STATE OF CALIFORNIA

Period of Performance Federal Agency: U.S. Department of Labor Federal Program Title: Unemployment Insurance State Administering Department: Employment Development Department (EDD) ALN: 17.225 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 23A60UB00053; April 1, 2023 - May 22, 2025 23A60UB000081; April 1, 2023 - May 22, 2025 25A60UD000072; January 8, 2025 - January 8, 2028 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Subpart E – Cost Principles § 200.403 – Factors affecting allowability of costs Except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (h) Administrative closeout costs may be incurred until the due date of the final report(s). If incurred, these costs must be liquidated prior to the due date of the final report(s) and charged to the final budget period of the award unless otherwise specified by the Federal agency. All other costs must be incurred during the approved budget period. At its discretion, the Federal agency is authorized to waive prior written approvals to carry forward unobligated balances to subsequent budget periods. See § 200.308(g)(3). Condition: For awards with period of performance start dates occurring during the fiscal year, audit procedures included testing 40 transactions recorded in the general ledger during the initial month of the award. Based on these procedures, we identified five instances where a portion of payroll hours charged to the grant related to services performed prior to the approved period of performance start date of January 8, 2025. The total amount of payroll costs charged outside of the period of performance at the beginning of the award was $12,898. For awards with period of performance end dates occurring during the fiscal year, audit procedures included testing 40 transactions recorded in the general ledger during the final month of the award and subsequent to the period of performance end date. Based on these procedures, we identified 25 instances where a portion of payroll hours charged to the grants related to services performed after the approved period of performance end date of May 22, 2025. The total amount of payroll costs charged outside of the period of performance at the end of the award was $12,968. Questioned costs: $25,866 Context: See “Condition.” Cause: The condition resulted from controls over payroll cost allocation that were not performed with sufficient precision to ensure payroll charges were reviewed against authorized award start and end dates prior to being recorded to Federal awards. As a result, payroll costs incurred outside of the approved period of performance were not prevented or detected in a timely manner. Effect: The Department charged payroll costs to Federal awards outside the approved budget period, resulting in noncompliance with Federal requirements and a potential overstatement of allowable Federal expenditures. Repeat finding: No Recommendation: We recommend that management strengthen internal controls over payroll charging to Federal awards by implementing procedures to verify that project service dates fall within the authorized award dates before costs are charged to the grant. We also recommend the Department implement supervisory or system-based review controls to identify payroll charges posted outside the approved budget period and prevent such costs from being charged to Federal awards. These actions will help ensure payroll costs charged to federal awards are allowable, reduce the risk of unallowable charges, and improve compliance with Uniform Guidance. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Period of Performance Employment Development Department Employment Development Department (EDD) agrees that it did not have documented procedures or formal ongoing monitoring activities to adequately ensure that payroll charges to Federal awards fell within the authorized award dates before costs were charged to the grant. As a result, payroll costs were incurred outside of the approved period of performance and were not prevented or detected in a timely manner. EDD’s Unemployment Insurance Branch (UIB) established the procedures to be overseen by the UIB Budget Unit to ensure proper controls are in place moving forward and costs are appropriately charged to current and future grants. See artifacts titled ‘Project-Activity Code Establishment Procedure for DUA Revised 7.6.26’ and ‘UIAN DUA Template for Code Release Instructions’. To address the 25 instances where payroll hours were charged to a grant after the approved period of performance end date of May 22, 2025, the Department identified and removed those expenditures from the federal grant and reallocated them to an appropriate state funding source via ledger adjustments. Adjustments were processed during the month end closing process for May and June. As a result, all expenditures outside of the grant’s period of performance have been identified and appropriately removed from the federal grant. Estimated Implementation Date: Currently implemented Contact: - Diane Underwood, Division Chief, Unemployment Insurance Branch

Special Tests and Provisions Federal Agency: U.S. Department of Labor Federal Program Title: Unemployment Insurance State Administering Department: Employment Development Department (EDD) ALN: 17.225 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 24A55UI000061; October 1, 2023 - December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 – The Public Health and Welfare Chapter 7 – Social Security Subchapter III – Grants to States for Unemployment Compensation Administration § 503 – State laws (g) Recovery of unemployment benefit payments (1) A State shall deduct from unemployment benefits otherwise payable to an individual an amount equal to any overpayment made to such individual under an unemployment benefit program of the United States or of any other State, and not previously recovered. The amount so deducted shall be paid to the jurisdiction under whose program such overpayment was made. Any such deduction shall be made only in accordance with the same procedures relating to notice and opportunity for a hearing as apply to the recovery of overpayments of regular unemployment compensation paid by such State. 2025 California Code Unemployment Insurance Code - UIC Division 1 – Unemployment and Disability Compensation Part 1 – Unemployment Compensation Chapter 5 - Unemployment Compensation Benefits Article 1 – Eligibility and Disqualifications Section 1257 An individual is also disqualified for unemployment compensation benefits if: (a) He or she willfully, for the purpose of obtaining unemployment compensation benefits, either made a false statement or representation, including, but not limited to, using a false name, false social security number, or other false identification, with actual knowledge of the falsity thereof, or withheld a material fact in order to obtain any unemployment compensation benefits under this division. Article 4 - Overpayments Section 1375.1 If the director finds that an individual has been overpaid unemployment compensation benefits because he or she willfully, for the purpose of obtaining unemployment compensation benefits, either made a false statement or representation, with actual knowledge of the falsity thereof, or withheld a material fact, the director shall assess against the individual an amount equal to 30 percent of the overpayment amount. Assessments collected under this section shall be deposited in the following manner: (a) For penalty assessments established prior to October 22, 2013, 100 percent of the overpayment penalty amount in the Benefit Audit Fund. (b) For penalty assessments established on or after October 22, 2013, as follows: (1) 50 percent of the overpayment penalty amount in the Unemployment Trust Fund. (2) 50 percent of the overpayment penalty amount in the Benefit Audit Fund. Condition: Audit procedures included testing 60 overpayment case files to assess whether overpayments were properly established and whether penalties were applied in accordance with program requirements. Based on this testing, we identified one instance of noncompliance in which an overpayment met the criteria for the assessment of a penalty; however, the Department did not apply the required 30 percent penalty to the overpayment amount. Questioned costs: None Context: See “Condition.” Cause: The controls over the review and approval of overpayment determinations that were not performed with sufficient precision to ensure that cases meeting the criteria for penalty assessment were consistently identified and evaluated. Specifically, controls were not operating at a level precise enough to verify that overpayment cases involving willful misrepresentation or omission of material facts were subject to the required review for application of the 30 percent penalty prior to finalization. As a result, penalties required under program provisions were not consistently applied. Effect: As a result of controls not operating with sufficient precision to ensure proper evaluation of overpayment cases, penalties required under program provisions were not consistently assessed. This resulted in noncompliance with applicable requirements and increases the risk that overpayments may not be fully recovered, thereby reducing program collections and weakening the Department’s enforcement of program rules. Repeat finding: Yes – 2024-004 Recommendation: We recommend that management strengthen internal controls over overpayment determinations to ensure penalties are assessed when required. Specifically, the Department should implement procedures requiring personnel to evaluate whether an overpayment resulted from a willful false statement or representation, with actual knowledge of the falsity, or withholding of a material fact for the purpose of obtaining unemployment compensation benefits, and, when those conditions are present, apply the required 30 percent penalty before the overpayment determination is finalized. We also recommend the Department implement supervisory review or system-based controls to identify cases in which the facts support penalty assessment, but the penalty has not been applied. These actions will help ensure overpayments and related penalties are properly established, improve compliance with applicable requirements, and reduce the risk of underassessment. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Special Tests and Provisions Employment Development Department EDD has current policies, procedures, and training in place instructing employees to include applicable penalty amounts when establishing overpayments in the database. When the overpayment for the sample in question was established, the employee did not follow proper procedure to include the penalty. EDD accepts this oversight and is committed to reviewing its applicable policies and procedures to ensure they are clear, and the penalty requirements are emphasized. Regarding internal controls, EDD leverages a process known as the Field Office Basic Evaluation System (FOBES). This process includes a standardized form that is utilized by leadership to evaluate the quality of their employees’ work in a variety of processes, including overpayment processing. EDD continues to review and modernize the existing assessment form and FOBES process to ensure effectiveness and consistency while evaluating employee compliance with policies and procedures. EDD will enhance current procedures to outline the steps for reviewing claimant eligibility and applying disqualification penalties by: - Updating procedures in the various resources available for our determination false statement processes to include more comprehensive guidance. - Providing updated training for employees on any changes to procedures. Milestones: - Update UI Manuals by 8/14/2026. - Engage with UIB training team to update overpayment-related training and create a new refresher training by 8/14/2026. - Evaluate when a refresher training can be presented to determination trained employees by 8/14/2026. - Provide updated milestone to DOL by 9/30/2026. Estimated Implementation Date: September 2026 Contact: - Diane Underwood, Division Chief, Unemployment Insurance Branch

2024-004

Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Epidemiology and Laboratory Capacity for Program Infectious Diseases (ELC) State Administering Department: California Department of Public Health ALN: 93.323 Pass-Through Agency: Heluna Health Pass-Through Number(s): 95-2557063 Award Number and Period: NU50CK000539; August 1, 2019 – July 31, 2027 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Subpart E – Cost Principles § 200.403 – Factors affecting allowability of costs Except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (h) Administrative closeout costs may be incurred until the due date of the final report(s). If incurred, these costs must be liquidated prior to the due date of the final report(s) and charged to the final budget period of the award unless otherwise specified by the Federal agency. All other costs must be incurred during the approved budget period. At its discretion, the Federal agency is authorized to waive prior written approvals to carry forward unobligated balances to subsequent budget periods. See § 200.308(g)(3). Condition: For awards with period of performance end dates occurring during the fiscal year, audit procedures included testing transactions recorded in the general ledger during the final month and after of the award. We tested a sample of nineteen transactions totaling $2,643,649. Our testing identified three transactions, totaling $33,571, for which costs were incurred after the ending of the period of performance. Specifically, the award period end date on July 31, 2024; however, the associated costs were incurred between August 1, 2024 and February 28, 2025. Questioned costs: $66,833 ($33,571 related to the sample tested and $33,262 in the untested population). Context: See “Condition.” Cause: Controls over the review of expenditures at the end of the period of performance were not operating with sufficient precision to ensure that only allowable costs incurred before the award end date were charged to the appropriate Federal award. Specifically, management did not consistently apply procedures to verify that expenditures were recorded to the correct grant and within the applicable period of performance, resulting in the misclassification of post-award costs to the grant. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. Repeat finding: No Recommendation: The Department should strengthen controls over grant accounting by implementing procedures to ensure that expenditures are both charged to the correct grant and incurred within the applicable period of performance. This should include establishing controls to verify grant coding and transaction dates prior to posting or reimbursement, as well as enhancing supervisory review processes to detect and prevent misclassification of expenditures and the recording of unallowable post-award costs. Additionally, the Department should provide training to personnel responsible for grant accounting on proper grant coding and period-ofperformance requirements. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Period of Performance California Department of Public Health The California Department of Public Health (CDPH) agrees with this finding. CDPH is reviewing and updating existing processes and training materials to ensure expenditures are charged to the appropriate federal award and within the applicable period of performance. CDPH will coordinate with relevant staff in the Financial Management Division to strengthen grant monitoring during the award closeout process and will continue to review expenditures on an ongoing basis to prevent the misclassification of post-award costs. Estimated Implementation Date: June 2027 Contact: - Louise Karsten, Emergency Funding Coordination Branch Manager, Center for Preparedness and Response

Special Tests and Provisions Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Foster Care Title IV-E State Administering Department: California Department of Social Services (CDSS) ALN: 93.658 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401CAFOST; October 1, 2023- September 30, 2024 2501CAFOST; October 1, 2024- September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 45 – Public Welfare Subtitle B – Regulations Relating to Public Welfare Chapter XIII – Administration for Children and Families, Department of Health and Human Services Subpart G – The Administration on Children, Youth and Families, Foster Care Maintenance Payments, Adoption Assistance, and Child and Family Services Part 1356 – Requirements Applicable to Title IV-E § 1356.21 – Foster care maintenance payments program implementation requirements (a) Statutory and regulatory requirements of the Federal foster care program To implement the foster care maintenance payments program provisions of the title IV-E plan and to be eligible to receive Federal financial participation (FFP) for foster care maintenance payments under this part, a title IV-E agency must meet the requirements of this section, 45 CFR 1356.22, 45 CFR 1356.30, and sections 472, 475(1), 475(4), 475(5), 475(6), and for a Tribal title IV-E agency section 479(B)(c)(1)(C)(ii)(II) of the Act. (m) Review of payments and licensing standards In meeting the requirements of section 471(a)(11) of the Act, the title IV-E agency must review at reasonable, specific, time-limited periods to be established by the agency: (1) The amount of the payments made for foster care maintenance to assure their continued appropriateness, and that the amount made to a licensed or approved relative or kinship foster family home is the same as the amount that would have been made if the child was placed in a licensed or approved non-relative foster family home; § 1356.60 Fiscal requirements (title IV-E) (a) Federal matching funds for foster care maintenance and adoption assistance payments. (1) Federal financial participation (FFP) is available to title IV-E agencies under an approved title IV-E plan for allowable costs in expenditures for: (i) Foster care maintenance payments as defined in section 475(4) of the Act, made in accordance with §§ 1356.20 through 1356.30, section 472 of the Act. (c) Federal matching funds for other title IV-E agency administrative expenditures for foster care and adoption assistance under title IV-E Federal financial participation is available at the rate of fifty percent (50%) for administrative expenditures necessary for the proper and efficient administration of the title IV-E plan. The State's cost allocation plan shall identify which costs are allocated and claimed under this program. Condition: Audit procedures included testing 60 county claims for reimbursement and evaluating whether the payment rates applied were consistent with applicable foster care ratesetting guidance issued by the California Department of Social Services (CDSS). Of the 60 claims tested, 19 utilized rates that did not agree to the authorized rates in effect at the time the reimbursement was claimed. The differences between the rates applied and the authorized rates ranged from approximately 1% to 43%, indicating that reimbursement calculations were not consistently based on current statewide rate guidance. Foster care rate-setting guidance is updated periodically throughout the fiscal year and requires counties to implement revised rates as changes become effective. Testing indicated that counties did not consistently implement updated rates, and CDSS did not maintain monitoring procedures that operated with sufficient precision to verify the timely adoption of revised rates or to identify and correct the use of outdated rates. As a result, reimbursement claims were not consistently calculated using current authorized payment rates. Accordingly, CDSS did not maintain effective internal controls to ensure foster care reimbursement payments were consistently determined using current, authorized rates in accordance with applicable program requirements. Questioned costs: None Context: See “Condition.” Cause: CDSS did not maintain internal controls that operated with sufficient precision to ensure updated foster care rate-setting guidance was timely communicated, implemented, and consistently applied by counties. Specifically, monitoring controls were not designed or performed at a level capable of verifying county adoption of revised rates, identifying instances in which outdated rates continued to be used, or timely detecting and correcting rate discrepancies. As a result, changes to authorized statewide rates were not consistently incorporated into county reimbursement calculations, increasing the risk that payments were calculated using outdated rate schedules. Effect: The use of outdated rates resulted in foster care payments that were not consistently based on current authorized rate schedules, increasing the risk that expenditures charged to the program were misstated. Specifically, payments may have been overpaid or underpaid and were not consistently supported as allowable foster care maintenance or administrative expenditures. In addition, the lack of monitoring over implementation of updated rates reduces assurance that costs were properly calculated, applied, and classified in accordance with program requirements, affecting the reliability of reported expenditures. Repeat finding: No Recommendation: CDSS should strengthen internal controls over payment rate setting by establishing procedures to ensure that rate updates are timely implemented and consistently applied. This should include issuing clear implementation guidance to counties when rate changes occur, requiring confirmation of adoption of updated rates, and performing periodic monitoring or reconciliations to verify that payment rates used in county claims align with current authorized rate schedules. CDSS should also implement review controls to identify and correct instances where outdated rates are used before claims are finalized and reported. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Special Tests and Provisions California Department of Social Services CDSS agrees with this finding. CDSS Accounting has coordinated with the Foster Care Rates and Data Section to update internal procedures to post the annual Sharing Ratio All County Letter (ACL) by August 1st to counties prior to the August 20th deadline for the July Assistance Claims. This will ensure the counties have sufficient time to implement the approved sharing ratio for the current fiscal year. CDSS will now include a link to the current ACL with the monthly CA800 claim templates. After the claims are submitted, accounting will perform a review of the rates for the 58 counties to ensure the correct sharing ratio was applied. Estimated Implementation Date: September 2026 Contact: - Jay Lal, Chief, Accounting and Disbursement Bureau, Accounting and Fiscal Systems Branch, Finance and Accounting Division

Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care and Development Fund State Administering Department: California Department of Social Services (CDSS) ALN: 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2534CACCDD; October 1, 2024 – September 30, 2027 2534CACCDM; October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Subpart E – Cost Principles § 200.403 – Factors affecting allowability of costs Except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (h) Administrative closeout costs may be incurred until the due date of the final report(s). If incurred, these costs must be liquidated prior to the due date of the final report(s) and charged to the final budget period of the award unless otherwise specified by the Federal agency. All other costs must be incurred during the approved budget period. At its discretion, the Federal agency is authorized to waive prior written approvals to carry forward unobligated balances to subsequent budget periods. See § 200.308(g)(3). Condition: For awards with period of performance start dates occurring during the fiscal year, audit procedures included testing 60 transactions recorded in the general ledger during the initial month of the award. Based on these procedures, we identified 25 instances where a portion of costs charged to the grant related to services performed prior to the approved period of performance start date of October 1, 2024. The total amount of costs charged outside of the period of performance at the beginning of the award was $7,013,956. Questioned costs: $7,013,956 Context: See “Condition.” Cause: The condition is due to ineffective controls over aligning expenditure recording with the approved period of performance, including insufficient review procedures to ensure that costs are charged to Federal awards based on the actual service period rather than timing of payment or accrual. In addition, controls did not adequately prevent or detect the systematic charging of pre-award service costs to newly awarded funding sources. Effect: Charging costs incurred prior to the period of performance results in noncompliance with Federal requirements and causes expenditures to be improperly shifted to ineligible funding periods. This practice overstates allowable costs at the beginning of the award and increases the risk that funds are used for activities not authorized under the award, potentially resulting in questioned costs and required repayment. Repeat finding: No Recommendation: We recommend that management strengthen internal controls over costs charged to Federal awards by implementing procedures to ensure that expenditures are aligned with the approved period of performance. This should include controls to verify, prior to recording, that service periods and underlying activities fall within authorized award dates. In addition, the Department should implement supervisory and/or system-based controls to detect and prevent costs recorded outside the period of performance, including mechanisms that flag transactions associated with pre-award or post-expiration service periods and ensure that costs are consistently charged to the appropriate funding source based on when services were performed. These actions will help ensure that costs charged to Federal awards are allowable and properly timed, reduce the risk of unallowable charges, and improve compliance with period of performance requirements under Uniform Guidance. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Period of Performance California Department of Social Services CDSS agrees with this finding. State operations costs incurred from July through September 2024 were incorrectly charged to FFY 2025 when the federal drawdown was processed in October, rather than being charged to FFY 2024. The issue identified in the audit period has been corrected in the ACF-696 report submitted on April 30, 2026. Upon identifying the error, CDSS provided additional training to staff and added a second level of supervisory review to ensure the appropriate federal fiscal year is applied when processing drawdowns that cross both the state and federal fiscal years. These corrective actions are intended to prevent similar misclassifications and strengthen compliance with federal reporting requirements. Estimated Implementation Date: July 2026 Contact: - Rosali Bautista, Chief, Accounting and Reporting Bureau, Accounting and Fiscal Systems Branch, Finance and Accounting Division

Special Tests and Provisions Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care and Development Fund State Administering Department: California Department of Social Services (CDSS) ALN: 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2434CACCDD; October 1, 2023 - September 30, 2026 2434CACCDF; October 1, 2023 - September 30, 2026 2434CACCDM; October 1, 2023 - September 30, 2025 2534CACCDD; October 1, 2024 - September 30, 2027 2534CACCDF; October 1, 2024 - September 30, 2027 2534CACCDM; October 1, 2024 - September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 – Public Welfare Subtitle A – Department of Health and Human Services Subchapter A – General Administration Part 98 – Child Care and Development Fund Subpart E – Program Operations (Child Care Services)—Lead Agency and Provider Requirements § 98.40 Compliance with applicable State and local regulatory requirements (a) Lead Agencies shall: (1) Certify that they have in effect licensing requirements applicable to child care services provided within the area served by the Lead Agency; (2) Describe in the Plan exemption(s) to licensing requirements, if any, for child care services for which assistance is provided, and a demonstration for how such exemption(s) do not endanger the health, safety, or development of children who receive services from such providers. Lead Agencies must provide the required description and demonstration for any exemptions based on: (i) Provider category, type, or setting; (ii) Length of day; (iii) Providers not subject to licensing because the number of children served falls below a Statedefined threshold; and (iv) Any other exemption to licensing requirements; and (3) Provide a detailed description in the Plan of the requirements under paragraph (a)(1) of this section and of how they are effectively enforced. § 98.41 Health and safety requirements (a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to child care providers of services for which assistance is provided under this part. Such requirements, which are subject to monitoring pursuant to § 98.42, shall: (1) Include health and safety topics consisting of, at a minimum: (i) The prevention and control of infectious diseases (including immunizations); with respect to immunizations, the following provisions apply: (A) As part of their health and safety provisions in this area, Lead Agencies shall assure that children receiving services under the CCDF are age-appropriately immunized. Those health and safety provisions shall incorporate (by reference or otherwise) the latest recommendation for childhood immunizations of the respective State, territorial, or tribal public health agency. (B) Notwithstanding this paragraph (a)(1)(i), Lead Agencies may exempt: (1) Children who are cared for by relatives (defined as grandparents, great grandparents, siblings (if living in a separate residence), aunts, and uncles), provided there are no other unrelated children who are cared for in the same setting. (2) Children who receive care in their own homes, provided there are no other unrelated children who are cared for in the home. (3) Children whose parents object to immunization on religious grounds. (4) Children whose medical condition contraindicates immunization. (C) Lead Agencies shall establish a grace period that allows children experiencing homelessness and children in foster care to receive services under this part while providing their families (including foster families) a reasonable time to take any necessary action to comply with immunization and other health and safety requirements. (1) The length of such grace period shall be established in consultation with the State, Territorial or Tribal health agency. (2) Any payment for such child during the grace period shall not be considered an error or improper payment under subpart K of this part. (3) The Lead Agency may also, at its option, establish grace periods for other children who are not experiencing homelessness or in foster care. (4) Lead Agencies must coordinate with licensing agencies and other relevant State, Territorial, Tribal, and local agencies to provide referrals and support to help families of children receiving services during a grace period comply with immunization and other health and safety requirements; (ii) Prevention of sudden infant death syndrome and use of safe sleeping practices; (iii) Administration of medication, consistent with standards for parental consent; (iv) Prevention and response to emergencies due to food and allergic reactions; (v) Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; (vi) Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; (vii) Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a man-caused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5195a(a)(1)) that shall include procedures for evacuation, relocation, shelter-in-place and lock down, staff and volunteer emergency preparedness training and practice drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions; (viii) Handling and storage of hazardous materials and the appropriate disposal of bio contaminants; (ix) Appropriate precautions in transporting children, if applicable; (x) Pediatric first aid and cardiopulmonary resuscitation; (xi) Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph (e) of this section; and (xii) May include requirements relating to: (A) Nutrition (including age-appropriate feeding); (B) Access to physical activity; (C) Caring for children with special needs; or (D) Any other subject area determined by the Lead Agency to be necessary to promote child development or to protect children's health and safety. (2) Include minimum health and safety training on the topics above, as described in § 98.44. § 98.42 Enforcement of licensing and health and safety requirements (a) Each Lead Agency shall certify in the Plan that procedures are in effect to ensure that child care providers of services for which assistance is made available in accordance with this part, within the area served by the Lead Agency, comply with all applicable State, local, or tribal health and safety requirements, including those described in § 98.41. (b) Each Lead Agency shall certify in the Plan it has monitoring policies and practices applicable to all child care providers and facilities eligible to deliver services for which assistance is provided under this part. The Lead Agency shall: (1) Ensure individuals who are hired as licensing inspectors are qualified to inspect those child care providers and facilities and have received training in related health and safety requirements appropriate to provider setting and age of children served. Training shall include, but is not limited to, those requirements described in § 98.41, and all aspects of the State, Territory, or Tribe's licensure requirements; (2) Require inspections of child care providers and facilities, performed by licensing inspectors (or qualified inspectors designated by the Lead Agency), as specified below: (i) For licensed child care providers and facilities, (A) Not less than one pre-licensure inspection for compliance with health, safety, and fire standards, and (B) Not less than annually, an unannounced inspection for compliance with all child care licensing standards, which shall include an inspection for compliance with health and safety, (including, but not limited to, those requirements described in § 98.41) and fire standards (inspectors may inspect for compliance with all three standards at the same time); and (ii) For license-exempt child care providers and facilities that are eligible to provide services for which assistance is made available in accordance with this part, an annual inspection for compliance with health and safety (including, but not limited to, those requirements described in § 98.41), and fire standards; (iii) Coordinate, to the extent practicable, monitoring efforts with other Federal, State, and local agencies that conduct similar inspections. (iv) The Lead Agency may, at its option: (A) Use differential monitoring or a risk-based approach to design annual inspections, provided that the contents covered during each monitoring visit is representative of the full complement of health and safety requirements; (B) Develop alternate monitoring requirements for care provided in the child's home that are appropriate to the setting; and (3) Ensure the ratio of licensing inspectors to such child care providers and facilities is maintained at a level sufficient to enable the State, Territory, or Tribe to conduct effective inspections on a timely basis in accordance with the applicable Federal, State, Territory, Tribal, and local law; (4) Require child care providers to report to a designated State, Territorial, or Tribal entity any serious injuries or deaths of children occurring in child care. (c) For the purposes of this section and § 98.41, Lead Agencies may exclude grandparents, great grandparents, siblings (if such providers live in a separate residence), aunts, or uncles, from the term “child care providers.” If the Lead Agency chooses to exclude these providers, the Lead Agency shall provide a description and justification in the CCDF Plan, pursuant to § 98.16(l), of requirements, if any, that apply to these providers. Condition: The CDSS has not established health and safety monitoring procedures to ensure licensed-exempt providers serving children who receive subsidies comply with all applicable health and safety requirements. Review of oversight results issued by the grantor agency identified deficiencies in multiple health and safety areas for license-exempt providers. Questioned costs: None Context: See “Condition.” Cause: The condition is due to delays in finalizing and implementing a comprehensive health and safety monitoring process for license-exempt providers. Although CDSS has initiated efforts to develop monitoring procedures for license-exempt contractors, full implementation is dependent on statutory and budgetary actions, which have delayed the Department’s ability to establish, implement, and enforce required health and safety standards, training, and inspection requirements across all applicable provider types. As a result, controls were not fully designed or operating to ensure consistent compliance with CCDF health and safety requirements during the audit period. Effect: Failure to implement and enforce required health and safety standards increases the risk that children receiving CCDF-funded services are in environments that do not meet minimum Federal health and safety requirements. In addition, the lack of consistent monitoring and enforcement reduces the Department’s ability to detect and remediate noncompliance, resulting in program-wide noncompliance and increased risk of Federal sanctions or funding implications. Repeat finding: Yes – 2024-016 Recommendation: We recommend that CDSS strengthen internal controls over health and safety compliance by establishing and fully implementing comprehensive health and safety standards across all applicable provider types, including license-exempt providers. The Department should also ensure that required pre-service and ongoing training requirements are clearly defined, implemented, and tracked for all required health and safety topics. In addition, CDSS should enhance its monitoring and inspection processes to ensure required annual inspections, including unannounced inspections where applicable, are performed timely and consistently documented. These actions will help ensure that providers receiving CCDF funds comply with Federal health and safety requirements, improve the Department’s ability to identify and correct noncompliance, and strengthen overall program integrity and child safety. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Special Tests and Provisions California Department of Social Services CDSS agrees with this finding. This was identified in the previous audit. CDSS Child Care and Development Division is working towards compliance with federal requirements for license-exempt health and safety monitoring with an anticipated completion date of July 1, 2029, assuming additional resources are secured. This plan has been outlined in Appendix A of the Federal Fiscal Year 2025-27 State Plan for California with Administration of Children and Families (State Plan). The State Plan can be provided upon request. Estimated Implementation Date: July 2029 Contact: - Jeff Fowler, Child Care Administration Bureau Chief Central Operations Branch, Child Care and Development Division

2024-016

Special Tests and Provisions Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care and Development Fund State Administering Department: California Department of Social Services (CDSS) ALN: 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2434CACCDD; October 1, 2023 - September 30, 2026 2434CACCDF; October 1, 2023 - September 30, 2026 2434CACCDM; October 1, 2023 - September 30, 2025 2534CACCDD; October 1, 2024 - September 30, 2027 2534CACCDF; October 1, 2024 - September 30, 2027 2534CACCDM; October 1, 2024 - September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). § 200.329 Monitoring and reporting program performance (a) Monitoring by the recipient and subrecipient The recipient and subrecipient are responsible for the oversight of the Federal award. The recipient and subrecipient must monitor their activities under Federal awards to ensure they are compliant with all requirements and meeting performance expectations. Monitoring by the recipient and subrecipient must cover each program, function, or activity. See also § 200.332. Title 45 – Public Welfare Subtitle A – Department of Health and Human Services Subchapter A – General Administration Part 98 – Child Care and Development Fund Subpart B – General Application Procedures § 98.11 – Administration under contracts and agreements Lead Agencies have broad authority to administer and operate the CCDF program through other governmental, nongovernmental, or public or private local agencies; however, the Lead Agency must retain overall responsibility for the administration of the program and ensure that administrative and implementation responsibilities undertaken by agencies other than the Lead Agency are governed by written agreements specifying the mutual roles and responsibilities of the Lead Agency and other agencies in meeting CCDF requirements. The approved FFY 2025–2027 CCDF State Plan identifies CDSS as the Lead Agency and states that activities performed by agencies other than CDSS are governed through written agreements, including contracts and grant award notifications, that include required elements such as tasks to be performed, schedules for completing tasks, budgets, and performance measures. The State Plan further describes CDSS’s monitoring process for contractors, including standard review instruments, corrective action follow-up, fiscal and program reporting, and contractor review requirements. Condition: Audit procedures included testing a sample of 60 CCDF contractors to determine whether CDSS performed on-site monitoring visits in accordance with the contractor review cycle specified in the approved State Plan and related monitoring procedures. Of the 60 contractors tested, 2 contractors did not receive an on-site monitoring visit within the required review period. Specifically, the contractors had not received an on-site visit within four years, although the State Plan and related monitoring procedures require contractor reviews to be performed within a three-year cycle. As a result, CDSS did not consistently perform required monitoring procedures within the timeframe established for oversight of CCDF contractors. Questioned costs: None Context: See “Condition.” Cause: CDSS did not maintain internal controls that operated with sufficient precision to ensure all CCDF contractors were scheduled for and received required on-site monitoring visits within the established review cycle. Specifically, monitoring controls were not designed or performed at a level sufficient to identify overdue contractor reviews, track the status of required visits, and ensure timely completion of on-site monitoring for all applicable contractors. Effect: Failure to perform timely on-site monitoring visits reduces CDSS’s ability to determine whether contractors are operating in accordance with written agreements, State Plan requirements, and applicable CCDF program requirements. Untimely monitoring increases the risk that contractor noncompliance, performance deficiencies, or unsupported program activities are not identified and corrected promptly, which may affect CDSS’s ability to retain effective oversight and overall responsibility for the CCDF program. Repeat finding: No Recommendation: We recommend that CDSS strengthen internal controls over CCDF contractor monitoring by implementing procedures to ensure all contractors are scheduled for and receive required on-site monitoring visits within the review cycle established in the approved State Plan and related monitoring procedures. These procedures should include maintaining a complete monitoring schedule, tracking the date of each contractor’s last review, identifying upcoming and overdue reviews, and requiring documented supervisory review to ensure monitoring visits are completed timely. CDSS should also establish a process to periodically reconcile the monitoring schedule to the population of active CCDF contractors and promptly follow up on overdue reviews. These controls should help ensure CDSS performs contractor oversight consistently, documents compliance with written agreement monitoring requirements, and retains effective responsibility for CCDF administration. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report. Response to views of responsible officials: We acknowledge CDSS's response regarding resource constraints, risk-based prioritization, and its interpretation of the "as resources permit" language in Title 5, California Code of Regulations, Section 18023(b). However, the approved State Plan and related monitoring procedures in effect during the audit period established a three-year review cycle for contractor monitoring. Audit testing identified that 2 of 60 CCDF contractors did not receive an on-site monitoring visit for more than four years. While CDSS employed a risk-based approach to prioritize monitoring activities, the required reviews were not completed within the established review cycle for the contractors identified in our testing. Accordingly, the finding is based on CDSS's failure to consistently perform monitoring reviews within the established review cycle and the lack of controls to ensure overdue reviews were identified, tracked, and completed timely. Therefore, we continue to conclude that the finding is valid as presented.

Special Tests and Provisions California Department of Social Services CDSS agrees in part and disagrees in part with this finding. Section 10.1 of the State Plan, “Effective Internal Controls” which establishes the review cycle for CDSS’s monitoring activities inadvertently contains a conflicting timing requirement for contractor reviews. This finding is based upon the language in subsection 10.1.2 “Fiscal management practices,” which states that CDSS must conduct contract monitoring review of each contracting agency every three years. However, subsection 10.1.1 “Organizational structure to support integrity and internal controls,” and the related regulation in Title 5 California Code of Regulations Section 18023(b), both require onsite monitoring every three years, or as resources permit. Importantly, CDSS conducts an annual risk assessment and schedules monitoring visits based on both contractor risk level and time since previous review. Staffing constraints required prioritizing higher-risk contractors, which resulted in two lower-risk contractors not receiving onsite monitoring within a threeyear review cycle. This was not due to a lack of internal controls, but a strategic decision based on resource levels, level of risk, and within the allowable parameters of Subsection 10.1.1 of the State Plan. CDSS will correct this section within the State Plan to ensure that it is clear that all contract monitoring is subject to the same every three years, or as resources permit, requirement. Estimated Implementation Date: October 2027 Contact: - Jeff Fowler, Child Care Administration Bureau Chief Central Operations Branch, Child Care and Development Division

Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster State Administering Department: Department of Health Care Services (DHCS) ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2405CA5MAP; July 1, 2024 – September 30, 2024 2405CA5ADM; October 1, 2024 – December 31, 2024 2505CA5MAP; January 1, 2025 – March 31, 2025 2505CA5ADM; April 1, 2025 – June 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912, state Medicaid agencies must establish and adhere to timeliness and performance standards for determining and redetermining eligibility. These standards are intended to ensure that eligibility decisions are made promptly and accurately, and that benefits are not continued beyond the period of eligibility. Condition: Audit procedures included a review of 60 Medicaid beneficiaries associated with currently eligible participants to evaluate compliance with eligibility requirements, including the timeliness of redeterminations and the propriety of benefits issued. Based on our testing, instances of noncompliance were identified related to both the timeliness of eligibility redeterminations and the appropriateness of benefits paid: - For eleven of the 60 beneficiaries tested, required eligibility redeterminations were not completed within the prescribed timeframes. - For three of the 60 beneficiaries tested, benefits were provided during periods in which the individuals did not meet eligibility requirements. These exceptions indicate that controls over the monitoring and completion of required redeterminations, as well as controls to ensure benefits are issued only to eligible individuals, were not operating effectively. Questioned costs: $18,468 Context: See “Condition.” Cause: The exceptions identified were due to internal controls over the eligibility determination and redetermination processes not operating with sufficient precision to ensure consistent compliance with program requirements. Specifically, controls were not performing at a level of precision necessary to consistently enforce DHCS guidance, ensure timely completion of required verification procedures, and detect and correct errors through supervisory review. As a result, inaccuracies in eligibility determinations were not consistently prevented or identified, contributing to improper enrollment of ineligible beneficiaries. Effect: Failure to properly determine eligibility and terminate benefits in the eligibility system may result in individuals receiving improper benefit payments and noncompliance with grant award terms and conditions. Repeat finding: Yes – 2024-011 Recommendation: DHCS should enhance its procedures for monitoring and resolving MEDS alerts, ensuring timely review and action on system-generated discrepancies. Additionally, staff should receive ongoing training on the importance of accurately updating eligibility requirements in CalSAWS to ensure the prevention of inappropriate continuation of benefits. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Eligibility California Department of Health Care Services DHCS is currently in the process of reevaluating its Medi-Cal Eligibility Data System (MEDS) monitoring process by taking the following steps: Research and Data Collection - DHCS will initiate the revised MEDS alert hierarchy process by conducting targeted research. This effort will include obtaining the total number of records associated with each MEDS Alert, encompassing the entire universe of MEDS alerts. - As part of this research, DHCS will review the highest volume alerts and identify the root causes. County Staff Workgroup: DHCS will form a workgroup with County Staff to collaborate on refining the MEDS Alerts process. The objectives of this workgroup are to: - Determine whether certain alerts can be streamlined to improve efficiency. - Assess if additional functionality can be added to CalSAWS to address issues that lead to high volume alerts. - Develop strategies to ensure counties have sufficient support to resolve MEDS alerts both accurately and timely. Hierarchy Revision and Implementation - DHCS will use the findings from the research phase and the input provided by the workgroup to revise the MEDS Alerts Hierarchy and ACWDL. - The Program Review Branch will update the BI tool to incorporate all MEDS alerts that affect eligibility, and pertinent high-volume alerts. - We are considering amendments to WIC section 14154.5 to reflect any changes in calculating performance standards for MEDS alerts. - DHCS will postpone posting MEDS Alerts performance data to the public facing dashboard until the end of this process. DHCS does not resolve MEDS Alerts. The purpose of the above process is to reduce the number of MEDS alerts created because of caseworker action by providing additional guidance to counties and potentially adding functionality to CalSAWS that would reduce the number of alerts created due to system discrepancies. This is anticipated to reduce the number of MEDS alerts, which would ease the county staff workload and allow counties to better manage the MEDS alerts workload. Focused reviews will continue to assist the department in identifying counties that do not act upon newly reported information that negatively impacts eligibility. DHCS will require counties to submit a corrective action plan and emphasize implementing ongoing trainings to mitigate inappropriate continuation of benefits. DHCS will continue to monitor progress until the identified issues no longer persist. Estimated Implementation Date: June 2027 Contact - Sarah Crow, Medi-Cal Eligibility Division, Division Chief - Harold Higgins, Medi-Cal Eligibility Division, Branch Chief - Amy Halim, Medi-Cal Eligibility Division, Section Chief

2024-011

Special Tests and Provisions Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster State Administering Department: California Department of Public Health (CDPH) ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2405CA5MAP; July 1, 2024 – September 30, 2024 2405CA5ADM; October 1, 2024 – December 31, 2024 2505CA5MAP; January 1, 2025 – March 31, 2025 2505CA5ADM; April 1, 2025 – June 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, per Centers for Medicare and Medicaid Services (CMS) guidance issued in “Admin Info: 25-03- All” letter dated October 23, 2024, Surveys for Skilled Nursing Facilitates (SNF) and Intermediate Care Facilities (ICF) surveys should be conducted in the following timeframes: - Nursing home recertification health surveys are conducted within the maximum time interval of 15.9 months. - Active Intermediate care facility for individuals with intellectual disabilities (ICF/IID) that have been surveyed within the required maximum interval of 15.9 months. Condition: During our audit procedures, we reviewed sixty surveys related to provider recertification under the Medicaid program. We identified that thirty Skilled Nursing Facilities and seventeen Intermediate Care Facilities were not conducted in the required timeframe. Questioned costs: None Context: See “Condition.” Cause: Resource and staffing constraints limited CDPH’s capacity, as the survey agency supporting DHCS’s Medicaid provider certification process, to conduct all required recertification surveys within federally mandated timeframes. Consequently, surveys were prioritized based on risk and need, resulting in some SNF and ICF/IID surveys not being completed within the required 15.9-month interval. Effect: Failure to conduct required recertification surveys timely may result in noncompliance with federal Medicaid provider health and safety requirements and reduces assurance that participating facilities continue to meet standards for Medicaid participation. Repeat finding: Yes – 2024-012 Recommendation: DHCS, in coordination with CDPH, should strengthen oversight controls to ensure timely completion of SNF and ICF/IID surveys. Procedures should include tracking required survey due dates, monitoring surveys approaching or exceeding the 15.9-month interval, documenting prioritization decisions when capacity constraints exist, and performing supervisory review to verify that overdue surveys are identified and remediated timely. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Special Tests and Provisions California Department of Public Health Public Health concurs with the finding that a portion of the federally-required Skilled Nursing Facility (SNF) and Intermediate Care Facility (ICF) recertification surveys were not completed within the 15.9-month requirement. Public Health’s ability to meet survey workload was hindered by the nearly three-month federal shutdown, reduced staffing capacity due to budget constraints, and competing high-priority workloads. Surveys that were overdue in FFY 2024-25 have been prioritized in FFY 2025-26, focusing first on facilities presenting the highest risk and those with the longest intervals since their last survey. Public Health will continue prioritizing the highest-risk federal workload within the limits of available staffing and budget. The federal contract allotment has remained stagnant despite increased expectations, and reductions in state funding during SFY 2024-25 and continuing through SFY 2025-26 limit Public Health’s ability to backfill gaps with state resources. As a result, Public Health will focus surveyor efforts on Immediate Jeopardy (IJ) investigations, quality-of-care issues, access-to-careconcer, and Tier 1 workload (including SNFs and ICFs). This approach aligns with CMS’s shift toward prioritizing IJ and high-risk intakes over lower-tier recertification surveys. Public Health remains committed to completing all federal workload assignments and will strive to meet Mission and Priorities Document (MPD) and State Performance Standards Systems (SPSS) requirements to the fullest extent possible given current staffing and budget limitations. Estimated Implementation Date June 2027 Contact - Andy Barbusca, State Surveyors Branch Chief, Center for Health Care Quality, California Department of Public Health

2024-012

Activities Allowed and Unallowed Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Children’s Health Insurance Program (CHIP) (Not a Major Program) State Administering Department: Department of Health Care Services (DHCS) ALN: 93.767 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305CA3002; October 1, 2022- September 30, 2024 2405CA5021; October 1, 2023- September 30, 2025 2505CA5021; October 1, 2024- September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included a review of 40 CHIP beneficiaries associated with currently eligible participants. Of the 40 beneficiaries tested, two were assigned an obsolete aid code. While the underlying participant eligibility appeared to meet program criteria, the aid code is a key data element used in determining reimbursement rates. As a result, payments for these beneficiaries were calculated using an incorrect rate, leading to improper payment amounts. Questioned costs: $14,910,485 (known costs $1,850) Context: See “Condition.” Cause: The control designed to detect and correct invalid or obsolete aid codes did not operate at a sufficient level of precision to identify these errors. Specifically, an automated system interface between CalSAWS and MEDS does not consistently update or prevent the use of discontinued aid codes. Effect: Use of obsolete aid codes may result in reimbursement calculations using incorrect rates, leading to improper payment amounts and noncompliance with federal award terms and conditions. Because aid codes drive reimbursement rate determinations, control deficiencies over obsolete or invalid aid codes increase the risk that expenditures are not calculated accurately or supported by current program requirements. Repeat finding: Yes – 2024-010 Recommendation: DHCS should strengthen controls over aid code maintenance and validation to ensure obsolete or invalid aid codes are not used in reimbursement calculations. Procedures should include periodic reviews of aid code tables, reconciliation of active aid codes between CalSAWS and MEDS, monitoring of system interface exceptions, and documented supervisory review to identify and correct obsolete aid codes before payments are calculated. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Activities Allowed and Unallowed California Department of Health Care Services DHCS reinstated county performance standards effective June 1, 2024, through Medi-Cal Eligibility Division Letter (MEDIL 24-12) and issued All County Welfare Directors Letter (ACWDL) 24-17 on November 25, 2024. ACWDL notified counties DHCS would leverage data to monitor application processing times. The data will be used to select counties for focused reviews targeting application processing times and procedures to ensure counties are performing eligibility determinations timely and accurately. DHCS has implemented multiple monitