the 12 month reporting period not based on individual grant amount.Risk Assessment?We reviewed?ECD?s?December?2018?Financial Integrity Act Risk Assessment and determined that management did not identify the risk of inaccurate federal financial reports in its annual risk assessment.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.Criteria?Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,? Title 2, Code of Federal Regulations, Part 200, Section 62, states,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:a. Transactions are properly recorded and accounted for, in order to: (1) Permit the preparation of reliable financial statements and Federal reports; (2) Maintain accountability over assets; and (3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal awardb. Transactions are executed in compliance with: (1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and (2) Any other federal statutes and regulations that are identified in the Compliance Supplement; andc. Fund, property, and other assets are safeguarded against loss from unauthorized use or disposition.According to the Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book), Principle 3.09, ?Management develops and maintains documentation of its internal control system.?Principle 3.10 of the Green Book states,Effective documentation assists in management?s design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel, as well as a means to communicate that knowledge as needed to external parties, such as external auditors.Principle 10.03 further states, ?Management designs appropriate types of control activities for the entity?s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system.?Additionally, the HUD 60002 report instructions state, under Section 3, ?Applicability,?The following agencies that are direct recipients of the following HUD assistance are required to submit Form HUD 60002: . . . .b. Housing and Community Development Assistance (HCD) funding: . . . Section 3 applies to all construction related activities and projects when the direct recipient receives more than $200,000 from all sources of HCD funding in a given 12-month reporting period.EffectWithout effective controls to ensure compliance, ECD increases its risk of noncompliance, errors, fraud, waste, and abuse.As noted in 2 CFR 200.338, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in 2 CFR 200.207, ?Specific conditions,?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.RecommendationThe Commissioner should ensure that management develops effective controls to achieve compliance with applicable federal reporting requirements and assign employees to be responsible for ongoing monitoring of the risks and any mitigating controls; and act if deficiencies occur. The Commissioner should ensure that department staff assess all significant risks, including the risks noted in this finding, in the department?s annual risk assessment. In addition, the Commissioner should adequately document and approve the risk assessment and the mitigating controls.The CDBG Director should require grantees to resubmit Summary Reports to include the FIG grant award amount information not previously included as required by HUD in order to revise HUD reports which were submitted in error. Additionally, the Director should provide technical assistance to ensure grantees understand how to properly complete the summary reports. The CDBG Director should also consider providing training for CDBG staff involved in the report preparation process, and for staff involved in managing non-CDBG grants that are funded with CDBG program income, to ensure they understand the requirements they must meet. Additionally, the CDBG Director should develop written policies and procedures for the HUD 60002 report preparation and review process to ensure the accuracy of the reports.Management?s CommentWe concur with this finding. Although we had implemented reviews of the of the HUD 60002 Report and the subgrantees? data following the prior finding, we apparently did not do enough to eliminate all the errors. Additional procedures are being developed and implemented to address the causes of this finding. First, the HUD 60002 Report will be edited and reviewed more frequently throughout the reporting cycle rather than compiled at the end of the reporting period. Further, a method for electronic submission of Section 3 data from the subgrantees is being developed to reduce instances of manual entry and the possibility of transposition of numbers, typing errors, and omissions. This will be in place before the next reporting period ends. Also, Section 3 reports will now be collected for all CDBG-funded FIG projects to ensure Section 3 compliance. A revised copy of the Section 3 report was submitted to THDA on January 28, 2020.

Finding Number: 2019-005CFDA Number: 14.228Program Name: Community Development Block Grants/State?s Program and Non-Entitlement Grants in HawaiiFederal Agency: Department of Housing and Urban DevelopmentState Agency: Department of Economic and Community DevelopmentFederal Award Identification Number: B-18-DC-47-000Federal Award Year: 2018Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: ReportingRepeat Finding: N/APass-Through Entity: N/AQuestioned Costs: N/AManagement?s review process for the federal Performance and Evaluation Report is inadequate; as a result, the Department of Economic and Community Development has reported inaccurate information to the federal grantorBackgroundThe primary mission of the Department of Economic and Community Development (the department), as a pass-through entity, is to provide federal funding from the U.S. Department of Housing and Urban Development (HUD) to communities across the state to promote economic and community development. These cities and counties, also known as grantees, use the Community Development Block Grant (CDBG) funds for projects that align with one of the three national objectives to? principally benefit low- and moderate-income people;? eliminate or prevent slums and blight; or? address a serious and immediate threat to the health or welfare of the community.The CDBG grants provide funds for various types of projects, including housing rehabilitation; purchase of emergency equipment; construction or repair of water and sewer lines and systems; and commercial facade upgrades. HUD requires the department to prepare and submit the Performance and Evaluation (PER) report annually to report the uses of the federal funding, activities, and accomplishments taking place for each open grant year in the fiscal year reported.The department compiles financial information for the PER report from HUD?s Integrated Disbursement and Information System; Edison (the state?s cost accounting system); and program income reconciliations performed by the Department of Finance and Administration?s Fiscal Director assigned to the department. Both the Department of Finance and Administration?s Fiscal Director and the Department of Economic and Community Development?s CDBG Director review the report prior to submission to the Tennessee Housing Development Agency (THDA); (See Schedule of Findings and Questioned Costs for footnote) THDA then submits (See Schedule of Findings and Questioned Costs for footnote) the final report to HUD on behalf of the department.We reviewed the PER report that was due to THDA on September 28, 2019, to determine whether the key line items were reported properly and whether management?s review process was adequate. To ensure the department compiled and prepared the data accurately, we traced the data in the PER report to the data in the Integrated Disbursement and Information System, Edison, and program income reconciliations. For the PER report tested, the department reported on open grants for years 2010 through 2018.ConditionWe found that the department has not established an adequate review process for the PER report. Specifically, the Excel spreadsheet that management and staff used to reconcile the grant?s program income had an incorrect formula, and reviewers did not verify that changes made to the spreadsheet were actually saved prior to using the spreadsheet to prepare the report. As a result of these issues management reported significant inaccuracies on the PER report submitted to THDA and, ultimately, HUD for fiscal year 2019. Specifically, we found that management misreported the following key line items (see Table 1):See Schedule of Findings and Questioned Costs for chart/table.Criteria?Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,? Title 2, Code of Federal Regulations, Part 200, Section 62, states,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:a. Transactions are properly recorded and accounted for, in order to: (1) Permit the preparation of reliable financial statements and Federal reports; (2) Maintain accountability over assets; and (3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal awardb. Transactions are executed in compliance with: (1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and (2) Any other federal statutes and regulations that are identified in the Compliance Supplement; andc. Fund, property, and other assets are safeguarded against loss from unauthorized use or disposition.Cause and EffectDuring our prior audit fieldwork for the 2018 Single Audit on the CDBG program we identified and discussed the inadequate review process for the PER report with department management. Additionally, we recommended to management that the department?s Fiscal Director should revise the PER report to correct the underreported program income error. During the current audit, the Fiscal Director stated that the correction was made on the report spreadsheet but that the change did not save; however, no one reviewed the spreadsheet to ensure the change had saved before relying on the spreadsheet to create the official report. Because the department did not have an effective review process, these errors were not detected and corrected for the 2019 report.Under Section 3 of the Housing and Urban Development Act of 1968, the federal grantor requires management to report annually? the uses of CDBG federal funding;? activities and accomplishments regarding employment; and? other economic opportunities provided to low- and very low-income persons.Without accurately reported data, HUD is unable to effectively monitor and analyze the key critical information about the beneficiaries of the program.Risk Assessment?We reviewed?ECD?s?December?2018?Financial Integrity Act Risk Assessment and determined that management did not identify the risk of inaccurate federal financial reports in its annual risk assessment.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.RecommendationThe Commissioner of the Department of Economic and Community Development should ensure that management assess all significant risks, including the risks noted in this finding, in the department?s annual risk assessment.The Deputy Commissioner of Rural and Community Development should work with the CDBG Director to revise and implement an effective review process for the PER report to ensure compliance with applicable requirements; assign employees to be responsible for ongoing monitoring of the risks and any mitigating controls; and act if deficiencies occur. The CDBG Director and the Department of Finance and Administration?s Fiscal Director should revise the report to correct the issues noted in this finding and should resubmit the report to THDA.Management?s CommentWe concur with this finding. The current process for the PER development, review, and submission is being refined. In addition to the current personnel, the Department Controller assigned by Finance and Administration will review the PER for correctness and consistency. This step will replace a second review by the same staff person in an attempt to have more people review the document. Also, a report used to reconcile program income amounts will be included with the internal ECD documents used to review and verify the information included in the PER. A revised copy of the PER was submitted to THDA on January 28, 2020 for the audited year. The new process will be fully implemented for use in the new PER submission cycle.

Finding Number: 2019-006CFDA Number: 14.228Program Name: Community Development Block Grant/State?s Program and Non-Entitlement Grants in HawaiiFederal Agency: Department of Housing and Urban DevelopmentState Agency: Department of Economic and Community DevelopmentFederal Award Identification Number: N/AFederal Award Year: N/AFinding Type: Significant DeficiencyCompliance Requirement: OtherRepeat Finding: N/APass-Through Entity: N/AQuestioned Costs: N/AThe Department of Economic and Community Development did not provide adequate internal controls in one specific area increasing the risk of data loss and the inability to continue operationsCondition, Criteria, Cause, and EffectThe Department of Economic and Community Development did not design and monitor internal controls related to one of the department?s systems. We are reporting internal control deficiencies in one area. This condition was in violation of state policies and industry-accepted best practices.For this area, we reviewed the Department of Economic and Community Development?s December 2018 Financial Integrity Act Risk Assessment and determined that management listed the risks relating to these areas; however, the department did not have an effective control to mitigate the risks.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.Ineffective implementation and operation of internal controls increases the likelihood of errors, data loss, and the inability to continue operations. Pursuant to Standard 4.40 of the U.S. Government Accountability Office?s Government Auditing Standards, we omitted details from this finding because they are confidential under the provisions of Section 10-7-504(i), Tennessee Code Annotated. We provided management with detailed information regarding the specific conditions we identified, as well as the related criteria, causes, and our specific recommendations for improvement.RecommendationManagement should ensure that this condition is corrected by promptly developing and consistently implementing internal controls in this area. Management should implement effective controls to ensure compliance with applicable requirements; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentWe do not concur. We have implemented internal controls commensurate with the level of risks as determined by the subject matter experts. The subject matter experts have designed and performed tests of the controls. The tests performed did not uncover any risks that increased the likelihood of errors, data loss, or the inability to continue operations. We are constrained against providing more details under the provisions of Section 10-7-504(i), Tennessee Code Annotated.Auditor?s CommentIt appeared that management did not fully understand their responsibility to implement effective internal controls.After we completed our audit procedures, we learned that department management reportedly took steps to understand and implement internal controls in this area.

Finding Number: 2019-007CFDA Number: 10.553, 10.555, 10.556, 84.010, 84.027, 84.173, 84.048, and 84.367Program Name: Child Nutrition Cluster, Title I Grants to Local Educational Agencies, Special Education Cluster, Career and Technical Education ? Basic Grants to States, Supporting Effective Instruction State GrantsFederal Agency: Department of Agriculture, Department of EducationState Agency: Department of EducationFederal Award Identification Number: 201818(17)N109945, 201919N109945, S010A160042, S010A170042, S010A180042, H027A160052, H027A170052, H027A180052, H173A160095, H173A170095, H173A180095, V048A160042, V048A170042, V048A180042, S367A160040, S367A170040, and S367A180040Federal Award Year: 2016 through 2019Finding Type: Significant DeficiencyCompliance Requirement: OtherRepeat Finding: 2018-008Pass-Through Entity: N/AQuestioned Costs: N/AThe Department of Education did not provide adequate internal controls in three areas, all of which were noted in previous audits, increasing the risk of errors, data loss, and the inability to continue operationsCondition, Criteria, Cause, and EffectThe Department of Education did not design and monitor internal controls related to five of the department?s systems. We are reporting internal control deficiencies in three areas, all of which were repeated from prior audits because department management did not implement sufficient corrective action. All three conditions are repeated from the prior-year audit, and two conditions are also repeated for one system since the 2017 audit and for three systems since the 2015 audit. These conditions were in violation of state policies and industry-accepted best practices. In its response to the prior findings, management agreed that internal controls needed improvement and provided details of corrective action. However, the conditions continued to exist during the audit period.For all three areas, we reviewed Department of Education?s December 2018 Financial Integrity Act Risk Assessment and determined that management listed the risks relating to these areas; however, the department did not have an effective control to mitigate the risks.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.Ineffective implementation and operation of internal controls increases the likelihood of errors, data loss, and the inability to continue operations. Pursuant to Standard 4.40 of the U.S. Government Accountability Office?s Government Auditing Standards, we omitted details from this finding because they are confidential under the provisions of Section 10-7-504(i), Tennessee Code Annotated. We provided management with detailed information regarding the specific conditions we identified, as well as the related criteria, causes, and our specific recommendations for improvement.RecommendationManagement should ensure that these conditions are corrected by promptly developing and consistently implementing internal controls in these areas. Management should implement effective controls to ensure compliance with applicable requirements; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentWe concur. Corrective actions and corresponding information has been sent under separate cover in accordance with Section 10-7-504(i), Tennessee Code Annotated, for this finding.Management will evaluate and continuously monitor all implemented controls to ensure the controls effectively mitigate the identified risks. The annual risk assessment will be updated to reflect the newly implemented controls and the mitigation of the identified risks.

Finding Number: 2019-008CFDA Number: 10.553, 10.555, 10.556, 84.010, 84.027, 84.173, 84.048, and 84.367Program Name: Child Nutrition Cluster , Title I Grants to Local Educational Agencies, Special Education Cluster, Career and Technical Education ? Basic Grants to States, Supporting Effective Instruction State GrantsFederal Agency: Department of Agriculture, Department of EducationState Agency: Department of EducationFederal Award Identification Number: 201818(17)N109945, 201919N109945, S010A160042, S010A170042, S010A180042, H027A160052, H027A170052, H027A180052, H173A160095, H173A170095, H173A180095, V048A160042, V048A170042, V048A180042, S367A160040, S367A170040, and S367A180040Federal Award Year: 2016 and 2019Finding Type: Material Weakness (10.553, 10.555, 10.556, 84.010, 84.027, 84.173, 84.048, and 84.367) and Noncompliance (10.553, 10.555, 10.556, 84.010, 84.027, 84.173, 84.048, and 84.367)Compliance Requirement: Allowable Costs/Cost Principles (Material Weakness ? 10.553, 10.555, 10.556, 84.010, 84.027, 84.173, 84.048, and 84.367; Noncompliance ? 10.553, 10.555, 10.556, 84.010, 84.027, 84.173, 84.048, and 84.367), Cash Management (Material Weakness ? 84.048), Subrecipient Monitoring (Material Weakness ? 84.010, 84.027, 84.173, 84.048, and 84.367)Repeat Finding: 2018-007Pass-Through Entity: N/AQuestioned CostsCFDA - Federal Award Identification Number - Amount10.555 - 185TN330N1099 - $8,40710.555 - 195TN330N1099 - $7,09684.010 - S010A180042 - $46,66084.027 - H027A170052 - $2,94584.027 - H027A180052 - $8,33984.173 - H173A180095 - $284.048 - V048A170042 - $4,84784.048 - V048A180042 - $1,32684.367 - S367A17040 - $97,478As noted in the prior audit, department management did not have an effective key internal control for reimbursing and monitoring subrecipients for costs charged to five federal programs; as a result, management reimbursed subrecipients for costs that were unallowable or not adequately supported, resulting in $177,100 in federal questioned costsBackgroundDepartment?s Process for Reimbursing SubrecipientsEducation-Related Federal Program FundsThe Department of Education is the pass-through entity for the following programs administered by the U.S. Department of Education:? Title I Grants to Local Educational Agencies (See Schedule of Findings and Questioned Costs for footnote);? Special Education Cluster (See Schedule of Findings and Questioned Costs for footnote);? Career and Technical Education ? Basic Grants to States (See Schedule of Findings and Questioned Costs for footnote); and? Supporting Effective Instruction State Grants (See Schedule of Findings and Questioned Costs for footnote).The department awards federal funds to subrecipients, including local educational agencies (LEAs). LEAs incur education-related costs, such as teacher salaries and benefits, and submit reimbursement requests to the department, using ePlan, the department?s grants management system. The ePlan system has edit checks that automatically compare an LEA?s reimbursement request line items to the LEA?s approved budget and reject any amounts exceeding the line items? budget by 10% or more. Additionally, after the LEA submits its reimbursement request, the Director of Local Disbursement or the Executive Director of Local Finance reviews the reimbursement request to ensure that ePlan correctly calculated the amounts on the reimbursement request. Once the department approves the reimbursement request, it is processed for payment. Throughout the year, the department monitors a sample of LEAs; the monitoring includes a review of allowability of costs the LEAs submitted to the department for reimbursements and the department subsequently paid. This process is described further on page 44.Department of Education?s Relationship With the Tennessee Board of RegentsIn accordance with the Carl D. Perkins Vocational and Technical Education Act of 2006, the Department of Education and the Tennessee Board of Regents (TBR) entered into a memorandum of understanding that outlines the department?s delegation of certain Career and Technical Education ? Basic Grants to States (CTE) program responsibilities to TBR. Under the relationship defined in this memorandum, in fiscal year 2019, the department transferred CTE funds and responsibilities for administering those funds to TBR. TBR, under the terms of the memorandum, awarded CTE funds to eligible community colleges and colleges of applied technology (See Schedule of Findings and Questioned Costs for footnote) to meet the program objectives for postsecondary students. TBR is responsible for administering the portion of CTE funds it receives and ensuring that the federal funds are used in accordance with federal requirements.Child Nutrition Cluster FundsThe Department of Education is the pass-through entity for three of the four Child Nutrition Cluster (See Schedule of Findings and Questioned Costs for footnote) programs administered by the U.S. Department of Agriculture. The three Child Nutrition Cluster programs administered by the department are? the School Breakfast Program,? the National School Lunch Program, and? the Special Milk Program for Children.The department awards federal funds to school food authorities (SFAs), which are primarily local educational agencies (LEAs). SFAs submit claims monthly, based on the number of meals served, through the Tennessee: Meals, Accounting, and Claiming system (TMAC) and are reimbursed funds based on a set rate per meal served. TMAC has edit checks that automatically determine if the number of meals claimed exceed the SFA-provided number of children in attendance and if the number of operating days claimed are greater than the number of operating days for the month. Once the claim is submitted, either the department?s Nutrition Services Compliance Director or the Nutrition Services Federal Reporting Specialist reviews the claim for propriety. Once the department approves the claim, it is processed for payment.Cash Management for All Federal Program GrantsThe Department of Finance and Administration is responsible for adequate cash management for all of the Department of Education?s grant awards. In the cash management process, a state receives either cash advances or cash reimbursements from the federal awarding agencies that oversee federal grant programs. For those programs that operate on a cash reimbursement basis, the state incurs expenditures first and then requests federal funds to offset state spending under these programs. The request for and receipt of federal funds is called a federal cash drawdown. The Department of Finance and Administration operates all of the department?s programs on a cash reimbursement basis. Programs may be 100% federally funded or funded with a combination of state and federal funds.The Treasury State Agreement between the U.S. Department of the Treasury and the State of Tennessee establishes the methods and timing fiscal staff use to draw down funds from the federal government for the state-administered federal programs with large amounts of expenditures (See Schedule of Findings and Questioned Costs for footnote). For federal programs with smaller amounts of expenditures, federal-state transfers are governed by Title 31, Code of Federal Regulations (CFR), Part 205, Subpart B.Department?s Responsibilities as a Grant AdministratorAs a pass-through entity of federal funds, the department is responsible for providing overall program oversight, which includes, but is not limited to,? approving only eligible subrecipients who comply with the federal program requirements and guidelines;? providing appropriate and effective training, technical assistance, and any other necessary support to facilitate a successful program participation;? designing effective controls to ensure subrecipients receive reimbursement payments for expenditures that are fully compliant with program requirements and guidelines; nd? monitoring subrecipients? activities to provide reasonable assurance that the subrecipients administer these federal awards in compliance with federal requirements and guidelines.According to the department?s Executive Director of Local Finance, in order to meet these responsibilities, for the Title I, Special Education Cluster, and Supporting Effective Instruction programs, the Division of Local Finance conducts risk-based joint fiscal monitoring (See Schedule of Findings and Questioned Costs for footnote) of subrecipients, including LEAs. As part of this joint fiscal monitoring, the monitors review LEAs? compliance with all three federal program requirements, including allowable costs, period of performance, and cash management.Based on our discussions with management at the department and TBR for the CTE program, the department and TBR conduct the subrecipient monitoring. The department?s Office of Career and Technical Education and the CTE consultants located at the department?s regional Centers of Regional Excellence offices perform risk-based monitoring of LEAs, including reviewing LEAs? compliance with federal requirements for program expenditures. Additionally, TBR performs risk-based monitoring of the postsecondary institutions, which includes reviewing federal program expenditures to determine compliance with federal requirements.Audit ResultsTo determine compliance with federal requirements related to expenditures, including allowable costs/cost principles and cash management, we tested nonstatistical, random samples of reimbursements to LEAs, SFAs, and post-secondary institutions (See Schedule of Findings and Questioned Costs for footnote) under the purview of TBR. The details of these populations and samples can be found in Table 1.Condition ? Unallowable and Unsupported CostsBased on our testwork, we determined that department and TBR management did not sufficiently review supporting documentation for subrecipient reimbursement requests to ensure that the department only paid subrecipients for allowable costs. As a result, management reimbursed subrecipients for unallowable and inadequately supported costs, totaling $177,100, with funds from five federal programs, which represent federal questioned costs. See Table 1 for a summary of questioned costs.Table 1Federal Program Population, Sample, and Questioned Costs InformationSee Schedule of Findings and Questioned Costs for chart/table.The questioned costs in Table 1 were unallowable for two reasons:? the LEAs? or postsecondary institutions? expenditures charged to the federal program were specifically unallowable under federal regulations or program guidance; or? the LEA, SFA, or postsecondary institution did not provide complete supporting documentation to demonstrate that the costs were allowable and that the department appropriately charged the costs to federal programs.While the questioned cost amounts for the Child Nutrition Cluster, Special Education Cluster, and CTE were less than $25,000, 2 CFR 200.516(a)(3) requires us to report known and likely questioned costs greater than $25,000 for a type of compliance requirement for a major program. For these programs, we determined that the likely questioned costs exceeded $25,000.Table 2a exhibits the department?s questioned costs from Table 1 by LEA and includes additional details about the unallowable expenditures we found. Table 2b exhibits TBR?s questioned costs from Table 1 by postsecondary institution and includes additional details about the unallowable expenditures we found. Because the department has delegated authority for CTE funds awarded to postsecondary institutions to TBR, TBR is responsible for ensuring that only allowable and properly supported expenditures are reimbursed to the postsecondary institutions.Following both tables, we provide additional details about the unsupported expenditures we found.Unallowable LEA and Postsecondary ExpendituresOf the questioned costs noted in Table 1, we identified instances of expenditures that were specifically unallowable under federal regulations or program-specific guidance from either the U.S. Department of Education or the Tennessee Department of Education. Details of these expenditures, including the unallowable cost description, can be found in Table 2a for LEAs and Table 2b for postsecondary institutions.Table 2aDepartment of EducationUnallowable Costs the Department Reimbursed to LEAsSee Schedule of Findings and Questioned Costs for chart/table.Table 2bTennessee Board of RegentsUnallowable Costs TBR Reimbursed to Postsecondary InstitutionsSee Schedule of Findings and Questioned Costs for chart/table.Unsupported LEA, SFA, and Postsecondary Institution AmountsBased on our review of the underlying expenditures for the reimbursements tested, we found that LEAs, SFAs, and postsecondary institutions did not always have supporting documentation for their expenditures. In these cases, the LEA, SFA, or postsecondary institution? did not provide support for some or all of the expenditures;? provided support that did not equal the amount included in the reimbursement; or? duplicated the same expenditure on the reimbursement, based on the support provided.We found questioned costs as a result of unsupported amounts for the following programs:? Child Nutrition ? $15,503;? Title I ? $41,099;? Special Education ? $10,768;? CTE ? TBR ? $269; and? SEI ? $96,376.Risk AssessmentWe reviewed the Department of Education?s December 2018 Financial Integrity Act Risk Assessment and determined that management listed the risk that federal funds charged to a federal grant are not allowable under program regulations; however, the department did not have an effective control to mitigate its risk.Cause ? Unallowable and Unsupported CostsTitle I, SEI, IDEA, and CTEThe department does not require LEAs to submit documentation of expenditures when they request reimbursement. Additionally, TBR does not require postsecondary institutions to submit documentation of expenditures to them as support for the reimbursement requests TBR submits to the department. As a result, department management does not review LEAs? underlying expenditures before approving the requests. The department?s Executive Director of Local Finance, Office of Career and Technical Education management, and TBR?s Vice Chancellor for Student Success all stated that the department and TBR do not have sufficient resources to review all of the documentation for each reimbursement before reimbursing subrecipients. Additionally, if LEAs and post-secondary institutions are required to wait for the department and TBR to review documentation of expenditures, it could negatively affect their fiscal positions and cause cash flow issues.According to management of both the department and TBR, subrecipient monitoring activities should include a review of LEAs? and postsecondary intuitions? expenditures to ensure they are allowable and properly supported; however, as we identified in a separate condition in this finding, had the monitors performed sufficient monitoring activities, we would reasonably expect the monitors to have found the same conditions we identified.Child Nutrition ClusterFor the two meal claims submitted by one SFA, we determined that the SFA ceased operations during fiscal year 2019. When we attempted to contact the SFA and the SFA?s sponsoring organization (See Schedule of Findings and Questioned Costs for footnote), we received no response. Additionally, neither the LEA under which the SFA operated nor the department had retained the necessary documentation, and neither were able to obtain the documents after we requested them. In addition, another SFA double-counted one day of meals on its monthly meal claim request, resulting in $38 in questioned costs.Criteria ? Unallowable and Unsupported CostsThe U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.According to the Green Book?s Principle 10 ,?Design Control Activities,?10.02 Management designs control activities in response to the entity?s objectives and risks to achieve an effective internal control system. . . . As part of the risk assessment component, management identifies the risks related to the entity and its objectives . . . Management designs control activities to fulfill defined responsibilities and address identified risk responses.According to 2 CFR 200.403, ?costs must meet the following general criteria in order be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and . . . (g) Be adequately documented.?According to 2 CFR 200.421(e), ?Unallowable advertising and public relations costs include . . . Costs of promotional items and memorabilia, including models, gifts, and souvenirs.?According to 2 CFR 200.438, ?Costs of entertainment, including amusement, diversion, and social activities and any associated costs are unallowable.?According to 2 CFR 200.470(a)(1), ?Taxes that a governmental unit is legally required to pay are allowable, except for self-assessed taxes.? Federal grants cannot fund a state?s sales tax.Regarding the Child Nutrition Cluster, 7 CFR 210.8(c) states, ?The Claim for Reimbursement shall include data in sufficient detail to justify the reimbursement claimed and to enable the State agency to provide the Report of School Program Operations required . . . Such data shall include, at a minimum, the number of free, reduced price and paid lunches and meal supplements served to eligible children.?Title 20, United States Code, Section 300.8(a)(1) defines a student with disabilities as, ?having an intellectual disability, a hearing impairment (including deafness), a speech or language impairment, a visual impairment (including blindness), a serious emotional disturbance (referred to in this part as `emotional disturbance?), an orthopedic impairment, autism, traumatic brain injury, an other health impairment, a specific learning disability, deaf-blindness, or multiple disabilities, and who, by reason thereof, needs special education and related services.? While gifted students meet the state definition of a special education activity, gifted students are not included in the federal definition.The Tennessee Department of Education?s guidance, ?Using Federal Education Funds to Pay for Food,? states, ?Full meals for families/parents or students are not allowable . . . under any circumstances. The IRS defines a meal as, `A quantity of food that equals a full serving of breakfast, lunch or dinner.??The department?s Division of College, Career and Technical Education Policies state, ?purchases of consumables [related to equipment] may be allowed in rare incident if these purchases will increase student success for school systems with limited resources of no more than $25,000 in total annual allocations . . . [the system] must submit a request stating the specific consumables and purchase amount . . . for approval.?Condition and Cause ? Cash ManagementConditionDuring our review of Career and Technical Education expenditures, we found that the following three LEAs requested reimbursement for expenditures that had not yet been incurred at the time of reimbursement:? Robertson County,? Dyer County, and? Moore County.Because these reimbursements were only made at an improper time, but contained allowable costs, we have not questioned these costs.Risk AssessmentWe reviewed the Department of Education?s December 2018 Financial Integrity Act Risk Assessment and determined that management did not identify the risk that subrecipients may request reimbursement for costs that had not yet been incurred at the time of reimbursement and a mitigating control.CauseAs previously noted for unallowable costs, the department does not require LEAs to submit documentation of expenditures when they request reimbursement. Additionally, as previously noted and reported later in this finding, if the department?s monitors had performed sufficient subrecipient monitoring activities, which should include a review of LEA cash management, we would reasonably expect the monitors to have found the same conditions we identified.Criteria ? Cash ManagementAccording to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.According to Tennessee?s 2019 Treasury-State Agreement, all federal costs requested from the federal government must have been incurred when the request for reimbursement is made.Condition and Cause ? Subrecipient MonitoringCondition ? Department of Education ? Joint Fiscal Monitoring and CTE MonitoringWhile we determined that the department performed risk-based monitoring for Title I, SEI, Special Education Cluster, and CTE, based on the conditions reported in this finding, we questioned the sufficiency of the department?s monitoring process. When we requested documentation of the monitoring performed by the department?s divisions, we found that the monitors do not document the methods used to select expenditure items for review, and they do not maintain working papers or copies of other evidence to document the work performed or to support the monitoring reports issued. As a result, we were unable to determine if the department?s monitoring efforts were sufficient.Although the monitors indicated they examined expenditures during monitoring activities, we would reasonably expect the monitors to have found the same conditions we identified. Of the 145 LEAs that received Title I, SEI, and Special Education funds, the department performed joint fiscal monitoring (See Schedule of Findings and Questioned Costs for footnote) of 15 LEAs. Four of the LEAs reported for noncompliance in this finding were included in the 15 LEAs monitored; however, the department?s monitors at these 4 LEAs did not identify similar issues during their monitoring. The four LEAs include? Metro Nashville Public Schools,? Shelby County,? Campbell County, and? Giles County.During our audit period, of the 124 LEAs that received CTE funding, the department monitored 20 LEAs. Based on our review of the department?s monitoring reports, we found that management identified expenditure noncompliance at 1 of the LEAs included in our testwork; as a result of the department?s monitoring efforts, the department required the LEA to refund the department the noncompliant amount.Condition ? TBR ? CTE MonitoringBased on our discussion with TBR?s Assistant Vice Chancellor for Student Success, TBR?s monitoring procedures include performing various types of monitoring, depending on the level of risk assigned to each postsecondary institution. These monitoring activities include the following:? Self-assessment monitoring ? For postsecondary institutions identified as the lowest risk, school management completes TBR?s monitoring document and submits it to TBR.? Telephone/virtual monitoring ? For postsecondary institutions identified as lower risk, TBR staff will call the school to discuss and complete the monitoring document with school staff.? Desktop monitoring ? For postsecondary institutions identified as moderate risk, TBR staff review school documentation at TBR?s central office.? On-site monitoring ? For postsecondary institutions identified as high risk, TBR staff conduct on-site reviews, including reviewing school documentation.Of the 39 postsecondary institutions that received CTE funding, TBR performed monitoring of 10 postsecondary institutions, as follows:? one institution completed a self-assessment,? TBR staff completed desktop monitoring for eight institutions, and? TBR staff completed on-site monitoring for one institution.However, during our audit period, TBR did not monitor any of the postsecondary institutions where we found questioned costs.Risk AssessmentWe reviewed the Department of Education?s December 2018 Financial Integrity Act Risk Assessment and determined that management listed the risk that the department would not conduct subrecipient monitoring visits and the risk that the department would not follow up on noncompliance found during monitoring; however, the department did not have an effective control to mitigate its risk.Additionally, we determined that management did not identify the risk that its monitoring process may not be designed to reasonably ensure monitors will detect noncompliance and a mitigating control.CauseBased on our discussions with department and TBR management, their limited resources available for monitoring limit the number of on-site visits they can conduct. Additionally, based on our discussion with the department?s Executive Director of Local Finance, the monitors documented on-site monitoring by checking off items on a monitoring checklist; they did not maintain any further documentation because they did not think it was necessary. However, the Executive Director of Local Finance stated that beginning in fiscal year 2020, the fiscal monitors will document their sample selection methodologies and expenditure items that they review during monitoring.Criteria ? Subrecipient MonitoringAccording to 2 CFR 200.331, ?All pass-through entities must . . . Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved.?According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.Furthermore, Principle 10 of the Green Book, ?Design Control Activities,?10.02 Management designs appropriate types of control activities for the entity?s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system.?Management?s Corrective Action Subsequent to Our Audit PeriodIn the department?s six-month follow-up to the prior audit finding, management stated that they drafted a new fiscal monitoring instrument that they would begin using for fiscal year 2020 monitoring. Management also stated that they will standardize the fiscal monitoring process to include reviewing both supporting documentation for expenditures and documentation of sample selection methodologies. Because management took these fiscal monitoring actions in fiscal year 2020, after our audit period, we will examine the revised fiscal monitoring process during the next audit.EffectWhen the department does not have proper preventative or detective internal controls in place to determine if costs reimbursed to subrecipients are allowable and properly supported, the department increases the risk of reimbursing funds for unallowable costs. This could result in state refunds/reimbursements to the U.S. Department of Education and the U.S. Department of Agriculture for expenditures that are unallowable.Additionally, federal regulations address actions that federal agencies may impose in cases of noncompliance. As noted in 2 CFR 200.338, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.207, ?Specific conditions,?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.Furthermore, Section 200.338 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:(a) Temporarily withhold cash payments pending corrective action of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.(b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.(c) Wholly or partly suspend or terminate the Federal award.(d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awardi

Finding Number: 2019-009CFDA Number: 84.048Program Name: Career and Technical Education ? Basic Grants to StatesFederal Agency: Department of EducationState Agency: Department of EducationFederal Award Identification Number: V048A160042, V048A170042, and V048A180042Federal Award Year: 2016 through 2018Finding Type: Material WeaknessCompliance Requirement: Matching, Level of Effort, and EarmarkingRepeat Finding: N/APass-Through Entity: N/AQuestioned Costs: N/ADepartment of Education management did not have a formally documented key internal control to ensure staff met earmarking and matching requirements of the Career and Technical Education programBackgroundAs a condition of receiving Career and Technical Education ? Basic Grants to States funding, the Tennessee Department of Education must meet matching and earmarking requirements. To comply with the matching requirement, the department must supplement at least 50% of the grant, dollar-for-dollar, with funds from non-federal sources (such as state appropriations). The earmarking requirement stipulates that the department must reserve a portion of the grant funds for specific activities:? Secondary and Postsecondary Career and Technical Education Programs ? not less than 85%;? State Leadership Activities ? not more than 10%; and? State Administration ? not more than 5% or $250,000, whichever is greater.ConditionManagement had no documented evidence that management conducted reviews to ensure the program staff met matching and earmarking requirements for the Career and Technical Education program. Management reported that periodic supervisory reviews were the key internal control to ensure the staff met matching and earmarking requirements, but without documentation, we could not verify that the key internal control, supervisory reviews, were in place and operating effectively. Despite the lack of documented reviews, we performed calculations to verify that the department complied with these federal requirements to meet earmarking and matching requirements, and we did not find any instances of federal noncompliance with this requirement.We reviewed Department of Education?s December 2018 Financial Integrity Act Risk Assessment and determined that management listed the risk of not meeting matching requirements; however, the department did not have an effective control to mitigate its risk. Management did not identify the risk of not meeting earmarking requirements and a mitigating control.CauseBased on our discussion with the Senior Director of College and Career Experiences, department management had not formally documented their review process to ensure staff meet federal earmarking and matching requirements for the Career and Technical Education program. After we brought this issue to their attention, management drafted and provided us with a formal process they plan to use to document the internal controls going forward.CriteriaThe U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to the Green Book, Sections 3.09 through 3.10,? Management develops and maintains documentation of its internal control system,? Effective documentation assists in management's design of internal control by establishing and communicating the who, what, when, where and why of internal control execution to personnel.Best practices require that management document internal control to meet operational needs. Documentation of controls, including changes to controls, is evidence that controls are established, identified, capable of being communicated to those responsible for their performance, and capable of being monitored and evaluated by the entity?s management.EffectWithout documenting internal controls, management is unable to effectively monitor the status of matching and earmarking requirements of Career and Technical Education grants. This increases the department?s risk of noncompliance with the terms and conditions of the grant, which could cause the federal grantor to impose additional monitoring or to wholly or partly suspend or terminate the grant award.Furthermore, failure to document effective internal controls increases the risk that only a few employees will know and understand the internal control structure, therefore increasing the risk that if the organization were to lose these individuals it would also lose the organizational knowledge of the control system. Failure to document the control system also potentially increases the risk of inaccurate communication of internal controls to external parties, such as external auditors.RecommendationWe recommend the department?s Senior Director of College and Career Experiences establish and implement a process to document the review of matching and earmarking calculations for the Career and Technical Education program.Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentWe concur. Department management will implement additional internal controls to ensure earmarking and matching requirements of the CTE program are met. This will include updating CTE program policies, budget and expenditure calculations, increased internal communication, risk identification, monitoring relevant requirements and requiring additional formal documentation. The department aims to draft and implement these updated policies and internal controls no later than April 30, 2020.

Finding Number: 2019-010CFDA Number: 84.048Program Name: Career and Technical Education ? Basic Grants to StatesFederal Agency: Department of EducationState Agency: Department of EducationFederal Award Identification Number: V048A160042, V048A170042, and V048A180042Federal Award Year: 2016 through 2018Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: Matching, Level of Effort, EarmarkingRepeat Finding: N/APass-Through Entity: N/AQuestioned Costs: N/AThe Department of Education management did not have an internal control to ensure the department met the state administrative funding requirement for the Career and Technical Education programBackgroundThe Career and Technical Education ? Basic Grants to States (CTE) program is designed to develop the academic knowledge, technical skills, and employability of secondary and post-secondary students. The U.S. Department of Education allocates funding to states to develop CTE programs in schools and colleges, to provide state leadership, and to cover related administrative expenditures.Maintenance of Effort RequirementAs a condition of receiving federal funds, some federal programs may require a state to contribute some of its own funds toward these programs. To meet the federal ?maintenance of effort? requirement, states must either provide? a specified level of service from one period to another, or? a specified level of expenditures from non-federal sources (such as state appropriations) or federal sources for specific activities from one period to another.For the state?s CTE program, the Tennessee Department of Education must show ?maintenance of effort? for a specified level of expenditures. This means that the department must spend at least the same, if not more, state appropriations from year to year in order to meet the federal requirement. Not only does the U.S. Department of Education stipulate maintenance of effort requirements for the CTE grant as a whole, but it also requires the state department to spend a specified amount for state administration activities. In order to determine the department?s compliance with the federal requirements governing maintenance of effort and the state administration funding levels, we extracted the department?s CTE expenditure data for fiscal years 2017 and 2018 and calculated the total expenditures the department charged to CTE as a whole and to state administration for each year.ConditionBased on our testwork, we found that the department met the overall maintenance of effort requirement for the CTE program; however, the department did not meet the requirement to maintain its CTE state administrative funding at the required level for fiscal year 2018 (See Schedule of Findings and Questioned Costs for footnote). We calculated a shortfall of $40,432 of funding in the state administration category.We reviewed the department?s December 2018 Financial Integrity Act Risk Assessment and determined that management listed the risk of failure to meet maintenance of effort; however, the department did not have an effective control to mitigate its risk associated with all aspects of the requirement.CriteriaAccording to Title 20, United States Code, Section 2413(a), ?State Administrative Costs,?For each fiscal year for which an eligible agency receives assistance under this chapter, the eligible agency shall provide, from non-Federal sources for the costs the eligible agency incurs for the administration of programs under this chapter, an amount that is not less than the amount provided by the eligible agency from non-Federal sources for such costs for the preceding fiscal year.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.CauseBased on our discussions with the Chief Financial Officer and the Senior Director of College and Career Experiences, they were not aware of the federal requirement for state administration maintenance of effort because it is outlined in a separate section of the federal statute from the overall maintenance of effort requirement. Therefore, management?s internal control over maintenance of effort did not specifically include review of state administration funding levels. Furthermore, the Chief Financial Officer stated that the department may have misclassified some state administration expenses as state leadership activities, which, if correctly classified, would show that the department met state administration maintenance of effort. However, management ultimately could not identify these misclassified transactions or provide evidence to show that the department met the spending levels.EffectBy not meeting requirements to maintain state fiscal effort for the CTE program, the department risks a reduction of federal funding for state administration activities in subsequent award years. This could diminish the department?s capacity to provide sufficient oversight, monitoring, and technical assistance to the local educational agencies that offer CTE programs to students.RecommendationManagement should implement internal controls to ensure that the department meets state administration maintenance of effort requirements each fiscal year. These controls should include formal documentation of all maintenance of effort spending.Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentWe concur. Department management will implement additional internal controls to ensure the required level of CTE state administrative funding is met. This will include updating CTE program policies, budget and expenditure calculations, increased internal communication, risk identification, and monitoring relevant requirements, as well as potentially requiring additional formal documentation. The department aims to draft and implement these updated policies and internal controls no later than April 30, 2020.

Finding Number: 2019-011CFDA Number: 16.575Program Name: Crime Victim AssistanceFederal Agency: Department of JusticeState Agency: Department of Finance and AdministrationFederal Award Identification Number: 2016-VA-GX-0053Federal Award Year: 2015 and 2016Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: Allowable Cost/Cost Principles (Significant Deficiency and Noncompliance), Subrecipient Monitoring (Significant Deficiency)Repeat Finding: N/APass-Through Entity: N/AQuestioned Costs: $593Office of Criminal Justice management reimbursed subrecipients for expenditures that were unallowable under the Crime Victim Assistance grant, resulting in federal question costsBackgroundThe Department of Finance and Administration?s (the department) Office of Criminal Justice Programs is responsible for administering the Crime Victims Assistance program, which is funded by and known as the Victims of Crime Act of 1984 (VOCA). The Office for Victims of Crime within the U.S. Department of Justice distributes crime victim assistance grants to states through annual apportionments. According to Title 28, Code of Federal Regulations (CFR), Part 94, Section 107(a), the Office of Criminal Justice Programs (the office) must distribute 95% of all funds through subawards to subrecipients that provide direct services to victims, such as rape treatment centers, domestic violence shelters, centers for missing children, and other community-based victim coalitions and support organizations. Furthermore, the office must prioritize funding toward services for victims of sexual assault, domestic abuse, child abuse, and underserved populations.Under the office?s grant contracts, the VOCA subrecipients expend their own organizational funds to provide direct services to victims of crime and then submit requests for reimbursement to the office either monthly or quarterly, depending on the subrecipient?s preference. The reimbursement request includes totals for specific line items, such as salaries and benefits, specific assistance to individuals, travel, among other items. The department?s Office of Business and Finance performs all fiscal-related duties on behalf of the Office of Criminal Justice Programs, including processing reimbursements in Edison, the state?s accounting system. The Office of Criminal Justice Programs? Fiscal Manager (See Schedule of Findings and Questioned Costs for footnote) and Office of Business and Finance staff do not require the subrecipients to submit supporting documentation with the reimbursement requests; as such, the Office of Criminal Justice Programs must rely on monitoring activities to determine whether subrecipients met the grant requirements.As a key control to ensure that the office and subrecipients meet federal requirements, office management relied on their subrecipient monitoring process to ensure that the office only reimbursed allowable costs. As part of the department?s annual monitoring plan, office management identifies which VOCA subrecipients to monitor, and fiscal monitors review the supporting documentation for a sample of reimbursement requests from each identified subrecipient to verify whether the expenditures were allowable. If a monitor finds any unallowable costs, they question the costs in the subrecipient?s monitoring report and deduct these costs from future reimbursement payments. Additionally, that subrecipient will be considered high risk (See Schedule of Findings and Questioned Costs for footnote) in the next year?s monitoring plan. However, due to the conditions noted in this finding, we cannot determine the effectiveness of the key control.Conditions and CriteriaUnallowable CostsThe office awarded $45,614,025 to 228 subrecipients from July 1, 2018, through June 30, 2019. To determine if the office and its subrecipients complied with federal grant requirements, we selected a nonstatistical, random sample of 25 subrecipient reimbursement requests, totaling $528,975, from a population of 1,868 subrecipient reimbursement requests, totaling $32,724,878, and obtained supporting documentation directly from the subrecipients. Based on our testwork, we determined that for 7 of the 25 (28%) reimbursement requests tested, the office improperly reimbursed subrecipients for unallowable expenditures. See Table 1 for more information.Table 1Types of Unallowable ExpendituresSee Schedule of Findings and Questioned Costs for chart/table.Because we identified $593 in federal questioned costs, 2 CFR 200.516(a)(3) requires us to report known questioned costs when known or likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program.Unsupported Expenditures2 CFR 200.403(g) states that ?costs must ? [b]e adequately documented.?Indirect Costs28 CFR 94.109(a) states that the office ?may charge a federally-approved indirect cost rate to the VOCA grant.? According to the approved agreement with the U.S. Department of Health and Human Services, the subrecipient?s indirect cost rate was 43.5%, but the subrecipient improperly used 44%.Travel ExpensesOffice staff reimbursed three subrecipients for mileage above the approved rate, resulting in $237 of federal questioned costs. The State of Tennessee?s Comprehensive Travel Regulations allow the state to reimburse mileage at $0.47/mile; however, staff approved mileage at rates greater than the allowed amount.Office staff reimbursed one subrecipient for one night?s stay in a hotel above the approved rate, resulting in $12 of federal questioned costs. The State of Tennessee?s Comprehensive Travel Regulations allow the state to reimburse subrecipients for actual lodging costs plus tax incurred up to the applicable maximum amounts as indicated on the reimbursement rate schedule.MealsOffice staff reimbursed two subrecipients for unallowable meals, resulting in $105 of federal questioned costs. According to the office?s OCJP Grants Manual, ?Reimbursement for a single meal for employees on a one-day travel status is not permitted.?Risk AssessmentIn the department?s 2018 Financial Integrity Act Risk Assessment, management addressed the risk that costs charged to a federal grant may not be allowable under program regulations. The assessment identified several control activities, including the office?s fiscal and program subrecipient monitoring. However, the office?s control may not be effective to mitigate its risk. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to the Green Book?s Principle 7, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.CauseBecause the office does not require subrecipients to submit documentation of expenditures when they request reimbursements, the office?s monitoring must be sufficient to prevent and detect improper reimbursements to subrecipients. Even though subrecipients submit a one-page summary of costs by line item, such as payroll and travel, office staff did not have detailed information about the underlying expenditures when approving the subrecipients? reimbursement requests. According to office management, subrecipient monitoring activities include a review of subrecipient?s expenditures that should detect unallowable costs. Given that we found that 7 of 25 subrecipients (28%) in our sample requested reimbursement for unallowable costs, we cannot conclude that management?s only control to prevent and detect unallowable costs is operating effectively.EffectBy inadvertently approving $593 in unallowable expenditures, office management did not comply with federal cost principles that help ensure the department is a good steward of federal funds. Federal regulations address actions that federal agencies may impose in cases of noncompliance. As noted in ?Remedies for noncompliance,? 2 CFR 200.338, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in ?Specific conditions,? 2 CFR 200.207,1) Requiring payments as reimbursements rather than advance payments;2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;3) Requiring additional, more detailed financial reports;4) Requiring additional project monitoring;5) Requiring the non-Federal entity to obtain technical or management assistance; or6) Establishing additional prior approvals.Furthermore, 2 CFR 200.338 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.c) Wholly or partly suspend or terminate the Federal award.d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).e) Withhold further Federal awards for the project or program.f) Take other remedies that may be legally available.RecommendationGiven the office?s limited resources and number of subrecipients it reimburses from federal programs, the Commissioner should work with the office?s Director and monitoring staff to develop a multi-faceted approach to ensure that subrecipients comply with all federal requirements and to enhance monitoring effectiveness. This approach should include re-evaluating or monitoring expenditure sampling methodologies in order to review sufficient documentation to detect unallowable costs. If monitors find unallowable costs, management should take the appropriate action, such as elevating the subrecipient to high risk, increasing monitoring frequency, and recovering questioned costs.The Commissioner should assess all significant risks, including the risks noted in this finding, in the department?s documented risk assessment. The risk assessment and the mitigating controls should be adequately documented and approved by the Commissioner. The Commissioner should implement effective controls to ensure compliance with applicable requirements; assign employees to be responsible for ongoing monitoring of the risks and any mitigating controls; and act if deficiencies occur.Management?s CommentWe concur. OCJP has multi-faceted procedures in place to ensure that subrecipients comply with all federal requirements. Monitoring is extremely effective in determining noncompliance and recouping questioned costs. OCJP reviews agencies prior to contract award to determine risk. Varying levels of oversight are then implemented based on the pre-award risk assessment. Once the contract is fully executed, OCJP program managers complete a risk assessment within 60 days of the contract start date, and then annually in the case of multi-year contracts. Frequency of program and fiscal monitoring is determined based on this risk assessment. Sample sizes are expanded during monitoring visits at the auditor?s discretion based on the potential materiality of identified issues. Additionally, agencies are monitored more frequently if significant issues are discovered. OCJP has a process to track and recoup all questioned costs that are identified. If any issues arise during the monitoring cycle, the agency?s risk assessment is updated and the monitoring plan is revised as necessary within the monitoring cycle.OCJP also has procedures in place to review all invoices submitted for reimbursement prior to processing for payment. This review helps identify areas that could lead to questioned costs. Issues found during this review result in the invoice being sent back for correction and/or additional documentation requested before the invoice will be processed for payment.OCJP will update the department?s risk assessment to account for this finding; the audit supervisor will oversee the work of all auditors as it relates to this finding and the Assistant Director of the Fiscal Unit will be responsible for overseeing the overall direction of the fiscal monitoring, monitor any risks and implement mitigating controls. The update to the risk assessment will be finalized for the fall 2020 submission.

Finding Number: 2019-012CFDA Number: 16.575Program Name: Crime Victim AssistanceFederal Agency: Department of JusticeState Agency: Department of Finance and AdministrationFederal Award Identification Number: 2015-VA-GW-0018 and 2016-VA-GX-0053Federal Award Year: 2015 and 2016Finding Type: Material Weakness and NoncomplianceCompliance Requirement: ReportingRepeat Finding: N/APass-Through Entity: N/AQuestioned Costs: N/AManagement of the Office of Criminal Justice Programs has not established proper controls over report preparation and report review processes and has reported inaccurate and incomplete information to the federal grantorBackgroundThe Department of Finance and Administration?s (the department) Office of Criminal Justice Programs (the office) is responsible for administering the Crime Victims Assistance program, which is funded by and known as the Victims of Crime Act of 1984 (VOCA). While collaborating with other public and private nonprofit organizations, the office uses VOCA grants to provide services to victims of crime in Tennessee.The U.S. Department of Justice?s (DOJ) requires the Office of Criminal Justice Programs to file a Federal Financial SF-425 report quarterly for each VOCA grant. The quarterly reporting periods end December 31, March 31, June 30, and September 30. The cumulative report includes summary information on expenditures, unliquidated obligations, recipient share (match), program income, and indirect expenses for the duration of the grant. DOJ requires the office to submit the report 30 days after the end of the reporting quarter (See Schedule of Findings and Questioned Costs for footnote) through DOJ?s Grants Management System.The department?s Office of Business and Finance is responsible for performing all fiscal related duties on behalf of the Office of Criminal Justice Programs, including the submission of financial reports to DOJ. At the close of each period, the Accountant II provides a trial balance for all VOCA awards and enters the VOCA program and administration expenditure totals into a spreadsheet used to track the available funds of each federal project. To calculate the current period total, the Accounting Manager subtracts the current cumulative expenditure totals from the cumulative expenditure totals reported in the previous period. The Accountant II performs further calculations for some of the information included on the SF-425 report. Specifically, lines 10i, ?Total Recipient share required,? and 10j, ?Recipient share of expenditures,? require fiscal staff to report the subrecipient?s match of VOCA expenditures.?Project Match Requirements,? Title 28, Code of Federal Regulations (CFR), Part 94, Section 118, requires subrecipients to match at least 20% of the ?total cost of each project? unless subrecipients obtain exception waivers from the Office of Criminal Justice Programs to match less or not at all. DOJ allows for and grants full and partial match waivers to a portion of the office?s recipients, based on an application process. Subrecipients must submit a written request for a waiver to the office?s Senior Audit Manager, who typically considers factors such as local resources, annual budget changes, past ability to match, and whether the funding is for new or additional activities to determine whether to approve or deny the waiver request.Conditions and CauseWe found that Office of Business and Finance management did not have written policies and procedures for the federal reporting process to ensure staff correctly prepared and management sufficiently reviewed federal reports prior to submitting them to DOJ.Inaccurate ReportingFor the Accounting Manager to report information accurately in the SF-425 report, the Accountant II must identify each subrecipient?s approved matching rate and then calculate the total amount of match based on their expenditures. However, based on our review of the Office of Criminal Justice Programs? SF-425 quarterly report for December 2018, we noted that the Accounting Manager, who compiled and submitted the reports, did not accurately report line ?10i. Total recipient share required.? This line item is important as it is the basis for determining the subrecipients? required match. In order to calculate the total recipient share required, the Accountant II excluded all full waiver recipients and assumed all other recipients matched at 20%, thereby ignoring the partial waivers granted to recipients.We recalculated the Total Recipient Share Required by obtaining each recipient?s matching rate and multiplying by the recipient?s amount of expenditures for the period. Based on this, we determined that the state overreported the Total Recipient Share Required by $374,893.See Schedule of Findings and Questioned Costs for chart/table.According to the Accounting Manager, DOJ auditors informed Office of Business and Finance staff that they could use estimates for quarterly reports; however, fiscal staff must report actual numbers on the final report. As such, the Accounting Manager believed the Accountant II used an acceptable methodology. The Accounting Manager, however, was not able to provide any documentation of this discussion and based on our review of the reporting requirements, we could not identify guidance that permits an estimation for line 10i, total recipient share required. According to the DOJ?s Grants Management System User Guide, this field should include ?all matching and cost sharing provided by recipients and third-party providers to meet the level required by the program.?Incomplete ReportingAdditionally, we found that the Accounting Manager did not report required financial information associated with indirect costs for lines 11a-d and 11f on the SF-425 report despite the Office of Criminal Justice Programs charging indirect costs to the grant. According to the DOJ Grants Financial Guide, Section 3.15, ?Reporting Requirements,? the state agency is required to report the type and correct indirect cost rate and/or base supplied by the cognizant federal agency.Based on our review of the negotiated agreement between the office and the federal entity, dated May 11, 2018, DOJ approved the office to operate with a provisional indirect cost rate during the reporting period. According to the Accounting Manager, fiscal staff did not report the indirect cost information in the report because the rate was provisional, and the Office of Criminal Justice Programs was negotiating a new, final rate. Based on our interpretation of the DOJ Grants Financial Guide, Office of Business and Finance staff should have used the provisional rate and included the office?s indirect costs in its SF-425 reports.No Documentation of ReviewFinally, due to a lack of supporting documentation, we were unable to determine whether the Accounting Manager?s review of the SF-425 was adequate or complete. The Accounting Manager claimed to review the information received from the Accountant II before including the information in the report; however, the supporting documentation of this review was lost when emails were not archived and were deleted from the system.Risk AssessmentGiven the problems identified during our fieldwork, we also reviewed the department?s December 2018 Financial Integrity Act Risk Assessment and determined that management?s risk assessment addressed the risks associated with reporting inaccurate information on federal reports. The assessment identified several control activities that did not explicitly address or reduce the risk of inaccurate and incomplete information. Instead, the controls focused more on the risk of not submitting the reports timely.CriteriaInadequate and Incomplete ReportingAs stated in ?Financial management,? Title 2, CFR, Part 200, Section 302,(a) . . . the state?s and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions . . .(b) The financial management system of each non-Federal entity must provide for the following . . . [a]ccurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirementsNo Documentation of ReviewThe U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Sections 3.9 through 3.11 of the Green Book,Management develops and maintains documentation of its internal control system.Effective documentation assists in management?s design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel....Management documents internal control to meet operational needs. Documentation of controls, including changes to controls, is evidence that controls are identified, capable of being communicated to those responsible for their performance, and capable of being monitored and evaluated by the entity.Risk AssessmentAccording to Principle 7.02 of the Green Book, ?Identify, Analyze, and Respond to Risks,? management should identify ?risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.?EffectWithout establishing and implementing effective reporting controls, neither the office nor DOJ can properly track subrecipient match and the Office of Criminal Justice Programs? indirect costs, which may risk losing federal funds or other penalties as a result of failing to report accurate financial data. Without accurate and complete financial reporting, DOJ is unable to effectively monitor the status of VOCA funds awarded to the department.Additionally, federal regulations address actions that may be imposed by federal agencies in cases of noncompliance. As noted in 2 CFR 200.338, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in section 200.207, ?Specific conditions:?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.RecommendationThe Commissioner should ensure that the Office of Business and Finance?s Fiscal Director, and the Office of Criminal Justice Programs? Director implement training procedures to ensure staff are aware of all SF-425 reporting requirements. Additionally, the Fiscal Director should implement controls to review and ensure the accuracy of all submitted SF-425 data and that staff retain financial report supporting documentation in accordance with federal and state record disposition requirements.The Commissioner should assess all significant risks, including the risks noted in this finding, in the department?s documented risk assessment. In addition, the Commissioner should adequately document and approve the risk assessment and mitigating controls. The Commissioner should ensure that management implements effective controls to ensure compliance with applicable requirements; assign employees to be responsible for ongoing monitoring of the risks and any mitigating controls; and act if deficiencies occur.Management?s CommentWe concur. The Office of Business and Finance (OBF) has begun the process of updating and adding additional written procedures for the internal steps involved in generating the SF-425. OBF expects the procedures to be finalized and implemented by the end of March 2020. These written procedures will also address requirements for maintaining documentation of review of SF-425s prior to their submission. Additionally, staff has been retrained on the instructions for the SF-425 provided by our federal partners.The OBF has already begun and will continue an extensive review of all significant risks associated with the SF-425 reporting requirements and will update or add identified risks to the department?s risk assessment documents. Appropriate OBF staff will monitor these risks and their mitigating controls and will act to correct any deficiencies that may be identified.The Office of Criminal Justice Programs (OCJP) requires that the financial points of contact (FPOC) successfully complete the Office of Justice Programs (OJP) financial management and grant administration training. This training fully outlines all SF-425 reporting requirements. This training is required within 120 days of being assigned as a FPOC and is reoccurring every 3 years.

Finding Number: 2019-013CFDA Number: 16.575Program Name: Crime Victim AssistanceFederal Agency: Department of JusticeState Agency: Department of Finance and AdministrationFederal Award Identification Number: 2015-VA-GW-0018 and 2016-VA-GX-0053Federal Award Year: 2015 and 2016Finding Type: Significant DeficiencyCompliance Requirement: EligibilityRepeat Finding: N/APass-Through Entity: N/AQuestioned Costs: N/AOffice of Criminal Justice Programs management did not establish effective controls to ensure that Victims of Crime Act of 1984 grants were properly awarded and executedBackgroundThe Department of Finance and Administration?s (the department) Office of Criminal Justice Programs (the state office) is responsible for administering the Crime Victims Assistance program, which is funded by and known as the Victims of Crime Act of 1984 (VOCA). The U.S. Department of Justice?s Office for Victims of Crime awards victim assistance grants to the department annually based on the amount available within the Crime Victims Fund and the state?s population. The state office must distribute 95% of all funds through subawards to subrecipients that provide direct services to victims, such as rape treatment centers, domestic violence shelters, centers for missing children, and other community-based victim coalitions and support organizations.Under a competitive eligibility process, VOCA grant applicants (subrecipients) apply to the state office through open solicitations. According to the state office?s Internal Procedures Manual, applicants must submit a proposed budget, project narrative detailing how the agency intends to use the grant, and a current balance sheet to demonstrate the entity?s ability to provide a monetary match as part of its application.Selecting Eligible SubrecipientsTo determine eligible applicants, the state office uses an evaluation team (See Schedule of Findings and Questioned Costs for footnote) to score the grant applicants? applications and make recommendations to management by preparing a summary memo as to which applicants should receive grant awards. The management review team, consisting of the Director, Deputy Director, Program Assistant Director, and the Program Supervisor, review the summary memo and determine the amount to be awarded for each selected applicant. The management review team documents its decisions in a funding plan, which sets the maximum allowable amount for each grant award, and submits the funding plans to the Assistant Commissioner for review and approval.Subrecipient Notification and Grant Award TrackingAfter the Assistant Commissioner makes a grant applicant determination, the solicitation?s program manager, who is responsible for managing the subrecipients? grants from the application to the grant award?s end, sends either the acceptance or denial letter to the applicant but does not provide the grant award amount. Concurrent with the notification, the program manager enters the applicant?s grant amounts into the office?s subrecipient tracking spreadsheet to prepare the grant document and to create the grant record.Final Grant Award Review and Award DeterminationAfter notification and creation of the grant record, program managers, program supervisors, and the Senior Audit Manager review the applicants? program narratives and budget proposals to ensure that the applicants did not include unallowable costs in the proposed grant budget. According to the Director, management often makes changes to the grant award budget totals during this process, which staff document in the spreadsheet.Once all reviewers are satisfied with the approved applicants? grant budget, the responsible program manager enters the budget numbers into the grant award. Based on our review of the state office?s Internal Procedures Manual, the Program Manager, Program Supervisor, Programs Assistant Director (if needed), and Quality Assurance Program Manager review the prepared grant award before management sends the grant award to the subrecipient and the Commissioner for signature, thereby executing the grant award.Conditions and CauseThe State Office?s Written Policy Did Not Include Parts of Management?s Subrecipient Grant Award Process, and Management Did Not Maintain Eligibility DocumentationState office management did not include the following processes in its written policy or maintain documentation relevant to these processes. We found the following processes were missing:? management?s review of the evaluation team?s recommendations;? management?s determination of funding plan amount submitted to the Assistant Commissioner for review and approval; and? program managers, program supervisors, and the Senior Audit Manager?s review of grant budgets to ensure they only contain allowable costs after a funding plan?s approval.The Director stated that management used internal documentation and approvals for all changes made to VOCA grant award amounts, but management did not formally document these review and approval processes in written policy.From July 1, 2018, through June 30, 2019, the state office awarded 228 subrecipients total grant awards of $45,614,025. To determine if the state office complied with federal and state eligibility documentation requirements, we tested a nonstatistical random sample of 60 grants awards totaling $19,205,512. Based on our work, we found that management did not retain all required documentation in the files for the 60 grant awards tested.Based on discussions, the Assistant Director stated that staff did not retain all required documentation to support management?s decisions to award grants that provide a specific service to victims of crime, or management?s decision to continue an existing grant. Missing documentation included items such as? the evaluation team?s score sheets;? the current balance sheet if the subrecipient was a nonprofit or public agency;? the funding plan; and? supporting documentation for contract budget revisions after management approved the funding plan.Risk AssessmentWe reviewed the department?s 2018 Financial Integrity Act risk assessment and determined that management did not identify the risk that controls over the state office?s grant eligibility processes was either ineffective or was not in place to mitigate the risks.CriteriaThe U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. Principle 10.03 of the Green Book provides examples of internal control activities management may implement, including reviews at the functional or activity level and documentation of transactions and internal control. The Green Book advises that management should ?compare actual performance to planned or expected results throughout the organization? and ?clearly document internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination.? It also states that documentation and records should be ?properly managed and maintained?.The state office?s Internal Procedures Manual outlines its grant award process and details certain documentation that should be provided by the subrecipient and/or retained by the office including? an Intent to Apply form;? subrecipient applications that should contain:o budget;o project narrative;o overall project duration;o project director;o match share of the budget line items;o applicant?s employer identification number (EIN), data universal number system (DUNS), system for award management (SAM) number; ando current balance sheet (non-profit and public agencies);? score sheet; and? funding plan.According to Principle 7.02 of the Green Book, ?Identify, Analyze, and Respond to Risks,?Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.EffectWithout effective controls over the eligibility and the matching processes, management increases the risk that it may incorrectly award subrecipients and/or incorrectly prepare and execute grant awards, which may result in noncompliance with federal program requirements. Federal regulations address actions that federal agencies may impose in cases of noncompliance. As noted in ?Remedies for noncompliance,? Title 2, CFR, Part 200, Section 338, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or passthrough entity may impose additional conditions,? including, as described in ?Specific conditions,? Title 2, CFR, Part 200, Section 207:1) Requiring payments as reimbursements rather than advance payments;2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;3) Requiring additional, more detailed financial reports;4) Requiring additional project monitoring;5) Requiring the non-Federal entity to obtain technical or management assistance; or6) Establishing additional prior approvals.RecommendationThe Director should develop and implement proper internal controls to ensure that state office staff create, document, and implement a process for negotiation with subrecipients that provides adequate documentation for any subsequent review, as well as maintain all required supporting documentation. Furthermore, the Director and Assistant Director should ensure that all state office staff are aware of and follow established controls.Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentWe concur. OCJP?s very detailed Internal Procedures Manual thoroughly documents many processes. However, auditors were able to identify some procedures that could be enhanced. This includes known internal procedures that were not explicitly written. For the FY2021 contracting cycle, OCJP put all process steps in writing. OCJP held an all-staff meeting on February 4, 2020 to discuss the updates and an additional training is slated for March 17, 2020.OCJP will update the department?s risk assessment to account for this finding to include outlining responsibilities for the Senior Program Manager and Program Manager during the application process. The update to the risk assessment will be finalized for the fall 2020 submission.

Finding Number: 2019-014CFDA Number: 16.575Program Name: Crime Victim AssistanceFederal Agency: Department of JusticeState Agency: Department of Finance and AdministrationFederal Award Identification Number: 2015VAGX0018 and 2016VAGX0053Federal Award Year: 2015 and 2016Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: Subrecipient MonitoringRepeat Finding: N/APass-Through Entity: N/AQuestioned Costs: N/AOffice of Criminal Justice Programs management has not developed policies to ensure that all applicable subrecipients receive required single auditsBackgroundThe Department of Finance and Administration?s (the department) Office of Criminal Justice Programs is responsible for administering the Crime Victims Assistance program, which is funded by and known as the Victims of Crime Act of 1984 (VOCA). The Office for Victims of Crime within the U.S. Department of Justice distributes crime victim assistance grants to states through annual apportionments. According to Title 28, Code of Federal Regulations (CFR), Part 94, Section 107(a), the Office of Criminal Justice Programs (the office) must distribute 95% of all funds through subawards to subrecipients that provide direct services to victims, such as rape treatment centers, domestic violence shelters, centers for missing children, and other community-based victim coalitions and support organizations.Condition and CriteriaNo Formal Process to Annually Ensure Federal Audit Requirements were MetUnder federal grant requirements when a state provides subawards to subrecipients for the purpose of providing direct services to victims, the state must provide the subrecipients with sufficient information to ensure the subrecipients can comply with all applicable federal requirements when administering their grants. One such requirement, ?Audit requirements,? 2 CFR 200.501(a), requires subrecipients that have expended $750,000 within their fiscal year to obtain a single audit so that the federal grantor and the state (the pass-through entity) can reasonably ensure that the subrecipients have complied with applicable requirements.Furthermore, the office is required by ?Requirements for pass-through entities,? 2 CFR 200.331(f), to verify that all subrecipients that spent $750,000 or more obtained a single audit. As such, if the office?s subrecipients received any audit findings related to the VOCA program, the office must issue a management decision within six months of the audit report?s release, indicate whether the office sustained the finding, and describe any corrective action the subrecipient must take (See Schedule of Findings and Questioned Costs for footnote).Based on our discussion with office management, we found that management had not implemented a process to ensure that office staff annually reviewed subrecipients? total federal expenditures or ensured subrecipients obtained a single audit as required. Rather, office monitors only reviewed subrecipients? total federal expenditures during monitoring visits, which occur once every three years. As a result, office staff may not know whether a subrecipient met the audit threshold each year.We identified 36 VOCA subrecipients (local governments and nonprofits) that expended at least $750,000 in federal funding during fiscal year ended June 30, 2018 (See Schedule of Findings and Questioned Costs for footnote), and thus the office was required to ensure that the subrecipients were audited and that the office obtained the audits for review. Based on our testwork, even though the subrecipients were audited, we found that for 22 of 36 subrecipients tested (61%), office staff did not obtain the subrecipients? 2018 single audits or follow up on any VOCA-related findings. To determine whether subrecipients? auditors found noncompliance with the VOCA grant, we reviewed the 22 subrecipients? single audit reports and found that the reports did not contain any VOCA-related findings.Risk AssessmentWe reviewed the department?s December 2018 Financial Integrity Act Risk Assessment and determined that management did not identify the risk of noncompliance with federal audit requirements or a mitigating control. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to the Green Book?s Principle 7.02, ?Identify, Analyze, and Respond to Risks,? management should identify ?risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.?CauseBased on our discussions with office management, management did not establish an annual process to verify whether subrecipients obtained a single audit as required because management believed this was the Central Procurement Office?s responsibility. Instead, management only considered this federal requirement during subrecipient monitoring visits.According to the Senior Audit Manager, she implemented a process in summer 2019 to ensure that she obtained a single audit report for all VOCA subrecipients that expended $750,000 or more in federal funds. As a result, the Senior Audit Manager provided us copies of the 2018 single audit reports for 16 of the 22 subrecipients noted above.EffectWhen management does not verify that applicable subrecipients obtain single audits and perform their own required review of those audits, management increases the risk that subrecipients may, in the process of administering federal grants,? not receive the required audit timely;? use federal grant funds for unauthorized purposes; and/or? fail to comply with federal statutes and regulations, as well as federal grant awards? terms and conditions.Without staff timely reviewing the subrecipients? audit reports, office management?s ability to issue management decisions for audit findings within six months of accepting the audit is more difficult. Not issuing management decisions timely or at all increases the risk of subrecipients not correcting problems with internal controls or compliance with regulations.RecommendationThe office?s Director should ensure that an annual process, including written policies and procedures, is developed and implemented to ensure that the office verifies that all subrecipient audits are completed every year; that program staff review the audit reports; and that management issues decisions and achieves corrective action, as applicable.Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and act if deficiencies occur.Management?s CommentWe concur. In November 2019, OCJP was notified by the CPO that they were revising Policy 2013-007 and section D.19. of the grant contract templates to move the oversight responsibility of subrecipient Single Audits from the CPO to the Granting State Agency. At that time, OCJP began developing written procedures to track agencies that require a Single Audit. OCJP?s Internal Procedures Manual has been updated to include our written process.OCJP will receive the Notice of Audit Form and subrecipient audits as a result of the revised D.19. language in the grant templates. These forms will be submitted to an OCJP email address overseen by the OCJP fiscal manager. An Access database query has been created and has been in use since November 2019 to track the following: which subrecipients are required to have a Single Audit, whether it was received, if there were findings, and when there were findings related to OCJP funding, the subrecipient's corrective response to the finding.OCJP will update the department?s risk assessment to account for this finding, identifying the roles of the audit supervisor and fiscal manager in overseeing receipt of required subrecipient audits and tracking agency corrective responses. The Assistant Director of the Fiscal Unit will be assigned the responsibility for ongoing monitoring of these risks and mitigating controls. The update to the risk assessment will be finalized for the fall 2020 submission.

Finding Number: 2019-015CFDA Number: 93.778Program Name: Medicaid ClusterFederal Agency: Department of Health and Human ServicesState Agency: Department of Finance and AdministrationFederal Award Identification Number: 05-1805TN5MAP and 05-1905TN5MAPFederal Award Year: 2017 through 2019Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: EligibilityRepeat Finding: N/APass-Through Entity: N/AQuestioned Costs: $9,499The Division of TennCare did not have an effective key internal control for determining eligibility; as a result, management paid capitation and administrative payments and claims for members who were not eligible, resulting in $14,424 in federal and state questioned costsBackgroundTennCare is Tennessee?s Medicaid program, a federal and state funded program that provides health insurance coverage to certain groups of low-income individuals, such as pregnant women, children, caretaker relatives of dependent children, and other adults with disabilities. In general, the Division of TennCare (TennCare) makes three types of payments on behalf of its members:? capitation or administrative (See Schedule of Findings and Questioned Costs for footnote) payments to managed care organizations who contract with TennCare to deliver services to members;? fee-for-service claims paid directly to providers for services (See Schedule of Findings and Questioned Costs for footnote) provided to certain members, such as children enrolled in the Department of Children?s Services? (DCS) foster care or adoption assistance program, or for certain costs relating to Medicare for members who are enrolled in both Medicaid and Medicare; and? reimbursements to benefit managers for services, such as pharmacy, dental, and health services.TennCare EligibilityInitial Eligibility ProcessProcess in place July 1, 2018, through March 31, 2019 ? Prior to implementation of the TennCare Eligibility Determination System (TEDS)Prior to the implementation of the TennCare Eligibility Determination System (TEDS), applicants applied to TennCare in one of three ways:? online through the Federally Facilitated Marketplace (See Schedule of Findings and Questioned Costs for footnote);? by phone or a paper application; or? by visiting a Department of Human Services office for in-person assistance to apply online, by paper, or by phone.Once an applicant submitted an application, a TennCare eligibility specialist processed the application manually to determine if the applicant was eligible under any available eligibility category.Process in place April 1, 2019, through June 30, 2019 ? After TEDS (See Schedule of Findings and Questioned Costs for footnote) implementationWith the implementation of TEDS beginning April 1, 2019, applicants were able to apply for eligibility using TennCare Connect, TEDS? public-facing web portal. Whether an applicant applies by phone, paper, or through TennCare Connect, the applicant?s information is entered into TEDS for automated processing, thereby removing the need for human intervention in many cases. If the applicant?s eligibility determination requires human intervention, a TennCare eligibility specialist is assigned to process the application manually (See Schedule of Findings and Questioned Costs for footnote) in TEDS to determine if the applicant is eligible for any available TennCare eligibility category.Eligibility Category AssignmentWhen TennCare staff approve individuals for coverage, TennCare assigns the applicants (members) to eligibility categories, based on conditions that make them eligible (children, pregnant women, parents or caretakers of children, or other categories for certain adults).Transitional Medicaid CategoryTransitional Medicaid is authorized for members who lose Child or Caretaker Relative eligibility due to increased earnings (income thresholds). To be eligible for Transitional Medicaid, the members must have been eligible for and receiving benefits in their appropriate category (Child or Caretaker Relative) for at least three of six months immediately preceding the month of ineligibility. If the members are determined eligible for Transitional Medicaid, they are eligible for 12 months.Children in DCS CustodyTennCare contracts with DCS to determine eligibility for children who receive Title IV-E (See Schedule of Findings and Questioned Costs for footnote) foster care or adoption assistance (See Schedule of Findings and Questioned Costs for footnote) and children with special medical needs who receive a non-Title IV-E state adoption subsidy payment. Based on the contract terms, DCS must send TennCare the following documents for each child in DCS custody:? quarterly reports that include information such as children?s eligibility determination activities;? a report of all children entering and exiting DCS custody each business day; and? monthly reports that provide lists of children who are incarcerated, hospitalized, or on runaway status.Eligible DCS children can be enrolled in either the Foster Care Category, where a child member can have coverage until he or she turns 18 or, once a child reaches age 18, the child can be deemed eligible for transitional foster care coverage called the Extension of Foster Care program, if the child meets the following requirements:? a young adult completing their high school diploma or General Education Diploma;? a young adult enrolled in an institution that provides post-secondary or vocational education; or? a young adult that has a serious disability that prevents them from pursuing education or full-time employment.Pseudo (or temporary) Social Security Numbers CategoryAccording to TennCare?s Assistant Commissioner of Member Services, management may have to assign a pseudo (temporary) Social Security number to members when they enroll in TennCare if the member cannot provide a Social Security number at the time of application. Management assigns pseudo Social Security numbers when members meet one of the following conditions:? a newborn who has not been issued a valid Social Security number;See Schedule of Findings and Questioned Costs for chart/table.? a child in DCS custody who qualifies for the federal adoption assistance program and may be applying for a new Social Security number;? an undocumented or ineligible immigrant receiving payments for emergency services;? a person who is in the process of applying for a Social Security number; or? a person approved by the Federally Facilitated Marketplace who has incomplete Social Security number data.Prior to the implementation of TEDS,TennCare?s system was designed to automatically send quarterly letters to members with pseudo Social Security numbers once the member had been enrolled for at least 9 months to determine if the member had ultimately obtained their social security number. Management?s auto-generated letters requested the member to submit a valid Social Security Number within 90 days of the date on the letter. If management did not receive the letter within 90 days, management terminated the members? eligibility. Management ended this quarterly process after September 30, 2018, as management prepared to implement TEDS.With TEDS, the system automatically interfaces with the Social Security Administration?s database to validate members? social security numbers.Eligibility RedeterminationFederal regulations (Title 42, Code of Federal Regulations [CFR], Part 435, Section 916) state that, after members? initial eligibility determination and enrollment, the Division of TennCare is required to redetermine members? TennCare eligibility annually. During our audit period, TennCare contracted with Maximus Inc., to perform TennCare?s eligibility redeterminations. Under the contract, Maximus prepared and mailed renewal packets to members that TennCare scheduled for redetermination. Members were asked to complete the renewal packets with updated information, such as household size and income, attach supporting documentation, and mail the renewal packets back to Maximus. Once Maximus received the renewal packets, Maximus? staff processed the renewal packets to determine if the members were still eligible for TennCare coverage. If Maximus determined the member was no longer eligible for TennCare, staff initiated the member?s termination process.When TennCare implemented TEDS, TennCare management assumed responsibility for redetermining member eligibility and no longer contracts with Maximus for redetermination of members.Condition, Criteria, and CauseOverall Eligibility RequirementsFrom a population of 1,727,384 TennCare members, totaling $4,593,296,080, for whom TennCare paid capitation payments to Managed Care Organizations during fiscal year 2019, we tested a nonstatistical random sample of 86 members, totaling $111,140, to determine if TennCare appropriately determined the members? eligibility for TennCare coverage. At this time, TennCare determined these members? eligibility prior to implementing TEDS. We found that TennCare miscategorized eligibility for 3 of 86 members tested (3%). Specifically, we found the following.?See Schedule of Findings and Questioned Costs for chart/table.? Based on our review, we found that management incorrectly assigned one member to the incorrect eligibility category when management redetermined the member?s eligibility. Management approved the member?s coverage?an 8-year old boy?in the pregnancy category, rather than a category for children. Because we determined the member was still eligible for TennCare, we did not question costs. According to TennCare?s Assistant Commissioner of Member Services, the redetermination contractor, Maximus, erroneously duplicated the mother?s coverage (pregnancy category) on the child?s eligibility information.? Furthermore, we found that DCS management did not inform TennCare management of a needed change to one member?s TennCare coverage. The member moved from DCS custody to the Extension of Foster Care program. Because the member was eligible in the Extension of Foster Care program during the audit period, we did not question costs. However, during fieldwork, we determined that the member left the Extension of Foster Care program; at that point he was no longer eligible for TennCare. According to discussions with TennCare?s Assistant Commissioner of Member Services and the DCS Program Director, DCS allowed children to participate in an extension program under certain criteria up to age 21; however, DCS did not report to TennCare members who left the Extension for Foster Care program on the DCS custody reports. Therefore, TennCare would not have known to terminate this member?s eligibility category in interchange (See Schedule of Findings and Questioned Costs for footnote).See Schedule of Findings and Questioned Costs for chart/table.? Finally, we found one member that received Transitional Medicaid coverage; however, management could not provide documentation demonstrating that the member?s parent or caretaker relative lost TennCare coverage as a result of increased earnings. We also reviewed the member?s information to determine if he may have been eligible in another category; however, we found that he was not eligible for any other eligibility category , resulting in federal questioned costs totaling $1,504 and a remaining $783 in state questioned costs. Based on discussions with TennCare?s Assistant Commissioner of Member Services, Maximus approved this member in error.According to the Social Security Act, Section 1902 (5), ??the determination of eligibility for medical assistance under the plan shall be made by the State or local agency administering the State plan approved??Eligibility Requirements Relating to Non-U.S. CitizensWe identified the population of TennCare members who had been assigned pseudo Social Security numbers during our audit period. We specifically analyzed this population to determine TennCare?s compliance with the eligibility requirements for non-U.S. Citizens and found the following errors.Services to Members with a Pseudo Social Security NumberFrom a population of 82 members who were assigned pseudo Social Security numbers during the year ended June 30, 2019, we tested a sample of 60 members to determine if management only assigned a pseudo Social Security number to members who met the one of the categories. For 3 of 60 members tested (5%), the members did not have an eligible citizenship or immigration status in order to receive TennCare coverage. All three members initially applied for CoverKids? (See Schedule of Findings and Questioned Costs for footnote) pregnancy coverage, and they all noted on their applications that they were not U.S. citizens and thus should have only been eligible for the CoverKids pregnancy category. Apparently, these members? family members were U.S. Citizens and receiving TennCare benefits. Based on discussions with the Assistant Commissioner of Member Services, the eligibility counselor incorrectly changed the members? citizenship status, which enrolled them into TennCare. As a result, we identified federal questioned costs totaling $7,684 and remaining $3,981 in state questioned costs.According to 42 CFR 435(406), TennCaremust provide Medicaid to otherwise eligible individuals who are (1) Citizens; or (2) Aliens lawfully admitted for permanent residence [?]; (3) Aliens granted lawful temporary resident status under sections 245A and 210A of the Immigration and Nationality Act if the individual is aged, blind, or disabled [?], under 18 years of age, or a Cuban Haitian entrant [?]; or (4) Aliens granted lawful temporary resident status under section 210 of the Immigration and Nationality Act unless the alien would, but for the 5-year bar to receipt of [Aid to Families with Dependent Children (AFDC) (See Schedule of Findings and Questioned Costs for footnote)] contained in such section, be eligible for AFDC.Emergency Services Provided to Undocumented or Ineligible ImmigrantsThe Social Security Act, Section 1903(v), mandates that TennCare cover emergency services for those who are not eligible for Medicaid only because of their citizenship status. An emergency medical condition is defined as the sudden onset (unforeseen occurrence) of a medical condition manifesting itself by acute symptoms of sufficient severity (including severe pain) such that the absence of immediate medical attention could reasonably be expected to result in? placing the patient?s health in serious jeopardy;? serious impairment to bodily functions; or? serious dysfunction of any bodily organ or part.According to Health Care Finance and Administration, Policy Manual Number: 020.005, Emergency Medical Services, 5. Eligibility Begin and End Dates, ?Coverage will be limited to the length of time required to stabilize the emergent episode.? TennCare management is responsible for paying for the administrative fees and claims specifically related to the emergency service.From a population of 82 members who had a pseudo Social Security number during the year ended June 30, 2019, we filtered the population to identify 77 undocumented or ineligible immigrants classified as receiving emergency services. Immigrants are individuals who may or may not be in the U.S. legally; certain immigrants, such as student visa holders, legal permanent residents with this status for less than 5 years, or undocumented individuals, do not meet the immigration requirements to receive TennCare. Of the 77, we determined that TennCare paid claims for emergency services for 44 undocumented immigrants. Based on our audit work, we found that for 10 of 44 undocumented immigrants tested (23%), TennCare management paid TennCare Select administrative fees outside of the dates the individuals received emergency services. Specifically, we found the following:? For three undocumented immigrants, TennCare did not end administrative payments to TennCare Select on the last day the individual received the emergency service, resulting in $243 in federal questioned costs and the remaining $126 in state questioned costs. According to TennCare?s Assistant Commissioner of Member Services, the TennCare eligibility counselors did not enter an end date in interChange when the individual?s emergency services ended.? For seven ineligible immigrants, TennCare erroneously paid administrative payments to TennCare Select beginning on the first day of the month in which the individuals received emergency services rather than the day the individuals began receiving services, resulting in $68 in federal questioned costs and the remaining $35 in state questioned costs. According to TennCare?s Assistant Commissioner of Member Services, an eligibility counselor updated the individuals? eligibility information in TEDS but did not re-run the individuals? eligibility determination process, which caused interChange to backdate the individuals? eligibility to the first day of the month rather than the date the individuals began receiving emergency service.Risk AssessmentWe reviewed the Division of TennCare?s December 2018 Financial Integrity Act Risk Assessment and determined that management listed the risks of a contractor not fulfilling its contractual obligations and ineligible applicants being approved for eligibility; however, TennCare did not have an effective control to mitigate its risk. Management did not identify the risk that TennCare would pay administrative fees for undocumented immigrants outside the allowed emergency service dates and a mitigating control.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.EffectWhen TennCare management inappropriately approves TennCare benefits, the division increases the risk of adding ineligible individuals to its membership rolls, thereby allowing them to receive a public benefit they are not entitled to receive and rendering related costs unallowable. Charging costs to the federal grantor based on ineligible individuals results in improper federal payments to the state, which require the state to either reduce the next federal draw of funds or reimburse the grantor directly. The U.S. Department of Health and Human Services ultimately makes the determination of and resolution for the federal share of improperly charged costs.Additionally, federal regulations address actions that federal agencies may impose in cases of noncompliance. As noted in 2 CFR 200.338, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.207, ?Specific conditions,?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.Furthermore, Section 200.338 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:(a) Temporarily withhold cash payments pending corrective action of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.(b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.(c) Wholly or partly suspend or terminate the Federal award.(d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).(e) Withhold further Federal awards for the project or program.(f) Take other remedies that may be legally available.RecommendationThe Assistant Commissioner of Member Services should ensure that eligibility counselors are aware of and understand eligibility requirements for all categories in order to properly approve members under the correct category. To assist eligibility counselors when approving eligibility, management should also ensure its information system, TEDS, has the proper edit checks in place to prevent eligibility counselors from approving members for certain eligibility categories when the member?s gender is not compatible with the eligibility category.The Assistant Commissioner of Member Services should ensure that eligibility counselors enter the correct end dates for individuals receiving emergency services and carry out all systematic processes to ensure that interChange has the correct information to approve administrative payments and claims in accordance with federal requirements governing emergency services.TennCare management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentManagement concurs with this finding.TennCare agrees that for two cases identified by auditors, the members? eligibility category was incorrect. These two decisions were made prior to the transition to the new eligibility determination system (TEDS) and were completed through manual processes. These worker errors would now be mitigated through use of the TEDS rules engine that has been programmed to determine the correct outcome and category of eligibility automatically when eligibility is run by either automated processes or through worker action.The auditor findings related to payments for Emergency Medical Services (EMS) outside of the emergent period have also now been mitigated. Some of the issues identified were caused by worker keying errors in the manual form process that was in place prior to TEDS implementation. Those processes were discontinued in the spring of 2019 and all EMS applications are now completed in TEDS. The remainder of the cases were processed in TEDS and were caused by one of two issues. Either the worker processing the case did not run the rules and authorize the case after a correction was made to the underlying data or the case was impacted by a defect that has now been corrected. Both issues caused the transmission of EMS eligibility segments to the Medicaid Management Information System (MMIS) with a start date at the beginning of the month rather than the date that the emergency began. That defect was corrected as of October 2019. A report has also been created in TEDS to monitor cases where a change has been made but not completed by a worker.

Finding Number: 2019-016CFDA Number: 93.917 and 93.994Program Name: HIV Formula Care Grants, Maternal and Child Health Services Block Grant to the StatesFederal Agency: Department of Health and Human ServicesState Agency: Department of HealthFederal Award Identification Number: 2X09HA28331-04, 2X07HA00024-28, 5X07HA00024-29, 1B04MC30643-01, 1B04MC31518-01Federal Award Year: 2018 and 2019Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: Subrecipient MonitoringRepeat Finding: 2018-010Pass-Through Entity: N/AQuestioned Costs: N/AThe Department of Health did not verify that subrecipient single audits were performed for the HIV and MCH programsConditionAs noted in the prior audit, the department did not verify that subrecipient single audits were performed for the HIV and MCH programs. According to the Assistant Commissioner of Compliance and Ethics, as of July 25, 2019, the Department of Health has not reviewed any subrecipients? Single Audit reports for either the HIV Formula Care Grants or Maternal and Child Health Services (MCH) Block Grant programs that were due to the Federal Audit Clearinghouse during the year ended June 30, 2019.Management concurred with the prior audit finding and stated:The Assistant Commissioner of Compliance and Ethics will work with the department?s contract administration division, as well as HIV and MCH program management, to develop a set of policies and procedures that will ensure that the department receives a copy of each subrecipient audit report concurrent with the subrecipient?s submission of their report to the Federal Audit Clearing HouseIn its six-month follow-up for the prior audit finding, dated August 27, 2019, the department informed the Director of State Audit that:A policy that addresses the requirements of 2 CFR [Code of Federal Regulations] 200.331(f) and 2 CFR 200.521(d) has been drafted and was implemented effective July 1, 2019. . .. The policy further outlines the managing program area?s responsibility to review the subrecipient?s audit report and issue a management decision to the subrecipient regarding any findings within six months of the report having been filed with the Federal Audit Clearinghouse. . .. Given the cycles of the contract process, as well as audits for different subrecipients and their respective varying fiscal years, we anticipate seeing evidence of this policy implementation fully executed by June 30, 2020.Regarding the assignment of duties, the policy states:[the] policy will require the program to review audit reports on receipt and to document a management decision of approval or disapproval with the corrective actions outlined by the grantee within six months of the completion of the report and its filing with the Federal Clearinghouse.Criteria2 CFR 200.331(f) states that ?all pass-through entities must . . . verify that every subrecipient is audited as required by Subpart F ? Audit Requirements of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in Section 200.501 Audit requirements.?CauseIn the previous audit we reported that the department had not clearly assigned responsibility for verification of subrecipient audits. Although management drafted a policy during the audit period, corrective action was not complete by the end of audit period since the policy was ?implemented effective July 1, 2019.?EffectWhen management does not verify that applicable subrecipients obtain single audits, it increases the risk that subrecipients may, in the process of administering federal grants,? not receive the required audit timely;? use federal grant funds for unauthorized purposes; and/or? fail to comply with federal statutes and regulations, as well as federal grant award terms and conditions.RecommendationThe department should follow the policy concerning the receipt and review of subrecipient audit reports.Management?s CommentWe Concur. During the 2018 Single Audit of the Department of Health, this finding was noted by the Comptroller?s Office and our agency developed the policy noted in the finding which required a fundamental change to our existing systems of review for subrecipient single audits. The change includes a contract requirement for grantees to provide copies of single audits to program management at the same time they are submitted to the Federal Audit Clearinghouse and for program management to review the audit report and engage the grantee regarding any findings within a six month period after the submission of the audit report to the Federal Audit Clearinghouse.This policy required implementation that involved our division of contracts, legal counsel, and program management; the implementation across these divisions was completed by July 1, 2019. However, the successful completion of the policy?s integration required a full cycle of grant contract execution, subsequent compliance by subrecipients with the single audit requirement, and review by our program management of single audits in a timely manner. Only then will we have the evidence to indicate the effectiveness of our corrective actions.On August 27, 2019, we notified the Comptroller?s Office of our progress in the implementation of this corrective action and indicated at that time that ?we anticipate seeing evidence of this policy implementation fully executed by June 30, 2020.? The responsible individual for monitoring the evidence of this successful implementation of this policy is the Assistant Commissioner of Compliance & Ethics. We believe that our corrective action will produce the intended results by the target date previously indicated to the Comptroller?s Office.

Finding Number: 2019-017CFDA Number: 10.558 and 10.559Program Name: Child and Adult Care Food Program, Child Nutrition ClusterFederal Agency: Department of AgricultureState Agency: Department of Human ServicesFederal Award Identification Number: 175TN331N1099, 185TN331N1099, 185TN331N2020, 185TN340N1050, 195TN331N1099, 195TN331N2020, and 195TN340N1050Federal Award Year: 2017 through 2019Finding Type: Significant Deficiency (10.559), Material Weakness (10.558), Noncompliance (Subrecipient Monitoring)Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Subrecipient Monitoring, OtherRepeat Finding: 2018-015Pass-Through Entity: N/AQuestioned Costs: N/AAs noted in the prior five audits, the Department of Human Services? oversight activities for the Child and Adult Care Food Program and Summer Food Service Program for Children continue to lack sufficient follow-up actions to address repeated sponsors? noncompliance and fraud risk factors, resulting in payments to sponsors that repeatedly violate federal requirementsBackgroundThe Department of Human Services (DHS), in partnership with the U.S. Department of Agriculture and local organizations, operates the Child and Adult Care Food Program (CACFP) and the Summer Food Service Program for Children (SFSP) to provide free, reduced-price, and paid meals to eligible participants. CACFP is a year-round program, and SFSP operates during the summer months when school is out. DHS contracts with subrecipients, who administer the programs and deliver the meals to eligible participants. DHS reimburses the subrecipients to cover the administrative costs and the costs of meals served.DHS?s Responsibilities as a Grant AdministratorAs a pass-through entity for federal funds, DHS is responsible for providing overall program oversight, which includes, but is not limited to,? approving only eligible subrecipients who comply with the federal program requirements and guidelines;? providing appropriate and effective training, technical assistance, and any other necessary support to facilitate successful program participation;? designing effective controls to ensure subrecipients claim the correct number of meals and receive reimbursement payments for meals that are fully compliant with program requirements and guidelines;? monitoring subrecipients? activities to provide reasonable assurance that the subrecipients administer these federal awards in compliance with federal requirements and guidelines; and? maintaining the integrity of the food programs by taking appropriate and prompt actions to address subrecipients? unwillingness and/or inability to comply with the federal requirements and guidelines, which may include performing stricter oversight of the noncompliant subrecipients and, if necessary, terminating them from the program.History of Single Audit Report Results for Food ProgramsSince 2014, we have reported to management the inadequacy of the food programs? administration and recommended the need for a robust program overhaul, with an emphasis on strengthening controls within the monitoring and oversight activities. In the prior five audits, we have reported the following number of findings, outlined in Table 1, both for CACFP and SFSP, with corresponding questioned costs:See Schedule of Findings and Questioned Costs for chart/table.History of Repeated Noncompliance/Fraud Indicators in the Food ProgramsFrom our site reviews of subrecipients, we found fraud indicators and questionable practices at subrecipients and their feeding sites. We have repeatedly communicated to management that until DHS enhances its efforts to identify sponsors with high fraud risk factors and takes aggressive action to ensure sponsors comply or are terminated from the programs, management will continue to pay high risk sponsors that submit questionable billings and/or that do not serve meals to children.We have reported in the annual Single Audit Report the following number of findings (listed in Table 2) that included subrecipients with fraud indicators and the corresponding questioned costs:See Schedule of Findings and Questioned Costs for chart/table.It is important to note that in a majority of instances, we identified improper payments resulting from fraud risk indicators based on samples of transactions we randomly selected for our testwork, suggesting that fraud and corresponding questioned costs are likely higher than we reported in our current and prior years? Single Audit Reports.Management?s Steps to Address Prior-year FindingsIn response to our prior-year findings, management took the following steps to improve management?s oversight of the programs:1) To improve processes within the Audit Services section during monitoring reviews, in May 2017 DHS implemented the Audit Command Language software, (See Schedule of Findings and Questioned Costs for footnote) which replaced the previous pen-and-paper review system. The new system provides electronic access to the working papers from any location and allows staff to retain program records electronically.2) During fiscal year 2018, management filled vacant positions of auditors, monitors, and investigators assigned to the food programs so that staffing levels remained reasonably consistent. In addition, we found consistent retention levels, with no significant turnover, for key management positions directly responsible for overseeing the administration of the food programs.Despite these improvements, management has not yet sufficiently improved internal control processes to identify and follow up on sponsors with fraud risk factors so that management can gain sponsor compliance or promptly remove sponsors that are unable or unwilling to comply with program requirements.Condition A: DHS Did Not Adequately Address the Continuous Noncompliance and Repeat Weaknesses in Internal ControlsOur current audit results include repeated material weaknesses and significant deficiencies in internal controls over compliance with program requirements, as discussed in detail in separate findings in this audit report (see Table 3). These findings, when considered both individually and collectively, indicate that, despite DHS?s continuous efforts to address deficiencies, management still has work to do to establish the oversight necessary to identify sponsors that continue to exhibit an unwillingness to comply with the requirements, as evidenced by our audit results and DHS?s routine monitoring reviews.All six of the food program findings reported in the current audit report are repeat findings. Management?s corrective action was not sufficient to significantly reduce sponsor noncompliance or to correct control deficiencies at both the department and the subrecipient levels. During our discussions with management, we asked why management has been unable to correct the conditions noted, but management did not provide any comments for the majority of the findings by the time we finalized our audit.See Schedule of Findings and Questioned Costs for chart/table.Condition B: Repeat Offenders Continue to Participate in the Food Programs and Submit False ClaimsDespite our numerous prior findings on repeat offenders and fraud indicators, DHS has not yet developed and implemented effective preventive and detective controls to prevent ill-intended subrecipients from participating in the food programs and submitting false claims. During our current audit, we identified numerous subrecipients who continued to exhibit questionable reporting, including submitting false claims by inflating meals on reimbursement requests; photocopying or altering documentation; or claiming meals at fake sites and receiving reimbursement payments for meals not served to children.Condition C: Risk AssessmentWe reviewed DHS?s December 2018 Financial Integrity Act risk assessment and determined that management listed the risk of subrecipients submitting claims without supporting documentation; however, DHS did not have an effective control to mitigate its risk.CauseWe identified the following key contributing factors for the repeat findings shown in this report:Management?s Opinion That Meeting Minimum Federal Requirements Is SufficientSince 2014, we have communicated to DHS that the food programs need a robust overhaul of oversight to address continuous weaknesses. Despite management?s attempts to strengthen the oversight for subrecipients who are unwilling or unable to correct repeat program noncompliance, management has still not improved the process to identify sponsors exhibiting fraud risks or to increase scrutiny of subrecipients that are identified as risky. Management is responsible for maintaining the programs? integrity and therefore should pursue and follow up on the subrecipients until they implement corrective action and achieve compliance. Until these processes are in place and operating effectively, management will continue to pay high risk sponsors that submit questionable billings and/or that do not serve meals to children.Management continues to justify its current level of oversight efforts by stating DHS meets or exceeds minimum requirements established by the federal program. However, merely meeting or even exceeding certain federal requirements is not sufficient management oversight action to actively seek out subrecipients who are submitting questionable meal reimbursement claims. As the grantor and the pass-through entity of the federal funds, it is ultimately management?s responsibility, under the programs? authority, to ensure that only sponsors who are willing and capable to comply with program rules and regulations participate in the programs.Management?s Narrow Focus and Inability to Design and Implement Effective Enhanced Controls Within the Programs? Riskiest AreasWe have reported subrecipients with fraud indicators in our findings for six consecutive years, and management continually fails to examine and scrutinize questionable reporting practices that we consider to be the riskiest and the most vulnerable to fraud. As a result, repeat offenders continue submitting false claims, year after year, by one or a combination of the following methods:? tampering with program documentation,? incorrectly reporting meals,? billing for meals never served, and? misusing program funds.Even though DHS monitors have observed similar inconsistencies during their monitoring reviews, management has not implemented enhanced processes to follow up on unreasonable patterns occurring in the food programs. Management?s narrow focus is based on a checklist of procedures rather than on gathering evidence of improper billings so that these subrecipients can be removed from the programs. Management apparently believes that effective monitoring is measured by the number of site visits performed or the number of questions answered on its monitoring checklists, instead of results-based reviews that ensure subrecipients comply or are promptly removed from program participation. Management continues to rely heavily on subrecipients? integrity for accurate self-reporting of meals and does not adequately follow up on inconsistencies, such as questionable meal reporting patterns, based on its own monitoring results or audit results shared through our findings.Management Has Yet to Achieve and Sustain Program Integrity and StandardsManagement stated in their comments to prior audit findings that program integrity is imperative but, at the same time, it must be balanced within the context of the practical operation of the programs, including inherent challenges of the programs? design. We believe oversight for the food programs is not operating at an acceptable level, as evidenced by continuous and repeat findings noted during our current audit.Training ConcernsDespite all available tools to train subrecipients and strengthen their knowledge on program requirements, both we and DHS monitors continue to observe violations in operations of the food programs, year after year, in some cases for the same subrecipients. These entities have received training and technical assistance and were required to submit numerous corrective action plans from prior-year monitoring noncompliance, yet their violations continue. Although management continues to offer training, either the training is ineffective or the subrecipients? intent is to steal or not to comply. In either case, DHS should closely watch sponsors who repeatedly violate the program rules and should remove consistent offenders from the program. Without stiffer penalties for repeat offenders, management continues to foster an environment characterized by sub-standard performance and dishonest behaviors.Continuous Information Systems Design Deficiencies, Under-utilized Technology, and Lack of Basic Analytical ProceduresEven after implementing the Tennessee Information Payment System (TIPS) and HighBond, which management believed would help resolve these long-standing findings, we continue to identify similar conditions of noncompliance and control deficiencies in both SFSP and CACFP. While TIPS?s edit checks detect when sponsors claim meals over the maximum approved numbers, the subrecipients? failure to accurately calculate meals and maintain accurate and complete documentation to support the reimbursement claims continues to be an issue for the subrecipients and DHS.In addition, management does not use TIPS to its full potential. Despite TIPS having the capability of retaining meal count documentation electronically, during our current audit we have noted instances of missing or lost meal count documentation, resulting in questioned costs. Furthermore, DHS does not consistently perform analytical procedures to analyze the meal claims for reasonableness prior to approving all sponsors? claims for reimbursements, stating that such tasks would be too time-consuming to implement and sustain. In fact, DHS does not even open most claims for review. Management states that it relies on monitoring to review claim documentation, but monitoring staff typically only review subrecipients every few years and for only one selected month. Management has not yet developed historical data and systematic procedures using the available technology, institutional knowledge, and experience with the programs, which could help detect questionable patterns and/or identify irregularities.CriteriaCondition AAccording to ?Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,? Title 2, Code of Federal Regulations (CFR), Part 200, Section 331, the pass-through entity?s monitoring of subrecipients must includeFollowing-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means.In addition, 2 CFR 200.62 states,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity [DHS] designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:a. Transactions are properly recorded and accounted for, in order to: (1) Permit the preparation of reliable financial statements and Federal reports; (2) Maintain accountability over assets; and (3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award;b. Transactions are executed in compliance with: (1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and (2) Any other federal statutes and regulations that are identified in the Compliance Supplement; andc. Funds, property, and other assets are safeguarded against loss from unauthorized use or disposition.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book), Section OV2.14 on management?s role states,Management is directly responsible for all activities of an entity, including the design, implementation, and operating effectiveness of an entity?s internal control system. Managers? responsibilities vary depending on their functions in the organizational structure.Section OV3.05 of the Green Book, regarding design and implementation of internal control, also states,When evaluating design of internal control, management determines if controls individually and in combination with other controls are capable of achieving an objective and addressing related risks. When evaluating implementation, management determines if the control exists and if the entity has placed the control into operation. A control cannot be effectively implemented if it was not effectively designed. A deficiency in design exists when (1) a control necessary to meet a control objective is missing or (2) an existing control is not properly designed so that even if the control operates as designed, the control objective would not be met. A deficiency in implementation exists when a properly designed control is not implemented correctly in the internal control system.Principle 9.04 of the Green Book, on analysis of and response to change, continues,As part of risk assessment or a similar process, management analyzes and responds to identified changes and related risks in order to maintain an effective internal control system. Changes in conditions affecting the entity and its environment often require changes to the entity?s internal control system, as existing controls may not be effective for meeting objectives or addressing risks under changed conditions. Management analyzes the effect of identified changes on the internal control system and responds by revising the internal control system on a timely basis, when necessary, to maintain its effectiveness.Condition BAccording to 7 CFR 225.15(c),Sponsors shall maintain accurate records justifying all meals claimed . . . The sponsor?s records shall be available at all times for inspection and audit by representatives of the Secretary, the Comptroller General of the United States, and the State agency for a period of three years following the date of submission of the final claim for reimbursement for the fiscal year.In addition, according to the 2016 Administration Guide ? Summer Food Service Program,Sponsors may claim reimbursement only for those meals that meet SFSP requirements. Reimbursement may not be claimed for . . . [m]eals that were not served.According to 7 CFR 226.10(c),Claims for Reimbursement shall report information in accordance with the financial management system established by the State agency, and in sufficient detail to justify the reimbursement claimed and to enable the State agency to provide the final Report of the Child and Adult Care Food Program (FNS 44) required under ?226.7(d). In submitting a Claim for Reimbursement, each institution shall certify that the claim is correct and that records are available to support that claim.Condition CAccording to Principle 7, ?Identify, Analyze, and Respond to Risks,? of the Green Book,7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.EffectBecause DHS management has not addressed weaknesses noted in the CACFP and SFSP programs? prior findings, management?s lack of sufficient oversight continues to threaten the integrity of the programs. Without implementing sufficient follow-up processes to address repeat offenders in the future, DHS will continue to? make improper reimbursements to subrecipients;? provide meals to ineligible participants;? not detect noncompliance or fraud timely; and? jeopardize federal funding because of noncompliance.Additionally, federal regulations address actions that federal agencies may impose in cases of noncompliance. As noted in 2 CFR 200.338, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.207, ?Specific conditions,?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of evidence of acceptable performance within a given period of performance;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.Furthermore, Section 200.338 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:(a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.(b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.(c) Wholly or partly suspend or terminate the Federal award.(d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).(e) Withhold further Federal awards for the project or program.(f) Take other remedies that may be legally available.RecommendationThe Commissioner should pursue actions afforded to DHS as the pass-through agency to ensure that subrecipients, and DHS, comply with the federal requirements. The Commissioner, the Director of Child and Adult Care Food Program and Summer Food Service Program, and the Director of Audit Services should ensure that staff implement stronger controls that address all deficiencies and should recover overpayments to subrecipients. The Commissioner should analyze and improve control processes affecting DHS and its subrecipients to ensure compliance with all federal requirements. The Commissioner should seek to establish better oversight to identify high-risk subrecipients and to follow up when staff find billing schemes. With proper oversight, management is more likely to have reasonable assurance that both staff and subrecipients have reasonably complied with federal regulations.If subrecipients continue to not comply with federal guidelines, management should impose additional conditions upon the subrecipients or take other action, as described in 2 CFR 200.207 and 200.338.Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentAs in the previous audit, the state auditors are repeating the summary of what they reported as findings on the food programs without regard to the requirements of the Government Auditing Standards (GAS) and Title 2 of the Code of Federal Regulations, Part 200, which must be followed in conducting the Single Audit. We believe it is time for the state auditors to acknowledge the actions the department has taken and report in a fair and reasonable manner as required by the Government Auditing Standards.In a recent investigative report that the Comptroller?s Office released on November 4, 2019, the investigators cited the department?s monitoring work that showed the adequacy and effectiveness of the department?s administrative and monitoring operation, contrary to the state auditors? current assertion that the department?s monitoring is ?inadequate?.For the last three years the department has consistently taken extensive actions to boost internal controls and monitoring of the food programs through increasing the number of food program management staff, increasing monitoring staff, providing training to staff and sponsors? staff, revising the monitoring procedures, increasing the number of sponsors and feeding sites monitored, following up on noncompliant sponsors, and removing noncompliant sponsors from the food programs. We believe it is time for the state auditors to acknowledge the actions the department has taken and report in a fair and reasonable manner free from personal and professional bias.The department?s payroll costs to administer and monitor the food programs in FFY2019 was $2,481,956.43 of the total food programs expenditures of $72,674,315.72. It is worth noting that the majority of these administrative costs are incurred as a result of monitoring. This amount does not take into consideration dollars paid to the Comptroller?s Office for their continued work in this program area.We believe our costs to administer and monitor the Food Programs are reasonable and prudent and our efforts are in material compliance with federal requirements. In fact, the United States Department of Agriculture, which regulates these dollars, has closed each of the Comptroller?s previous findings (2014-2017) without issue and with no disallowed costs. The department remains at the will of the legislature should a decision be made to spend additional state dollars and monitor this program above the requirements of the federal law.The department?s monitoring reports are a matter of public record and are posted on the department?s website (www.tn.gov/humanservices) under DHS Office of Inspector General. https://www.tn.gov/humanservices/dhs-program-integrity.html.Auditor?s CommentOur finding focuses on management?s lack of sufficient oversight activities specifically related to sponsors with fraud risks and questionable billing patterns and is not merely a summary of food program findings. Our audit results are clearly described in Conditions A through C along with the applicable federal criteria and recommendations.According to 2 CFR 200.303The non-Federal entity [DHS] must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.Contrary to management?s statement, we acknowledge when applicable, management?s improvements and corrective action in each of the food program findings.Federal Management DecisionIn accordance with 2 CFR 200.521 a federal grantor must follow up on findings of the non-federal entity and issue management decisions. The U.S. Department of Agriculture (USDA), the federal grantor, reviewed the department?s USDA program findings resulting from Single Audits occurring prior to the 2019 Single Audit and issued a Notification of Closure letter which sustained our prior audit findings and accepted the department?s correction action plan for Single Audits through 2017; in doing so, the USDA closed the file without issue. At the time of our report, the department is working with USDA to achieve audit resolution for the 2018 Single Audit findings and final action (management decision) is due in September 2020. The federal grantor?s management decision (closure letter) of prior findings does not relate to the auditor?s conclusions and findings from the current 2019 Single Audit of the department?s programs. Based on our 2019 Single Audit of DHS, we found that management had not fully implemented corrective action which they communicated to the federal grantor following the 2018 Single Audit.

Finding Number: 2019-018CFDA Number: 10.558 and 10.559Program Name: Child and Adult Care Food Program, Child Nutrition ClusterFederal Agency: Department of AgricultureState Agency: Department of Human ServicesFederal Award Identification Number: 185TN331N1099, 185TN331N2020, 185TN340N1050, 195TN331N1099, 195TN331N2020, and 195TN340N1050Federal Award Year: 2018 and 2019Finding Type: Significant Deficiency (10.559), Material Weakness (10.558), Noncompliance ? Subrecipient MonitoringCompliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Subrecipient MonitoringRepeat Finding: 2018-016Pass-Through Entity: N/AQuestioned Costs: N/AAs noted in the prior audit, the Department of Human Services has inadequate internal controls over subrecipient monitoring of the Child and Adult Care Food Program and Summer Food Service Program for Children and did not perform monitoring reviews in accordance with program requirementsBackgroundThe Child and Adult Care Food Program (CACFP) and the Summer Food Service Program for Children (SFSP) are funded by the U.S. Department of Agriculture and administered on the state level by the Department of Human Services (DHS). As a pass-through entity for CACFP and SFSP funds, DHS is responsible for providing sufficient qualified consultative, technical, and managerial personnel to administer the program and for monitoring performance to ensure that subrecipients comply with program rules and regulations.Subrecipients, through approved feeding sites where actual meal services take place, provide meals and supplements to eligible participants. To receive reimbursement payments for meals served to children, subrecipients submit reimbursement requests to DHS through the Tennessee Information Payment System, an online platform for the food programs? administration. Subrecipients self-report the number of meals claimed on reimbursement requests based on daily meal count documentation that site personnel prepare during each meal service. Subrecipients are required to retain all program records for at least three years and to provide records to authorities performing monitoring reviews or audits.DHS is required to monitor subrecipients? activities to obtain reasonable assurance that the subrecipients administer federal awards in compliance with federal and state requirements. Given that DHS has limited front-end control in place to prevent improper payments to subrecipients, DHS uses the Audit Services Unit (ASU) to provide a detective control through its monitoring process, which is DHS?s only control for determining the accuracy of the reimbursement claims.Audit Services Unit Monitoring ProcessMonitors document their reviews in HighBond, (See Schedule of Findings and Questioned Costs for footnote) an online platform that DHS implemented in May 2017 to improve and streamline the monitoring processes during monitoring reviews. HighBond provides electronic access to the working papers from any location and allows management to maintain monitoring records in electronic formats.ASU monitors perform the following types of monitoring reviews:1) Site Reviews. Monitors visit feeding sites where the actual meal services take place and perform meal service observations to assess whether feeding site personnel comply with applicable rules and regulations. Federal regulations for each program outline the minimum required number of site reviews that monitors must perform.2) Sponsor Reviews. Subsequent to the site reviews, monitors perform an administrative review of the subrecipients to assess their compliance with the administrative requirements over the program operations. Monitors also review the subrecipients? meal count documentation to verify it matches the reimbursement requests submitted for meals served.3) Vendor Reviews, applicable to SFSP only. If the subrecipients obtain meals to serve to children from a food vendor, instead of self-preparing meals, monitors visit the food vendor?s facilities to evaluate the vendor?s compliance with applicable program rules.In HighBond, monitors document the results of the reviews on the applicable electronic site guide, sponsor guide, and vendor guide. Once the monitors complete the applicable reviews, they discuss their monitoring results with program staff to determine how the noncompliance should be reported and addressed. This multi-level review also serves as management?s quality assurance process to ensure monitoring activities are sufficient, documented, and support the final monitoring reports. During this multi-level review, program staff determine whether the identified noncompliance rises to the level of a serious deficiency or is reportable as a finding.Upon completing the review, ASU releases the monitoring report, which includes details of the noncompliance; all corresponding disallowed meal costs, if any; and instructions for corrective action. The instructions specifically inform the subrecipient to submit a corrective action plan, outlining steps to address and prevent the noncompliance from occurring in the future, and how to submit payment for disallowed meal costs. Once the subrecipient submits the corrective action plan, DHS?s food program staff assess the plan for adequacy and track the recovery of disallowed meal costs.Serious Deficiency ProcessAs outlined in the federal regulations, DHS is required to identify and classify a subrecipient?s more serious program violations as serious deficiencies. The serious deficiency process requires DHS to begin actions to terminate the sponsor from the program, including denying the subrecipient?s future applications and program participation, unless the subrecipient takes appropriate corrective actions to address the serious deficiencies and repays all disallowed costs. Once a subrecipient is determined seriously deficient in the food program operations, DHS must perform monitoring reviews during the subsequent program year if the subrecipient is permitted to participate.Current TestworkFor our CACFP testwork, from a population of 127 monitoring reports ASU issued between July 1, 2018, and June 30, 2019, we randomly selected a sample of 60 monitoring reports and reviewed the supporting monitoring files. For our SFSP testwork, we reviewed all 30 monitoring reports ASU issued during state fiscal year 2018 and the supporting monitoring files.As noted in the prior audit, we reported that DHS?s subrecipient monitoring was insufficient and that management did not ensure monitors performed and documented complete and accurate reviews of subrecipients. DHS management concurred in part with the prior finding. In its six-month follow-up report to the Comptroller, management stated thatAdditional training to staff was provided in May 2019 to address proper completion of the working papers, addressing issues such as:? signing off when the monitors complete the work and are ready for review;? documenting conclusions in the proper section within ACL;? uploading the documents obtained from the subrecipients in the specific section;? documenting the conclusion when documents were reviewed/observed and not required to be uploaded into ACL;? identify risks and follow up on potential fraud; and? technical assistance to subrecipients.Audit Services updated the monitoring guide for SFSP that was utilized during the summer of 2019 and the CACFP monitoring guide is currently being updated to reflect the new federal requirements and will be completed in time for the FFY [federal fiscal year] 2020 CACFP monitoring of the sponsoring organizations.These efforts were implemented during or after state fiscal year 2019. The errors noted during our current testwork, which covers the period July 1, 2018, through June 30, 2019, occurred prior to management?s corrective action; therefore, we do not know if management?s corrective action is working. We will evaluate the corrective action during the next Single Audit. For the audit period ended June 30, 2019, we noted that DHS?s subrecipient monitoring was insufficient and found continued issues related to monitors not performing and documenting complete and accurate reviews of subrecipients.Condition A and Criteria: Insufficient Subrecipient MonitoringVarious program-specific guides in both CACFP and SFSP require DHS to implement an adequate monitoring system with sufficient monitoring steps, effective follow-up processes, and adequate review practices to obtain reasonable assurance about subrecipients? performance and accountability of program funds. In addition, according to Title 2, Code of Federal Regulations (CFR), Part 200, Section 62,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:(a) Transactions are properly recorded and accounted for, in order to:(1) Permit the preparation of reliable financial statements and Federal reports;(2) Maintain accountability over assets; and(3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award;(b) Transactions are executed in compliance with:(1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and(2) Any other Federal statutes and regulations that are identified in the Compliance Supplement; and(c) Funds, property, and other assets are safeguarded against loss from unauthorized use or disposition.During the performance of our testwork, we noted several areas within the monitoring process that were not sufficient and that contributed to ongoing noncompliance.Inadequate/Flawed Multi-Level Review Process ? As described above, ASU and program staff consult with each other after monitoring reviews are completed to discuss the status of a subrecipient?s compliance with federal requirements. Based on evidence and auditor judgment we found that the multi-level review (which also serves as the quality review process for monitoring activities, documentation, and reporting) was not sufficiently designed to achieve quality monitoring and subrecipient compliance. Instead, we found that the multi-level reviews failed to detect monitoring deficiencies. The majority of the noncompliance noted in Condition B below stems from monitors? inadequate and inconsistent monitoring activities and insufficient documentation.Lack of Consistent Procedures and Guidance During Monitoring Reviews ? We noted that DHS management has not developed sufficient procedures and guidelines to ensure that monitors perform consistent and uniform reviews. Based on our review of the monitoring files, we found instances where monitors may have misunderstood and inadequately assessed compliance requirements that they were responsible for verifying. DHS?s monitoring review guides include approximately 350 questions to assess subrecipients? compliance, but they do not provide any explanation or refer to additional details of the underlying federal requirements. Considering the programs? complexity, unique characteristics, and pre-established deadlines to complete the reviews, the monitors do not have adequate information and resources to perform quality reviews. Instead, the monitors appeared to use the guides as a checklist without expanding monitoring activities to address questionable billing practices or other fraud and compliance risks. Additionally, we noted inconsistencies in the guides we reviewed.Demanding and Deadline-Driven Workloads ? With approximately 400 subrecipients sponsoring thousands of meal feeding sites statewide, it is difficult for the 22 ASU monitors to adequately perform reviews to obtain reasonable assurance of subrecipients? compliance and/or to follow up on irregularities. To accomplish the activities they do, monitors have pre-established deadlines to submit monitoring files for further review, regardless of what they may find during the monitoring reviews. To achieve the subrecipient monitoring requirements of both programs, management toggles the programs by only performing monitoring reviews of SFSP subrecipients during the summer months (May through August) and placing CACFP monitoring reviews on hold until SFSP monitoring reviews are complete. Additionally, we noted that 29 SFSP subrecipients participated in more than 1 month and 1 subrecipient only participated in 1 month; however, ASU?s site visits and monitoring reviews focused on the same month for 23 of the 29 monitoring reviews. ASU did not perform site visits and did not review documentation for the remaining months of the SFSP program. Even though management has been able to keep positions for food program monitors, auditors, and investigators filled, we question whether the current number of positions is adequate given the continuing problems and risks associated with the food programs.Inadequate Follow-up Procedures for Inconsistencies and Red Flags ? DHS management has not yet developed effective enhanced monitoring processes to follow up on questionable subrecipient billing practices and fraud schemes, such as claiming the same number of meals for long periods or claiming more meals on days when monitors were not present compared to days when monitors observed the meal service. See Finding 2019-017 for additional details on fraud indicators in the food programs that DHS could have detected had it developed targeted follow-up and enhanced processes to address questionable subrecipient billing patterns.Not Utilizing Serious Deficiency Process Effectively ? The federal regulatory guidance on what constitutes a serious deficiency is not completely defined, and management has a certain degree of discretion to identify the subrecipient as seriously deficient in the food program administration. However, once DHS identifies a subrecipient as seriously deficient, DHS is required to provide stricter oversight and more frequent monitoring than it does for subrecipients that are not classified as seriously deficient. We found instances where the subrecipient?s noncompliance met or could meet the regulatory definition of a serious deficiency; however, food program staff did not elevate the issue to the serious deficiency level, essentially allowing the subrecipient to continue participating without any increased scrutiny from monitors. In fact, based on the current monitoring process and schedule, monitors would not visit the subrecipients again until three years has passed.Condition B and Criteria: Noncompliance Noted During CACFP and SFSP Monitoring ReviewsCACFP Monitoring ReviewsBased on our review of CACFP monitoring files, we noted that DHS either did not assess or did not adequately assess the subrecipient?s compliance with operating the program in accordance with federal requirements. According to 7 CFR 226.6(m),(3) Review content. As part of its conduct of reviews, the State agency must assess each institution?s compliance with the requirements of this part pertaining to:(i) Recordkeeping;(ii) Meal counts;(iii) Administrative costs;(iv) Any applicable instructions and handbooks issued by FNS [Food and Nutrition Service] and the Department to clarify or explain this part, and any instructions and handbooks issued by the State agency which are not inconsistent with the provisions of this part;(v) Facility licensing and approval;(vi) Compliance with the requirements for annual updating of enrollment forms;(vii) If an independent center, observation of a meal service;(viii) If a sponsoring organization, training and monitoring of facilities;(ix) If a sponsoring organization of day care homes, implementation of the serious deficiency and termination procedures for day care homes and, if such procedures have been delegated to sponsoring organizations in accordance with paragraph (l)(1) of this section, the administrative review procedures for day care homes;(x) If a sponsoring organization, implementation of the household contact system established by the State agency pursuant to paragraph (m)(5) of this section;(xi) If a sponsoring organization of day care homes, the requirements for classification of tier I and tier II day care homes; and(xii) All other Program requirements.(4) Review of sponsored facilities. As part of each required review of a sponsoring organization, the State agency must select a sample of facilities, in accordance with paragraph (m)(6) of this section. As part of such reviews, the State agency must conduct verification of Program applications in accordance with ?226.23(h) and must compare enrollment and attendance records (except in those outside-school-hours care centers, at-risk afterschool care centers, and emergency shelters where enrollment records are not required) and the sponsoring organization?s review results for that facility to meal counts submitted by those facilities for five days.We noted the following during our review of the monitoring files.Meal Count Documentation ? We noted that for 7 of 60 monitoring files we reviewed (12%), ASU monitors did not compare the number of meals served to the attendance records, did not identify that subrecipients claimed more meals than the number of children in attendance, and did not note any issues when the subrecipients failed to maintain documentation to support the meal reimbursement claims.Administrative Costs ? We noted that for 3 of 5 monitoring files we reviewed for subrecipients classified as sponsoring organizations (60%), the ASU monitors did not perform the necessary reviews and did not calculate the amount of administrative costs billed to the program to ensure the subrecipients complied with the requirement that administrative costs do not exceed 15% of meal reimbursements.Facility Licensing ? We noted that for 16 of 60 monitoring files we reviewed (27%), ASU monitors either did not review the subrecipient?s license, or the completed monitoring guide did not include a question to instruct the monitor to review the license or documentation of alternate approval to participate in the program.Eligibility Documentation ? We noted that for 12 of 55 monitoring files we reviewed (22%), ASU monitors did not always review the eligibility applications or enrollment forms and did not include findings in the monitoring report when the subrecipient did not maintain the eligibility documentation.Training and Monitoring ? We noted that for 20 of 20 monitoring files we reviewed for sponsoring organizations (100%), ASU monitors either did not perform procedures to assess the subrecipient?s compliance with training personnel and monitoring of its feeding site?s requirements because the monitor thought the question was not applicable; did not identify the subrecipient?s noncompliance with the training and monitoring requirements; or did not include identified training and monitoring noncompliance in its monitoring report.Serious Deficiency Process ? We noted that for 3 of 3 monitoring working papers we reviewed (100%), DHS did not assess the sponsoring organizations of homes? compliance with implementation of the serious deficiency policy.Household Contact System (See Schedule of Findings and Questioned Costs for footnote) ? DHS had not developed a written household contact system policy to guide subrecipients in how to conduct household contacts during the monitoring of its sites. We noted that for 20 of 20 monitoring files reviewed where the subrecipient was required to have a household contact system in place (100%), the ASU monitor answered the monitoring guide questions ?not applicable? and/or added comments that the household contact system was not needed, which is a clear violation of federal requirements.Tiering Classification of Day Care Homes ? We noted that for 2 of 3 monitoring working papers we reviewed (67%), DHS did not keep documentation to support its assessment of the sponsoring organizations? compliance with tiering classification for day care homes.Five-Day Reconciliations ? We noted that for 10 of 20 monitoring files we reviewed for sponsoring organizations (50%), ASU monitors did not perform the required 5-day reconciliations of meals and attendance; did not always reconcile the meals to attendance; performed 5-day reconciliations that did not reconcile to supporting documentation; or performed reconciliations that included less than 5 days.SFSP Monitoring ReviewsBased on our review of SFSP monitoring files, we noted that DHS either did not assess or did not adequately assess the subrecipients? compliance with operating the program in accordance with federal requirements. According to the 2017 Summer Food Service Program State Agency Monitor Guide,The State agency must review sufficient records to determine whether the sponsor is in compliance with Program requirements as detailed in regulations. . . . These records include, but are not limited to:? Program agreement? Program application (and supporting documents)? Documents to support the sponsor?s eligibility? Tax exempt status documentation to support nonprofit food status? Training documentation (provided to and attended by staff)? Sponsor site monitoring records (such as preoperational site visits, first week visits, and reviews conducted within the first four weeks)? Accounting records, bank statements, check ledgers, and credit card statements? Invoices and receipts? Meal count records? Menus and other food service records? Meal delivery receipts? Documentation of the nonprofit food service account? Health and safety inspections? FSMC [Food Service Management Companies] contracts, if applicable? Documentation of corrective action taken to correct any Program violations.According to 7 CFR 225.7(d)(6),As part of the review of any vended sponsor which contracts for the preparation of meals, the State agency shall inspect the food service management company?s facilities.Meal Count Records ? For 19 of 30 monitoring files we reviewed (63%), we noted that although the ASU monitors performed procedures to assess the subrecipients? compliance with maintaining accurate and complete meal count records, the ASU monitors did not always identify all meal service violations. We noted that the ASU monitors did not identify and did not report in the monitoring report that subrecipients claimed meals outside of the subrecipients? approved dates of operation; that subrecipients served meals in excess of the site?s approved serving limits; that subrecipients? documentation indicated that the subrecipient did not take point-of-service meal counts (See Schedule of Findings and Questioned Costs for footnote) during the meal observations; and subrecipients? site supervisors did not sign the meal count forms that were submitted to DHS for reimbursement.Food Service Management Companies ? We noted that for 2 of 5 subrecipients who contracted with vendors to provide meals (40%), the monitors did not perform vendor review guides of the vendors? facilities. Without these guides, we are unable to determine if monitors performed vendor reviews.Additionally, while the ASU monitors indicated on the monitoring guides that they performed procedures to assess the subrecipients? compliance with program requirements, the monitoring files did not include documentation to support their assessment. Without the documentation, we could not be sure whether the ASU monitors reviewed or correctly assessed the subrecipients? compliance with program requirements. Specifically, we noted the monitoring files did not include documentation of the following:? preoperational visit for 1 of 13 monitoring files of new subrecipients reviewed (8%);? subrecipient?s monitoring of its feeding sites for 1 of 30 monitoring files reviewed (3%);? invoices and receipts used to assess the subrecipient?s nonprofit food service program for 2 of 30 monitoring files reviewed (7%);? accounting records, bank statements, check ledgers, or credit card statements used to assess the subrecipient?s compliance with allowable costs for 18 of 30 monitoring files reviewed (60%); and? meal delivery receipts for 1 of 5 monitoring files reviewed for vended subrecipients (20%).Condition C and Criteria: Risk AssessmentWe reviewed DHS?s December 2018 Financial Integrity Act Risk Assessment and determined that management did not identify the risk of noncompliance with monitoring reviews and a mitigating control. The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7, of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.CauseWe believe DHS?s inadequate review process, incomplete and inconsistent monitoring guides, current staffing level, lack of follow-up procedures on red flags, and ineffective use of the serious deficiency process could have contributed to the conditions noted in this finding. See Finding 2019-017 for further details on issues related to the subrecipient monitoring process.EffectWhen top management does not ensure monitoring activities are sufficiently performed, documented, and reported, there is an increased risk that ASU monitors will fail to properly identify subrecipient noncompliance; that ASU and program staff will fail to recover improper payments to subrecipients; and ultimately that subrecipients will be allowed to continue participating in the food programs even though they repeatedly violate federal requirements because of lack of training or intentional fraudulent actions.Federal regulations address actions that federal agencies may impose in cases of noncompliance. As noted in 2 CFR 200.338, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.207, ?Specific conditions,?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.Section 200.338 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:(a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.(b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.(c) Wholly or partly suspend or terminate the Federal award.(d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).(e) Withhold further Federal awards for the project or program.(f) Take other remedies that may be legally available.RecommendationThe Commissioner of DHS should ensure that the Audit Services Director implements controls to ensure the subrecipient monitoring process consistently complies with federal regulations. These controls should ensure that Audit Services staff fully understand all federal requirements; complete all review guides for all required monitoring activities; and prepare accurate monitoring reports that include all findings or issues noted during the monitoring review.The Commissioner should assess all significant risks, including the risks noted in this finding, in DHS?s documented risk assessment. The risk assessment and the mitigating controls should be adequately documented. The Commissioner should implement effective controls to ensure compliance with applicable requirements; assign employees to be responsible for ongoing monitoring of the risks and any mitigating controls; and take action if deficiencies occur.Management?s CommentWe do not concur.We do not concur that the department has inadequate internal control over the subrecipient monitoring of the Child and Adult Care Food Program and Summer Food Service Program for Children and did not perform monitoring reviews in accordance with program requirements.The food programs management contracts with over 350 sponsoring organizations to feed children in over 3,800 feeding sites throughout the State of Tennessee. The department?s monitoring procedures direct staff to review and obtain, as necessary, thousands of documents such as meal count sheets, enrollment information, sponsors? staff training and monitoring, and food cost receipts. Procedures also include, among other requirements, civil rights, nondiscrimination, appeal rights, and compliance wi

Finding Number: 2019-019CFDA Number: 10.558Program Name: Child and Adult Care Food ProgramFederal Agency: Department of AgricultureState Agency: Department of Human ServicesFederal Award Identification Number: 185TN331N1099, 185TN331N2020, 185TN340N1050, 195TN331N1099, 195TN331N2020, and 195TN340N1050Federal Award Year: 2018 and 2019Finding Type: Material Weakness and NoncomplianceCompliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Subrecipient MonitoringRepeat Finding: 2018-018Pass-Through Entity: N/AQuestioned Costs: $65,407For the fifth year, the Department of Human Services did not ensure that the Child and Adult Care Food Program subrecipients maintained accurate and complete supporting documentation for meal reimbursement claims and that subrecipients received reimbursements in accordance with federal guidelines, resulting in $65,407 of questioned costsBackgroundThe Child and Adult Care Food Program (CACFP) is a year-round food program for eligible participants at child care centers, day care homes, afterschool care programs, emergency shelters, and adult day care centers. CACFP is funded by the U.S. Department of Agriculture and administered on the state level by the Department of Human Services (DHS). As a pass-through entity for the CACFP, DHS is responsible for ensuring that subrecipients are eligible to participate in the program and that the subrecipients comply with federal requirements. To receive payment for the meals they provide to eligible participants, subrecipients submit meal reimbursement claims to DHS through the Tennessee Information Payment System. DHS management is responsible for monitoring the subrecipients? activities to provide assurance that the subrecipients administer federal awards in compliance with federal requirements.Because management does not review supporting documentation for meal reimbursement claims before issuing payments to the subrecipients, management must rely on its Audit Services Unit to ensure subrecipients comply with federal program requirements and spend grant funds accordingly. Audit Services is required to monitor at least 33.3% of all subrecipients each year. Generally, Audit Services reviews one meal reimbursement claim, representing one month of the program year, at each subrecipient. Audit Services staff perform regular monitoring visits at each subrecipient once every two or three years, depending on the type of institution. When staff find a serious deficiency during a monitoring visit, they increase the frequency of monitoring visits to once a year until the subrecipient has corrected the serious deficiency.As noted in the four prior audits, we reported that CACFP staff had not ensured subrecipients maintained accurate supporting documentation for meal reimbursement claims and that CACFP staff had paid the subrecipients based on inaccurate claims for meal reimbursement. DHS management concurred in part with the most recent prior finding. In its six-month follow-up report to the Comptroller, management stated that for the subrecipients identified in the prior audit finding, DHS, in conjunction with U.S. Department of Agriculture?s Food and Nutrition Service, would conduct monitoring visits and would pursue any disallowed costs identified during the monitoring visits. Based on our current work, however, we once again noted noncompliance for state fiscal year 2019.Because monitoring is DHS?s only control to ensure subrecipients? compliance with program requirements, we tested the department?s monitoring process and identified subrecipient monitoring process deficiencies, which we have reported in detail in Finding 2019-017 regarding overall management oversight. In that finding, we note that the monitoring process is not sufficient to identify and properly respond to fraud indicators and to address the underlying causes of subrecipients? noncompliance. We also found other CACFP federal noncompliance as described below in this finding.To determine whether DHS?s CACFP subrecipients complied with program requirements for proper meal reimbursement, we selected a nonstatistical, random sample of 60 subrecipients. We tested 1 meal reimbursement claim for each of the 60 subrecipients, for a total sample of 60 subrecipients? claims. To select the claim month, we haphazardly selected 1 month during the state fiscal year ended June 30, 2019. To select the feeding site(s) to review for the claim, we haphazardly selected sites based on the following methodology. If the subrecipient had? 1 to 25 feeding sites, we selected up to 3 sites;? 26 to 50 feeding sites, we selected 5 sites; and? 51 or more feeding sites, we selected 10 sites.When deemed necessary, due to questionable meal reimbursement documentation, we expanded our testwork to additional months and/or sites. Based on our review of the subrecipients? claims, we determined that DHS reimbursed subrecipients for inaccurate claims.Condition A and Criteria: Meal Reimbursement Documentation Was InaccurateBased on our testwork, we noted that for 27 of 60 claims reviewed (45%), the subrecipients did not maintain documentation to accurately support the number of meals requested on the meal reimbursement claim. We noted that for the 27 claims reviewed,? 15 subrecipients did not maintain accurate meal count documentation;? 6 subrecipients did not maintain accurate attendance documentation; and? 6 subrecipients did not maintain both accurate meals count and attendance documentation.The subrecipients submitted their claim for reimbursement for either more meals served than they had documentation to support or for fewer meals served than they had reported on supporting documentation. As such, DHS reimbursed subrecipients based on inaccurate meal reimbursement claims, leading to overpayments to the subrecipients totaling $9,420.We expanded our review of four subrecipients and reviewed an additional five claim months. Based on our expanded testwork, we noted that all the subrecipients (100%) did not maintain accurate meal count and attendance documentation for the additional months reviewed, resulting in $10,665 in overpayments to the subrecipients based on inaccurate claims. See Tables 1 and 2 for details of inaccurate documentation and questioned costs by subrecipient.See Schedule of Findings and Questioned Costs for chart/table.See Schedule of Findings and Questioned Costs for chart/table.Risk AssessmentWe reviewed DHS?s 2018 Financial Integrity Act risk assessment and determined that management listed the risk of subrecipients submitting unsupported claims; however, DHS did not have an effective control to mitigate its risk.According to Title 7, Code of Federal Regulations (CFR), Part 226, Section 10(c),Claims for Reimbursement shall report information in accordance with the financial management system established by the State agency, and in sufficient detail to justify the reimbursement claimed and to enable the State agency to provide the final Report of the Child and Adult Care Food Program (FNS 44) required under ?226.7(d). In submitting a Claim for Reimbursement, each institution shall certify that the claim is correct and that records are available to support that claim.In addition, 7 CFR 226.15(e)(4) states,At a minimum, the following records shall be collected and maintained: . . .Daily records indicating the number of participants in attendance and the daily meal counts, by type (breakfast, lunch, supper, and snacks), served to family day care home participants, or the time of service meal counts, by type (breakfast, lunch, supper, and snacks), served to center participants.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.Condition B and Criteria: Meal Reimbursement Documentation Included Fraud IndicatorsBased on our initial and expanded testwork results, we determined that the department still has not developed effective enhanced monitoring activities to identify and follow up on fraud indicators. Based on our testwork, we noted that 3 of 60 subrecipients (5%) submitted meal reimbursement claims that included the following fraud indicators:? the same number of meals served each operational day of the claim month (block claiming), in essence claiming that the exact same number of children were served each day, which is improbable; and? claims that indicated all children eligible to be served had perfect attendance for multiple months, again which is improbable.We questioned $45,321 for the subrecipients? claims that included the fraud indicators. See Table 3.See Schedule of Findings and Questioned Costs for chart/table.According to 7 CFR 226.10(c),Claims for Reimbursement shall report information in accordance with the financial management system established by the State agency, and in sufficient detail to justify the reimbursement claimed and to enable the State agency to provide the final Report of the Child and Adult Care Food Program (FNS 44) required under ?226.7(d). In submitting a Claim for Reimbursement, each institution shall certify that the claim is correct and that records are available to support that claim.According to 2 CFR 200.404,A cost is reasonable if, in its nature and amount, it does not exceed that which would be incurred by a prudent person under the circumstances prevailing at the time the decision was made to incur the cost. The question of reasonableness is particularly important when the non-Federal entity is predominantly federally-funded. In determining reasonableness of a given cost, consideration must be given to:(a) Whether the cost is of a type generally recognized as ordinary and necessary for the operation of the non-Federal entity or the proper and efficient performance of the Federal award.(b) The restraints or requirements imposed by such factors as: sound business practices; arm's-length bargaining; Federal, state, local, tribal, and other laws and regulations; and terms and conditions of the Federal award.(c) Market prices for comparable goods or services for the geographic area.(d) Whether the individuals concerned acted with prudence in the circumstances considering their responsibilities to the non-Federal entity, its employees, where applicable its students or membership, the public at large, and the Federal Government.(e) Whether the non-Federal entity significantly deviates from its established practices and policies regarding the incurrence of costs, which may unjustifiably increase the Federal award?s cost.CauseBased on our discussion with management, DHS does not require the subrecipients to provide supporting documentation for each meal reimbursement claim before payment. DHS instead relies on Audit Services to review supporting documentation for meal reimbursement claims during monitoring visits. Audit Services routinely reviews only a very small sample of claims during a monitoring visit, which does not provide management with an effective preventative or detective control. DHS did not provide any additional information as to how they plan to address the subrecipients? inaccurate claim reporting.According to 7 CFR 226.6(a)(5), as part of its pass-through responsibilities, DHS agrees to ensure that participating subrecipients effectively operate the program. Also, ?Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,? 2 CFR 200.62, states,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:a. Transactions are properly recorded and accounted for, in order to:(1) Permit the preparation of reliable financial statements and Federal reports;(2) Maintain accountability over assets; and(3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award;b. Transactions are executed in compliance with:(1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and(2) Any other federal statutes and regulations that are identified in the Compliance Supplement; andc. Funds, property, and other assets are safeguarded against loss from unauthorized use or disposition.EffectFederal regulations address actions that federal agencies may impose in cases of noncompliance by a non-federal entity, in this case DHS. As noted in 2 CFR 200.338, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.207(b), ?Specific conditions,?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.Section 200.338 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:(a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.(b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.(c) Wholly or partly suspend or terminate the Federal award.(d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).(e) Withhold further Federal awards for the project or program.(f) Take other remedies that may be legally available.Questioned CostsOur testwork included a review of a nonstatistical random sample of 60 subrecipient meal reimbursement claims which resulted in $9,420 of known questioned costs, expanded testwork on 4 subrecipients which resulted in $10,665 of known questioned costs, and our expanded work for fraud indicators for 3 subrecipients which resulted in $45,321 of known questioned cost. We selected the nonstatistical, random sample of 60 meal reimbursement claims, totaling $939,840, from a population of 7,592 claims and adjustments, totaling $66,809,536, for the period July 1, 2018, through June 30, 2019 (the state?s fiscal year). For major programs, 2 CFR 200.516(a) requires auditors to report known and likely questioned costs greater than $25,000 for a type of compliance requirement. According to 2 CFR 200.84,Questioned cost means a cost that is questioned by the auditor because of an audit finding:(a) Which resulted from a violation or possible violation of a statute, regulation, or the terms and conditions of a Federal award, including for funds used to match Federal funds;(b) Where the costs, at the time of the audit, are not supported by adequate documentation; or(c) Where the costs incurred appear unreasonable and do not reflect the actions a prudent person would take in the circumstances.RecommendationDHS should accept full responsibility as the pass-through entity, as described in the federal regulations, and mandate accurate claims for reimbursement. If subrecipients continue to not maintain adequate meal reimbursement documentation, management should impose additional conditions upon the subrecipients or take other action, as described in 2 CFR 200.207 and 200.338. We recommend that DHS take action on findings that we present and enforce the federal guidelines and for subrecipients with enhanced fraud risks, should request sufficient documentation to support claims for reimbursement before approving reimbursements to the subrecipients. Additional steps like this may be necessary to ensure that subrecipients are only paid for actual meals served to children rather than allowing the subrecipients to continue intentionally or unintentionally overbilling the state for federal reimbursement. Only relying on subrecipient monitoring to review a small portion of the total amount of claims is not enough to prevent or detect inaccurate claims for reimbursement or fraud from occurring in the CACFP. For more recommendations concerning the issues discussed in this finding, see Finding 2019-017 on overall management oversight.Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentMonitoring is not the department?s only control over subrecipient compliance with program requirements. The department utilizes claim reviews prior to payment, onsite technical assistance and training visits, desk reviews, system controls and edit checks as additional controls over subrecipient compliance.We believe our costs to administer and monitor the Food Programs are reasonable and prudent and our efforts are in material compliance with federal requirements. In fact, the United States Department of Agriculture, which regulates these dollars, has closed each of the Comptroller?s previous findings (2014-2017) without issue and with no disallowed costs. The department remains at the will of the legislature should a decision be made to spend additional state dollars and monitor this program above the requirements of the federal law.Condition A: Meal Reimbursement Documentation Was InaccurateWe concur in part.Ten of the subrecipients identified as having inaccurate documentation underclaimed meals. We do not concur that unclaimed meals should be identified as errors. There is no federal requirement that subrecipients must claim all meals served. Including underclaimed meals as part of a notice of noncompliance misrepresents the scope and scale of the issue and is contrary to federal requirements. Additionally, the state auditors identified underclaims as error, but did not take the underclaim in consideration when calculating questioned costs. This approach maximizes the questioned cost and the number of identified sponsors with errors instead of accurately representing the amount of money that would be recoverable by the department. 20 of the 27 subrecipients with identified questioned costs were below the department threshold and would not be pursued for recovery.The department continues to evaluate findings identified in this report and in our own internal monitoring and has created training sessions to mitigate the identified programmatic weaknesses. All CACFP trainings are developed and conducted in conjunction with USDA FNS.Condition B: Meal Reimbursement Documentation Included Fraud IndicatorsWe concur in part.The state auditors reviewed documentation for the months of December 2018 and February 2019 for Subrecipient Number 1, the department monitored Subrecipient Number 1 for the month of January 2019. As a result of the department?s monitoring Subrecipient Number 1 was declared Seriously Deficient, was required to submit corrective action, returned the identified overpayment and completed additional training. It is notable that the state auditors reviewed the month prior to and after the month of review completed by the department. Similar issues were identified and corrected by the sponsor; however, the department?s monitoring was not considered in this report since the state auditors reviewed different months.We do not concur that block claiming, and perfect attendance are sufficient to question costs. USDA FNS has provided guidance to the department that block claims and perfect attendance are potential issues to be followed up on with monitoring and verification. DHS will follow up on the information provided and will work to recover any supported disallowed meal costs contingent on the receipt of necessary documentation from state auditors in support of their conclusions.Auditor?s CommentCondition ATitle 7, Code of Federal Regulations (CFR), Part 226.10(c) states that in submitting a claim for reimbursement, each subrecipient shall certify that the claim is correct and that records are available to support that claim. Therefore, inaccurate claim reporting of meals served?both underclaimed and overclaimed?violate program requirements. Additionally, DHS management seems to suggest that auditors should not take issue with sponsors that underclaim meals; however, Audit Services? monitors included underclaimed meals as errors in their monitoring reports.Condition BAs we have noted in the finding, and as defined in 2 CFR 200.084, we are required to question costs that appear unreasonable. It is illogical and thus unreasonable for a subrecipient to submit an identical claim (block claim) or a claim suggesting perfect attendance for three consecutive months.Federal Management DecisionIn accordance with 2 CFR 200.521 a federal grantor must follow up on findings of the non-federal entity and issue management decisions. The U.S. Department of Agriculture (USDA), the federal grantor, reviewed the department?s USDA program findings resulting from Single Audits occurring prior to the 2019 Single Audit and issued a Notification of Closure letter which sustained our prior audit findings and accepted the department?s correction action plan for Single Audits through 2017; in doing so, the USDA closed the file without issue. At the time of our report, the department is working with USDA to achieve audit resolution for the 2018 Single Audit findings and final action (management decision) is due in September 2020. The federal grantor?s management decision (closure letter) of prior findings does not relate to the auditor?s conclusions and findings from the current 2019 Single Audit of the department?s programs. Based on our 2019 Single Audit of DHS, we found that management had not fully implemented corrective action which they communicated to the federal grantor following the 2018 Single Audit.

Finding Number: 2019-020CFDA Number: 10.558Program Name: Child and Adult Care Food ProgramFederal Agency: Department of AgricultureState Agency: Department of Human ServicesFederal Award Identification Number: 185TN331N1099, 185TN331N2020, 185TN340N1050, 195TN331N1099, 195TN331N2020, and 195TN340N1050Federal Award Year: 2018 and 2019Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: Eligibility, Subrecipient MonitoringRepeat Finding: 2018-019Pass-Through Entity: N/AQuestioned Costs: $6,584For the seventh year, the Department of Human Services did not ensure that Child and Adult Care Food Program subrecipients claimed meals only for eligible participants; did not accurately determine participant eligibility; and did not maintain complete and accurate eligibility documentation as required by federal regulations, resulting in $6,584 in federal questioned costsBackgroundThe Child and Adult Care Food Program (CACFP), a year-round program, is federally funded by the U.S. Department of Agriculture (USDA) and administered on the state level by the Department of Human Services (DHS). As a pass-through entity for CACFP, DHS is responsible for ensuring that subrecipients are eligible and comply with federal requirements. Because management does not review supporting documentation for meal reimbursement claims before issuing payments to the subrecipients, management must rely on its Audit Services section to ensure subrecipients comply with federal program requirements and spend grant funds accordingly. To ensure subrecipients? compliance, Audit Services staff perform monitoring visits at a subrecipient or feeding site. Monitors follow a DHS-provided review guide, which is a checklist that covers all federal requirements for the program, including ensuring subrecipients maintain participants? eligibility applications when required and properly determine participants? eligibility.A subrecipient is referred to as an institution; however, if the subrecipient is administratively responsible for two or more feeding sites, it is classified as a sponsoring organization. Sponsoring organizations can sponsor either homes (residential) or centers (non-residential). Feeding sites are actual locations where the institutions or sponsoring organizations (subrecipients) serve meals to participants in a supervised setting. Although these subrecipients receive federal cash reimbursement for all meals served, they receive higher levels of reimbursement for meals served to participants who meet the income eligibility criteria published by the USDA?s Food and Nutrition Service for meals served free or at a reduced price.Subrecipients must determine the enrolled participant?s eligibility for free and reduced-price meals in order to claim reimbursement for the meals served to that individual at the correct rate. Subrecipients may establish a participant?s eligibility using either a household application or proof of participation in another federal program, such as the Supplemental Nutrition Assistance Program, Temporary Assistance for Needy Families, or Food Distribution Program on Indian Reservations. Additional federal requirements apply to sponsoring organizations that sponsor child care centers or institutions that operate as independent child care centers; as such, these subrecipients must complete an eligibility addendum to document when and what meals a participant will eat while at the feeding site.As noted in the six prior audits, DHS did not ensure that subrecipients determined and properly documented individual eligibility for participants. DHS management did concur in part with the prior finding. They stated,The Department adopted the use of [the CACFP Meal Benefit Income Eligibility (Child Care) Form prototype document], notified subrecipients, and made it available for immediate use on June 21, 2018. . . .Child and Adult Care Food Program (CACFP) sponsors are trained by the Department at least annually through in-person and online means. Further, the Program Specialists began conducting on-site, in-person technical assistance visits to subrecipients starting in January 2019. In addition, beginning June 2019, Family Day Care Home subrecipients, independent centers, and sponsors will have the opportunity to attend one of many regional training sessions to be offered each month that will include income eligibility applications, recordkeeping requirements, and other program requirements. . . .The Audit Services monitoring findings recalculate and report the disallowed meal costs by reclassifying the individuals to free, reduced-price, or paid as necessary. The errors and disallowed meal costs are resolved through the corrective action and Serious Deficiency process, which includes the sponsors? full Due Process rights through appeal as required by Federal law.During our current testwork, we concluded that these training and monitoring efforts were insufficient to correct the continuing issues related to subrecipients not maintaining complete and accurate eligibility documentation.Condition and CriteriaFrom a population of 319 CACFP subrecipients, we selected a nonstatistical, random sample of 60 subrecipients. For each subrecipient selected, we haphazardly selected a total of 663 unique participants to review. We tested the eligibility applications to ensure the subrecipients correctly determined participants? eligibility and claimed the correct amount for meals served to participants as defined by federal regulations. We noted the following problems.Condition A: Age Requirement ErrorsFor the 663 participants selected, the 60 subrecipients were required to keep documentation of 638 participants? ages. We noted errors for 6 of the 60 subrecipients (10%), including errors for 79 of the 638 participants (12%) who required documentation of age. Specifically, 3 subrecipients did not maintain any documentation of participants? ages for 55 participants, and 3 subrecipients did not document ages on the maintained documentation for 24 participants.The subrecipients claimed the participants were children; however, the eligibility applications were missing the participants? birth date and/or age, and none of the subrecipients provided any other supporting documentation of the children?s ages when we requested the data. Therefore, we could not determine if the participants met the program?s definition of a child.Title 7, Code of Federal Regulations (CFR), Section 226, Part 2, defines a child participant for the CACFP program as(a) Persons age 12 and under;(b) Persons age 15 and under who are children of migrant workers;(c) Persons with disabilities as defined in this section; [emphasis in original](d) For emergency shelters, persons age 18 and under; and(e) For at-risk afterschool care centers, persons age 18 and under at the start of the school year.Since the subrecipients did not maintain documentation of the participants? age, we reclassified the participants? eligibility category as ?paid? and questioned the difference in the reimbursement rates. See Table 1 for a summary of questioned costs.Condition B: Subrecipients Did Not Maintain Eligibility Applications or Did Not Maintain Complete ApplicationsFor the 663 participants we selected, the 60 subrecipients were required to keep eligibility documentation for 633 participants. We noted errors for 23 of the 60 subrecipients (38%), including errors for 102 of the 633 participants (16%) who required eligibility documentation. We noted that 1 subrecipient did not maintain any eligibility applications for all 52 program participants; 1 subrecipient did not maintain eligibility applications for 5 participants; and 21 subrecipients did not maintain complete applications for 40 participants and did not maintain eligibility applications for 5 participants. Either the applications were not updated annually, or they were missing one or more of the following required components:? all household members,? income information,? the last four digits of the participant?s Social Security number, or? the signature of the participant?s guardian.According to 7 CFR 226.2 under the definition of documentation,The completion of the following information on a free and reduced-price application: (1) Names of all household members. . .7 CFR 226.10(d) states,All records to support the claim shall be retained for a period of three years after the date of submission of the final claim for the fiscal year to which they pertain, except that if audit findings have not been resolved, the records shall be retained beyond the end of the three-year period as long as may be required for the resolution of the issues raised by the audit. All accounts and records pertaining to the Program shall be made available, upon request, to representatives of the State agency, of the Department, and of the U.S. Government Accountability Office for audit or review, at a reasonable time and place.In addition, 7 CFR 226.15(e)(2) states,Documentation of the enrollment of each participant at centers (except for outside-school-hours care centers, emergency shelters, and at-risk afterschool care centers). All types of centers, except for emergency shelters and at-risk afterschool care centers, must maintain information used to determine eligibility for free or reduced-price meals in accordance with ?226.23(e)(1). For childcare centers, such documentation of enrollment must be updated annually, signed by a parent or legal guardian, and include information on each child?s normal days and hours of care and the meals normally received while in care.Since the subrecipients did not maintain applications that supported free and reduced-price meal reimbursement, we reclassified the participants? eligibility category as ?paid? and questioned the difference in the reimbursement rates. See Table 1 for a summary of questioned costs.Condition C: Subrecipients Did Not Maintain Documentation of Meals, Hours, and DaysFor the 663 participants we selected, the 60 subrecipients were required to keep enrollment documentation for 633 participants. We noted errors for 18 of the 60 subrecipients (30%), including errors for 121 of the 633 participants (19%) who required enrollment documentation. We noted that 1 subrecipient did not maintain any enrollment documentation for all 52 program participants; 7 subrecipients did not always maintain documentation of meal, hours, and days for 42 participants; and 10 subrecipients did not always maintain documentation of each child?s normal meals and normal days and hours of care for 11 participants, and the documentation they did maintain was not complete and/or updated annually for 16 participants.As stated above in 7 CFR 226.15(e)(2), subrecipients should maintain and annually update enrollment documentation regarding the participants? days and hours of care and meals received while in care. We did not question costs for the documentation errors noted above because the errors we noted did not negate the participants? eligibility for the program.Condition D: Subrecipients Incorrectly Determined the Category of Meal Status for Their ParticipantsFor the 663 participants we selected, the 60 subrecipients were required to document the category of meal status for 643 participants. We noted errors for 15 of the 60 subrecipients (25%). We noted that the subrecipients did not keep information needed to classify the eligibility meal status (free, reduced-price, or paid) or incorrectly determined the eligibility meal status for 69 participants.We also found the following:? Information needed to classify the child for free or reduced-price eligibility was missing for 54 participants (8%).? Based on the information provided for the remaining participants, subrecipients incorrectly determined the eligibility meal status for 15 participants (2%).7 CFR 226.23(e)(4) states,The institution shall take the income information provided by the household on the application and calculate the household?s total current income. When a completed application furnished by a family indicates that the family meets the eligibility criteria for free or reduced-price meals, the participants from that family shall be determined eligible for free or reduced-price meals. . . . When information furnished by the family is not complete or does not meet the eligibility criteria for free or reduced-price meals, institution officials must consider the participants from that family as not eligible for free or reduced-price meals, and must consider the participants as eligible for ?paid? meals.For the errors noted, we reclassified the participants? eligibility to the correct category and questioned the difference in the reimbursement rates. See Table 1 for a summary of questioned costs.Condition E: Risk AssessmentWe reviewed DHS?s December 2018 Financial Integrity Act Risk Assessment and determined that management did not identify the risk of subrecipients incorrectly determining eligibility requirements or maintain the documentation to support eligibility and a mitigating control.CauseDuring our discussions, DHS management did not provide a specific cause for the issues. Based on the number and type of errors we found in our testwork, as well as management?s partial concurrence with the prior-year findings, either DHS?s training of subrecipients on properly completing and maintaining individual eligibility documentation is ineffective or the subrecipients are unwilling to comply with program regulations.According to 7 CFR 226.6(a)(5), as part of its pass-through entity responsibilities, DHS agrees to ensure participating subrecipients effectively operate the program. Also, 2 CFR 200.62, ?Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,? states,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:a. Transactions are properly recorded and accounted for, in order to: (1) Permit the preparation of reliable financial statements and Federal reports; (2) Maintain accountability over assets; and (3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award;b. Transactions are executed in compliance with: (1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and (2) Any other federal statutes and regulations that are identified in the Compliance Supplement; andc. Funds, property, and other assets are safeguarded against loss from unauthorized use or disposition.EffectBecause the Director of CACFP and the Summer Food Service Program (SFSP) did not ensure subrecipients correctly determined the meal status of participants and maintained proper documentation to support eligibility determinations, DHS improperly reimbursed subrecipients for participants whose eligibility was unsupported. Until the current management implements sufficient controls and ensures corrective action at all levels, DHS will continue to have an increased risk of improperly reimbursing subrecipients in the program.Federal regulations address actions that federal agencies and non-federal agencies may impose in cases of noncompliance. As noted in 2 CFR 200.338, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.207, ?Specific conditions,?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.Section 200.338 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:(a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.(b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.(c) Wholly or partly suspend or terminate the Federal award.(d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).(e) Withhold further Federal awards for the project or program.(f) Take other remedies that may be legally available.Questioned CostsWe questioned costs totaling $6,584 for the conditions noted above. Meal reimbursement claims are calculated using a combination of reimbursement rates established by the USDA and a percentage of participants classified in the free, reduced-priced, or paid categories. Because the errors noted above required us to reclassify participants into the paid category, we determined the questioned costs for each subrecipient after considering all errors we noted. See a summary of the known questioned costs in Table 1.See Schedule of Findings and Questioned Costs for chart/table.Our testwork included a review of a nonstatistical, random sample of 60 subrecipient meal reimbursement claims, which resulted in $6,584 of known questioned costs. We selected the nonstatistical, random sample of 60 meal reimbursement claims, totaling $693,958, from a population of 7,592 claims and adjustments, totaling $66,809,536, for the period July 1, 2018, through June 30, 2019 (the state?s fiscal year). 2 CFR 200.516(a)(3) requires us to report known and likely questioned costs greater than $25,000 for a type of compliance requirement for a major program. According to 2 CFR 200.84,Questioned cost means a cost that is questioned by the auditor because of an audit finding:(a) Which resulted from a violation or possible violation of a statute, regulation, or the terms and conditions of a Federal award, including for funds used to match Federal funds;(b) Where the costs, at the time of the audit, are not supported by adequate documentation; or(c) Where the costs incurred appear unreasonable and do not reflect the actions a prudent person would take in the circumstances.RecommendationThe Commissioner and the Director of CACFP and SFSP should ensure all subrecipients are properly trained to perform required eligibility determinations and maintain proper documentation to support eligibility determinations. In addition, management should ensure sufficient controls are in place and corrective action is taken at all levels.If subrecipients continue to not maintain supporting documentation or correctly determine participant eligibility, management should impose additional conditions upon the subrecipients or take other action, as described in 2 CFR 200.207 and 200.338.Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentWe believe our costs to administer and monitor the Food Programs are reasonable and prudent and our efforts are in material compliance with federal requirements. In fact, the United States Department of Agriculture, which regulates these dollars, has closed each of the Comptroller?s previous findings without issue and with no disallowed costs.The state auditors identified $6,584 of questioned costs represents a less than 1% error rate for the reimbursement claims sampled. Additionally, 19 of the 33 sample subrecipient questioned costs were below the state?s threshold for recoupment. The department continues to evaluate findings identified in this report and in our own internal monitoring and has created training sessions to mitigate programmatic weaknesses including training subrecipients on participant eligibility and documentation. All CACFP trainings are developed and conducted in conjunction with USDA -FNS.Condition A: Age Requirement ErrorsWe do not concur.The state auditors reviewed ?eligibility applications to ensure that the subrecipients correctly determined participant?s eligibility and claimed the correct amount for meals served to participants as defined by federal regulations.? There is no federal requirement that the child?s age be included on the eligibility application. The updated CACFP Meal Benefit Income Eligibility (Child Care) form provided by USDA for Child Care programs to use for CACFP does not include a location for the child?s age to be recorded. The eligibility applications were not incomplete because they were missing the participants? birth date and/or age, the applications do not require age information under federal law.The state auditors indicated that they could not determine if the participants met the program?s definition of a child. The ages and birthdates of individuals attending childcare are maintained in multiple locations, including, but not limited to, the classroom rosters which are separated by age group; the meal counts, which are separated by age group; Head Start enrollment information; the individual information maintained on each child by the child care institution; and State licensing documentation.Condition B: Subrecipients Did Not Maintain Eligibility Applications or Did Not Maintain Complete ApplicationsWe concur in part.The state auditors found error with eligibility applications due to all household member names not being listed. We concur that this as an error on the CACFP Meal Benefit Income Eligibility (Child Care) form provided by USDA for Child Care programs to use for CACFP. We do not concur that this is a State error. The USDA provided form does not require that all household member names be listed. The USDA form requires that all children in the day care and all adult household members be named on the form. This number can differ from the total number of household members if there are additional children in the home that do not attend the child care.We agree that income eligibility applications are complicated and that errors with income information, partial Social Security numbers and guardian signatures are frequent findings identified in our monitoring process. USDA continues to evaluate the income eligibility application templates used for CACFP and DHS is continuing to provide training and technical assistance specific to this area. The Eligibility Manual for School Meals Determining and Verifying Eligibility, issued by USDA on July 18, 2017 states that, ?when no income is provided for any of the adult household members, the application is still considered complete.? Income information and the last four digits of the participant?s Social Security number are not required for individuals who are eligible based on participation in Supplemental Nutrition Assistance Program (SNAP), Temporary Assistance for Needy Families (TANF), or Food Distribution Program on Indian Reservation (FDPIR). Children are determined Other Source Categorically Eligible if they are homeless, migrant, runaway, foster child or enrolled in Head Start and guardians are not required to report any additional information on these children.The identified sponsor that did not provide eligibility applications for all 52 program participants has not participated in CACFP since July 2018. This represents over half of the identified errors.Condition C: Subrecipients Did Not Maintain Documentation of Meals, Hours, and DaysWe do not concur.The state auditors indicated documentation of the enrollment of each participant at centers that such documentation of enrollment must be updated annually and include information on each child?s normal days and hours of care and the meals normally received while in care. A USDA Memo released on March 11, 2005, CACFP Policy #02-05: Collection of Required Enrollment Information by Child Care Centers and Day Care Homes, states, ?State licensing agencies in a number of States require parents to sign their children in and out of child care facilities each day. This satisfies the requirement to collect the normal days and hours in care on each child?s enrollment form provided that: the sign-in sheet captures the time the children arrive at and depart from the child care facility; and each day, the sign-in and sign-out times are signed or initialed by a parent or guardian.?Further, as indicated in USDA Memo CACFP 15-2013, ?The Food and Nutrition Service (FNS) discourages state agencies from requiring a specific form to document enrollment for the purposes of CACFP. Instead, we encourage State agencies to accept other types of forms that centers and homes may already use in order to capture the required information.? Therefore, CACFP specific documentation of enrollment of each participant at centers and day care homes is not a Federal requirement and state audit seems to be requiring more stringent reporting than is necessary and compliant with federal law.The identified sponsor that did not provide eligibility applications for all 52 program participants has not participated in CACFP since July 2018.Condition D: Subrecipients Incorrectly Determined the Category of Meal Status for Their ParticipantsWe concur.We agree that income eligibility applications are complicated and that errors with determining the category of meal status for their participants is a frequent finding identified in our monitoring process. USDA continues to evaluate the income eligibility application templates used for CACFP and DHS is continuing to provide training and technical assistance specific to this area. The Eligibility Manual for School Meals Determining and Verifying Eligibility, issued by USDA on July 18, 2017 states that, ?when no income is provided for any of the adult household members, the application is still considered complete.? Income information and the last four digits of the participant?s Social Security number are not required for individuals who are eligible based on participation in Supplemental Nutrition Assistance Program (SNAP), Temporary Assistance for Needy Families (TANF), or Food Distribution Program on Indian Reservation (FDPIR). Children are determined Other Source Categorically Eligible if they are homeless, migrant, runaway, foster child or enrolled in Head Start and guardians are not required to report any additional information on these children. Income eligibility is updated annually by USDA and distributed to CACFP sponsors.The sponsor that did not provide eligibility applications for all 52 program participants has not participated in CACFP since July 2018. This represents 96% of the identified errors.Condition E: Risk AssessmentThe department conducts the state-required annual Financial Integrity Act Risk Assessment within the state adopted Committee of Sponsoring Organizations of the Treadway Commission?s Enterprise Risk Management Framework including the optional toolkit forms provided by the Department of Finance and Administration.The forms are a management tool used to document significant organizational risks and key internal controls to mitigate risks within management?s risk tolerance. Management determines the effectiveness of its own controls and its risk tolerance. If risks are not sufficiently mitigated, management can implement a plan of action to modify or create new internal controls. In cases where the inherent risk can not be sufficiently mitigated by the department?s internal controls alone, for example, regulatory restraints or dependency on other organizations, management can only accept or avoid the risk.Auditor?s CommentConditions A, B, and CThe basis of this finding is that neither the department or the sponsors provided us with required eligibility documentation at the time of our audit fieldwork or subsequently. We reviewed and accepted any form of documentation provided to us that was sufficient evidence to conclude that the department or the sponsor met eligibility requirements. We can only presume that the department did not provide us all documentation we requested because they could not locate it either.We discussed the issues in this finding with the Director of Director of CACFP and SFSP on December 17, 2019. From the date of that conversation, the department?s management and staff had until February 21, 2020, to provide us with any outstanding documentation to resolve these conditions; however, they did not provide any form of documentation for enrollment, including proof that the participant was a child (such as age or birth date); normal days, hours of care; household members; and the meals normally received while in care.In addition, the sponsor that did not provide any eligibility documentation participated in CACFP during the audit period and their lack of documentation resulted in questioned costs.As noted above, we identified individual eligibility noncompliance for 33 of the 60 subrecipients we sampled (55%). Given that th

Finding Number: 2019-021CFDA Number: 10.559Program Name: Child Nutrition ClusterFederal Agency: Department of AgricultureState Agency: Department of Human ServicesFederal Award Identification Number: 175TN331N1099, 185TN331N1099, and 195TN331N1099Federal Award Year: 2017 through 2019Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: Allowable Costs/Cost PrinciplesRepeat Finding: 2018-021Pass-Through Entity: N/AQuestioned Costs: $304,730As noted in the prior five audits, the Department of Human Services did not ensure that Summer Food Service Program for Children sponsors maintained complete and accurate supporting documentation for meal reimbursement claims and/or that sponsors claimed meals and received reimbursements in accordance with federal guidelines, resulting in $304,730 of questioned costsBackgroundThe Summer Food Service Program for Children (SFSP) is funded by the U.S. Department of Agriculture and administered on the state level by the Tennessee Department of Human Services (DHS). As a pass-through entity for SFSP funds, DHS is responsible for providing sufficient qualified consultative, technical, and managerial personnel to administer the program and monitor performance to ensure that subrecipients, known as sponsors, comply with program rules and regulations.SFSP operates during the summer months. Because the state operates on a July 1 through June 30 fiscal year, our audit of SFSP crossed two state fiscal years. Our audit scope was July 1, 2018, through June 30, 2019, and our SFSP review included the following periods:? summer 2018 (May through August 2018, with the months of July through August falling within our audit scope); and? summer 2019 (May through August 2019, with the months of May and June falling within our audit scope).DHS uses the Tennessee Information Payment System (TIPS) to document approvals of meal services at individual sites and to process reimbursement payments to sponsors for meals served to children. DHS does not require sponsors to submit supporting documentation when filing claims; however, federal regulations require sponsors to maintain all documentation to support their claims and to comply with federal guidelines during the meal reimbursement process. In addition, as the non-federal entity, DHS must implement internal controls over compliance requirements for federal awards designed to provide reasonable assurance that its subrecipients achieve compliance with the federal grantor?s regulations.As part of DHS?s internal control process, DHS management established a sponsor application process to provide oversight and accountability for sponsors? operations. During the application process and before sponsors can begin in the program, DHS staff approves various information pertaining to the sponsors? meal services before the sponsors can serve meals and claim reimbursement through the reimbursement request process. The information that DHS approves includes, but is not limited to,? the physical locations of where actual meal services take place?sponsors are expected to serve SFSP meals at these locations during approved dates;? the maximum number of meals sponsors can serve during individual meal services, known as the capacity;? the meal types the sponsors serve; and? the approved dates of operation, when site personnel serve meals to children.Sponsors can request to change previously approved information on the application to accommodate summer program operations. Once DHS has approved the changes, sponsors must abide by the newly approved information in order to claim meals for reimbursement.Sponsors use meal count forms to document the number of meals served to children during each meal service. Sponsors use these forms to calculate reimbursement requests.DHS provides federal reimbursements to sponsors for eligible meals served to individuals who meet age and income requirements based on a combined rate, which covers meals and administrative components. The meal component of the combined reimbursement rate is applicable to all sponsors and their sites. The administrative component of the combined rate depends on whether sponsors self-prepare their own meals or obtain meals from a food vendor. If the sponsor obtains meals from a food vendor, then the geographical location of the feeding site, which can be either urban or rural, determines the administrative component of the combined reimbursement rate.Based on our understanding of the federal regulations, the federal grantor expects sponsors to administer the program with high integrity and to accurately claim only reimbursable meals served to children and in compliance with program guidance. The federal grantor also expects DHS to monitor the sponsors to obtain reasonable assurance that sponsors comply with federal and state regulations, and to follow up on program violations and inconsistencies.DHS approved 58 sponsors for the 2018 Summer Food Service Program. Based on the results of our 2018 Single Audit, because we have already questioned meal reimbursement claims for 3 of the sponsors in the 2018 Single Audit, we did not include these 3 sponsors in our population for our current testwork. We haphazardly selected for testwork 1 meal reimbursement claim for each of the remaining 55 sponsors and 1 additional meal reimbursement claim for the 5 largest sponsors. We also selected a nonstatistical, haphazard sample of 60 meal reimbursement claims, totaling $4,664,822, from the population of 109 SFSP sponsors? meal reimbursement claims paid during state fiscal year 2019, totaling $9,247,016.Based on our review of the sponsors? claims, we determined that DHS reimbursed sponsors for inaccurate meal reimbursement claims. Specifically, we found thatA. sponsors did not maintain or could not provide complete and accurate supporting documentation for meal claims submitted to DHS for reimbursement;B. sponsors claimed meals above the approved serving limits;C. sponsors claimed meals outside the approved dates;D. DHS reimbursed sponsors using incorrect administrative rates;E. one sponsor claimed more than the allowed meal types per day;F. sponsors provided questionable meal count forms to support reimbursement payments; andG. sponsors did not use compliant meal count forms.As reported in findings in the five prior audits, we found that sponsors had not complied with established federal regulations required to support the meal reimbursement claims. DHS management concurred in part with the prior audit finding and stated, ?The Department?s continuous effort of increasing and improving its training to food program sponsors can mitigate the risk of future noncompliance but does not act as a complete preventive control.?We believe that management?s current control environment is ineffective because management does not adequately scrutinize repeat violators and/or questionable meal reporting practices in the program?s riskiest areas. As a result, management continues to allow sponsors to participate in the program and be reimbursed for meals served in violation of program requirements and, in some cases, for meals not served at all. Since 2014, we have continued to see the same or similar program noncompliance, often by the same sponsors. These sponsors have been identified repeatedly by our audits and even by the department?s Audit Services unit for noncompliance even though these very sponsors have had years of training and consultative assistance on program operations. Given the inherent risk of improper payments in SFSP and DHS?s less aggressive approach to address repeated sponsor noncompliance, we continue to find sponsors that ignore the federal and state regulations and, in some cases, exhibit dishonest behavior. See Finding 2019-017 for further information on management?s oversight responsibilities.Condition A and Criteria: Claims Were Incomplete and/or Based on Inaccurate Meal CountsBased on our review of the DHS TIPS reimbursement payments to sponsors and corresponding supporting meal count documentation obtained from the sponsors, we noted that for 52 of 60 claims reviewed (87%) for 47 sponsors, DHS staff did not ensure the sponsors maintained complete or accurate documentation to support meal reimbursement claims filed with DHS.The sponsors submitted claims for reimbursement for more meals served than the sponsors had documentation to support. In some cases, the sponsors submitted claims for fewer meals served than were reported on supporting documentation.According to Title 7, Code of Federal Regulations (CFR), Part 225, Section 15(c),Sponsors shall maintain accurate records which justify all meals claimed . . . The sponsor?s records shall be available at all times for inspection and audit by representatives of the Secretary, the Comptroller General of the United States, and the State agency for a period of three years following the date of submission of the final claim for reimbursement for the fiscal year.Questioned Costs for This ConditionSee Table 1 for details of questioned costs for this condition.See Schedule of Findings and Questioned Costs for chart/table.Condition B and Criteria: Sponsors Served and Claimed Meals Above the Approved Serving LimitsBased on our review of DHS?s approved information in TIPS pertaining to serving limits and our review of the meal count documentation obtained from the sponsors, we noted that for 16 of 60 claims reviewed (27%), 15 sponsors claimed meals above the maximum number of approved meals for the sponsors? feeding sites.According to the 2016 Administration Guide ? Summer Food Service Program,Non-Reimbursable MealsSponsors may claim reimbursement only for those meals that meet SFSP requirements. Reimbursement may not be claimed for . . . [m]eals over the cap[.]Questioned Costs for This ConditionSee Table 2 for details of questioned costs for this condition.See Schedule of Findings and Questioned Costs for chart/table.Condition C and Criteria: Sponsors Served and Claimed Meals Outside the Approved Dates of OperationBased on our review of DHS?s approved operation days in TIPS and our review of the meal count documentation obtained from sponsors, we noted that for 11 of 60 claims reviewed (18%), 10 sponsors served and claimed meals prior to DHS approval or claimed meals before or after the approved dates of operation.According to the 2016 Administration Guide ? Summer Food Service Program,Non-Reimbursable MealsSponsors may claim reimbursement only for those meals that meet SFSP requirements. Reimbursement may not be claimed for . . . [m]eals served outside of approved timeframes or approved dates of operation[.]In addition, 7 CFR 225.9(d) states,Reimbursements. Sponsors shall not be eligible for meal reimbursements unless they have executed an agreement with the State agency. All reimbursements shall be in accordance with the terms of this agreement. Reimbursements shall not be paid for meals served at a site before the sponsor has received written notification that the site has been approved for participation in the Program.Questioned Costs for This ConditionSee Table 3 for details of questioned costs for this condition.See Schedule of Findings and Questioned Costs for chart/table.Condition D and Criteria: DHS Reimbursed Sponsors Using Incorrect Administrative RatesBased on our review of meal reimbursement information in TIPS, we noted that for 3 of 60 meal reimbursement claims tested (5%), DHS reimbursed 3 sponsors using incorrect administrative reimbursement rates, resulting in overpayments of $368.Site Locality Discrepancy (Rural Versus Urban Locality)Our review found that DHS reimbursed 3 sponsors for 6 feeding sites using the higher administrative rate applicable to vended sites located in a rural area. However, we found that the sites were actually located in an urban area, requiring the sponsors to be reimbursed at the lower administrative rate.According to the 2016 Administration Guide ? Summer Food Service Program,The SFSP has two different levels of administrative reimbursement rates. The higher reimbursement rates are for sponsors of sites that prepare or assemble their own meals and for sponsors of sites located in rural areas. The lower rate is for all other sponsors.Questioned Costs for This ConditionSee Table 4 for details of questioned costs for this condition.See Schedule of Findings and Questioned Costs for chart/table.Condition E and Criteria: Sponsor Claimed More Than the Allowed Meal Types per DayBased on our review of the TIPS reimbursement payments DHS paid to sponsors and corresponding supporting meal count documentation obtained from the sponsors, we noted that for 1 of 60 claims reviewed (2%), 1 sponsor claimed 4 meal types on 1 day. This site is classified as an open site and is only allowed to claim a maximum of 2 meals types per day.According to 7 CFR 225.16(b)(3),Restrictions on the number and types of meals served. Food service sites other than camps and sites that primarily serve migrant children may serve either: (i) One meal each day, a breakfast, a lunch, or snack; or (ii) Two meals each day, if one is a lunch and the other is a breakfast or a snack.Questioned Costs for This ConditionSee Table 5 for details of questioned costs for this condition.See Schedule of Findings and Questioned Costs for chart/table.Condition F and Criteria: Sponsors Provided Questionable Meal Count Forms to Support Reimbursement PaymentsOur review of the meal count documentation revealed that for 7 of 60 meal reimbursement claims tested (12%), 7 sponsors provided questionable meal count forms and displayed the following questionable practices:? photocopied meal count forms (exact or partial replicas of the same forms with only the dates or names changed);? block claiming (claiming the same number of meals served each day); and? altered meal count forms (names, dates, and meal totals differ from version provided to DHS).We found that three sponsors photocopied meal count forms (exact or partial replicas of the same forms with only the dates or names changed), which suggests the meal count documentation was not properly prepared during the actual meal services as required by federal regulations and which also heightens the risk of potential fraudulent activity. We do not believe, nor would any prudent person believe, that photocopied meal count forms represent adequate documentation to support meal reimbursement payments.We noted that three sponsors block claimed most of the meal counts we selected for review. The sponsors claimed that they served the same number of meals each day with little or no variance during the claim period. Given our experience with SFSP, we believe that these meal service outcomes are unlikely and that the number of meals claimed is questionable.We found that one sponsor altered meal count forms. At DHS?s request to facilitate monitoring, the sponsor provided DHS meal count forms in 2018; however, when we requested the meal count forms in 2019 for review, we compared the forms provided to DHS in 2018 with the forms we requested for the same dates of services, and many of the meal count forms had changed. Site supervisors? names, meal count dates, and meal count totals were different on some days. The altered forms suggest the meal count documentation was not properly prepared during the actual meal service as required by federal regulations; they also heighten the risk of potentially fraudulent activity.According to 7 CFR 225.15(c),Sponsors shall maintain accurate records justifying all meals claimed . . . The sponsor?s records shall be available at all times for inspection and audit by representatives of the Secretary, the Comptroller General of the United States, and the State agency for a period of three years following the date of submission of the final claim for reimbursement for the fiscal year.The 2016 Administration Guide ? Summer Food Service Program states, ?Daily meal count sheets are required.? The guide also states, ?Each site must take a point-of-service meal count every day.?Also according to the program guide,Sponsors may claim reimbursement only for those meals that meet SFSP requirements. Reimbursement may not be claimed for . . . [m]eals that were not served[.]Questioned Costs for This ConditionSee Table 6 for details of questioned costs for this condition.See Schedule of Findings and Questioned Costs for chart/table.Condition G and Criteria: Sponsors Did Not Use Compliant Meal Count FormsBased on our review of the meal count documentation obtained from sponsors, we noted that for 4 of 60 claims reviewed (7%), 4 sponsors did not use an allowable meal count form. We noted the following noncompliance in the meal count forms:? no site supervisor signatures on any meal count forms or signature lines; and? no point-of-service daily meal count form and no point-of-service documented on the form.For three sponsors, the meal count forms did not contain any site supervisor signatures, nor did they contain a line for a site supervisor to sign. For one sponsor, the sponsor uses a weekly meal count form instead of a daily meal count form and does not document point-of-service on the weekly form. Furthermore, in Finding 2019-022, we noted that point-of-service counts were not taken at two sites we observed for this sponsor.According to the 2016 Administration Guide ? Summer Food Service Program,Daily meal count sheets are required; however, the weekly consolidated meal count form is not.In addition, according to the guide,Each site must take a point-of-service meal count every day. . . . The site supervisor must sign and date the meal count form.Questioned Costs for This ConditionSee Table 7 for details of questioned costs for this condition.See Schedule of Findings and Questioned Costs for chart/table.Condition H and Criteria: Risk AssessmentWe reviewed DHS?s December 2018 Financial Integrity Act Risk Assessment and determined that management listed the risk of subrecipients submitting claims that are not supported by documentation; however, DHS did not have an effective control to mitigate its risk.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.CauseBecause DHS does not require subrecipients to provide supporting documentation for each meal reimbursement claim before payment, management and staff instead rely on the Audit Services unit to review supporting documentation during monitoring visits and to train sponsors about the federal program requirements. We discussed the issues presented in this finding with DHS management; however, DHS did not provide a cause for the issues we found. In our discussions with sponsors, they said the causes for the errors noted in the conditions above were human errors and the lack of an adequate sponsor review. Sponsors also stated that additional training from DHS would help reduce these errors.?Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,? 2 CFR 200.62, states,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:a. Transactions are properly recorded and accounted for, in order to:(1) Permit the preparation of reliable financial statements and Federal reports;(2) Maintain accountability over assets; and(3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award;b. Transactions are executed in compliance with:(1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and(2) Any other Federal statutes and regulations that are identified in the Compliance Supplement; andc. Funds, property, and other assets are safeguarded against loss from unauthorized use or disposition.EffectAs a pass-through entity for SFSP, DHS is responsible for ensuring that sponsors comply with federal and state requirements. When DHS management and staff do not establish and implement properly designed controls to comply with federal requirements, management will continue to reimburse sponsors for unallowable expenditures resulting from errors, noncompliance, fraud, waste, and abuse.Additionally, federal regulations address actions that federal agencies and non-federal agencies may impose in cases of noncompliance. As noted in 2 CFR 200.338, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.207, ?Specific conditions,?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.Section 200.338 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:(a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.(b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.(c) Wholly or partly suspend or terminate the Federal award.(d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).(e) Withhold further Federal awards for the project or program.(f) Take other remedies that may be legally available.Summary of Questioned Costs for All ConditionsSee Table 8 for a summary of questioned costs for all conditions.See Schedule of Findings and Questioned Costs for chart/table.This finding, in conjunction with Finding 2019-022, resulted in total known federal questioned costs exceeding $25,000 for federal programs that were audited as major programs. When known questioned costs are greater than $25,000 for a type of compliance requirement for a major program, 2 CFR 200.516(a)(3) requires us to report those costs.According to 2 CFR 200.84, questioned costs are costs an auditor questions because the costs either (a) resulted from a violation or possible violation of federal requirements, (b) were not supported by adequate documentation, or (c) were unreasonable.RecommendationThe Commissioner and the Director of Operations for the Child and Adult Care Food Program (CACFP) and SFSP should pursue actions to ensure both subrecipients and DHS comply with the federal requirements. The Director of Operations for CACFP and SFSP should develop stronger preventive and detective controls over SFSP. These controls should ensure that all sponsors maintain complete and accurate documentation to support the meals served and claimed for reimbursements and that sponsors follow federal guidelines when claiming meals on their meal reimbursements.When subrecipients continually fail to maintain adequate meal reimbursement documentation, management should impose additional conditions upon the subrecipients or take other action, as described in 2 CFR 200.207 and 200.338.Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentThe questioned cost does not mean the cost is not allowed or misused of funds. The department and federal agency will determine the allowability of the cost in accordance with federal law.We believe our costs to administer and monitor the Food Programs are reasonable and prudent and our efforts are in material compliance with federal requirements. In fact, the United States Department of Agriculture, which regulates these dollars, has closed each of the Comptroller?s previous findings (2014-2017) without issue and with no disallowed costs. The department remains at the will of the legislature should a decision be made to spend additional state dollars and monitor this program above the requirements of the federal law.Condition A: Claims Were Incomplete and/or Based on Inaccurate Meal CountsWe concur in part.The department agrees that incomplete meal claims and inaccurate meal counts occur in the SFSP program due to inherit risk in the manual process of completing the meal counts. The department?s monitors already identified this type of issue during the monitoring process and provided the Comptroller?s Office with monitoring reports. The department monitored 24 of the 47 sponsors identified in this condition. Out of the 24 monitored sponsors, the department noted the same or similar instances of noncompliance in 21 of the issued reports, and the sponsors have subsequently submitted corrective action addressing the issue and returned any identified overpayment. The department?s monitoring was not taken into consideration during the audit process because the review month or feeding sites selected varied from the state auditors? selection.The department does not concur with the identified noncompliance for six sponsors noted in this finding. The identified noncompliance was that the sponsor did not claim enough meals. There are no federal regulations that require a sponsor to claim all eligible meals and to report underclaimed meals in a finding of sponsor noncompliance is disingenuous and against federal regulations. It is important to note that 12 of the 41 remaining claims resulted in questioned costs that are below the federal regulation and department?s threshold for collection.Condition B: Sponsors Served and Claimed Meals Above the Approved Serving LimitsWe concur in part.The department agrees that claiming meals above the approved serving limits occurs in the SFSP program, and as noted above, this issue was identified by the department?s monitors. The department monitored 6 of the 16 sponsors identified in this condition. Out of the 6 monitored sponsors, the department noted the same or similar instances of noncompliance in all 6 of the issued reports, and the sponsors have subsequently submitted corrective action addressing the issue and returned any identified overpayment. The department?s monitoring was not taken into consideration during the audit process because the review month or feeding sites selected varied from the state auditors? selection.It is important to note that 8 of the 16 sponsors with questioned costs are below the department?s threshold for collection.The department continued with its effort of increasing and improving its training to food program sponsors and provided additional technical support to mitigate the risk of future noncompliance.Condition C: Sponsors Served and Claimed Meals Outside the Approved Dates of OperationWe concur in part.The department agrees that serving and claiming meals outside the approved dates of operation occurs in the SFSP program, and this issue was identified by the department?s monitors. The department monitored 5 of the 11 sponsors identified in this condition. Out of the 5 monitored sponsors, the department?s monitors noted the same or similar instances of noncompliance in the issued reports, and the sponsors have subsequently submitted corrective action addressing the issue and returned any identified overpayment. The department?s monitoring was not taken into consideration during the audit process because the review month or sites selected varied from the state auditors? selection.It is important to note that 4 of the 11 sponsors with questioned costs are below the department?s threshold for collection.The department continued with its effort of increasing and improving its training to food program sponsors technical support to mitigate the risk of future noncompliance.Condition D: DHS Reimbursed Sponsors Using Incorrect Administrative RatesWe concur.In the summer of 2018 SFSP administrative reimbursement rates were determined in the application based on county selection of the applicant. This process created an opportunity for human error, as occurred in these three instances. The department has since changed the system to determine geographic location based on the address of the summer feeding sites removing the opportunity for this error to occur

Finding Number: 2019-022CFDA Number: 10.559Program Name: Child Nutrition ClusterFederal Agency: Department of AgricultureState Agency: Department of Human ServicesFederal Award Identification Number: 195TN331N1099Federal Award Year: 2019Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: Allowable Costs/Cost PrinciplesRepeat Finding: 2018-022Pass-Through Entity: N/AQuestioned Costs: FY2020: $13,927For the sixth consecutive year, the Department of Human Services did not ensure that Summer Food Service Program for Children subrecipients served and documented meals according to established federal regulations, resulting in $13,927 of federal questioned costsBackgroundGeneral InformationThe Summer Food Service Program for Children (SFSP) is funded by the U.S. Department of Agriculture and administered on the state level by the Tennessee Department of Human Services (DHS). As a pass-through entity for SFSP funds, DHS is responsible for providing sufficient qualified consultative, technical, and managerial personnel to administer the program and monitor performance to ensure that subrecipients, known as sponsors, comply with program rules and regulations.Sponsors may operate the program at one or more feeding sites. DHS requires sponsors to count meals served and record this number on a daily meal count form. Sponsors can claim reimbursement requests only for meals that comply with program guidance, such as meals served with all required components and within DHS-approved timeframes. Site personnel then submit the meal count forms to the sponsor, who calculates monthly totals and submits reimbursement requests to DHS.DHS uses the Tennessee Information Payment System (TIPS) to process reimbursement payments to sponsors. DHS does not require sponsors to submit supporting documentation when filing claims; however, federal regulations require sponsors to maintain all documentation to support their claims and to comply with federal guidelines during the meal reimbursement process. DHS monitors subrecipients to obtain reasonable assurance that both sponsors and site personnel comply with state and federal requirements.When DHS monitors identify that subrecipients have not complied with federal requirements, DHS addresses these meal service violations by requiring subrecipients to submit a corrective action plan, which outlines actions and steps to prevent the noncompliance from occurring in the future. More serious violations, outlined in the federal guidelines, result in a process called a serious deficiency, which requires DHS to start terminating the sponsor from the program and disapprove the subrecipient?s application from future program participation unless the subrecipient takes appropriate corrective actions to prevent the recurrence of the deficiencies.SFSP operates during the summer months (May through August). Because the state operates on a July 1 through June 30 fiscal year, our audit of SFSP, including meal observation and subsequent follow-up claim review testwork, crossed two state fiscal years:? 2019 (July 1, 2018, through June 30, 2019, with the months of May and June falling during our review period); and? 2020 (July 1, 2019, through June 30, 2020, with the months of July and August falling during our review period).Follow up on Prior Audit FindingsWe reported in the prior five audits that subrecipients had not complied with established federal regulations required for meal service at feeding sites and had not maintained accurate meal reimbursement documentation. DHS management concurred in part with the prior audit finding and acknowledged that noncompliance and errors occur in administering the SFSP. Management stated that they remain committed to efforts to make improvements and to continue to provide federally required monitoring and training opportunities to sponsors; however, management also commented that no monitoring plan or training activities can ensure complete compliance with all requirements.As noted in our prior audit findings and again in this finding, we continue to find that the same sponsors have not complied with the federal requirements. Even though we have reported these sponsors to management, we do not see sufficient evidence that management has used our audit results to further investigate and address repeatedly identified noncompliant sponsors.Overall ConditionWe found that 16 of 21 sponsors noted in this finding had participated in the SFSP program in the past and were returning to participate as sponsors for the 2019 SFSP program year; they have participated in SFSP for 4 or more years, and therefore have received repeated training on compliance requirements. Given the fact that these sponsors have multiple years of experience and an established relationship with DHS in this program, we believe that management has not effectively analyzed the causes for the sponsors? continued noncompliance and that the following may contribute to sponsors? continuous program violations:? DHS has either not provided sponsors training or has provided insufficient or ineffective training;? DHS has not identified the sponsors? continued noncompliance as serious deficiencies requiring corrective action;? DHS has not identified that sponsors are incapable of administering the program in accordance with requirements; or? DHS is incapable or unwilling to react to fraud risk factors for sponsors that may have nefarious motives.We also found that even though DHS may place sponsors into a serious deficiency status based on its monitoring process and begin actions to terminate the sponsors from program participation, the serious deficiency process has its weaknesses. One such weakness involves sponsors with a history of repeat violations that continue to submit corrective action plans year after year but either are unable to correct noncompliance issues or have no real intent to correct noncompliance issues. On paper, the corrective action as described may seem sufficient to solve noncompliance issues; however, the sponsors continue to not follow the rules of the program or implement corrective action. As such, DHS?s monitoring and serious deficiency processes have not been sufficient to enforce or to ensure that habitually noncompliant sponsors come into compliance or are effectively removed from program participation.Conditions A, B, and C noted in this finding are repeated from the prior year. It is also important to note that DHS approved approximately 1,900 feeding sites statewide, under 53 participating sponsors, to serve meals during 2019 SFSP. The 34 meal services we observed or attempted to observe represents only a small fraction of SFSP operations. As such, given the numerous deficiencies we found in our limited sample review, we believe the deficiencies are pervasive throughout the entire program and sponsor population.Current Testwork PlanUsing a combination of systematic and haphazard selection methods, we selected 25 of the 53 sponsors that DHS approved for the 2019 program. We observed 25 meal services at 25 different sites, operated by the 25 different sponsors. In addition, for 4 of the 25 sponsors, we expanded our testwork. We attempted 9 meal observations at 5 sites and were able to observe 3 meal services at 3 sites. For the remaining 6 attempts, the sponsor did not serve meals on the day we attempted to observe the meal service.After the 2019 SFSP meal service program ended, we subsequently followed up with all 25 sponsors to ensure they claimed the correct number of meals on the reimbursement claims submitted to DHS for the 28 meal services we observed and the 6 meal services we attempted to observe. These 34 meal service follow-ups consisted of 30 monthly claims the sponsors submitted.We noted meal service noncompliance during our meal observations (see Condition A). Based on our follow-up reviews, we also noted that subrecipients did not claim the correct number of meals for the day of our observation and attempted observation (see Condition B); did not maintain accurate meal reimbursement documentation for all meals for the month we reviewed (see Condition C); and did not use daily point-of-service meal count forms (see Condition D). See details in the Condition sections as follows.Condition A: Meal Service NoncomplianceOverall, we noted 8 different types of meal service noncompliance at 15 of 25 meal services observed (60%), ranging from 1 to 5 SFSP violations per site. For our expanded testwork, we noted 6 different types of meal service noncompliance at 3 of 3 meal services observed (100%), ranging from 2 to 3 SFSP violations per site.In our sample testwork, we observed the types of noncompliance with the SFSP program requirements noted in Table 1.See Schedule of Findings and Questioned Costs for chart/table.In our expanded testwork, we observed the types of noncompliance with the SFSP program requirements noted in Table 2.See Schedule of Findings and Questioned Costs for chart/table.The above-mentioned instances of noncompliance substantiate grounds to disallow program payments. We discussed each instance of noncompliance and its allowability for program reimbursement with sponsors? personnel at the time of or subsequent to our site visit, and the personnel agreed to correct the meal count forms and document only reimbursable meals. See Conditions B and C for the results of our follow-up review.Additionally, during one meal observation, we found that two sponsors (Sponsor 1 and Sponsor 3) were serving the same children more than the maximum two meals per day. Different sponsors may serve meals at the same site, but the maximum number of meals allowed for the same child is two meals. DHS approved and reimbursed Sponsor 1 for lunch and snacks and Sponsor 3 for breakfast and snacks. Sponsor 3 was the second sponsor approved for this site; therefore, we questioned all costs DHS paid to Sponsor 3 for this site, totaling $2,730.CriteriaSee Table 3 for applicable noncompliance criteria.See Schedule of Findings and Questioned Costs for chart/table.See Schedule of Findings and Questioned Costs for footnote.According to Title 7, Code of Federal Regulations (CFR), Part 225, Section 16(b)(3),Restrictions on the number and types of meals served. Food service sites other than camps and sites that primarily serve migrant children may serve either: (i) One meal each day, a breakfast, a lunch, or snack; or (ii) Two meals each day, if one is a lunch and the other is a breakfast or a snack.Condition B: Incorrect Number of Meals Claimed for the Day of Our Meal Service Observations and Attempted ObservationsMeal Service ObservationsOur sample testwork revealed that for 6 of 25 meal services observed (24%), 6 sponsors did not claim the correct number of meals that we physically observed during our observation. Our expanded testwork revealed that for 1 of 3 meal services observed (33%), 1 sponsor did not claim the correct number of meals that we physically observed during our observation. See Table 4 for details of the noncompliance and the questioned costs for the meal service observations.See Schedule of Findings and Questioned Costs for chart/table.Attempted Meal Service ObservationsOur expanded testwork revealed that for the six attempted meal services observations, two sponsors claimed meals that they did not serve. At one sponsor, we observed locked doors and signs posted stating that the facility would be closed. Site personnel later stated that the site was closed on the date of the attempted breakfast and lunch meal service observations and no children were fed. On an additional attempted lunch meal service observation, all children were away on a field trip and site personnel stated no lunch would be taking place. At the other sponsor, we attempted to observe three lunch meal services at two sites and found no children present for meals. See Table 5 for the details of the noncompliance and the questioned costs for these two sponsors.See Schedule of Findings and Questioned Costs for chart/table.In addition to questioning the costs for the days we did not observe any children, we questioned all the meals, totaling $2,839, for Sponsor 10, Site B, because we did not see any meals served at this site.Condition C: Meal Reimbursement Documentation Was Inaccurate for the Month of Our Meal Service Observations and Attempted ObservationsIn addition to verifying the day of our meal service observations, we also verified the number of meals the sponsor claimed for the entire corresponding month for the feeding sites where we performed and attempted to perform our meal observations. Our testwork revealed that for 16 of 30 monthly claims reviewed (53%), 15 sponsors did not maintain correct documentation to support the meal reimbursement claim submitted for the meal type for the month. See Table 6 for details of the noncompliance.See Schedule of Findings and Questioned Costs for chart/table.Criteria (Applicable to Conditions B and C)According to 7 CFR 225.15(c),Sponsors shall maintain accurate records justifying all meals claimed . . . The sponsor?s records shall be available at all times for inspection and audit by representatives of the Secretary, the Comptroller General of the United States, and the State agency for a period of three years following the date of submission of the final claim for reimbursement for the fiscal year.Condition D: No Daily Point-of-Service Meal Count FormBased on our review of the meal count documentation provided by the sponsors, we noted that 1 of 25 sponsors (4%) was not using the required daily meal count form. The sponsor did not use a daily meal count form with point-of-service documented on the form; therefore, we questioned the cost. Additionally, we observed 2 meal services for this sponsor and, as noted in Condition A, point-of-service did not occur at either meal observation. See Table 7 for details of the noncompliance.See Schedule of Findings and Questioned Costs for chart/table.CriteriaAccording to the Summer Food Service Program?s 2016 Administration Guide,Daily meal count sheets are required; however, the weekly consolidated meal count form is not. . . . Each site must take a point-of-service meal count every day.Condition E: Risk AssessmentWe reviewed DHS?s December 2018 Financial Integrity Act Risk Assessment and determined that management did not identify the risk of sponsors repeatedly not following federal regulations while serving meals and a mitigating control.CriteriaThe U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.CauseDuring our discussions, DHS management did not provide a cause for the issues. In our discussions with sponsors, they said the causes for the errors noted in the conditions above were human errors and miscommunication or lack of communication between the site personnel and the sponsor.EffectWhen sponsors do not comply with program requirements during meal services and fail to maintain complete and accurate supporting documentation for the number of meals claimed, DHS cannot ensure that reimbursements paid to sponsors are for allowable meals. As a pass-through entity for SFSP, DHS is responsible for ensuring that sponsors comply with federal and state requirements. When DHS cannot do so, it will continue to reimburse sponsors for unallowable expenditures resulting from errors, noncompliance, fraud, waste, and abuse.Additionally, federal regulations address actions that federal agencies may impose in cases of noncompliance. As noted in 2 CFR 200.338, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.207, ?Specific conditions,?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.Section 200.338 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:(a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.(b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.(c) Wholly or partly suspend or terminate the Federal award.(d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).(e) Withhold further Federal awards for the project or program.(f) Take other remedies that may be legally available.Summary of Questioned CostsWe questioned $13,927 for the noncompliance noted above. See Table 8 for the overall noncompliance and questioned costs noted at the 21 sponsors.See Schedule of Findings and Questioned Costs for chart/table.This finding, in conjunction with Finding 2019-021, resulted in total known federal questioned costs exceeding $25,000 for federal programs that were audited as major programs. 2 CFR 200.516(a)(3) requires us to report known questioned costs greater than $25,000 for a type of compliance requirement for a major program.According to 2 CFR 200.84, questioned costs are costs an auditor questions because the costs either (a) resulted from a violation or possible violation of federal requirements, (b) were not supported by adequate documentation, or (c) were unreasonable.RecommendationThe Commissioner and the Director of Operations for the Child and Adult Care Food Program (CACFP) and SFSP should ensure that both DHS and its subrecipients comply with the federal requirements. DHS should initiate the process to remove any sponsors claiming meals for reimbursement when they do not in fact serve meals to children. The Director of Operations for CACFP and SFSP should develop stronger preventive and detective controls over SFSP. These controls should ensure that all sponsors follow federal guidelines when serving meals and claiming meals on their meal reimbursements.If subrecipients continue violating program guidelines, management should impose additional conditions upon the subrecipients or take other action, as described in 2 CFR 200.207 and 200.338.Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentWe concur in part.The department?s costs to administer and monitor the Food Programs are reasonable and prudent and our efforts are in material compliance with federal requirements. The department remains at the will of the legislature should a decision be made to spend additional state dollars and monitor this program above the requirements of the federal law.The state auditors indicated that ?the serious deficiency process has its weaknesses.? We concur that this process has weaknesses, however the department is federally required to follow the serious deficiency process as outlined in 7 CFR 225 and USDA Summer Food Service Program State Agency Monitor Guide (2017). Management is acting in accordance with the USDA Summer Food Service Program State Agency Monitor Guide (2017) Part 8: Corrective Action, Serious Deficiency, and Termination. ?The serious deficiency process of SFSP was established to ensure compliance with USDA FNS regulations and guidance and to protect Program integrity?by allowing State agencies a process in which sponsors that have not corrected non-compliance issues may be terminated for cause in accordance with Federal regulations.? (2017, p. 59)When a sponsor fails to implement timely corrective action to correct serious deficiencies cited the State agency must proceed with termination of the sponsor?s Program agreement as specified in SFSP regulations. However, the State agency must provide the sponsor with a reasonable opportunity to correct problems before termination. If an acceptable corrective action plan is received and during a follow up visit it appears that the sponsor has permanently corrected the finding, a temporary deferral of the serious deficiency is given. If, in the future, it is discovered that the sponsor failed to permanently correct the serious deficiency the sponsor?s agreement is terminated.The state auditors stated that they believe that sponsors, ?continue to submit corrective action plans year after year but either are unable to correct noncompliance issues or have no real intent to correct noncompliance issues.? The department is not able to base program denials off perceived intent of a program sponsor. As stated above, if an acceptable corrective action plan is received the state agency must defer the serious deficiency and cannot use this as grounds for denial of an application.When a sponsor is denied, they must be provided information required by the governing federal law of their right to obtain a hearing. Upon request of a hearing, the Hearing Official then reviews the evidence and makes a final decision regarding continued participation. If a request for a hearing is not received in timely manner the sponsor?s participation is terminated. The only exception to the procedure is due to evidence of immediate health and/or safety of the children whereas immediate termination is warranted.The department is committed to the success and federal compliance of our SFSP sponsors. The department will continue to provide technical assistance and training to the sponsors in question and monitor sponsors in accordance with the federal regulations. It is the responsibility of the sponsors to serve meals in compliance with the federal regulations, and the department will continue to support this responsibility and act accordingly when compliance with the federal regulations is not upheld.Condition A: Meal Service NoncomplianceWe concur in part.We agree that meal service noncompliance occurs in the SFSP program, as it is one of the frequent issues identified in the department?s monitoring process. The department monitored 9 of the 15 sponsors identified in this condition. Out of the 9 monitored sponsors, the department noted the same or similar instances of noncompliance in 7 of the issued reports and the sponsors have subsequently submitted corrective action addressing the issue and returned any identified overpayment. The department?s monitoring was not taken into consideration during the audit process because the review month or sites selected varied from the state auditors? selection.We do not concur with the identified noncompliance for the remaining 2 monitored sponsors. The department monitored Sponsor 5 and Sponsor 7 during the same timeframe and was provided signed meal count forms for the sites and days in question. These sponsors and sites do not have any other identified issues and, therefore, have complied with the federal regulations.Condition B: Incorrect Number of Meals Claimed for the Day of Our Meal Service Observations and Attempted ObservationsWe concur in part.We concur that inconsistencies between observed meals and claimed meals occur in the SFSP program, as it is one of the issues identified in the department?s monitoring process. The department monitored 4 of the 7 sponsors identified in table 4 of this condition and monitored both sponsors identified in table 5 of this condition. The department noted the same or similar instances of noncompliance in the issued reports for all 4 monitored sponsors identified in table 4 and both sponsors identified in table 5. The sponsors have subsequently submitted corrective action addressing the issue and returned any identified overpayment. The department?s monitoring was not taken into consideration during the audit process because the review month or sites selected varied from the state auditors? selection.Condition C: Meal Reimbursement Documentation Was Inaccurate for the Month of Our Meal Service Observations and Attempted ObservationsWe concur in part.We concur that inaccurate meal reimbursement documentation occurs in the SFSP program, as it is one of the issues identified in the department?s monitoring process. The department monitored 11 of the 16 sponsors identified in this condition. Out of the 11 monitored sponsors, the department noted the similar instances of noncompliance in 10 of the issued reports, and the sponsors have subsequently submitted corrective action addressing the issue and returned any identified overpayment. The department?s monitoring was not taken into consideration during the audit process because the review month or sites selected varied from the state auditors? selection.We do not concur with the identified noncompliance for the remaining monitored sponsor, as the identified inaccuracy in the meal reimbursement documentation was that the sponsor did not claim enough meals. There are no federal regulations that require a sponsor to claim all eligible meals and including underclaimed meals in a finding of sponsor noncompliance is disingenuous. It is important to note that 12 of the 16 claims identified resulted in questioned costs that are below the states threshold for collection.Condition D: No Daily Point-of-Service Meal Count FormWe concur.The department monitored this sponsor and noted similar issues in the monitoring report. The sponsor has subsequently submitted corrective action addressing the issue and returned the identified overpaymentCondition E: Risk AssessmentThe department conducts the required annual Financial Integrity Act Risk Assessment within the state adopted Committee of Sponsoring Organizations of the Treadway Commission?s Enterprise Risk Management Framework including the optional toolkit forms provided by the Department of Finance and Administration.The forms are a management tool used to document significant organizational risks and key internal controls to mitigate risks within management?s risk tolerance. Management determines the effectiveness of its own controls and its risk tolerance. If risks are not sufficiently mitigated, management can implement a plan of action to modify or create new internal controls. In cases where the inherent risk can not be sufficiently mitigated by the department?s internal controls alone, for example, regulatory restraints or dependency on other organizations, management can only accept or avoid the risk.Auditor?s CommentIn addition to this finding and as noted in findings 2019-017, 2019-018, and 2019-021, DHS?s monitoring activities and efforts do not include sufficient next steps to address sponsors exhibiting fraud risk patterns and/or that submit meal claims when meals are not served. As a result, management continues to pay sponsors for meals served in violation of program requirements and, in some cases, for meals not served at all.Condition AAfter the meal service observation was completed, Sponsor 5 and 7 did not appropriately sign the meal count forms. When we discussed our observation results and the deficiencies we noted with Sponsor 5 and 7, they subsequently signed the forms. Had we not informed them of the deficiency the meal count forms would not have been signed when monitors arrived. The sponsors must comply without prompting from either auditors or monitors.Condition CTitle 7, Code of Federal Regulations (CFR), Part 225, Section 9(d) states that in submitting a claim for reimbursement, each sponsor shall certify that the claim is correct and that records are available to support this claim. Therefore, inaccurate claim reporting of meals served?both underclaimed and overclaimed?violate program requirements. Additionally, DHS management seems to suggest that auditors should not take issue with sponsors that underclaim meals; however, Audit Services? monitors included underclaimed meals as errors in their monitoring reports.The department?s threshold for collecting overpayments from sponsors has no relevance to the auditor?s determination of questioned costs. 2 CFR 200.84 defines questioned costs as costs an auditor questions because the costs either (a) resulted from a violation or possible violation of federal requirements, (b) were not supported by adequate documentation, or (c) were unreasonable. Once an auditor reports questioned costs based on the audit, the fe

Finding Number: 2019-023CFDA Number: 84.126Program Name: Rehabilitation Services - Vocational Rehabilitation Grants to StatesFederal Agency: Department of EducationState Agency: Department of Human ServicesFederal Award Identification Number: H126A180063 and H126A190063Federal Award Year: 2018 and 2019Finding Type: Material Weakness and NoncomplianceCompliance Requirement: Matching, Level of Effort, EarmarkingRepeat Finding: 2018-023Pass-Through Entity: N/AQuestioned Costs: N/AFor the second year in a row, the Department of Human Services did not expend the required 15% of the 2018 Vocational Rehabilitation grant award for pre-employment transition servicesBackgroundThe U.S. Department of Education provides Vocational Rehabilitation grants to assist states with operating comprehensive Vocational Rehabilitation programs to help individuals with disabilities gain, maintain, or return to employment. In Tennessee, the Department of Human Services (DHS) administers Vocational Rehabilitation through its Division of Rehabilitation Services. As part of administering Vocational Rehabilitation grants, Title 34, Code of Federal Regulations (CFR), Part 361, Section 65(a)(3)(i), requires DHS to reserve at least 15% of its allotted grant award to provide pre-employment transition services (Pre-ETS). For the federal fiscal year 2018, (See Schedule of Findings and Questioned Costs for footnote) DHS received a grant award of $59,511,955 from the federal government, which meant management needed to reserve and expend $8,926,793.25 to provide Pre-ETS in order to comply with the federal compliance requirement for matching, level of effort, and earmarking.DHS, in collaboration with local educational agencies, must use these funds to provide or arrange for the provision of Pre-ETS to disabled students. DHS must ensure these services are available statewide for all students with disabilities, regardless of whether the student has applied or been determined eligible for Vocational Rehabilitation services. Requirements in 34 CFR 361.48(a)(2) specify these services, including the following:(i) Job exploration counseling;(ii) Work-based learning experiences, which may include in-school or after school opportunities, or experience outside the traditional school setting (including internships), that is provided in an integrated environment in the community to the maximum extent possible;(iii) Counseling on opportunities for enrollment in comprehensive transition or postsecondary educational programs at institutions of higher education;(iv) Workplace readiness training to develop social skills and independent living; and(v) Instruction in self-advocacy . . . which may include peer mentoring.Federal guidance also specifies that administrative expenditures are allowable under the Vocational Rehabilitation grant, but DHS cannot classify administrative expenditures as Pre-ETS expenditures. The Department of Finance and Administration (F&A) is responsible for performing all fiscal-related duties on behalf of DHS. A Controller is assigned to oversee DHS?s fiscal-related duties.ConditionIn the 2018 Single Audit, we reported that DHS expended only $2,384,385 from the 2017 grant award to provide Pre-ETS, which was less than the 15% requirement. This year, to verify that DHS met the earmarking requirement for Pre-ETS, we determined the total 2018 grant award (See Schedule of Findings and Questioned Costs for footnote) expenditures as of the end of our audit period and calculated the percentage expended for providing Pre-ETS. For the 2018 grant award, DHS expended approximately $47.6 million of the $59.5 million awarded as of June 30, 2019 (See Schedule of Findings and Questioned Costs for footnote). Therefore, DHS was required to spend $7,137,985 for Pre-ETS. Based on our testwork, we found that DHS only expended $1,412,102 for Pre-ETS, which is approximately 3% of the total amount of grant fund expenditures and $5,725,883 less than the 15% requirement. Without a properly designed and implemented control, management failed to spend the required amount of funds on Pre-ETS activities.Risk AssessmentWe reviewed DHS?s and F&A?s December 2018 Financial Integrity Act Risk Assessment for DHS operations and determined that management did not identify the risk of noncompliance with earmarking and a mitigating control.CriteriaRegarding the use of Pre-ETS funds, 34 CFR 361.65(a)(3)(i) states,Pursuant to section 110(d) of the Act, the State must reserve at least 15 percent of the State?s allotment, received in accordance with section 110(a) of the Act for the provision of pre-employment transition services, as described in ?361.48(a) of this part.In addition, 34 CFR 361.48(a) states,Each State must ensure that the designated State unit, in collaboration with the local educational agencies involved, provide, or arrange for the provision of, pre-employment transition services for all students with disabilities, as defined in ?361.5(c)(51), in need of such services, without regard to the type of disability, from Federal funds reserved in accordance with ?361.65, and any funds made available from State, local, or private funding sources.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.CauseAccording to program management, DHS has put processes in place to meet the earmarking requirements going forward. Management stated, however, that they focused this effort on the funding beginning with the 2019 federal grant. Therefore, management did not focus on the 2018 grant, resulting in the deficient level of spending of earmarked funds for our audit period.EffectBy not expending earmarked funds as required, DHS increases the risk that Tennessee students eligible to receive Pre-ETS services will not receive services that could help them pursue opportunities to live more independently, including jobs and higher education.Additionally, federal regulations address actions that federal agencies may impose in cases of noncompliance. According to 2 CFR 200.338, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.207, ?Specific conditions,?1. Requiring payments as reimbursements rather than advance payments;2. Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;3. Requiring additional, more detailed financial reports;4. Requiring additional project monitoring;5. Requiring the non-Federal entity to obtain technical or management assistance; or6. Establishing additional prior approvals.Also, 2 CFR 200.338 states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:a. Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.b. Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.c. Wholly or partly suspend or terminate the Federal award.d. Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).e. Withhold further Federal awards for the project or program.f. Take other remedies that may be legally available.RecommendationThe Commissioner of DHS should ensure that Vocational Rehabilitation program management and staff continue to focus their efforts on increasing Pre-ETS spending to provide more services to disabled students in Tennessee.Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentWe concur.The department has continued to earmark the required 15% through its budgeting processes with the department?s budget team while continuing to focus on increased availability and improved controls for managing high-quality services through partner contracts with Local Education Agencies and community rehabilitation providers. As part of those efforts, the department shifted most Vocational Rehabilitation (VR) contracts from state fiscal year to federal fiscal year terms in order to better manage the disbursement of those funds in alignment with the federal funding award year. Prior to the shift, contracts for services, including pre-employment transition services (Pre-ETS), were liquidated in association with the previous federal award year because that was the year in which they were obligated when contracts were executed within the standard state fiscal year cycle. That shift, which began October 1, 2018, contributed to the condition described in this finding which may make it appear that the program was not expending funds or providing the level of service experienced in the previous year. In fact, not only did the program continue to provide Pre-ETS services to students with disabilities, the number of providers increased during the test period with an increased emphasis on finding providers to better serve distressed counties. As a result, the earmarking and expenditures will now be more accurately reflected with full obligations and expenditures within the federal fiscal award year. Management is committed to continued growth and availability of Pre-ETS services and will continue to monitor and adjust as needed to achieve full compliance.

Finding Number: 2019-024CFDA Number: 84.126Program Name: Rehabilitation Services - Vocational Rehabilitation Grants to StatesFederal Agency: Department of EducationState Agency: Department of Human ServicesFederal Award Identification Number: H126A180063 and H126A190063Federal Award Year: 2018 and 2019Finding Type: Material Weakness ? Matching, Level of Effort, Earmarking, Significant Deficiency ? Reporting, NoncomplianceCompliance Requirement: Matching, Level of Effort, Earmarking, ReportingRepeat Finding: 2018-024Pass-Through Entity: N/AQuestioned Costs: N/AFor the fifth year, fiscal staff for the Department of Human Services did not comply with financial reporting requirements for the Vocational Rehabilitation Grants to States program and did not ensure compliance with maintenance of effort requirementsBackgroundThe U.S. Department of Education?s Rehabilitation Services Administration (RSA) provides Vocational Rehabilitation grants to assist states in operating comprehensive vocational rehabilitation programs to help individuals with disabilities gain, maintain, or return to employment. In Tennessee, Vocational Rehabilitation is administered by the Department of Human Services (DHS) through its Division of Rehabilitation Services. The Department of Finance and Administration (F&A) is responsible for performing all fiscal-related duties on behalf of DHS, including submitting financial reports to RSA. A Controller is assigned to oversee DHS?s fiscal-related duties. As part of the grant?s requirements, the state matches the federal funds by using state and other non-federal funds, such as funds from local governments and donations, to pay 21.3% of all Vocational Rehabilitation expenditures. Fiscal staff draw down federal Vocational Rehabilitation funds using the U.S. Department of Education?s G5 grants management system.DHS is required to file a federal financial report, the SF-425 report, semi-annually for each federal fiscal year?s Vocational Rehabilitation grant. The semi-annual reporting periods are April 1 through September 30 and October 1 through March 31. Reports are generally due to RSA 45 days after the reporting period ends.Once it receives the SF-425 reports, RSA reviews DHS?s reports and makes the following determinations:? whether DHS is permitted to carry over Vocational Rehabilitation funds into the next federal fiscal year,? if DHS must return any unobligated federal program income to RSA, and? if DHS complied with various compliance requirements.General Reporting RequirementsObligationsRSA requires grantees (in this case, DHS) to track and report the amounts and funding sources of obligations (See Schedule of Findings and Questioned Costs for footnote). In addition, DHS must track these obligations by obligation date and by status (unliquidated or liquidated).RSA requires DHS to complete a separate SF-425 report for each federal Vocational Rehabilitation grant award until each award?s period of performance ends (See Schedule of Findings and Questioned Costs for footnote); therefore, if DHS carries over federal Vocational Rehabilitation funds into the subsequent federal fiscal year, it must submit two SF-425 reports for each reporting period in the subsequent federal fiscal year.Prior AuditsDuring the 2015 Single Audit, we identified several critical deficiencies in DHS?s preparation of Vocational Rehabilitation SF-425 federal financial reports. Specifically, we found that management did not ensure that DHS?s financial management systems were sufficient to permit the preparation of the SF-425 reports and that fiscal staff did not ensure that the reports were complete and accurate. In accordance with federal regulations, DHS entered into a corrective action plan with RSA during the 2015 audit period to correct the SF-425 reporting deficiencies.As part of the corrective action plan with RSA, during the 2017 Single Audit, we found that DHS had made improvements to the reporting processes, including? creating a reporting policy,? correcting accounting records,? modifying accounting systems to track required information, and? improving review and control processes.In addition, under the corrective action plan with RSA, DHS completed or revised SF-425 reports for the 2014 to 2017 grant awards during the 2018 Single Audit scope period. Despite these corrective steps, fiscal management still did not ensure that the required SF-425 reports were accurately prepared during the 2018 Single Audit. At the time of our prior audit fieldwork in fall 2018, we also found that management did not ensure they met the program?s maintenance of effort requirements (See Schedule of Findings and Questioned Costs for footnote). Management concurred with the prior audit finding and stated that they were in the process of enhancing the reporting unit, including educating staff on the proper manner of calculating and reporting unliquidated obligations as well as increasing the emphasis on training staff as it relates to reporting requirements and maintenance of effort thresholds. Management stated that they expected these enhancements to be completed on or about June 30, 2019.During the current audit period, we tested the semi-annual SF-425 report for the period ended March 31, 2019, for the federal fiscal years 2018 and 2019 grant awards. We also analyzed DHS?s state maintenance of effort expenditures to ensure DHS complied with maintenance of effort requirements. We found that, for the current period, fiscal management had not yet corrected the prior audit finding related to accurately preparing the required SF-425 reports or meeting the maintenance of effort requirement (see Condition). Management still improperly reported unliquidated obligations (by either overstating or understating the grant obligations); however, these errors were less material than the previous year.Condition and CauseControls Over the Reporting Process Were Inadequate, Resulting in Fiscal Staff Misreporting Three Lines on Two Reports by Improperly Including TransactionsDuring our testwork, we noted that the controls over the reporting process did not ensure that DHS properly reported accurate information related to certain lines of the submitted SF-425 reports. Fiscal staff incorrectly calculated the amount of unliquidated obligations reported on lines 10f, 10j, and 12d on the March 31, 2019, reports for both the 2018 and 2019 federal grants. For lines 10j and 12d on the 2018 grant report, DHS staff inadvertently entered the wrong fiscal information for the report line item. For line 10f on the 2018 grant report, and lines 10f, 10j, 12d on the 2019 grant report, DHS included transactions that occurred after the reporting period and thus should not have been included.Based on our understanding of DHS?s report preparation procedures and its internal instructions, fiscal staff include expenditure transactions occurring during the 15-day period subsequent to the end of the grant reporting period as unliquidated obligations because fiscal management have determined that expenditures during this 15-day period related to grant obligations that originated during the reporting period. We found, however, that fiscal staff included expenditure transactions occurring subsequent to April 15, 2019, as evidenced by the queries used to compile information for the report. These errors resulted in the variances shown in Tables 1 and 2. When we discussed these errors with management, they stated that the report?s preparer likely just made a mistake. The Fiscal Director acknowledged the instructions but stated that management would reevaluate the 15-day period since this practice was put into place before he became responsible for the report.See Schedule of Findings and Questioned Costs for chart/table.See Schedule of Findings and Questioned Costs for chart/table.Inadequate Controls and Noncompliance Related to Maintenance of Effort RequirementsDHS is required to spend at least as much in non-federal expenditures as it spent two years prior. For instance, DHS should have expended as much in non-federal expenditures in 2018 as it did in 2016. If DHS does not meet this requirement, regulations require RSA to reduce the subsequent grant award by the deficit. DHS reports its maintenance of effort expenditures on the SF-425 report, line 10j, Recipient Share of Expenditures.We found that DHS was not meeting its maintenance of effort requirements for grant year 2018 as of the March 31, 2019, report (the latest report submitted during our audit period). Although the 2018 grant was still open until September 30, 2019, the deficit as of March 31, 2019, was over $1 million. We obtained the 2018 grant?s final report, submitted September 30, 2019, (subsequent to our audit period), and noted that there had been no substantial change in the deficit.Additionally, when testing the maintenance of effort, we also examined lines 10j and 12d on the September 30, 2018, report for grant year 2018. We found that DHS had also reported these lines inaccurately by including expenditure transactions occurring beyond the reporting period (and after the recognized 15-day period described earlier), similar to the inaccuracies noted on the March 31, 2019, report. Fiscal staff also introduced reporting errors when they relied on a Procurement Budgetary Activity Report, extracted from the state?s accounting system, to determine the remaining amount of outstanding purchase orders. This is a real-time report that shows obligation amounts by purchase order, liquidations for each purchase order as of the date of the report, and the remaining unobligated amount. Since this report does not automatically classify the purchase orders between state and federal expenditures, the accountant preparing the report must do so. We found that the accountant misclassified several of these expenditures, which also contributed to lines 10j and 12d being inaccurate.Given the failure to properly meet and report the maintenance of effort, RSA was unable to reduce the 2019 grant by the appropriate deficit.Based on our discussion with the Fiscal Director, fiscal management now has an internal control in place to monitor its progress in meeting the required maintenance of effort. But this control was not implemented during the audit period. Additionally, the Fiscal Director and Controller said that the required amount of maintenance of effort had changed because DHS had to resubmit prior-year reports due to prior audit findings. As a result, they may not have known the exact amount to meet until the 2018 grant was well underway.Risk AssessmentWe reviewed DHS?s and F&A?s December 2018 Financial Integrity Act Risk Assessment for DHS operations and determined that management listed the risk of incorrect reporting; however, management did not have an effective control to mitigate its risk.We reviewed DHS?s and F&A?s December 2018 Financial Integrity Act Risk Assessment for DHS operations and determined that management did not identify the risk of noncompliance with maintenance of effort and a mitigating control.CriteriaAccording to RSA Policy Directive 15-05,RSA uses the SF-425 data to monitor the financial status of the VR [Vocational Rehabilitation] program and to assess grantee compliance with the fiscal requirements contained in the Rehabilitation Act of 1973 (Rehabilitation Act), as amended by the Workforce Innovation and Opportunity Act (WIOA). Therefore, the reports must be accurate and submitted timely. VR grantees must submit completed SF-425 reports on a semi-annual basis. The end dates for each reporting period in a fiscal year are 3/31 and 9/30.According to Policy Directive 15-05 for line 10f, Federal Share of Unliquidated Obligations,Enter the Federal portion of unliquidated obligations incurred by the grantee. Unliquidated obligations include direct and indirect expenses for goods and services incurred by the grantee, but not yet paid or charged to the VR grant award, including amounts due to contractors/vendors. When submitting a final SF-425 report, this line should be zero.According to Policy Directive 15-05 for line 10j, Recipient Share of Expenditures,Enter the total amount of non-Federal VR expenditures incurred for the reporting period. This amount must include the grantee?s non-Federal share of actual cash disbursements or outlays (less any rebates, refunds, or other credits), including payments to contractors, the grantee?s non-Federal share of unliquidated obligations (reported separately on line 12d ? Remarks), and the Non-Federal Share of Expenditures for the Establishment or Construction of Facilities for Community Rehabilitation Program (CRP) Purposes as reported on line 12a.According to Policy Directive 15-05 for line 12d, Recipient Share of Unliquidated Obligations,Enter that portion of unpaid obligations to be paid with non-Federal funds meeting the requirements in 34 CFR [Code of Federal Regulations] 361.60(b). This amount is also included in the amount reported on line 10j.Based on our review of Title 2, Code of Federal Regulations (CFR), Part 200, Section 303(a), DHS mustEstablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.According to question seven of RSA?s ?Period of Performance for Formula Grant Awards FAQs,? dated March 21, 2017,All expenditures incurred against an obligation must be tracked and reported by the States in terms of when the obligation was incurred, not when the liquidation occurs. For example, if a State enters into a contract in FFY [federal fiscal year] 2016 for the provision of services under the VR program, thereby constituting an obligation for purposes of 34 CFR 76.707 for FFY 2016, but many of the invoices submitted by the contractor for payment will be submitted to the State agency during FFY 2017, the State VR agency must report those expenditures (i.e., liquidation of the obligations) on its SF-425s for FFY 2016, not FFY 2017 when the payments were made.According to 34 CFR 361.62(a),The Secretary reduces the amount otherwise payable to a State for any fiscal year by the amount by which the total expenditures from non-Federal sources under the vocational rehabilitation services portion of the Unified or Combined State Plan for any previous fiscal year were less than the total of those expenditures for the fiscal year two years prior to that previous fiscal year.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.EffectWithout accurate financial reporting, neither the state nor the federal awarding agency can make appropriate programmatic decisions based on the contents of reports. As stated above, federal expenditures may be reduced by the amount by which the state does not meet its maintenance of effort.Additionally, federal regulations address actions that federal agencies may impose in cases of noncompliance. As noted in 2 CFR 200.338, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 200.207, ?Specific conditions?:(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.Furthermore, 2 CFR 200.338 also states,If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:(a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity.(b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.(c) Wholly or partly suspend or terminate the Federal award.(d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency).(e) Withhold further Federal awards for the project or program.(f) Take other remedies that may be legally available.RecommendationThe Department of Finance and Administration?s Controller for DHS fiscal activities should ensure that the Fiscal Director and fiscal staff are adequately trained on reporting requirements for Vocational Rehabilitation, including RSA?s instructions for report preparation, Vocational Rehabilitation regulations, Uniform Administrative Guidance, and the terms and conditions of the grant award. The Controller should implement internal controls for Vocational Rehabilitation financial reporting to provide for complete, accurate report submissions. This should include requiring fiscal staff to review records to ensure that reports include all relevant financial activity and that the activity has actually occurred in the period reported. If there is no evidence demonstrating the transaction occurred during the reporting period, the transaction should not be included in a report.The Controller should also ensure that controls are in place and effective to ensure staff accurately calculate and monitor maintenance of effort expenditures.Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentWe concur.The Department of Finance and Administration, which staffs the Department of Human Services accounting office, continues to enhance the financial reporting unit. These enhancements include, but are not limited to:? Increasing staff training for Vocational Rehabilitation?s reporting requirements and documentation of the calculation of maintenance of effort thresholds;? Incorporating multiple reviews of the report data prior to report submission;? Educating the reporting staff on the proper manner of calculating and reporting unliquidated obligations, including proper documentation of cut-off procedures; and? Developing and utilizing reporting tools, for example, queries and step by step instructions, to assist at arriving at the amounts to be reported.The enhancements are expected to be completed by June 30, 2020.Prior to September 30, 2020, significant Enterprise Risk Management Activities of the accounting office will be reviewed and updated to ensure inherent and residual risks related to reporting inaccurate information on federal reports have been appropriately evaluated and documented. In addition, identified control activities will be added or modified and monitored as needed to ensure that theses controls are operating effectively and do not deteriorate over time. Management Action Plans will also be created for any control activities that are operating beyond management?s risk tolerance.

Finding Number: 2019-025CFDA Number: 93.575 and 93.596Program Name: Child Care and Development Fund ClusterFederal Agency: Department of Health and Human ServicesState Agency: Department of Human ServicesFederal Award Identification Number: 1201TNCCDF, 1601TNCCDF, 1701TNCCDF, 1801TNCCDF, and 1901TNCCDFFederal Award Year: 2012 and 2016 through 2019Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: Allowable Costs/Cost PrinciplesRepeat Finding: 2018-026Pass-Through Entity: N/AQuestioned Costs: $4,085As noted in the three prior audits, the Department of Human Services did not ensure that child care providers maintained adequate documentation of child care services or that a contractor?s expenditures were reasonable, and fiscal services staff did not ensure that providers were reimbursed accurately, resulting in $4,085 of federal questioned costsBackground and Current ProcessThe Department of Human Services (DHS) is permitted to use the federal Child Care and Development Fund (CCDF) to fund its Child Care Certificate Program, which provides child care assistance to low-income families to allow them to work and/or attend school, and to promote the physical, emotional, educational, and social development of children. DHS?s Family Assistance and Child Care Services staff are responsible for determining children?s eligibility for child care services. Parents receiving assistance through the Child Care Certificate Program may enroll their children in any child care provider of their choice. In order to receive payments for child care services through the Child Care Certificate Program, the providers must sign a provider agreement and comply with the program?s requirements,Child Care Provider Payment ProcessChild care providers must submit Enrollment Attendance Verification (EAV) (See Schedule of Findings and Questioned Costs for footnote) forms (electronically or via mail) in order to receive payment for child care services. Providers are paid the weekly rates determined by DHS, depending on various factors such as? the child?s age,? the type of child care facility,? the provider?s location within the state,? whether the child care is full- or part-time,? the child?s school enrollment, and? the provider?s participation in the star-quality rating program.DHS pays providers a higher reimbursement rate for younger children, who require longer hours of child care, and for school-age children when school is not in session (including holidays). DHS also supports the providers? fixed costs of child care services by providing full payment even if a child is absent, up to five absences each month. Once the absence allowance is met, DHS only pays the providers based on the actual number of days they provided child care services each month.When providers submit EAV forms, fiscal services staff pay the providers based on each child?s daily rate and the number of days the child received child care services.DHS?s Oversight of Federal Award ActivitiesDHS is responsible for overseeing the operations of the federal award and must monitor providers? activities to assure compliance with federal requirements and performance expectations, as stated in Title 45, Code of Federal Regulations (CFR), Part 75, Section 342. DHS?s oversight includes local office staff, fiscal staff assigned to DHS from the Department of Finance and Administration, and Audit Services staff.The local DHS office staff are responsible for updating all school district calendars (noting which days schools are in session, out of session, or out for holidays) and loading the providers? rates (which are established for each eligible child) in the child care information system. Based on this data, the system generates provider payments for child care services provided.Upon receipt of a provider?s EAV, fiscal staff review the EAV for reasonableness and irregularities before approving the provider?s reimbursement. As support for the EAVs, DHS requires each provider to maintain at its location the attendance documentation (sign-in/sign-out sheets) for the past five years.DHS?s Provider Monitoring ActivitiesDHS?s Audit Services staff are responsible for monitoring child care providers to ensure they comply with the terms of the provider agreement and with federal and state rules and regulations. As part of their monitoring activities, Audit Services staff compare providers? EAVs to their attendance documentation (sign-in/sign-out sheets). Audit Services staff question a provider?s reimbursed costs when they identify differences between the attendance documentation and the EAV and/or when the provider has not maintained the required documentation.Other CCDF Program ResponsibilitiesDHS is also responsible for planning and administering child care quality improvement activities for the CCDF program. DHS contracts with various agencies, Tennessee higher education entities, and state departments to provide training and technical assistance to parents, caregivers, and child care providers. CCDF program staff are responsible for monitoring the contractors to ensure they comply with the terms and conditions of agreements.Prior Audit Finding Follow-upThe prior audit determined that DHS management had not ensured that child care providers had adequately documented their services and, therefore, we questioned federal costs. DHS management concurred that the costs noted in the prior audit finding were not allowable and mentioned the child care licensing and certificate staff?s efforts during their on-site visits to monitor the compliance of providers with documentation requirements. Management?s comments did not address whether it considered these monitoring efforts sufficient to ensure that providers were compliant. Moreover, management did not include any new actions relative to the lack of documentation, other than to recover the questioned costs noted in the prior finding.Condition and CriteriaTo determine if management followed program requirements, including whether management?s monitoring of providers was effective, we tested a nonstatistical, random sample of 55 (See Schedule of Findings and Questioned Costs for footnote) child care expenditures from July 1, 2018, to June 30, 2019, totaling $1,830,281, from a population of 87,909 transactions, totaling $110,475,200. We requested attendance documentation from the child care providers and supporting documentation from contractors to support child-care-related costs. Based on our testwork, for 14 of 55 expenditures tested (25%), we noted that DHS did not ensure that child care providers maintained adequate documentation of child care services and did not ensure that 1 contractor?s expenditures were reasonable. In addition, fiscal services staff did not accurately reimburse providers.Provider ConditionsChild Care Providers Did Not Maintain Attendance DocumentationBased on our testwork, for 2 of 14 errors noted, CCDF staff did not ensure the providers maintained attendance documentation to support the providers? requests for reimbursement for services, as required by federal regulations. The providers did not provide attendance documentation when requested to support the reimbursements for child care costs they received. We questioned $373 in federal funds for providers? and DHS?s lack of documentation.According to 45 CFR 98.90,(d)(1) Lead Agencies and subgrantees shall retain all CCDF records, as specified in paragraph (c) of this section, and any other records of Lead Agencies and subgrantees that are needed to substantiate compliance with CCDF requirements, for the period of time specified in paragraph (e) of this section. . . .(e) Length of retention period. (1) Except as provided in paragraph (e)(2) of this section, records specified in paragraph (c) of this section shall be retained for three years from the day the Lead Agency or subgrantee submits the Financial Reports required by the Secretary, pursuant to ?98.65(g), for the program period.In addition, Section A.7 of the contractor agreement states,The Provider (Contractor) shall immediately make available upon request by the Department, the Comptroller of the Treasury, or any federal agency any documentation related to any payments made by the State or Federal government for the care of children enrolled in the Child Care Certificate Program, up to a period of five (5) yearsChild Care Providers Did Not Maintain Adequate Attendance DocumentationBased on our testwork, we found that for 9 of 14 errors noted, although the providers maintained some attendance documentation, it was not adequate to support the providers? reimbursement requests. Specifically, we noted the following problems with the attendance documentation:? Providers reported children as present on the EAV, but the parents or other responsible individuals had not signed the children in and out on the attendance documentation.? Providers reported children present on the EAV; however, the attendance documentation showed the children were absent.? A provider did not report the child on the EAV at all.We questioned a total of $3,514 in federal funds for the days for which the child care providers did not maintain adequate documentation to support child care services.According to 45 CFR 98.67,(a) Lead agencies [DHS] shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds.(b) Unless otherwise specified . . . contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds.In addition, Section A.7 of the provider agreement states,The Provider (Contractor) shall maintain documentation of daily attendance, hours and location of each child as required by the Department.a. The Provider shall document attendance by requiring each child to be signed in and out by an authorized person whose name is listed in the child?s record. The authorized person shall not be an employee of the Provider unless such person is the child?s legal guardian.b. The Provider understands and agrees that acceptable forms of documentation may include the following, but that the Department may, at its sole discretion, require different or additional form(s) of documentation of a child?s daily attendance:A daily attendance (sign in and out) record of the printed and legal signature of each individual authorized to pick up and/or drop off the child must be maintained. Each child listed must be on separate lines. Parent/guardian and/or signatures of individuals authorized to pick up and/or drop off the child should be located in the child?s file. Initials or nicknames are not acceptable as signatures on the attendance sheets/logs. If the Provider uses an electronic process, the signature, number or code should match the signature of the parent/guardian or approved individual located in the child?s file. . . .e. The Provider further agrees that any failure to maintain such files at such location and to produce all such files immediately when requested by the Department or any other agency of the state or federal government may result in the denial of any and all payments for child care services for any children for whom payments may be or have been requested under this Contract.Contractor ConditionContractor Charged Unreasonable Costs to DHS, Which Passed the Charges to the CCDF GrantBased on our testwork, 1 of 14 errors we noted for our expenditure testwork was for a contractor. The contractor?s documentation did not support costs that were reasonable under CCDF regulations, and DHS?s program staff did not review the contractor?s supporting documentation for the expenditures before payment. Specifically, the costs did not relate to improving the quality of child care in Tennessee. These unreasonable charges included costs paid for a landline phone bill and internet charges for the contractor?s Director of the Child Care Resource and Referral Center.According to Section C.5(b)(1) of the contract between DHS and the contractor,An invoice under this Grant Contract shall include only reimbursement requests for actual, reasonable, and necessary expenditures required in the delivery of service described by this Grant Contract and shall be subject to the Grant Budget and any other provision of this Grant Contract relating to allowable reimbursements.Fiscal Services Staff Did Not Ensure That Providers Were Reimbursed AccuratelyBased on our testwork, for 2 of 14 errors we noted, fiscal services staff did not ensure that providers were reimbursed accurately. For both providers, we found that while the Account Technician reviewed the EAV that the provider submitted, staff did not discover the problem and reduce the number of days the child was absent according to the provider contract. Management stated that the problem was due to employee error and that additional training will be covered as needed during weekly team meetings. We questioned $43 in federal funds.Section A.6 of the provider agreement states,The Provider (Contractor): May include on the attendance report a child?s absence for routine illness or family needs up to five (5) days per month.Risk AssessmentWe reviewed DHS?s December 2018 Financial Integrity Act Risk Assessment and determined that management listed the risk of departmental noncompliance with program requirements as a risk; however, DHS did not have an effective control to mitigate its risk.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.CauseDHS?s process for ensuring compliance with federal regulations is not adequate to ensure child care providers maintain adequate documentation. Despite the repeated findings, management has relied solely on Audit Services staff?s monitoring. Furthermore, DHS has not established a reliable process for reviewing contractor invoices. Despite this repeated finding, management has not ensured that program staff scrutinize specific contractor purchases in their reviews of contractor invoices. Under the contract, invoices to DHS only include budgetary classifications of expenses and do not include supporting documentation for the contractor?s expenses other than travel. CCDF program staff only compared invoiced expenditures submitted for reimbursement to budgetary information to ensure that individual line items of the approved budget for the contractor were not exceeded.EffectWhen DHS does not ensure child care providers maintain adequate and complete documentation, it cannot ensure that payments to child care providers are for actual services. DHS cannot be certain that program payments are reasonable without reviewing supporting documentation for contractor expenses. In addition, DHS cannot ensure that providers are reimbursed correctly without carefully reviewing provider documentation. Without effective controls to ensure compliance, DHS increases its risk of noncompliance, errors, fraud, waste, and abuse.Questioned CostsWe questioned federal costs of $4,085 charged to the CCDF program. Requirements in 2 CFR 200.516(a)(3) instruct us to report questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. See a summary of the known questioned costs in Table 1.See Schedule of Findings and Questioned Costs for chart/table.RecommendationThe Deputy Commissioner of Programs and Services should ensure that child care providers maintain sign-in/sign-out sheets in accordance with the provider agreements to support the services provided and that contractors only claim reasonable costs related to improving the quality of child care. The Deputy Commissioner should also ensure that staff improve training and communication of program requirements with providers and contractors. In addition, although DHS recouped costs from the contractor related to the prior audit finding, DHS should perform a financial review to determine the extent of unallowable costs that the contractor charged to the program. The Deputy Commissioner should consider requiring contractors to submit supporting documentation for invoiced expenses. The Deputy Commissioner of Operations should also ensure that fiscal services staff review EAVs before approving the provider?s reimbursement to ensure payments are accurate. Furthermore, the Deputy Commissioner should reassess controls over the areas pointed out in this finding and document any mitigating controls implemented in DHS?s risk assessment. Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentCondition:Child Care Providers Did Not Maintain Attendance DocumentationWe Concur.The department required providers to maintain necessary attendance documentation. This requirement is enforced through child care licensing and certificate staff during their on-site visits. When a provider does not have required documentation, a demand letter is sent to that provider to recoup any reimbursements that are not supported by proper documentation. The department is exploring a new attendance tracking and payment processing system as part of child care modernization.Condition:Child Care Providers Did Not Maintain Adequate Attendance DocumentationWe Concur.The department required providers to maintain necessary attendance documentation. This requirement is enforced through child care licensing and certificate staff during their on-site visits. When a provider does not have required documentation, a demand letter is sent to that provider to recoup any reimbursements that are not supported by proper documentation. The department is exploring a new attendance tracking and payment processing system as part of child care modernization.Condition:Contractor Charged Unreasonable Costs to DHS, Which Passed the Charges to the CCDF GrantWe Concur.The department requested and reviewed policy documentation from the contractor and determined the contractor?s broad fiscal policies must be revised to meet CCDF reimbursement requirements. The department will review the revised fiscal policy to assure alignment with CCDF requirements and issue a management decision letter to the contractor to recover any disallowed costs before June 30, 2020.Condition:Fiscal Services Staff Did Not Ensure That Providers Were Reimbursed AccuratelyWe Concur.The Department of Finance and Administration, which staffs the Department of Human Services accounting office, will implement a process to review and monitor Enrollment Attendance Verification payments for accuracy. Continuous training and discussion with staff related to the importance of accurate payments is ongoing.Prior to September 30, 2020, the documentation of the Enterprise Risk Management Activities of the accounting office:? Will be reviewed and updated to ensure inherent and residual risks related to identified provider reimbursement risks have been appropriately evaluated and documented. In addition, identified control activities will be added or modified and monitored as needed to ensure that theses controls are operating effectively and do not deteriorate over time. Management Action Plans will also be created for any control activities that are operating beyond management?s risk tolerance.The department is also pursuing a new, automated attendance tracking and payment system, which would significantly decrease the risk of such provider errors.Condition: Risk AssessmentThe department conducts the annual Financial Integrity Act Risk Assessment within the state adopted Committee of Sponsoring Organizations of the Treadway Commission?s Enterprise Risk Management Framework including the optional toolkit forms provided by the Department of Finance and Administration.The forms are a management tool used to document significant organizational risks and key internal controls to mitigate risks within management?s risk tolerance. Management determines the effectiveness of its own controls and its risk tolerance. If risks are not sufficiently mitigated, management can implement a plan of action to modify or create new internal controls. In cases where the inherent risk can not be sufficiently mitigated by the Department?s internal controls alone, for example, regulatory restraints or dependency on other organizations, management can only accept or avoid the risk.

Finding Number: 2019-026CFDA Number: 93.575Program Name: Child Care and Development Fund ClusterFederal Agency: Department of Health and Human ServicesState Agency: Department of Human ServicesFederal Award Identification Number: 1801TNCCDFFederal Award Year: 2018Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: EligibilityRepeat Finding: 2018-027Pass-Through Entity: N/AQuestioned Costs: $794,347As previously noted, the Department of Human Services did not follow eligibility requirements for the Child Care and Development Fund when claiming expenditures for the Read to be Ready Summer Camp Program, resulting in federal questioned costs of $794,347BackgroundThe Child Care and Development Fund (CCDF) provides funds to states, territories, and Indian tribes to increase the availability, affordability, and quality of child care services. Funds are used to subsidize child care for low-income families with parents who are working or attending training or educational programs, as well as activities to promote overall child care quality for all children, regardless of subsidy receipt.To be considered a child care quality activity, the expenditure must fall into one of several categories described in Title 45, Code of Federal Regulations (CFR), Part 98, Section 53. These categories include providing training and professional development for child care workers; providing technical assistance to eligible child care providers; improving the supply and quality of child care programs and services for infants and toddlers; and carrying out other activities to improve the quality of child care services provided.For expenditures for child care services to be allowable, the services must be provided to eligible children. To be eligible, a child must? reside with a family whose income and assets do not exceed certain thresholds;? reside with a parent or parents who are working or attending a job training or educational program (or the child must receive or need to receive protective services); and? meet certain age requirements.In 2016, the Tennessee Department of Human Services (DHS), in conjunction with the Tennessee Department of Education, launched the Read to be Ready Summer Camp Program to support educator-led and literacy-based summer camps to help improve school-age students? reading skills. The camps ensure that all families and children have equitable access, and staff intentionally and responsively reach out when attendance is an issue. Home visits, translators, and supports are used to connect with and encourage families to participate.In our prior audit, management provided an email from the Administration for Children and Families (ACF) (See Schedule of Findings and Questioned Costs for footnote). In the email the ACF questioned management about the educational ?activities? of the camp and advised management that if the activities were direct services, then DHS must perform the CCDF-required eligibility determinations and collect the parent co-payments from parents, unless the ACF had waived this requirement through the DHS State Plan (See Schedule of Findings and Questioned Costs for footnote). Without a definitive response from ACF, our position from our prior audit has not changed as described in the following condition.Condition, Cause, EffectAs required by Uniform Guidance, we report that the department did not follow eligibility requirements for CCDF when claiming expenditures for the Read to be Ready Summer Camp Program, resulting in federal questioned costs of $794,347. Management could not provide any documentation used in the eligibility determination process or any federal waivers for eligibility determinations. When the department does not spend CCDF funds in compliance with federal requirements for direct services, management increases the risk that the federal awarding agency could request repayment or offset future grant awards by the entire amount of the questioned costs.Management initiated corrective before the end of the audit period and began using the Temporary Assistance for Needy Families (TANF) program or state funds to cover the program costs as of January 1, 2019. Based on our review of 45 CFR 260, the use of TANF funds for the Read to be Ready program appears to be reasonable.We are required by 2 CFR 200.516(a)(3) to report known questioned costs greater than $25,000 for a type of compliance requirement for a major program. DHS charged $794,347 of unallowable costs to the CCDF program in August 2018 before making the decision to change the funding source. ACF?s September 2019 management decision to DHS management addresses final resolution of the 2017 Single Audit finding. According to 2 CFR 200.521 ACF is required to provide final resolution of finding 2018-027 and this finding in the future.CriteriaAccording to 45 CFR 98.16(h) the CCDF State Plan must include, ?A description and demonstration of eligibility determination and redetermination processes to promote continuity of care for children and stability for families receiving CCDF services.?Per 45 CFR 98.50(F)(a),Direct child care services shall be provided:(1) To eligible children, as described in ?98.20;(2) Using a sliding fee scale, as described in ?98.45(k);(3) Using funding methods provided for in ?98.30.RecommendationGoing forward, the Commissioner should ensure that DHS is compliant with all TANF regulations related to child care services for the program and that funds for the Read to be Ready program are applied to the appropriate program. Additionally, the State Plan for which the program funds will be applied should include all the required information for the Read to be Ready program.Management?s CommentWe do not concur.The questioned costs were for 2018 summer program and the condition was previously reported in the 2018 Single Audit Report released in March 2019. The department?s corrective action of utilizing alternative funding sources for the 2019 summer program was communicated to the state auditors as early as April 2019.We question the state auditors? rational as to why this resolved issue was included as a finding in the current Single Audit report.As noted in the finding, ?. . . management began using the Temporary Assistance for Needy Families (TANF) program or state funds to cover the program costs as of January 1, 2019. Based on our review of 45 CFR 260, the use of TANF funds for the Read to be Ready program appears to be reasonable.?On September 26, 2019, the department received from US Department of Health and Human Services, Administration for Children and Families? (ACF), a decision letter on the department?s corrective action for the first Read to Be Ready Finding 2017-033, the ACF decision reads in part:The state announced in June 2019 that it would no longer use CCDF funds for their Read to Be Ready Summer Camps. ACF finds the corrective action taken by the Department sufficient to satisfy the resolution of this finding.The state auditors were copied by ACF on the decision letter. Since corrective action was fully implemented during the audit period, no further action by the department is needed to remedy the condition, and our federal grantor has accepted the department?s corrective action of using non-CCDF funds.Auditor?s CommentAs previously stated, under the Uniform Guidance, we are required to report the expenditures as questioned costs. It appears that the use of TANF funds for the Read to be Ready program is an appropriate corrective action

Finding Number: 2019-027CFDA Number: 93.575 and 93.596Program Name: Child Care and Development Fund ClusterFederal Agency: Department of Health and Human ServicesState Agency: Department of Human ServicesFederal Award Identification Number: 1601TNCCDFFederal Award Year: 2016Finding Type: Material Weakness and NoncomplianceCompliance Requirement: Matching, Level of Effort, EarmarkingRepeat Finding: 2018-028Pass-Through Entity: N/AQuestioned Costs: N/AFor the fourth year in a row, the Department of Human Services did not establish adequate internal controls over Child Care and Development Fund earmarking and did not comply with one earmarking requirementBackgroundThe U.S. Department of Health and Human Services (HHS) provides funds to states, territories, and Indian tribes to increase the availability, affordability, and quality of child care services through the Child Care and Development Fund (CCDF) cluster of programs. CCDF funds subsidize child care for low-income families where the parents are working or attending training or educational programs, as well as activities to promote overall child care quality for all children, regardless of subsidy receipt.CCDF consists of three funding streams: discretionary funds, mandatory funds, and matching funds. Additionally, under the Temporary Assistance for Needy Families program, a state may transfer funds to CCDF; the transferred funds are treated as discretionary funds.HHS requires the Tennessee Department of Human Services (DHS) to meet three earmarking requirements for CCDF: administrative earmarking, quality earmarking, and targeted funds earmarking.Under the administrative earmarking requirement, a state may not spend more than 5% of the aggregate amount of discretionary, mandatory, and federal and state shares of the matching funds on administrative activities.Under the quality earmarking requirement for the CCDF award for federal fiscal years 2016 and 2017, a state was required to spend at least 7% of the aggregate amount of discretionary, mandatory, and federal and state shares of the matching funds on quality activities. For fiscal years 2018 and 2019, the minimum quality spending requirement increased to 8%. In addition, beginning with the CCDF award for fiscal year 2017, a state must spend at least 3% of the aggregate amount of discretionary, mandatory, and federal and state shares of the matching funds on activities to improve the quality of care for infants and toddlers.The earmarking requirement for targeted funds specifies the minimum amounts that a state must spend for specified activities. For the 2016 grant award, HHS allocated Tennessee $2.9 million in Infant and Toddler targeted funds to be spent on activities to improve the quality of care for infants and toddlers. The terms and conditions of the CCDF grant award required the state to spend the 2016 grant award targeted funds by September 30, 2018. HHS did not allocate targeted funds for 2017, 2018, and 2019 grant awards.The Department of Finance and Administration (F&A) is responsible for performing all fiscal-related duties on behalf of DHS. During the prior audit, we found that F&A?s Controller for DHS fiscal activities and DHS?s Director of Child Care Services did not establish adequate internal controls over earmarking, and program staff did not comply with the earmarking requirements for administrative costs and targeted funds. Management concurred with the finding related to inadequate internal controls over earmarking and noncompliance with the earmarking requirements.For our current audit, to determine whether fiscal staff and DHS complied with federal earmarking requirements, we tested earmarking expenditures charged to the CCDF grant award provided for the grant year 2016, since grant year 2016 is the grant that closed during our audit period. Based on our audit procedures, we noted that DHS still did not establish adequate internal controls over earmarking, resulting in DHS not complying with the earmarking requirement for targeted funds.Condition and CriteriaProgram Staff and Fiscal Staff Did Not Establish Adequate Internal Controls Over Earmarking, Resulting in DHS Not Complying With the Earmarking Requirement for the Infant and Toddler Targeted FundWe discussed internal controls over earmarking with DHS fiscal staff and program staff, and we determined that neither program nor fiscal management had adequate controls in place to ensure compliance with the earmarking requirements. According to ?Appendix I: Requirements? of the Standards for Internal Control in the Federal Government, ?Management should design control activities to achieve objectives and respond to risks? and ?should implement control activities through policies.?Additionally, based on accounting records, we found that F&A?s Controller and DHS?s Child Care Services Program Directors did not ensure that DHS expended the $2.9 million allotment of Infant and Toddler targeted funds for the 2016 grant award. Provision 9c of the terms and conditions of the grant award requires the state to expend all of the targeted fund allotment. See Table 1 for the amounts of deficit in meeting the required spending thresholds for targeted funds.See Schedule of Findings and Questioned Costs for chart/table.Risk AssessmentWe reviewed DHS?s and F&A?s December 2018 Financial Integrity Act risk assessment for DHS operations and determined that management did not assess the risk of noncompliance with earmarking and a mitigating control.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.CauseBased on our discussion with fiscal management, they stated that at one point fiscal management monitored the status of earmarked expenditures by including their calculations in the reporting template used to prepare CCDF?s quarterly financial status report?the ACF 696. Fiscal management removed these calculations from the template; however, program management noted that although no controls were in place over the 2016 grant year award, they have since implemented controls over earmarking beginning with the 2019 grant year award that closes in 2021. We will test the effectiveness of these new controls in future audits of the program.EffectManagement?s failure to establish and maintain effective internal controls to meet federal requirements increases the risk that management and staff?s noncompliance will not be prevented or detected and corrected timely. Additionally, because the federal fiscal year 2016 grant award closed as of September 30, 2018, management no longer has access to the targeted funds. In effect, the department did not use available federal funding totaling $2.5 million to fulfill the grant?s purpose to improve the quality of care for infants and toddlers.Additionally, federal regulations address actions that HHS may impose in cases of the non-federal entity?s noncompliance. As noted in 45 CFR 75.371, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the HHS awarding agency or pass-through entity may impose additional conditions,? including, as described in Section 75.207, ?Specific award conditions,?(1) Requiring payments as reimbursements rather than advance payments;(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;(3) Requiring additional, more detailed financial reports;(4) Requiring additional project monitoring;(5) Requiring the non-Federal entity to obtain technical or management assistance; or(6) Establishing additional prior approvals.Furthermore, Section 75.371 also states,If the HHS awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions [as described above], the HHS awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances:(a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the HHS awarding agency or pass-through entity.(b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance.(c) Wholly or partly suspend (suspension of award activities) or terminate the Federal award.(d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and HHS awarding agency regulations at 2 CFR part 376 (or in the case of a pass-through entity, recommend such a proceeding be initiated by a HHS awarding agency).(e) Withhold further Federal awards for the project or program.(f) Take other remedies that may be legally available.RecommendationThe Department of Human Services? Director of Child Care Services and the Department of Finance and Administration?s Controller for DHS fiscal activities should coordinate to establish internal controls to monitor the compliance with the earmarking requirements and ensure that the earmarking requirements are met. This process should include developing a spending plan and budget for the minimum amounts to ensure the targeted funds spending requirement is met. Additionally, management should develop policies and procedures for periodically monitoring expenditures to ensure the department meets federal earmarking requirements within the required timeframe.Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentWe concur.Program staff have developed a process to capture quality contract expenses incurred for infant-toddler activities. Those expenses are reported to Fiscal Services so funds may be properly allocated. Fiscal Services and program leadership will continue to partner to track progress in meeting these requirements by June 30, 2020.The Department of Finance and Administration, which staffs the Department of Human Services accounting office, will coordinate with program to implement a process to monitor the status of earmarked expenditures on a quarterly basis ensuring compliance with earmarking requirements. By June 30, 2020, the internal controls will be designed and implemented, in order to reduce the risk of such process not being completed as prescribed.Prior to September 30, 2020, the documentation of the Enterprise Risk Management Activities of the accounting office:? Will be reviewed and updated to ensure inherent and residual risks related to misclassifying expenditures based on federal reporting risks have been appropriately evaluated and documented. In addition, identified control activities will be added or modified and monitored as needed to ensure that theses controls are operating effectively and do not deteriorate over time. Management Action Plans will also be created for any control activities that are operating beyond management?s risk tolerance.? Will be updated as needed to include the necessary assessment of risk relative to the role of the accounting department in ensuring compliance with earmarking requirements for targeted funds. This assessment will recognize that the control environments maintained by the program and accounting office staff relative to this area must be complementary to ensure achievement of the department?s objectives.

Finding Number: 2019-028CFDA Number: 93.575 and 93.596Program Name: Child Care and Development Fund ClusterFederal Agency: Department of Health and Human ServicesState Agency: Department of Human ServicesFederal Award Identification Number: 1201TNCCDF, 1601TNCCDF, 1701TNCCDF, 1801TNCCDF, and 1901TNCCDFFederal Award Year: 2012 and 2016 through 2019Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: EligibilityRepeat Finding: 2018-029Pass-Through Entity: N/AQuestioned Costs: $2,858As noted in the prior three audits, the Department of Human Services did not consistently perform case reviews of eligibility determinations and redeterminations, resulting in improper payments to child care providersBackgroundThe Tennessee Department of Human Services (DHS) administers the Child Care and Development Fund (CCDF), a federal program that provides subsidies for child care. CCDF funds the state?s Child Care Certificate Program, which helps Families First (Temporary Assistance for Needy Families) participants, parents transitioning from the Families First program, teen parents, and other individuals obtain child care. To participate in the Child Care Certificate Program, children must be declared eligible by DHS staff or, for children in foster care or protective services, by Department of Children?s Services? staff. In addition to income limits and other eligibility requirements, children must be under the age of 13 to participate in the program, unless they are incapable of self-care or are under court supervision.Child care providers request payment for services on a biweekly, semimonthly, or monthly basis by submitting child care Enrollment Attendance Verification forms for eligible children. DHS?s Division of Fiscal Services staff use the forms, in conjunction with provider and client eligibility data, to process payments to each provider.Under CCDF requirements, DHS is responsible for establishing child care provider payment rates and parent co-pay fees. DHS publishes a schedule of parent co-pay fees, which are based on household size and monthly income. DHS also publishes a schedule of provider payment rates, which are based on a variety of factors including the county where services are provided, the age of the child in care, and the type of child care provider. Providers? payment rates are also affected by the providers? star-quality rating (See Schedule of Findings and Questioned Costs for footnote).DHS groups all counties in Tennessee into eight districts. Program staff within each district conduct case reviews throughout the year to ensure that DHS?s eligibility determinations for children are completed accurately and timely. Each month, the Research and Data Analysis Unit provides a random sample of cases per child care specialist to field supervisors for review. The sample includes both original eligibility determinations and redeterminations. The sample, along with a link to a Survey Monkey tool, is distributed to field supervisors. The Survey Monkey tool is used as a case reading tool and records the results of the case review. The survey uses a point system to determine the case reading score. Quality Improvement and Strategic Solutions (QISS) staff compile the results for the score and make the results available on an internal dashboard. Management and the field supervisors review the results to determine areas that need improvement.Because DHS determines the providers? payment rate for each child depending on various factors (such as the child?s age, whether school is in or out, and the provider?s quality rating) and because those factors can change periodically, it is critical that management?s internal control processes, such as the monthly case reviews, are properly designed and implemented to help management identify and correct instances of incorrect payments.We reported in the prior audit, and management concurred, that DHS staff did not consistently perform case reviews of eligibility determinations and redeterminations and did not ensure staff calculated and made a payment to a child care provider in accordance with program requirements. Management stated that DHS collaborated with the QISS division to develop an automated case reading tool, which was fully implemented in August 2018 for cases determined in July 2018. Management also stated the overpayment to a provider was the result of human error, and they planned to provide staff with refresher training to prevent future occurrences. Management further stated that they would conduct periodic data analyses to identify when staff enter incorrect payment rate data in the system.Condition and CauseIn order to determine if DHS complied with federal requirements related to eligibility for children receiving subsidized child care, we obtained a list of all eligible individuals and related child care provider payments, along with certain individual eligibility information contained in DHS?s Tennessee Child Care Management System (TCCMS), for the period July 1, 2018, through June 30, 2019, and performed sampling procedures as detailed below. Based on the results of our testwork, we found that the Child Care Services Director did not ensure that program staff consistently performed case reviews of eligibility determinations and redeterminations. We also found that the Child Care Services Director did not ensure that staff calculated and made payments to child care providers in accordance with program requirements.Condition A: Internal Controls Over Case Reviews Were Not Applied Consistently as Required by the CCDF State PlanBased on our discussion with program staff, as well as our review of the CCDF State Plan and DHS?s Field Supervisor One?s job plan, DHS uses a supervisory case review process as the internal control to ensure eligibility determinations and redeterminations are performed and are appropriate. As part of the CCDF State Plan and the Field Supervisor One?s job plan, supervisors of the child care specialists who make the eligibility determinations are required to perform random monthly case reviews of at least five eligibility determination or redetermination cases assigned to each employee to ensure the determinations were accurate.We identified 35 employees who were responsible for conducting eligibility determinations for the Child Care Certificate Program during the scope of our audit. From the population of 35, we selected a random, nonstatistical month for each employee and reviewed the employee?s assigned cases to determine if the employee?s supervisor performed at least 5 case reviews for the selected month.Based on our testwork, we noted that for 7 of 35 employees (20%), the supervisors did not perform at least 5 CCDF eligibility determination and/or redetermination case reviews for the month we tested. For 5 of the 7 employees, supervisors did not review any cases for the month selected for testwork. Management agreed that this was a problem and stated that this occurred due to staffing vacancies.Condition B: Incorrect RatesFrom a population of 35,376 eligible individuals with payments totaling $97,931,028 for the Child Care Certificate Program from July 1, 2018, through June 30, 2019, we selected a nonstatistical, random sample of 60 eligible individuals to determine whether program staff calculated and paid provider payments in accordance with program requirements. Specifically, we performed an independent recalculation of the expected payment amount for each provider for the eligible child based on the child?s age, the provider?s quality rating, the type of provider, and the other factors DHS used to determine the payment amount.Based on our testwork, we determined that for 6 of 60 eligible children tested (10%), DHS did not ensure that program staff correctly calculated parent co-pay fees and provider rates in accordance with program requirements. Specifically, we noted for 2 errors, program staff undercalculated the parent co-pay fees. For the remaining 4 errors, we noted program staff overcalculated the provider rate for 2 individuals and undercalculated the provider rate for 2 individuals. Based on our discussion with program staff, the errors occurred because program staff manually entered incorrect parent co-pay fees and provider rates into TCCMS. We questioned $2,858 for the overpayments to the providers.Condition C: Risk AssessmentWe reviewed DHS?s December 2018 Financial Integrity Act Risk Assessment and determined that management did not identify the risks of incorrectly calculating fees and rates and a mitigating control.CriteriaCriteria for Internal Controls Over Case ReviewsThe U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides guidance to management for using quality information to achieve the entity?s objectives. According to Principle 13, ?Use Quality Information,?Management processes the obtained data into quality information that supports the internal control system. This involves processing data into information and then evaluating the processed information so that it is quality information. Quality information meets the identified information requirements when relevant data from reliable sources are used. Quality information is appropriate, current, complete, accurate, accessible, and provided on a timely basis. Management considers these characteristics as well as the information processing objectives in evaluating processed information and makes revisions when necessary so that the information is quality information. Management uses the quality information to make informed decisions and evaluate the entity?s performance in achieving key objectives and addressing risks.According to Title 45, Code of Federal Regulations (CFR), Part 98, Section 68(a),Lead Agencies are required to describe in their Plan effective internal controls that are in place to ensure integrity and accountability, while maintaining continuity of services, in the CCDF program. These shall include . . . (iii) Quality Control or quality assurance reviews.According to the CCDF State Plan, supervisory reviews and quality assurance reviews should be conducted to ensure accurate eligibility determinations.Criteria for Incorrect RatesAccording to 45 CFR 98.67(a), ?Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds.?According to 45 CFR 98.11(b), ?In retaining overall responsibility for the administration of the program, the Lead Agency shall . . . [e]nsure that the program complies with the approved Plan and all Federal requirements.? The approved State Plan identifies the provider payment rates that the state has established; therefore, 45 CFR 98.11(b) requires DHS to adhere to its established provider payment rates.Criteria Risk AssessmentAccording to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.EffectUnless DHS establishes and implements adequate controls to ensure that program staff review to ensure CCDF Child Care Certificate Program eligibility determinations are accurate, there is an increased risk that DHS will pay child care providers for services rendered to ineligible program participants. Improper application of the state?s child care provider payment rate and parent co-pay fees increase the risk of unallowable provider payments.Questioned CostsOur testwork included a review of a nonstatistical, random sample of 60 individuals from a population of 35,376 individuals. Our sample testwork focused on payments to providers, totaling $167,417, from a population of CCDF provider payments, totaling $97,931,028, for the period July 1, 2018, through June 30, 2019. We found that DHS overpaid providers $2,858, resulting in known questioned costs. 2 CFR 200.516(a)(3) requires us to report known and likely questioned costs greater than $25,000 for a type of compliance requirement for a major program. According to 2 CFR 200.84,Questioned cost means a cost that is questioned by the auditor because of an audit finding:(a) Which resulted from a violation or possible violation of a statute, regulation, or the terms and conditions of a Federal award, including for funds used to match Federal funds;(b) Where the costs, at the time of the audit, are not supported by adequate documentation; or(c) Where the costs incurred appear unreasonable and do not reflect the actions a prudent person would take in the circumstances.RecommendationRecommendation for Internal Controls Over Case ReviewsThe Commissioner should ensure that DHS?s internal controls are adequately designed and operating effectively to prevent or detect provider overpayments. The control process should include ensuring that supervisors perform and document each employee?s monthly eligibility case reviews as required by federal regulations and the CCDF State Plan.Recommendation for Incorrect RateThe Director of Operations for CCDF should ensure that program staff enter the correct payment rates and parent co-pay fees for eligible children into TCCMS.Recommendation for Risk AssessmentManagement should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentCondition A: Internal Controls Over Case Reviews Were Not Applied Consistently as Required by the CCDF State PlanWe Concur.The case reading tool will be modified to allow for review of cases across all categories of child care payment assistance. Long-term workflow technology tools that are being developed for the department will strengthen the case review process.Condition B: Incorrect RatesWe Concur.The Department is aware that errors may arise due to manual data entry in the current payment system and the Department has been exploring a new payment system as part of child care modernization. The Department has also conducted training on the existing system and plans on conducting additional trainings, as needed.Condition C: Risk AssessmentThe department conducts the annual Financial Integrity Act Risk Assessment within the state adopted Committee of Sponsoring Organizations of the Treadway Commission?s Enterprise Risk Management Framework including the optional toolkit forms provided by the Department of Finance and Administration.The forms are a management tool used to document significant organizational risks and key internal controls to mitigate risks within management?s risk tolerance. Management determines the effectiveness of its own controls and its risk tolerance. If risks are not sufficiently mitigated, management can implement a plan of action to modify or create new internal controls. In cases where the inherent risk can not be sufficiently mitigated by the Department?s internal controls alone, for example, regulatory restraints or dependency on other organizations, management can only accept or avoid the risk.

Finding Number: 2019-029CFDA Number: 93.575 and 93.596Program Name: Child Care and Development Fund ClusterFederal Agency: Department of Health and Human ServicesState Agency: Department of Human ServicesFederal Award Identification Number: 1201TNCCDF, 1601TNCCDF, 1701TNCCDF, 1801TNCCDF, and 1901TNCCDFFederal Award Year: 2012 and 2016 through 2019Finding Type: Material Weakness and NoncomplianceCompliance Requirement: Special Tests and ProvisionsRepeat Finding: 2018-030Pass-Through Entity: N/AQuestioned Costs: N/AAs noted in the three prior audits, Department of Human Services program staff did not comply with health and safety requirements for child care providers, and the Department of Human Services and the Department of Education had an inadequate review processBackgroundThe state?s Child Care Certificate Program, which is funded by the Child Care and Development Fund (CCDF), assists Families First participants, parents transitioning off Families First, teen parents, and other individuals to obtain child care. To participate in the program, children must be declared eligible by Department of Human Services (DHS) staff or, for children in foster care or protective services, by Department of Children?s Services staff. DHS establishes various child care provider payment rate schedules based on a variety of factors, including the county where services are provided, the age of the child in care, and the type of child care provider. Providers? payment rates are also affected by the providers? star-quality rating. The Star-Quality Child Care Program is a voluntary program that rewards child care agencies that exceed minimum licensing standards. DHS staff use the criteria in the payment rate schedules to assign a payment rate for each child. When providers submit Enrollment Attendance Verification forms, Fiscal Services staff pay the providers based on each child?s payment rate and the number of days the child received child care services.Under the CCDF Block Grant and Title 45, Code of Federal Regulations (CFR), Part 98, Section 41, lead agencies have significant responsibility for ensuring the health and safety of children in child care through the state?s child care licensing system and for establishing health and safety standards for children who receive CCDF funds. Also, 45 CFR 98.2 defines a lead agency as the legal entity to which the grant funds are awarded, which is the state. For Tennessee, the grant award documents specifically list DHS as the lead agency responsible for administering the program. The Department of Education (DOE) shares some responsibility with DHS for monitoring child care providers, which is reflected in a Memorandum of Agreement. Federal regulations in effect during the audit period did not specify how many site visits providers must receive, so DHS and DOE each used their own internal policies.Under program regulations, child care providers are classified as either licensed or non-licensed. Licensed providers consist of group homes, centers, or family day cares. Non-licensed providers consist of Authorized Child Care Professionals, Boys and Girls Clubs, and DOE (See Schedule of Findings and Questioned Costs for footnote). DOE staff are responsible for monitoring the approved providers that meet certain education requirements by performing one announced and one unannounced site visit per provider per school year. DHS is responsible for monitoring all other providers in the state. DHS policy requires Child Care Program Evaluators to perform announced and unannounced visits per provider licensing year (See Schedule of Findings and Questioned Costs for footnote) and to complete a child care evaluation form, which includes health and safety checks, for each visit. Providers must receive at least one announced visit per licensing year and the number of unannounced visits per licensing year is determined by the provider?s star rating. Program evaluators perform health and safety checklists upon a non-licensed provider?s initial enrollment and annually thereafter.Additionally, based on discussion with DHS?s CCDF staff, some children who are eligible for CCDF and reside in Tennessee may receive day care services from providers located in other states. If the provider is licensed by another state, CCDF staff collect the licensing information to ensure the provider meets health and safety requirements. If these providers are non-licensed, CCDF staff follow the same processes and procedures for non-licensed providers located in Tennessee.We reported in the prior audit finding that DHS did not complete the entire health and safety checklist for unregulated providers (See Schedule of Findings and Questioned Costs for footnote). DHS concurred with the prior finding and stated program management would conduct training reminding staff to satisfy all requirements when completing health and safety inspections. Child Care Certificate Program supervisory staff conducted the training, which included re-training staff on existing requirements when completing health and safety checklists, in May 2019. Since this training was conducted near the end of the scope of our audit, we found that noncompliance had continued to occur throughout our audit period as noted in the conditions below. Management also concurred that staff did not consistently record licensing documentation for out-of-state providers. On January 22, 2018, DHS implemented a Knowledge Retention Plan, Section 2.1.86, ?Child Care Services ? Child Care Certificate Program,? consisting of procedures for out-of-state providers to improve documentation processes for agencies licensed by other states. For the current audit, we found that DHS staff still had documentation issues related to health and safety requirements and licensing of out-of-state child care providers, resulting in this repeat finding.Condition and CauseCondition A: Staff Could Not Provide or Did Not Verify All Sections of the Health and Safety Checklist for Non-licensed Providers Due to An Inadequate Review ProcessTo determine if management followed CCDF program requirements, we tested the entire population of 69 non-licensed providers to determine if DHS complied with CCDF?s health and safety requirements for providers. For each non-licensed provider, we tested whether DHS program evaluators performed and completed the required provider health and safety checklists and whether DHS management ensured that monitoring activities included supervisory reviews of the staff?s performance to ensure providers? compliance with health and safety requirements.Based on our testwork, for 34 of 69 providers (49%), we found that DHS management did not ensure that program evaluators sufficiently and accurately completed a health and safety checklist for each provider. For 28 of the 34 errors noted, DHS management stated they could not locate and thus could not provide us the checklists; therefore, we could not determine if CCDF program evaluation staff performed a health and safety visit. For the remaining 6 errors, the program evaluation staff did not ensure that all sections on the health and safety checklist were verified. The Compliance Director of Child Care Services stated that there is a need for strengthened records management for the Child Care Certificate Program process documentation.In addition, for 40 of the 69 non-licensed providers we tested (58%), we noted that management did not have a proper supervisory review of monitoring activities related to providers? compliance with health and safety requirements. For 28 of the 40 errors noted, DHS management did not provide us the provider checklists when we requested them; therefore, we could not determine if staff performed a health and safety visit or that a supervisory review of the visit was completed. For the remaining 12 errors, while DHS management provided us the checklists, we found no evidence that a supervisory review was performed. We discussed our testwork results which identified both internal control deficiencies and noncompliance deficiencies with the Compliance Director of Child Care Services, who stated that he did not believe this was a problem; therefore, he provided no explanation for why these errors occurred.Also, based on discussion with DOE management, we determined that DOE did not perform supervisory reviews of monitoring activities related to providers? compliance with health and safety requirements. While program evaluators entered a narrative of the site visit into the Tennessee Licensed Care System (TLCS), management still did not perform a supervisory review of monitoring activities to ensure providers? compliance. In addition, although DOE used a spreadsheet to track whether staff performed the required announced and unannounced site visits for providers, the spreadsheet did not include fields for tracking whether staff performed follow-up procedures after noting violations during site visits and did not include evidence that a supervisory review was performed. Also, DHS staff did not confirm DOE monitored all sites it was responsible for, even though DHS is responsible for administering CCDF in Tennessee. According to DOE management, in August 2019, regional directors began reviewing and approving all site visits.Condition B: Licensing Documentation for Out-of-state Providers Was Not RecordedWe tested the entire population of out-of-state licensed providers and based on our review, we noted that for 2 of 14 out-of-state licensed providers (14%), DHS staff collected the licenses but did not record the providers? licensing information in TLCS, which includes the license effective date and expiration date. While management implemented Out of State Child Care Agency Procedures on January 22, 2018, to improve documentation processes for agencies licensed by other states, we found that DHS still had documentation issues. When asked to provide a reason why the information had not been updated, the Program Coordinator responded that both items are now in the system.Condition C:We reviewed DHS?s December 2018 Financial Integrity Act Risk Assessment and determined that management listed the risk of ensuring compliance with health and safety requirements; however, DHS did not have an effective control to mitigate its risk.CriteriaCriteria for All Conditions?Appendix I: Requirements,? of the Standards for Internal Control in the Federal Government states, ?Management should design control activities to achieve objectives and respond to risks? and ?Management should implement control activities through policies.?The health and safety requirements for licensed and non-licensed child care providers are found in 45 CFR 98.41(a), which states,(a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to child care providers of services for which assistance is provided under this part. Such requirements, which are subject to monitoring pursuant to ?98.42, shall:(1) Include health and safety topics.Condition AAccording to 45 CFR 98.11,(a) The Lead Agency has broad authority to administer the program through other governmental or non-governmental agencies. In addition, the Lead Agency can use other public or private local agencies to implement the program; however:(1) The Lead Agency shall retain overall responsibility for the administration of the program, as defined in paragraph (b) of this section;(2) The Lead Agency shall serve as the single point of contact for issues involving the administration of the grantee?s CCDF program; and(3) Administrative and implementation responsibilities undertaken by agencies other than the Lead Agency shall be governed by written agreements that specify the mutual roles and responsibilities of the Lead Agency and the other agencies in meeting the requirements of this part.According to Section A.7(d) of the contract between DHS and the contractor,The Contractor shall be subject to at least one health & safety inspection each year this Contract is in effect and requirements set forth in the Health and Safety Checklist provided by the Department in connection with a site visit.Condition BAccording to DHS?s Knowledge Retention Plan, Section 2.1.86, ?Child Care Services ? Child Care Certificate Program,? ?annual monitoring of the out of state agency will include . . . annual verification of license status and updating information in TLCS.?Condition CThe U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.EffectWithout performing all site visits as required by federal requirements and internal policy including the completion of health and safety checklists, the Program Coordinator and the Child Care Certificate Program Director approved child care providers for payments without ensuring critical health and safety requirements were in place, potentially subjecting children in the providers? care to unacceptable health and safety risks. Furthermore, by not clearly and consistently documenting verification of out-of-state providers? licenses, the Program Coordinator and the Child Care Certificate Program Director may pay providers who may no longer meet the requirements necessary to legally provide child care services.RecommendationDepartment of Human Services (DHS) management should ensure that staff perform all child care provider site visits, including health and safety checks, in accordance with federal regulations and internal policy. DHS management should also ensure that staff verify and document out-of-state providers? compliance with licensing and health and safety requirements and that staff maintain sufficient documentation to support licensure and health and safety compliance. In addition, DHS management should ensure controls are sufficient to ensure CCDF staff perform and complete a health and safety checklist for non-licensed providers, including a documented supervisory review of the site visit.Department of Education (DOE) management should ensure internal controls over the supervisory reviews of monitoring activities are in place and ensure that follow-up procedures are performed as required when staff note health and safety violations. DOE management should track whether the required follow-up was performed and should ensure supervisory reviews are performed.In addition, management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentsDepartment of Human ServicesCondition A: Staff Could Not Provide or Did Not Verify All Sections of the Health and Safety Checklist for Non-licensed Providers Due to An Inadequate Review ProcessWe Concur.The department conducted staff training for Child Care Certificate Program management in the fall of 2019, where staff were retrained on expectations for completing health and safety checklists for non-licensed providers. A technology solution is being developed for better storage and recall of inspection documents to be implemented by August 31, 2020.Condition B: Licensing Documentation for Out-of-state Providers Was Not RecordedWe Concur.The department agrees that 2 of the 14 out of state licensed providers tested did not have licensing information recorded in Tennessee Licensed Care System (TLCS) at the time of the review. The department had obtained both licenses, but the record had not been updated. Both were updated in TLCS by November 2019. The Child Care Certificate Program director will monitor to see that any license updates are done in a timely manner.Condition C: Risk AssessmentThe department conducts the annual Financial Integrity Act Risk Assessment within the state adopted Committee of Sponsoring Organizations of the Treadway Commission?s Enterprise Risk Management Framework including the optional toolkit forms provided by the Department of Finance and Administration.The forms are a management tool used to document significant organizational risks and key internal controls to mitigate risks within management?s risk tolerance. Management determines the effectiveness of its own controls and its risk tolerance. If risks are not sufficiently mitigated, management can implement a plan of action to modify or create new internal controls. In cases where the inherent risk can not be sufficiently mitigated by the Department?s internal controls alone, for example, regulatory restraints or dependency on other organizations, management can only accept or avoid the risk.Department of EducationWe concur.Beginning January 2019, Tennessee Department of Education (TDOE) management implemented additional internal controls to ensure compliance with health and safety requirements for child care providers. This includes documenting supervisory approval in the Tennessee Licensed Care System for all TDOE Child Care and Development Fund programs, as well as requiring additional formal documentation supporting the review and verification of all sections of the Health and Safety Checklist for Non-licensed Providers.

Finding Number: 2019-030CFDA Number: 96.001Program Name: Disability Insurance/Supplemental Security Income ClusterFederal Agency: Social Security AdministrationState Agency: Department of Human ServicesFederal Award Identification Number: 04-17-04TNDI00, 04-18-04TNDI00, and 04-19-04TNDI00Federal Award Year: 2017 through 2019Finding Type: Material WeaknessCompliance Requirement: Special Tests and ProvisionsRepeat Finding: N/APass-Through Entity: N/AQuestioned Costs: N/AThe department does not have a formal documented review process, which is a key control, to ensure Consultative Examination providers are licensed and credentialedBackgroundThe Professional Relations Office (PRO) is part of the Department of Human Services?s (DHS) Division of Disabilities Determination Services and is responsible for monitoring Consultative Examination (CE) providers, who evaluate the mental or physical disabilities of applicants applying for Social Security Disability Insurance benefits. DHS requires all CE providers to sign Memorandums of Understanding, which describe the CE providers? responsibilities. The providers are required to? be currently licensed in the state;? have the training and experience to perform the type of examination or test requested;? not be barred from participation in Medicare or Medicaid programs or any other federal or federally assisted programs; and? have the equipment required to provide an adequate assessment and record of existence and level of severity of a claimant?s impairment(s).To gain an understanding of DHS?s review process for ensuring CE providers meet all requirements, we discussed the process with the PRO supervisor. According to the PRO supervisor, PRO staff perform licensure and credential checks before a new provider is added to the CE panel and then annually thereafter. The current licensure verification process includes PRO staff accessing each provider?s license through the Tennessee Department of Health?s License Verification website and searching the System for Award Management (See Schedule of Findings and Questioned Costs for footnote) database for exclusions from program participation. The staff document the verification date of the licensure and credential check on an Excel spreadsheet, called the Tracker Tool, and maintain documentation of all search results and checks in an electronic folder.ConditionBased on our review of DHS?s CE provider process, we found that management did not have a documented review process to ensure staff actually performed the required licensure and credential checks and maintained accurate documentation for CE providers? licensure verification. In effect, management relied on staff to perform the verification process without assurance that the license verifications were timely and accurate, and that all supporting documentation was maintained.Specifically we were told, and we observed during a walkthrough, that the PRO supervisor reviewed the dates on the Tracker Tool monthly to ensure CE providers? licenses and credentials were up to date; however, we noted that the supervisor did not document the review or perform steps to ensure that the Tracker Tool matched supporting evidence of provider licensure. To determine compliance with CE providers? licensure and credentials, we tested a sample of 25 CE providers from a population of 371 CE providers. Based on our testwork, we found no noncompliance with CE providers? licensure and credentials.Risk AssessmentWe reviewed DHS?s December 2018 Financial Integrity Act Risk Assessment and determined that management did not identify the risk of the lack of a formal documented review of the CE providers? license and credentialing process and a mitigating control.CriteriaAs stated in the U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book), best practices include providing guidance to management for monitoring the internal control system. According to the Green Book?s Principle 16, ?Perform Monitoring Activities,?16.09 Management evaluates and documents the results of ongoing monitoring and separate evaluations to identify internal control issues. Management uses this evaluation to determine the effectiveness of the internal control system. Differences between the results of monitoring activities and the previously established baseline may indicate internal control issues, including undocumented changes in the internal control system or potential internal control deficiencies.According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.CauseAccording to the PRO Supervisor, DHS has no documented review process in place to ensure staff perform required CE providers? licensure and credential checks and that documentation is accurate and maintained in the electronic folder.EffectWhen a supervisory review of PRO staff?s work is not documented to ensure staff have performed the necessary checks for the CE providers? licensure and credentials, the risk increases for errors in the verification of the CE providers? licenses and credentials. Without verification that staff have performed these checks, a CE provider may continue to perform examinations without a license or with sanctions against them.RecommendationThe Director of Disabilities Determination Services should ensure a documented review process is in place to verify staff are performing the required licensure and credential checks, and should ensure documentation is maintained and accurate. Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentWe do not concur.The Social Security Administration (SSA), which governs the administration of this program, sets forth all applicable policies for Disability Determination Services (DDS) in the program operating manuals system (POMS). POMS Disability Insurance (DI) 39569.300 provides DDS with guidance for assuring proper licensures, credentials and exclusions of consultative examiner (CE) providers are verified and current. At the time of the Comptroller?s review, DDS had in practice a standard business process document that is more stringent than POMS. Additionally, the federal regional office of the Social Security Administration in Atlanta recently noted that for the third consecutive year, no additional information was needed from Tennessee because of the thoroughness and accuracy of their initial CE annual oversight report.As noted in the finding, Professional Relations Office (PRO) staff monitor CE provider licensing and credentialing regularly in compliance with POMS licensing and credentialing requirements and track results with internal tracking tools utilizing Microsoft Office products. Management will evaluate that process as part of its on-going efforts to enhance the documentation and accountability of its controls already in place and make any required adjustments to its risk assessment for the next review cycle.Auditor?s CommentManagement?s comments do not address the finding condition regarding management?s lack of documentation for the supervisory review. Without documentation we were unable to determine that any review was performed based on management?s described process. U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book), principle 16.09 states management should have documented results of ongoing monitoring; documenting that a review has been performed and that supporting documentation was reviewed.

Finding Number: 2019-031CFDA Number: 17.225Program Name: Unemployment InsuranceFederal Agency: Department of LaborState Agency: Department of Labor and Workforce DevelopmentFederal Award Identification Number: UI-27885-16-55-A-47, UI-28004-16-55-A-47, UI-29869-17-55-A-47, UI-30246-17-60-A-47, UI-31319-18-55-A-47, UI-31370-18-55-A-47, UI-31622-18-60-A-47, UI-32627-19-55-A-47, UI-32730-19-55-A47, FAC Benefits & UI Admin, EUC, Fed EB, UCFE, and UCX, and TUC-State ExpendituresFederal Award Year: 2016 through 2019Finding Type: Material Weakness and NoncomplianceCompliance Requirement: ReportingRepeat Finding: 2018-035Pass-Through Entity: N/AQuestioned Costs: N/ADue to continued difficulties with the Geographic Solutions Unemployment System, the Department of Labor and Workforce Development submitted federal reports with inaccurate and uncorroborated information for the fourth consecutive yearBackgroundThe U.S. Department of Labor (USDOL) requires state agencies, including the Department of Labor and Workforce Development (the department), to create and submit certain quarterly financial reports. For the Unemployment Insurance (UI) program, these reports include the Employment Training Administration (ETA) 227 report, which provides information on intrastate and interstate claim overpayments under the state?s regular UI program; federal UI programs including the Unemployment Compensation for Federal Employees and Unemployment Compensation for Ex-servicemembers (UCFE/UCX); and the federal-state Extended Benefits (EB) programs. Management uses the ETA 227 report to collect and report overpayment data on UI claims that result from claimant, employer, and/or agency errors and fraud. USDOL uses the ETA 227 report to calculate performance measures and to monitor the department?s benefit payment process.Department staff prepare the ETA 227 report using data from the Geographic Solutions Unemployment System (GUS) and perform a comparison of overpayment recoveries from GUS with comparable data in Edison, the state?s accounting system.To determine the accuracy of ETA 227 reports, USDOL requires state agencies to upload electronic files with data supporting reported amounts, referred to as populations, into its SUN system (See Schedule of Findings and Questioned Costs for footnote) for data validation. Data validation is designed to identify invalid, missing, and duplicated data on previously submitted reports and consists of the following two tests:? Report Validation ? an automated test that compares supporting data in a population file with amounts included on the ETA 227 report; and,? Data Element Validation ? a manual test performed by department staff who randomly sample and compare supporting data in a population file with unemployment records in GUS.USDOL requires state agencies to perform data validation every third year, except for data elements used to calculate Government Performance and Results Act measures, which state agencies must validate annually. Our review of prior data validation submissions indicated that the department was required to submit four populations supporting the ETA 227 report to USDOL by June 10, 2019: Overpayment Established by Cause, Overpayment Reconciliation Activities, Age of Overpayments, and Overpayments Established by Method. Although all four populations are necessary in order to support different sections of an ETA 227 report, USDOL does not require the department to submit all four populations at the same time. Instead, the department may choose to submit these populations at different times for different reporting periods. Since 2016, we have noted each year in our Single Audit Report that the department could not produce populations that could pass the USDOL data validation.We also noted in prior audits that management did not follow its own internal guidelines to report total overpayment recoveries within 5% of the recoveries reported in Edison. Management could not specifically explain the cause for exceeding its 5% reporting requirement or the nature of the variances. Management concurred with the prior audit finding, citing that it would continue to work with Geographical Solutions Incorporated (GSI), the GUS vendor, to resolve issues that prevented management from obtaining comparable populations from the system which could pass the data validation process.Condition and CauseDuring fiscal year 2019, the department submitted four population files to USDOL for the following reporting periods:? two files for the September 30, 2018, report;? one file for the December 31, 2018, report; and? one file for the March 31, 2019, report.Although the first three population files passed both the Report Validation and Data Element Validation tests, the population file submitted for the latest reporting period did not pass the Data Element Validation test.To determine if the department?s most recent reports met Report Validation standards, we reviewed population files supporting all sections of the two most recent reports for our audit period:? the report for the quarter ending March 31, 2019, submitted on April 29, 2019; and? the report for the quarter ending June 30, 2019, submitted on July 30, 2019 (See Schedule of Findings and Questioned Costs for footnote).Population and Report DiscrepanciesOur review of the March 31, 2019, report revealed that 4 of 53 lines (8%) included nonfinancial information about overpayment investigations that would not pass data validation; see Table 1 below.See Schedule of Findings and Questioned Costs for chart/table.GSI initially informed the Director of UI Integrity that the reported amounts were correct and the 2,508 difference in investigations noted in Table 1 above occurred because GUS included the same investigations multiple times in the population. Based on our analysis, however, GUS should have included additional investigations in the report. After further discussion with GSI, the Director of UI Integrity found that GUS excluded investigations from the report because investigation notices were manually created by staff and not automatically generated by GUS.Furthermore, our review of the June 30, 2019, report revealed that 1 of 53 lines (2%) included financial information that would not pass data validation. Management reported $758,571 on Line 310: Additions, while the population file supporting this line showed $785,276. Although the GSI vendor claimed that the difference was due to overpayments reclassified after the reporting period, data the department requested from GSI for this difference did not support this assertion.Edison and Report DiscrepanciesWe also reviewed management?s comparison of amounts reported in Edison with the amounts reported on ETA 227 Line 302: Recovered ? Total for the March 31, 2019, and June 30, 2019, reports. While reviewing the March 31, 2019, report, we found discrepancies between Edison and ETA 227 reported amounts; see Table 2 below.See Schedule of Findings and Questioned Costs for chart/table.According to the Director of Unemployment Insurance Integrity, there is often a difference when overpayment recoveries occur and when those recoveries are recorded into Edison. Although management cited 5% as an acceptable variance amount in our discussions with them, they did not formally establish this as the standard in a policy, nor did they develop written procedures for reconciling differences that exceed this margin. As a result, staff did not take any action to verify that the variance was due to timing differences, despite the fact that it was higher than 5%.OverallWe reviewed the Department of Labor and Workforce Development December 2018 Financial Integrity Act Risk Assessment and determined that management listed the risk of inaccurate reporting; however, the department did not have an effective control to mitigate its risk.CriteriaAs stated in ?Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,? Title 2, Code of Federal Regulations, Part 200, Section 302,(a) . . . the state?s and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions . . .(b) The financial management system of each non-Federal entity must provide for the following . . . [a]ccurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements.Furthermore, according to the UI Report Handbook No. 401, which provides reporting instructions for the ETA 227, ?all applicable data on the ETA 227 report should be traceable to the data regarding overpayments and recoveries in the state?s financial accounting system.?The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.EffectThe UI Report Handbook No. 401 describes the purpose of the ETA 227 report as follows: ?The state agency?s accomplishments in principal detection areas of benefit payment control are shown on the ETA 227 report. The Employment and Training Administration (ETA) and state agencies need such information to monitor the integrity of the benefit payment processes in the UI system.?Therefore, when the department does not submit accurate reports, neither the department nor USDOL can effectively monitor and analyze benefit payment process integrity.RecommendationGoing forward, management should take the following steps:1. coordinate with the GUS vendor to identify and resolve technical difficulties that prevent the department from corroborating amounts reported on the ETA 227;2. ensure that staff follow guidelines for reviewing ETA 227 reports prior to submission;3. develop formal, documented policies and procedures to compare the reported unemployment insurance amounts for each program (UI, UCFE/UCX, EB) with Edison entries; and4. implement effective controls to address the risks noted in this finding and update the risk assessment as necessary, assign staff to be responsible for ongoing monitoring of the risks and mitigating controls, and take action if deficiencies occur.Management?s CommentWe concur.The department has had problems with the ETA 227 report and with data validation, since GUS was implemented in May of 2016. Department staff has worked with Geographic Solutions staff, since that time, to correct outstanding problems with the report. In spite of the department?s best efforts, the problems with the report continue. The department has entered eight incident tickets since March of 2019 to address various and ongoing problems with the report. The department?s risk assessment has been updated.

Finding Number: 2019-032CFDA Number: 17.225Program Name: Unemployment InsuranceFederal Agency: Department of LaborState Agency: Department of Labor and Workforce DevelopmentFederal Award Identification Number: UI-27885-16-55-A-47, UI-28004-16-55-A-47, UI-29869-17-55-A-47, UI-30246-17-60-A-47, UI-31319-18-55-A-47, UI-31370-18-55-A-47, UI-31622-18-60-A-47, UI-32627-19-55-A-47, UI-32730-19-55-A47, FAC Benefits & UI Admin, EUC, Fed EB, UCFE, and UCX, and TUC-State ExpendituresFederal Award Year: 2016 through 2019Finding Type: OtherCompliance Requirement: Special Tests and ProvisionsRepeat Finding: 2018-037Pass-Through Entity: N/AQuestioned Costs: N/AAs noted in the prior four audits, we were unable to access federal tax information needed to fulfill our audit objectives due to restrictions imposed by the Internal Revenue ServiceBackground and CriteriaTo ensure the integrity of the Unemployment Insurance program, the U.S. Department of Labor (USDOL) mandates that the Tennessee Department of Labor and Workforce Development (the department) and other state agencies provide only eligible individuals with benefits. When an individual receives unemployment benefits to which he or she is not entitled, whether due to error or fraud, an overpayment occurs. The department instituted a multi-phase process to collect identified overpayments. One method the department uses to collect overpayments is the Treasury Offset Program, which intercepts individuals? federal tax refunds.In addition to the principal overpayment amount, the department imposes penalties and interest on individuals whose fraudulent acts resulted in an overpayment. Under Section 50-7-715(b), Tennessee Code Annotated, fraudulent overpayments incur a penalty of 30% or 50%, composed of a federally mandated penalty of 15% and an additional state penalty of 15% (for the first instance of overpaid benefits) or 35% (for the second and each subsequent instance of overpaid benefits). Section 303(a)(11) of the Social Security Act requires the department to deposit the 15% federal penalty into the state?s account in the USDOL Unemployment Trust Fund. Section 50-7-715(b)(2)(C) requires the department to use state penalties collected to defray the costs of deterring, detecting, and collecting overpayments.Part 4 of the Appendix XI ? Compliance Supplement lists one objective of the UI [Unemployment Insurance] Program Integrity ? Overpayments special test as ?properly identifying and handling overpayments, including, as applicable, assessment and deposit of penalties and not relieving employers of charges when their untimely or inaccurate responses cause improper payments.? The related audit procedure states,Based on a sample of overpayment cases: . . . If the overpayment was based on fraud, determine if the claimant was notified of the 15 percent penalty, and if there was no appeal or the claimant was unsuccessful in appeal, there was follow-up to collect the penalty, and the State deposited the penalty into the State?s account in the Unemployment Trust Fund.During our prior four audits, the department was unable to provide us with information about Treasury Offset Program recoveries due to restrictions imposed by the Internal Revenue Service (IRS). Management concurred with the prior-year finding and stated that it would communicate with the USDOL about the situation.ConditionSince neither the USDOL nor the IRS addressed the conflict between the Compliance Supplement and the Internal Revenue Code (IRC), department management and staff declined to provide us with the amounts collected via the Treasury Offset Program.CauseAccording to the Director of UI Recovery, the department could not share data regarding overpayment recoveries collected through the Treasury Offset Program with us due to the IRS?s restrictions. During our fiscal year 2015 audit, department management inquired with the IRS about whether we could access the exact amount of individual principal and penalty amounts collected through the Treasury Offset Program. An IRS Disclosure Enforcement Specialist answered on November 16, 2015, as follows: ?State Workforce Agencies participating in the Treasury Offset Program under IRC 6103(l)(10) for benefits collection are prohibited from redisclosing FTI [Federal Tax Information]. State auditors cannot have access to the individual amounts under this code section? [emphasis in original].In response to the prior audit finding, management sent a letter to the USDOL and the U.S. Department of the Treasury about access to Treasury Offset Program data. The letter, which management drafted in coordination with our office and sent on May 13, 2019, requested the federal agencies? ?assistance to resolve the apparent conflict in order to avoid future findings.? On August 20, 2019, we received a reply from the USDOL stating that the request ?was referred to the Employment and Training Administration?s Office of Unemployment Insurance, which has oversight responsibility for the federal-state UI program.? As of January 8, 2020, neither the Office of Unemployment Insurance nor other federal offices have provided any further response to the joint letter.EffectWithout access to federal tax information, we were unable to assess whether penalties due to fraud were properly deposited into the state?s Unemployment Trust Fund and could not achieve our audit objectives related to overpayment recoveries.RecommendationManagement should, in coordination with the USDOL and the IRS, continue its efforts to resolve the issues surrounding auditors? access to federal tax information.Management?s CommentWe concur.We concur that the Comptroller?s auditors are not allowed to access this data, due to restrictions imposed by federal law. We also concur that USDOL and IRS need to work together to develop a resolution. We appreciate the Comptroller?s Office assisting with a letter requesting federal assistance to resolve this situation.However, we are not able to resolve this issue.

Finding Number: 2019-033CFDA Number: 17.225Program Name: Unemployment InsuranceFederal Agency: Department of LaborState Agency: Department of Labor and Workforce DevelopmentFederal Award Identification Number: UI-27885-16-55-A-47, UI-28004-16-55-A-47, UI-29869-17-55-A-47, UI-30246-17-60-A-47, UI-31319-18-55-A-47, UI-31370-18-55-A-47, UI-31622-18-60-A-47, UI-32627-19-55-A-47, UI-32730-19-55-A47, FAC Benefits & UI Admin, EUC, Fed EB, UCFE, and UCX, and TUC-State ExpendituresFederal Award Year: 2016 through 2019Finding Type: Significant DeficiencyCompliance Requirement: Special Tests and ProvisionsRepeat Finding: 2018-036Pass-Through Entity: N/AQuestioned Costs: N/AFor the third consecutive year, the Department of Labor and Workforce Development hampered benefit overpayment recoveries by failing to adequately inform claimants of their debtsBackgroundThe Department of Labor and Workforce Development provides Unemployment Insurance (UI) benefits to individuals who meet certain eligibility criteria. When an individual receives benefits to which he or she is not entitled, whether due to error or fraud, the department establishes an overpayment. Claimants must repay overpayments to the department. The department also applies penalties and interest when it determines a claimant?s fraudulent acts caused the overpayment. The department?s UI Recovery Unit is responsible for collecting overpayments, penalties, and interest from claimants.In our prior audits, we reported that the department ceased mailing and emailing Benefit Overpayment Statements, which serve to notify claimants of overpayment balances and payment instructions. Management discontinued sending these monthly statements in fiscal year 2016 because the department?s ?new? UI system did not initially calculate the monthly interest charges on fraudulent overpayments correctly (See Schedule of Findings and Questioned Costs for footnote). Instead, the department only sent the statements via an online messaging feature in the web-based system.Our prior findings explained that staff sent claimants overpayment determination letters only when overpayments were first established, and that the one-time letters were not an effective tool to collect overpayments from claimants with long-outstanding balances. Furthermore, claimants could only access these statements if they had registered with the website and knew how to check messages. We observed that the department?s overpayment debt recoveries declined after it ceased mailing and emailing the statements.Management concurred with the prior-year audit finding, stating that it worked with the vendor responsible for the UI application and resumed sending mail and email statements in November 2018.ConditionBased on our audit work for fiscal year 2019, we found that management resumed sending monthly statements to claimants who selected mail as their preferred contact method, but management did not email monthly benefit overpayment statements to claimants, including those who chose email as their preferred contact method.We reviewed the department?s December 2018 Financial Integrity Act Risk Assessment and determined that management did not identify the risk of not notifying claimants about overpayments and did not identify a mitigating control.CriteriaThe U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) sets internal control standards and is considered best practice for non-federal entities. According to Principle 15, ?Communication with External Parties,? of the Green Book,15.03 Management communicates quality information externally through reporting lines so that external parties can help the entity achieve its objectives and address related risks. Management includes in these communications information relating to the entity?s events and activities that impact the internal control system.15.08 Based on consideration of the factors, management selects appropriate methods of communication, such as a written document?in hard copy or electronic format?or a face-to-face meeting. Management periodically evaluates the entity?s methods of communication so that the organization has the appropriate tools to communicate quality information throughout and outside of the entity on a timely basis.Additionally, Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,? states,7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.CauseAccording to the Director of UI Recovery, she verified that the vendor made the necessary corrections regarding the Benefit Overpayment Statements but did not retain documentation of her review showing that the system sent these statements by the claimants? preferred contact methods. Based on our review, however, the system did not email claimants monthly statements. After we inquired about email statements, the Director of UI Recovery confirmed that the system did not send the Benefit Overpayment Statements via email and filed another change order to activate all methods of communication.EffectAlthough the department continued to send statements via online messaging and resumed mailing statements, individuals who do not have ongoing claims may not visit the messaging center and receive the overpayment notifications. By not ensuring claimants received benefit overpayment statements according to their preferred method of contact, the department failed to adequately inform claimants of their debts and hampered overpayment recoveries. Despite an increase in overpayment recoveries since fiscal year 2018, collections remain lower than when the department sent monthly statements by mail and email; see Table 1 below.See Schedule of Findings and Questioned Costs for chart/table.RecommendationManagement should continue to take all reasonable steps to ensure that claimants are properly notified of their obligations to repay the department for any overpayments of benefits in order to ensure the integrity of the Unemployment Insurance program. Management should conduct thorough, documented testing when the vendor reports that it has addressed change order requests and should perform periodic follow-up reviews to ensure that the system is still functioning as intended.Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentWe concur.The department has been clear with the vendor that overpayment statements are to be sent by each individual claimant?s preferred method of communication. This was tested in a staging environment and then again in production. At some point after production testing in November of 2018, the GUS system [Geographic Solutions Unemployment System] stopped sending monthly statements to claimants who selected a preferred method of email for communication from the department. Those claimants who selected postal mail or internal messaging were sent monthly statements as required, but those who selected email were not. A ticket was entered to correct this issue on January 23, 2020; as of the date of this response, it has not yet been completed. The department?s risk assessment has been updated.

Finding Number: 2019-034CFDA Number: 17.225Program Name: Unemployment InsuranceFederal Agency: Department of LaborState Agency: Department of Labor and Workforce DevelopmentFederal Award Identification Number: UI-27885-16-55-A-47, UI-28004-16-55-A-47, UI-29869-17-55-A-47, UI-30246-17-60-A-47, UI-31319-18-55-A-47, UI-31370-18-55-A-47, UI-31622-18-60-A-47, UI-32627-19-55-A-47, UI-32730-19-55-A47, FAC Benefits & UI Admin, EUC, Fed EB, UCFE, and UCX, and TUC-State ExpendituresFederal Award Year: 2016 through 2019Finding Type: Significant DeficiencyCompliance Requirement: OtherRepeat Finding: 2018-041Pass-Through Entity: N/AQuestioned Costs: N/AAs noted in the prior four audits, the Department of Labor and Workforce Development did not provide adequate internal controls in one specific areaThe Department of Labor and Workforce Development did not provide adequate internal controls in one specific area related to six of the department?s systems. We are reporting internal control deficiencies in this area because department management did not implement sufficient corrective action. These conditions were in violation of state policies and/or industry-accepted best practices. In their response to the prior-year finding, management agreed that internal controls needed improvement and provided details of corrective action. However, the conditions continued to exist during the audit period.We reviewed the department?s December 2018 Financial Integrity Act Risk Assessment and determined that management listed risks relating to this area; however, the department did not have an effective control to mitigate the risks.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.Ineffective implementation and operation of internal controls increases the likelihood of errors, data loss, and the inability to continue operations. Pursuant to Standard 4.40 of the U.S. Government Accountability Office?s Government Auditing Standards, we omitted details from this finding because they are confidential under the provisions of Section 10-7-504(i), Tennessee Code Annotated. We provided management with detailed information regarding the specific conditions we identified, as well as the related criteria, causes, and our specific recommendations for improvement.RecommendationManagement should ensure that these conditions are remedied by the prompt development and consistent implementation of internal controls in this area. Management should implement effective controls to ensure compliance with applicable requirements; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Managements? CommentsDepartment of Labor and Workforce DevelopmentWe concur.The department delivered a confidential response to the Office of the Comptroller.Division of Strategic Technology SolutionsWe concur. STS has revised certain processes and implemented additional internal controls to further mitigate the risk associated with this finding.

Finding Number: 2019-035CFDA Number: 97.036Program Name: Disaster Grants ? Public Assistance (Presidentially Declared Disasters)Federal Agency: Department of Homeland SecurityState Agency: Department of MilitaryFederal Award Identification Number: PA-04-TN-1909 and PA-04-TN-4320Federal Award Year: 2018 and 2019Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: ReportingRepeat Finding: N/APass-Through Entity: N/AQuestioned Costs: N/APortions of Federal Financial Reports for the Disaster Grants ? Public Assistance Program Were Incomplete or InaccurateCondition and CauseTestwork revealed that portions of the SF-425 (federal financial reports) submitted to Federal Emergency Management Agency (FEMA) for two of the open disaster grants (PA-04-TN-1909 and PA-04-TN-4320) were incomplete or inaccurate. The department is required to submit an SF-425 each quarter for the open disaster grants. For both disaster grants? four quarterly reports (a total of eight reports), the Department of Finance and Administration (F&A) ? Military Fiscal incorrectly reported amounts for lines 10i (Total Recipient Share Required) and 10j (Recipient Share of Expenditures) on the SF-425. Consequently, since line 10k (Remaining Recipient Share to be Provided) is to be reported as line 10i less line 10j (or if line 10j is greater than 10i, report 0), line 10k was also incorrectly reported.Only the matching funds paid directly by the state are recorded in Edison. Third-party providers? shares of cost are accounted by the Tennessee Emergency Management Agency?s (TEMA?s) Public Assistance (PA) division. F&A - Military Fiscal does not have access to the information required to complete the required SF-425 Form and must obtain the information from TEMA?s PA division. As described below, there were not adequate procedures during the audit period for TEMA?s PA division to provide the needed information to F&A ? Military Fiscal.PA-04-TN-1909 Disaster GrantFor the four quarterly reports, the department reported the following amounts:See Schedule of Findings and Questioned Costs for chart/table.In the quarters ending September 30, 2018 and December 31, 2018, the department based the amounts on line 10i on the total federal funds authorized for the grant instead of the expenditures incurred. For the same quarters, line 10j was reported based on the product of total expenditures and the required matching percentage instead of the actual matching funds incurred by the state or by a third party.In the quarter ending March 31, 2019, F&A - Military Fiscal staff attempted to collect actual Recipient Share information to report the correct amounts but did not receive it in time to submit the SF-425; therefore, zero dollars was reported. In the quarter ending June 30, 2019, for line 10i, the amounts reported included only state funds committed to the subrecipient grants. For line 10j, the amounts reported included only matching funds paid by the state.PA-04-TN-4320 Disaster GrantFor the first three quarters of FY19, the department incorrectly reported $0 for lines 10i and 10j because it was unsure of the correct non-federal matching percentage. For the quarter ending June 30, 2019, the department reported $1,713,412.75 and $1,531,428.88 for lines 10i and 10j, respectively. For line 10i, the amounts reported included only state funds committed to the subrecipient grants. For line 10j, the amounts reported included only matching funds paid by the state.CriteriaWhen reports are submitted, all financial activity included in the reports should be based on underlying accounting records that demonstrate all the activity that occurred during the reporting period.The instructions for completing line 10i state:Enter the total required recipient share for reporting period specified in line 9. The required recipient share should include all matching and cost sharing provided by recipients and third-party providers to meet the level required by the Federal agency. This amount should not include cost sharing and match amounts in excess of the amount required by the Federal agency (for example, cost overruns for which the recipient incurs additional expenses and, therefore, contributes a greater level of cost sharing or match than the level required by the Federal agency).The instructions for completing line 10j state:Enter the recipient share of actual cash disbursements or outlays (less any rebates, refunds, or other credits) including payments to subrecipients and contractors. This amount may include the value of allowable third party in-kind contributions and recipient share of program income used to finance the non-Federal share of the project or program. Note: On the final report this line should be equal to or greater than the amount of Line 10i.The instructions for completing line 10k state:Enter the amount of Line 10i minus Line 10j. If recipient share in Line 10j is greater than the required match amount in line 10i, enter zero.EffectThe department underreported recipient share of non-federal expenditures to FEMA. Providing incorrect information to FEMA may result in decision makers being provided incorrect information to base decisions on.RecommendationF&A ? Military Fiscal and TEMA?s PA division should work together to identify the information needed to complete the reports and develop procedures to retrieve the information and provide the information timely to staff responsible for SF-425 preparation.Management?s CommentWe Concur, F&A - Military and TEMA staff identified the issue prior to the 2019 single audit and have corrected reporting guidelines for nonfederal share reporting relating to Federal Financial Reports (FFRs). Updated checklists within Standard Operation Procedures identify that TEMA will work with Fiscal Office to provide State and Local shares to reported. Quarterly and cumulative State and local shares will be reconciled by the Program Manager using the programmatic external database. Non-Federal Share will be provided via a certification form that will be signed by the Program Manager. The Fiscal Office will receive certification no less than one week prior to the FFR deadline. The criteria noted above will be implemented for the Quarter Ending March 2020 reporting period.

Finding Number: 2019-036CFDA Number: 97.036Program Name: Disaster Grants ? Public Assistance (Presidentially Declared Disasters)Federal Agency: Department of Homeland SecurityState Agency: Department of MilitaryFederal Award Identification Number: PA-04-TN-1909, PA-04-TN-4320, PA-04-TN-4171, PA-04-TN-4005, PA-04-TN-1979, PA-04-TN-4293, PA-04-TN-4189, PA-04-TN-1974, PA-04-TN-4211Federal Award Year: 2017 through 2019Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: Subrecipient MonitoringRepeat Finding: N/APass-Through Entity: N/AQuestioned Costs: N/AThe Department of Military did not review all subrecipient audit reportsConditionWe identified three instances where subrecipients were required to have an audit, but management did not review the audit. These audits covered the fiscal year 2018 subrecipients whose audits were required to be completed in fiscal year 2019.In addition, the listing used by the Office of Program Monitoring to select contracts for monitoring was not adequate to ensure that Program Monitoring knew which subrecipients were required to have an audit completed. Although the listing obtained from each program area includes total funding obligated by the contract, it does not include amounts passed through to the subrecipient during the fiscal year.CauseThe Office of Program Monitoring uses a listing of all open contracts within the Department of Military from the prior year to develop the Subrecipient Monitoring Plan for the current fiscal year (i.e., fiscal year 2019?s plan is developed based on contracts open during fiscal year 2018). The Office of Program Monitoring selects some contracts from this list for monitoring. Part of the office?s monitoring includes reviewing the subrecipients? most recent audit report. Since the department does not select every contract every year for monitoring, it is not reviewing all required audits for each subrecipient every year.CriteriaTitle 2, Code of Federal Regulations (CFR), Part 200, Section 331(f), states that the department must ?[v]erify that every subrecipient is audited as required by Subpart F ? Audit Requirements of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in Section 200.501 Audit requirements.?Regarding single audit requirements, 2 CFR 200.501(a) states that a ?non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part.?EffectAlthough we determined the three audits had been completed, management?s not reviewing each subrecipient?s audit report every year increases the risk that management may fail to issue required management decisions if the subrecipient has findings. The failure to issue management decisions may allow noncompliance to continue for an extended period of time.Not including amounts paid by the department to the subrecipient on the contract listing prevents the reviewer from readily knowing if the subrecipient was required to have an audit.RecommendationThe department should develop procedures to review audit reports yearly for subrecipients that have not been selected for monitoring by the Office of Program Monitoring. Additionally, the listing used by the Office of Program Monitoring to review subrecipient audits should include the amount passed through to the subrecipient for the prior year, to aid the office in identifying subrecipients requiring an audit.Management?s CommentWe concur. The Program Monitoring section of the State Military Department Administrative Services division has established and implemented controls to monitor all Subrecipient?s audit reports, identifying those who have expended $750,000 or more in Federal Awards during the Fiscal year, and follow up on any related findings. The Tennessee Emergency Management Agency has agreed to aid in identifying those Subrecipients requiring an audit and to provide more detailed reporting of Subrecipients? expended Federal Awards during the fiscal year.The Program Monitoring section has been completing this process for all contracts monitored, approximately 1/3 of the Subrecipient contracts in a fiscal year. Program Monitoring will now increase their verification of Federal Awards disbursed and follow up on any related findings for all Subrecipient Contracts identified by TEMA.

Finding Number: 2019-037CFDA Number: 20.106Program Name: Airport Improvement ProgramFederal Agency: Department of TransportationState Agency: Department of TransportationFederal Award Identification Number: VariousFederal Award Year: VariousFinding Type: Material Weakness and NoncomplianceCompliance Requirement: ReportingRepeat Finding: N/APass-Through Entity: N/AQuestioned Costs: N/AThe Department of Transportation?s Aeronautics Division management did not submit or submitted incomplete information on financial reports to the Federal Aviation AdministrationBackground and CriteriaThe Department of Transportation (the department), as the administrator of the Airport Improvement Program participating in the State Block Grant Program (See Schedule of Findings and Questioned Costs for footnote), is required to submit financial reports to summarize grant expenditures and the status of project funds. The department is required to submit the financial reports or approved equivalent reports to the federal government via the Memphis Airport District Office (Memphis ADO). The Memphis ADO operates in the Federal Aviation Administration?s (FAA) Southern Regional Office and serves Tennessee. As stated in the State Block Grant Program Advisory Circular 150/5100-21, Chapter 3.10, ?Federal Financial Reporting,? the department is required to submit the following financial reports:1. Standard Form (SF)-425, Federal Financial Report?[The SF-425] report, or an ADO/RO [Airport District Office/Regional Office] approved equivalent, must be submitted annually for each open grant (See Schedule of Findings and Questioned Costs for footnote) to monitor outlays and program income on a cash or accrual basis. This report is due 90 days after the end of each federal fiscal year and must also be submitted as a final financial report during closeout.? (See Schedule of Findings and Questioned Costs for footnote.)2. Standard Form (SF)-270?[The SF-270, Request for Advance or Reimbursement] report, or an equivalent ADO/RO approved equivalent report, must be submitted annually to summarize requests for block grant reimbursements for non-construction projects.?3. Standard Form (SF)-271?[The SF-271, Outlay Report and Request for Reimbursement for Construction Program], or an ADO/RO approved equivalent report, must be submitted annually to summarize requests for reimbursement for construction projects.?ADO-approved Equivalent ReportsTo determine if the department was approved to submit any equivalent reports, as allowed by the Advisory Circular, we verified reporting requirements with the Memphis ADO. According to the Program Manager at the Memphis ADO, the ADO has not approved an equivalent report for the SF-425 reports; thus, the department must submit the SF-425 reports annually for each open grant and at closeout (a final SF-425).The Memphis ADO Program Manager did confirm, however, that the ADO had approved the department?s Memorandum of Agreement (MOA) Annual Report as an approved equivalent report for both the SF-270 and SF-271 reports. As stated in the department?s 2006 MOA with the FAA to administer Airport Improvement Program funds under the State Block Grant Program, the reporting requirement, including the six key report items, for the MOA Annual Report is as follows:? MOA Annual Report (in lieu of SF-270 and SF-271)?TDOT will provide an annual report to MEM-ADO [Memphis ADO] by December 15th of each year outlining program activity for the preceding fiscal year. The annual report shall include [1] a brief summary of each project, [2] percentage of completion, [3] problems encountered and [4] funds expended and [5] balances, and [6] why the project needed.?ConditionWe found that the Aeronautics Division?s Director and Assistant Director failed to gain their own understanding of the federal reporting requirements, which led to management failing to submit reports and/or submitting incomplete reports to the Memphis ADO and the FAA.SF-425 Annual Federal Financial ReportAs of September 30, 2018, the federal fiscal year-end, the department had eight open grants with the FAA. We found that the Aeronautics Director and Assistant Director failed to submit to the federal agency all eight (100%) SF-425 annual federal financial reports due on December 29, 2018. The reports related to the following open grants:1. 3-47-SBGP-49-2015,2. 3-47-SBGP-50-2016,3. 3-47-SBGP-51-2016,4. 3-47-SBGP-52-2017,5. 3-47-SBGP-53-2017,6. 3-47-SBGP-54-2018,7. 3-47-SBGP-55-2018, and8. 3-47-SBGP-56-2018.SF-425 Final Federal Financial ReportDuring the period July 1, 2018, through June 30, 2019, the Aeronautics Division closed four Airport Improvement Program grants that required SF-425 final federal financial reports. We found that although the department?s Aeronautics Assistant Director submitted all four SF-425 final federal financial reports, three reports were incomplete. Specifically, for three SF-425 final federal financial reports, for grants 3-47-SBGP-49-2015, 3-47-SBGP-51-2016, and 3-47-SBGP-55-2018, the department did not report the basis of accounting or the reporting period end date.Memorandum of Agreement (MOA) Annual ReportFor the MOA Annual Report due by December 15, 2018, the department did not include three of six required key report line items (50%). Specifically, the Aeronautics Assistant Director did not include ?the percentage of completion,? ?the problems encountered?, or ?why the project was needed.?Risk AssessmentWe reviewed the department?s December 2018 Financial Integrity Act Risk Assessment and determined that Aeronautics Division management did not identify any risks associated with the Airport Improvement Program?s federal financial reports, including submitting incomplete reports, and any mitigating controls.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 ?Identify, Analyze, and Respond to Risks,? of the Green Book,7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.CauseThe Aeronautics Division?s Director and Assistant Director believed that the problem occurred due to miscommunications among the FAA, the Memphis ADO, and the department. The Director and Assistant Director stated that they were following the reporting guidelines established in the 2006 MOA, believing that those were the only reporting requirements the department needed to follow, and replaced all of the department?s reporting requirements. The 2006 MOA only listed that the department must submit an annual report and the final closeout documents. The Director and Assistant Director also stated that they were aware that the FAA planned on updating the MOA with all states participating in the State Block Grant Program, which would include additional reporting requirements. However, they stated that the FAA has not presented the department with a new MOA to sign, and the department?s 2006 MOA is still in effect. The Director and Assistant Director also stated that since no representative from the FAA or Memphis ADO communicated the reporting insufficiencies to the department, the Director and Assistant Director did not know their understanding of the department?s federal reporting requirements was flawed.For the incomplete SF-425 final federal financial reports, the Assistant Director stated that he did not know the appropriate accounting basis, so he left them blank. For the incomplete MOA Annual Report, the Director and Assistant Director stated that the FAA approved the 2018 MOA Annual Report format; however, they indicated that this approval was verbal but were unable to provide any corroborating evidence of this format approval.EffectWithout accurate financial reporting, neither the state nor the federal awarding agency can make appropriate programmatic decisions based on the contents of the reports. By failing to submit applicable financial reporting to the FAA, the division is not in compliance with applicable reporting regulations, which prevents the FAA and ADO from compiling standard information about the grants. Moreover, without demonstrating that the State of Tennessee can be a responsible custodian of grant funding, the federal government may decide to revoke current funding or to decrease future funding.Additionally, federal regulations address actions that federal agencies may impose in cases of noncompliance. As noted in Title 2, Code of Federal Regulations, Part 200, Section 338, ?If a non-Federal entity fails to comply with Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions,? including, as described in Part 200, Section 207, ?Specific conditions,? ?Requiring additional, more detailed financial reports.?RecommendationThe Commissioner should ensure that management develops effective controls to achieve compliance with applicable federal reporting requirements; assigns employees to be responsible for ongoing monitoring of the risks and any mitigating controls; and acts if deficiencies occur. The Commissioner should ensure that department staff assess all significant risks, including the risks noted in this finding, in the department?s annual risk assessment.The Aeronautics Division Director and Assistant Director must submit complete and accurate applicable financial reports to the Federal Aviation Administration and/or the Memphis Airport District Office. The Director and Assistant Director should obtain detailed written confirmation of their reporting requirements from the FAA. The Director and Assistant Director should establish, document, and implement a formal policy and procedure that ensures staff correctly identify, complete, and submit reports for each applicable grant.Management?s CommentWe concur. The Aeronautics Division will work with the Federal Aviation Administration (FAA) to confirm and detail report requirements. This confirmation will include any exceptions necessary to accommodate the State Block Grant Program. Required reporting will be documented in a new MOA with the FAA. Data elements will be identified and collected for report development, formal policy and procedures will be written, and effective controls established with levels of review. Policy and procedures will be documented and approved by September 1, 2020.

Finding Number: 2019-038CFDA Number: 20.106Program Name: Airport Improvement ProgramFederal Agency: Department of TransportationState Agency: Department of TransportationFederal Award Identification Number: VariousFederal Award Year: VariousFinding Type: Material Weakness and NoncomplianceCompliance Requirement: Subrecipient Monitoring, Special Tests and ProvisionsRepeat Finding: N/APass-Through Entity: N/AQuestioned Costs: N/AThe department?s monitoring procedures were not sufficient to ensure its subrecipients complied with airport revenue spending requirementsBackground and CriteriaPursuant to Title 49, United States Code, Chapter 471, Section 33, ?the revenues generated by an airport that is the subject of Federal assistance may not be expended for any purpose other than the capital or operating costs of (1) the airport; (2) the local airport system; or (3) any other local facility that is owned or operated by the person or entity that owns or operates the airport that is directly and substantially related to the air transportation of passengers or property.? The Department of Transportation (the department) refers to the owner or operator of an airport as a ?sponsor? [subrecipient] and monitors these sponsors to ensure revenue is spent as noted above and is not diverted for an unallowed activity.The department, through its subrecipient monitoring process, is responsible for monitoring airport subrecipients to determine that revenue generated by airports is only used for capital and operating costs. In fiscal year 2019, the department?s procedures to monitor airport revenues by its External Audit staff were to 1) review all subrecipients? Single Audits (See Schedule of Findings and Questioned Costs for footnote) for any findings related to the Airport Improvement Program and 2) complete a Detail Review Guide for Aeronautics Division subrecipients that were selected for monitoring as part of the state?s Central Procurement Office?s Policy 2013-007 (See Schedule of Findings and Questioned Costs for footnote). During fiscal year 2019, there were 64 subrecipients of the Airport Improvement Program.Condition and CauseThe department?s monitoring process and procedures were not sufficient to ensure that subrecipients actually spent airport revenues in accordance with federal requirements. The External Audit Director believed that the department met compliance with federal requirements by reviewing subrecipients who had received a Single Audit. The External Audit Director, however, did not consider that all airports would not be tested for the revenue diversion compliance requirement unless the Airport Improvement Program met the major program threshold under the Single Audit.Additionally, based on our review of the department?s monitoring tool, the Detail Review Guide, the guide?s revenue diversion monitoring objective steps did not include testing of airport revenues and related spending of those revenues. As such, the department?s monitoring efforts based on the guide were ineffective. Furthermore, based on our review of completed Detail Review Guides, we found that External Audit staff relied on the airport sponsor?s attestation that airport revenues were used only for capital or operating costs. According to the External Audit Director, the department believed that the implemented processes that were in place appropriately addressed the risks associated with improper airport revenue use.Risk AssessmentWe reviewed the department?s December 2018 Financial Integrity Act Risk Assessment and determined that management did not identify any risks associated with ineffective monitoring activities and a mitigating control.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks,?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.EffectBecause the department does not have sufficient monitoring procedures, misuse of revenues by airport subrecipients could go undetected. If revenues are found to be diverted from capital and operating costs, penalties imposed for revenue diversion may be up to three times the amount of the revenues that were used in violation of the requirement.RecommendationThe department?s External Audit staff should ensure all airport sponsors receiving Airport Improvement Program financial assistance have used all airport revenues for permitted purposes. The External Audit Director should enhance the department?s subrecipient monitoring procedures to ensure there is no unlawful revenue diversion. In addition, the External Audit Director should update the monitoring tool to ensure it provides monitors with the relevant objectives. Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentWe concur. The department is aware that not all airports are subject to the single audit requirement and that not all single audits will have the Airport Improvement Program audited as a major program. While the department has monitoring processes in place to review airport revenue and costs, the department recognizes these processes were not consistently applied and sufficiently documented in monitoring work. In order to ensure that airports receiving Airport Improvement Program funding are reviewed to determine that revenues are used in accordance with federal requirements, the Department will review and update the Detail Review Guide for the Aeronautics Division by March 1, 2020, in order to establish a clear objective related to monitoring for revenue diversion and to document the review of airport revenues and costs in order to test for unlawful revenue diversion.

Finding Number: 2019-039CFDA Number: 20.106Program Name: Airport Improvement ProgramFederal Agency: Department of TransportationState Agency: Department of TransportationFederal Award Identification Number: VariousFederal Award Year: VariousFinding Type: Material Weakness and NoncomplianceCompliance Requirement: Special Test and ProvisionsRepeat Finding: N/APass-Through Entity: N/AQuestioned Costs: N/AThe Aeronautics Division?s management did not establish proper internal controls to ensure compliance with Davis-Bacon Act provisionsBackground and CriteriaThe Davis-Bacon Act requires laborers and mechanics employed by contractors or subcontractors on federal contracts to be paid no less than the prevailing wage rate that the U.S. Department of Labor has established for that locale. In order to ensure that contractors and subcontractors are paying workers the applicable prevailing wage rate, federal regulations stipulate that construction contracts in excess of $2,000 include Davis-Bacon Act provisions. Title 29, Code of Federal Regulations (CFR), Part 5, Section 5.5(a), states that prevailing wage rate clauses must be included ?in any contract in excess of $2,000 which is entered into for the actual construction, alteration and/or repair, including painting and decorating, of a public building or public work, or building or work financed in whole or in part from Federal funds. . . .?In addition, federal regulations stipulate that contractors and subcontractors must submit weekly certified payrolls to the Department of Transportation. According to Title 29, CFR, Section 3.4,Each weekly statement . . . shall be delivered by the contractor or subcontractor, within seven days after the regular payment date of the payroll period, to a representative of a Federal or State agency in charge at the site of the building or work, or, if there is no representative of a Federal or State agency at the site of the building or work, the statement shall be mailed by the contractor or subcontractor, within such time, to a Federal or State agency contracting for or financing the building or work.According to the Aeronautics Division?s Project Managers, they oversee compliance with the Davis-Bacon and related acts by documenting receipt of the certified payrolls and verifying the accuracy of the wage scale rates contained therein.We obtained and analyzed a list of construction contract expenditures for fiscal year 2019 that were from 143 unique projects. We took the listing of unique projects and created a population of each project paired with each week in a year; this resulted in a population of 7,579 possible payroll periods (See Schedule of Findings and Questioned Costs for footnote). We then selected a random and systematic sample of 60 payroll periods to test. If the week selected at random did not have any construction work performed, the next available payroll period with construction work was tested. We found that the 60 payroll periods tested resulted from 32 unique projects.Condition, Cause, and EffectOur testwork revealed that for 17 of the 32 projects tested (53%), the department did not include the prevailing wage rate or Davis-Bacon Act clause in the construction contracts. Based on inquiry with management, the contract template used did not include the Davis-Bacon Act provisions, and management believed a general Compliance with FAA Regulations provision was sufficient if there were specific provisions omitted.Because Aeronautics Division management did not include the prevailing wage rate provisions in the construction contracts, contractors were not aware that they must comply with these requirements.Additionally, we found that for 59 of the 60 payroll periods tested (98%), the department did not ensure compliance with federal and state wage rate requirements as noted below:? For 59 of the payroll periods tested, the department did not ensure the contractor complied with the 7-day submission deadline. The contractor either never submitted these payrolls or submitted them up to 406 days late.? For 58 of the payroll periods tested, the department did not adequately document and/or maintain records to verify when the payrolls were received.We found that the Aeronautics Division?s management did not have written policies and procedures to ensure Davis-Bacon Act compliance; therefore, staff did not always maintain or document the date the contractors and subcontractors submitted the certified payrolls and did not always include the Davis-Bacon Act clause in contracts. As a result, the division is unable to ensure compliance with 29 CFR 3.4, including withholding contractors? payments until all required certified payrolls are submitted. Management attributed the errors noted above to department staff lacking training and understanding of federal wage rate requirements.Risk AssessmentGiven the problems identified during our fieldwork, we also reviewed the department?s December 2018 Financial Integrity Act Risk Assessment and determined that management?s risk assessment did not identify the specific risks and mitigating controls associated with wage rate requirements.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7 of the Green Book, ?Identify, Analyze, and Respond to Risks?7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.RecommendationAeronautics Division management should ensure that all construction contracts in excess of $2,000 contain the prevailing wage rate provisions. Additionally, division management should ensure staff are properly trained on policies and procedures for maintaining documentation of communication with all contractors and subcontractors and for withholding payments until contractors or subcontractors submit certified payrolls as required. Division management should ensure that all contractors and subcontractors understand the contract requirement to submit certified payrolls within seven days of the payroll ending period.Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentWe concur. The Aeronautics Division has communicated to all airports and representative consulting firms that weekly certified payrolls must be submitted to the Aeronautics Division within seven days after the regular payment date of the payroll period. Additionally, following receipt of certified payrolls and prior to approving related invoices, TDOT Project Managers shall verify the accuracy of the wage scale rates contained therein. The TDOT Project Manager will return an invoice to the sponsor unpaid if they are not in compliance with Davis-Bacon provisions. For invoices in compliance with the provisions, the TDOT Project manager will upload the associated certified payrolls with each invoice containing labor performed by contractors or subcontractors. TDOT Program Monitors shall verify that the related payrolls have been uploaded prior to creating the Voucher in Edison. This provides two levels of review. These procedures were effective February 3, 2020. Policy and procedures will be updated to reflect these requirements by April 1, 2020.

Finding Number: 2019-040CFDA Number: 20.106Program Name: Airport Improvement ProgramFederal Agency: Department of TransportationState Agency: Department of TransportationFederal Award Identification Number: VariousFederal Award Year: VariousFinding Type: Significant DeficiencyCompliance Requirement: OtherRepeat Finding: 2018-043Pass-Through Entity: N/AQuestioned Costs: N/AAs noted in the prior audit, the Department of Transportation did not provide adequate internal controls in three specific areasThe Department of Transportation did not design and monitor internal controls in three specific areas. For two of the three areas, we are reporting internal control deficiencies that were reported from the prior audit because management?s corrective action was not sufficient. Ineffective implementation of internal controls increases the likelihood of errors, data loss, and inability to continue operations.Ineffective implementation and operation of internal controls increases the likelihood of errors, data loss, and the inability to continue operations. Pursuant to Standard 4.40 of the U.S. Government Accountability Office?s Government Auditing Standards, we omitted details from this finding because they are confidential under the provisions of Section 10-7-504(i), Tennessee Code Annotated. We provided management with detailed information regarding the specific conditions we identified, as well as the related criteria, causes, and our specific recommendations for improvement.We reviewed the department?s December 2018 Financial Integrity Act Risk Assessment and determined that management listed the risk of two areas; however, the department did not have an effective control to mitigate its risk. Also, management did not identify the risk of the third area and a mitigating control.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Principle 7, ?Identify, Analyze, and Respond to Risks,? of the Green Book,7.02 Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses.RecommendationManagement should ensure that these conditions are remedied by the prompt development and consistent implementation of internal controls in this area. Management should implement effective controls to ensure compliance with applicable requirements; assign staff the responsibility for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentsDepartment of TransportationWe concur in part. To address the identified control weaknesses, TDOT Divisions will work in partnership with other State agencies to ensure adherence to revised procedures and enforcement of policy requirements by holding accountable those who violate procedures that are in place. Risk assessments will be updated along with corresponding mitigating controls.Department of Finance and AdministrationWe concur. STS has revised certain processes and implemented additional internal controls to further mitigate the risk associated with this finding.

Finding Number: 2019-041CFDA Number: 15.605, 15.611, and 15.626Program Name: Fish and Wildlife ClusterFederal Agency: Department of the InteriorState Agency: Tennessee Wildlife Resources AgencyFederal Award Identification Number: TN-FWE-F18AF00534, TN-FWE-F18AF01139, andTN-FWE-F18AF01079Federal Award Year: 2018 and 2019Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: Subrecipient MonitoringRepeat Finding: N/APass-Through Entity: N/AQuestioned Costs: N/ASubrecipient monitoring needs improvementConditionThe Tennessee Wildlife Resources Agency?s overall subrecipient monitoring was not adequate to ensure compliance with federal regulations. Our testwork revealed three specific problems relating to the agency?s subrecipient monitoring:? The monitoring plan did not include a grant recipient that management believes is a subrecipient.? The amounts paid to subrecipients were not identified on the Schedule of Expenditures of Federal Awards (SEFA).? The agency did not document the monitoring activities that staff performed for the subrecipients.CriteriaTitle 2, Code of Federal Regulations (CFR), Part 200, Section 331 states that pass-through entities must monitor the subrecipients? activities as necessary to ensure the subawards are used for authorized purposes.2 CFR 200.510 requires the auditee to identify ?the total amount provided to subrecipients from each Federal program? on the SEFA. In addition, the SEFA instructions from the Department of Finance and Administration also include this requirement.The use of checklists and other tools to document monitoring activities helps ensure that staff performing monitoring activities examine the risks that management identified as being likely to occur and/or having a significant impact on operations.CauseManagement recently became aware of subrecipient monitoring requirements through a report from the Department of the Interior, Office of Inspector General, dated December 11, 2018, citing concerns with ?insufficient oversight of subawards.? Agency personnel stated that they did not document monitoring because of a lack of personnel. Management indicated that staff did not identify one of the subrecipients was due to an oversight. Management stated that they did not separately identify payments to subrecipients on the SEFA because they were unaware of how to report that information.EffectThe effectiveness of the agency?s subrecipient monitoring activities is reduced when staff do not include all identified subrecipients on the monitoring plan and do not document monitoring activities. Not identifying expenditures to subrecipients on the SEFA is noncompliance and incorrectly suggests that there were no subrecipient expenditures for the fish and wildlife cluster.RecommendationThe agency should document subrecipient monitoring activities and include all subrecipients on the monitoring plan. The agency should also identify amounts paid to subrecipients for each program using the SEFA instructions provided by the Department of Finance and Administration.Management?s CommentWe concur. The agency does not have a separate monitoring staff. Program managers will be assigned the responsibility of monitoring documentation. By June 30, 2020, checklists and instructions will be provided to program managers to improve monitoring documentation efforts. Management will ensure subrecipients are included in the monitoring plan. Management will separately identify payments to subrecipients on the FY20 SEFA; which will be completed by centralized accounting staff assigned by Finance & Administration. This process will be overseen by the departmental controller.

Finding Number: 2019-042CFDA Number: 15.605 and 15.611Program Name: Fish and Wildlife ClusterFederal Agency: Department of the InteriorState Agency: Tennessee Wildlife Resources AgencyFederal Award Identification Number: TN-FWE-F18AF00534Federal Award Year: 2017 and 2018Finding Type: Significant Deficiency and NoncomplianceCompliance Requirement: Program IncomeRepeat Finding: N/APass-Through Entity: N/AQuestioned Costs: $290,787.00The Tennessee Wildlife Resources Agency did not always use program income in accordance with federal requirements, resulting in questioned costs of $290,787.00ConditionAccording to records provided by the former Tennessee Wildlife Resources Agency (TWRA) controller, the agency received $1,399,707.22 of program income for the TN-FWE-F18AF00534 award. The agency used the entire amount to meet matching requirements. However, the Notice of Award allows only $1,000,000 to be used as matching funds. The remaining $399,707.22 should be used in accordance with the deduction method. Using the matching method on the $399,707.22, instead of the deduction method resulted in excess draws of $290,787.00 which is federal questioned cost.CriteriaThe Notice of Grant Award specifies that $1,000,000 of program income may be used in accordance with the matching method.Title 2, Code of Federal Regulations, Part 200, Section 307 outlines use of program income:(e) Use of program income. . . . When the Federal awarding agency authorizes the approaches in paragraphs (e)(2) and (3) of this section, program income in excess of any amounts specified must also be deducted from expenditures.(1) Deduction. Ordinarily program income must be deducted from total allowable costs to determine the net allowable costs. Program income must be used for current costs unless the Federal awarding agency authorizes otherwise. Program income that the non-Federal entity did not anticipate at the time of the Federal award must be used to reduce the Federal award and non-Federal entity contributions rather than to increase the funds committed to the project.(2) Addition. With prior approval of the Federal awarding agency . . . program income may be added to the Federal award by the Federal awarding agency and the non-Federal agency. The program income must be used for the purposes and under the conditions of the Federal award.(3) Cost sharing or matching. With prior approval of the Federal award agency, program income may be used to meet the cost sharing or matching requirement of the Federal award. The amount of the Federal award remains the same.CauseSince the grant requires two different treatments of program income and the treatment used can significantly affect the amount drawn from the federal government, TWRA needs to use ongoing procedures to monitor program income levels to ensure the agency is using program income correctly during the draw process. However, the staff responsible for draws stated that the levels of program income were not considered during the draw process, so at the time of the draw, the agency was not aware of the proper use of the program income.EffectThe agency overbilled the federal government $290,787.00 and overstated federal revenue by $290,787.00 on the state?s financial statements.RecommendationAs long as there is a possibility that different treatments of program income may be necessary during an award, TWRA should establish an ongoing process to monitor program income received to allow the agency to apply it properly during the draw process.Management?s CommentWe concur. TWRA is currently aware of the CFR ? 200.307, Program Income, and its requirement to revert to the deductive method once the grant application program income estimate has been met. Beginning July 1, 2019, the centralized accounting group began a monthly process of documenting and tracking the program income received and sending this information to the Federal Aid Coordinator. We will include the program income in Edison for tracking purposes. Per discussions with the U.S. Fish and Wildlife Service, they requested that we reduce our future draw by $290,787 on the current (FY20) comprehensive grant to account for the overdraw that occurred in FY19.

Finding Number: 2019-043CFDA Number: 10.553, 10.555, 10.556, 10.559, 10.558, 84.010, 84.027, 84.048, 84.173, and 84.367Program Name: Child Nutrition Cluster, Child and Adult Care Food Program, Title I Grants to Local Educational Agencies, Special Education Cluster, Career and Technical Education ? Basic Grants to States, Supporting Effective Instruction State GrantsFederal Agency: Department of Agriculture, Department of EducationState Agency: Department of Human Services, Department of EducationFederal Award Identification Number: 201818(17)N109945, 201919N109945, 175TN331N1099, 185TN331N1099, 185TN331N2020, 185TN340N1050, 195TN331N1099, 195TN331N2020, 195TN340N1050, S010A160042, S010A170042, S010A180042, H027A160052, H027A170052, H027A180052, H173A160095, H173A170095, H173A180095, V048A160042, V048A170042, V048A180042, S367A160040, S367A170040, and S367A180040Federal Award Year: 2016 through 2019Finding Type: Significant Deficiency (84.010, 84.027, 84.173, 84.048, and84.367), Material Weakness (10.553, 10.555, 10.556, 10.559, and 10.558)Compliance Requirement: Activities Allowed or Unallowed (Significant Deficiency - 84.010, 84.367, 84.048, 84.027, and 84.173; Material Weakness - 10.553, 10.555, 10.556, 10.559 and 10.558), Allowable Costs/Cost Principles (Significant Deficiency - 84.010, 84.367, 84.048, 84.027, and 84.173; Material Weakness - 10.553, 10.555, 10.556, 10.559 and 10.558)Cash Management (Significant Deficiency - 84.048; Material Weakness - 10.553, 10.555, and 10.556), Eligibility (Significant Deficiency - 84.010, 84.367, 84.048; Material Weakness - 10.553, 10.555, 10.556, 10.559 and 10.558), Matching, Level of Effort, Earmarking (Significant Deficiency - 84.010, 84.367, 84.048, 84.027, and 84.173), Period of Performance (Significant Deficiency - 84.027 and 84.173), Subrecipient Monitoring (Significant Deficiency - 84.010, 84.367, 84.048, 84.027, and 84.173), Special Tests and Provisions (Significant Deficiency - 84.010, 84.367; Material Weakness - 10.553, 10.555, and 10.556)Repeat Finding: 2018-046Pass-Through Entity: N/AQuestioned Costs: N/AAs noted in the last two audits, the Department of Education and the Department of Human Services did not ensure that the internal controls related to vendor-owned applications used for administering federal programs were appropriately designed and operating effectivelyBackgroundThe Tennessee Department of Education (TDOE) and the Tennessee Department of Human Services (DHS) have both contracted with Software as a Service (SaaS) information technology vendors to establish applications that the departments use to administer federal programs. These SaaS vendors contracted with Infrastructure as a Service (IaaS) information technology vendors to store and process application software and federal program data at data centers in the cloud that the IaaS vendors own and operate.One SaaS vendor developed and maintains the Tennessee: Meals, Accounting, and Claiming (TMAC) application and the Tennessee Information Payment System (TIPS) application used by TDOE and DHS, respectively. The departments use these computer applications to process eligibility applications and meal reimbursement claims for the Child Nutrition Cluster (See Schedule of Findings and Questioned Costs for footnote) and the Child and Adult Care Food Program. The applications also collect and house data that the departments use to determine eligibility, to report performance to the U.S. Department of Agriculture, and to maintain the source documentation for payments related to these programs.Two SaaS vendors developed and maintained TDOE?s ePlan application and the EasyIEP application. Local educational agencies use ePlan to apply for federal education grants; to submit and revise related plans (such as needs assessments and prioritized goals and strategies) and reports (such as expenditure tracking, the budget summary, and year-to-date expenditures); to report expenditures and request reimbursements; and to process budget amendments and plan revisions. The local educational agencies submit, and TDOE reviews and approves, applications, plans, and reports entirely within ePlan.Local educational agencies use EasyIEP to manage individual education plans (IEPs) for special needs students and to report data used in the Report of Children and Youth with Disabilities Receiving Special Education Under Part B of the Individuals with Disabilities Education Act.Prior Audit Results and Management?s Corrective ActionTMAC and TIPSIn the prior audit, both TDOE and DHS were unable to obtain System and Organization Controls (SOC) examination reports from the SaaS vendor for TMAC and TIPs covering the vendor?s controls because the vendor did not have a SOC examination completed. The SaaS vendor did provide the departments with the SOC 2 Type 2 (See Schedule of Findings and Questioned Costs for footnote) examination reports on the controls administered by the IaaS at the data center hosting sites; however, DHS management did not review the IaaS vendor?s SOC examination report until we asked for evidence of its review.ePlan and EasyIEPIn the prior audit, we found that TDOE did not document its review of ePlan?s IaaS vendor?s SOC examination report. In addition, TDOE did not obtain and review a SOC examination report that was available from the EasyIEP SaaS vendor until we asked for it during our audit. In addition, TDOE did not obtain and review a SOC report that was available from the vendor that administered controls at the data center hosting site.Management?s Corrective ActionBoth TDOE and DHS management concurred with the prior audit finding and stated they understood the importance of safeguarding third-party-managed systems, and moving forward, they will ensure their contracts include the appropriate internal controls language adopted by the state?s Central Procurement Office in September 2018.Furthermore, DHS will include a SOC 2 Type 2 requirement in any new contract. TDOE planned to establish a process to obtain and review the EasyIEP vendor?s SOC report annually after its completion. For TMAC and ePlan, TDOE planned to discuss with each vendor the appropriate way to obtain an understanding of internal controls of their systems.ConditionAlthough federal regulations require the departments to do so, as noted in the last two audits, TDOE and DHS management still did not evaluate 1) whether the SaaS and IaaS vendors implemented controls over processing and storing federal program data or 2) whether the implemented controls were designed and operating effectively to ensure the departments could properly administer federal programs. Except as noted below, management did not consistently evaluate internal controls either internally or by obtaining and reviewing an independent examination, such as a SOC examination report, which would adequately describe the SaaS and IaaS vendors? internal controls and the auditor?s opinion on the effectiveness of controls.TMAC and TIPSAs addressed in prior audit findings, the departments were again unable to obtain a SOC examination from the SaaS vendor for TMAC and TIPS covering the vendor?s controls that applied to the audit period. In August 2019, the SaaS vendor did provide both departments a commitment letter stating that the vendor would perform a SOC examination; however, this SOC examination did not commence until after the audit period and would take between 6 and 18 months to complete. In DHS?s contact extension with the SaaS vendor in November 2019, DHS required that the SaaS vendor be subject to an annual SOC 2 Type 2 examination. The SaaS vendor did obtain and submit to the departments the most current SOC 2 Type 2 examination report on the controls administered by the IaaS vendor at the data center hosting sites. Neither TDOE nor DHS management provided any evidence of review of the IaaS vendor?s SOC report.ePlanTDOE obtained from the SaaS vendor for ePlan a SOC 1 Type 2 examination that covered the period October 1, 2017, to September 30, 2018. In addition, the SaaS vendor obtained and submitted to TDOE a SOC report on the controls administered by the IaaS vendor at the data center hosting site. TDOE management reportedly reviewed the SaaS vendor?s SOC 1 examination report and the IaaS vendor?s SOC 2 examination report but did not document its review.EasyIEPTDOE obtained a SOC 2 examination report from the SaaS vendor for EasyIEP which applied to part of the audit period. TDOE management did not provide evidence of review of the SaaS vendor?s SOC report. In addition, the SaaS vendor did not obtain and submit to TDOE the most current SOC examination report on the controls administered by the IaaS vendor at the data center hosting site.Departments? Risk AssessmentsWe reviewed the Department of Education and the Department of Human Services? December 2018 Financial Integrity Act Risk Assessment and determined that management did not identify the risk of ineffective internal controls related to vendor-owned applications and a mitigating control.Criteria?Standards for Financial and Program Management,? Title 2, Code of Federal Regulations (CFR), Part 200, Section 303, ?Internal Controls,? states,The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.The U.S. Government Accountability Office?s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Sections 3.09 through 3.11 of the Green Book,Management develops and maintains documentation of its internal control system.Effective documentation assists in management?s design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. . . .Management documents internal control to meet operational needs. Documentation of controls, including changes to controls, is evidence that controls are identified, capable of being communicated to those responsible for their performance, and capable of being monitored and evaluated by the entity.?Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards,? 2 CFR 200.62, states,Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards:(a) Transactions are properly recorded and accounted for, in order to: (1) Permit the preparation of reliable financial statements and Federal reports; (2) Maintain accountability over assets; and (3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award;(b) Transactions are executed in compliance with: (1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program; and (2) Any other Federal statutes and regulations that are identified in the Compliance Supplement; and(c) Funds, property, and other assets are safeguarded against loss from unauthorized use or disposition.CauseThe state?s Central Procurement Office and both departments did not include language in the original contracts that required an independent examination of the SaaS vendor?s or the IaaS vendor?s internal controls. Additionally, the departments? procedures did not provide for a review of the SaaS vendor?s or the IaaS vendor?s internal controls to ensure they were appropriately designed and operating effectively, both prior to the awarding of the contracts and on an ongoing basis.DHS did obtain a contract extension with the SaaS vendor with provisions for a SOC report. However, this contract was not executed until the current contract expired in November 2019 and was not in effect during the audit period. Likewise, TDOE executed a new contract with the SaaS vendor for ePlan, but the contract was not effective until after the end of the audit period.EffectTMAC and TIPSTDOE and DHS processed approximately $397 million and $71 million, respectively, in reimbursements to Child Nutrition Cluster and Child and Adult Care Food Program subrecipients in fiscal year 2019. Failure to provide an independent examination of internal controls over TMAC and TIPS prevents the departments? managements from obtaining assurance that the reimbursements processed and information collected are accurate, complete, and comply with federal requirements. Because the SaaS vendor did not disclose sufficient information about its internal controls during fieldwork, we cannot conclude on whether controls were implemented or operating effectively. Furthermore, without knowing whether the SaaS vendor implemented any controls, we could not rely on the IaaS vendor?s examination report. We were unable to achieve our audit objectives related to critical system controls.ePlanFor the major programs supported by ePlan, TDOE approved approximately $587 million in reimbursement requests to subrecipients in ePlan for the major programs audited. Management?s failure to monitor internal controls over ePlan prevents management from ensuring that reimbursements processed and information collected are accurate, complete, and comply with federal requirements.EasyIEPFor the major program supported by EasyIEP, TDOE managed plans for approximately 185,683 students. Failure to monitor internal controls over EasyIEP prevents TDOE management from ensuring that information collected to comply with federal requirements is complete and accurate. In addition, ineffective controls could compromise the confidentiality of student information.RecommendationManagement of both TDOE and DHS should ensure that internal controls related to their applications are appropriately designed and operating effectively. In addition, for future contracts with contractors that will be hosting services in the cloud, the departments should obtain an understanding of internal controls and assess control risks associated with proper administration of the federal grants before awarding the contracts.Management should implement effective controls to address the risks noted in this finding and update the risk assessment as necessary; assign staff to be responsible for ongoing monitoring of the risks and mitigating controls; and take action if deficiencies occur.Management?s CommentDepartment of EducationWe concur. The department understands the importance of safeguarding state information in a third-party managed system. All new contracts have adopted the required language to obtain a SOC Type II audit from our vendors. For some vendors, we are awaiting the completion of their first SOC audits. Additionally, in the spirit of continuous improvement, the Department will review and modify its processes as necessary to catalog and evaluate SOC reports received from vendors.Department of Human ServicesWe concur.The Software as a Service (SaaS) vendor initiated a System and Organization Controls (SOC) review process in August 2019 which are the items noted in this finding and which was brought to the attention of the Comptroller?s Office. The Department also executed a contract extension with the SaaS vendor in November 2019 which prescribes the Department?s requirements for annual SOC Type II audits and reporting.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION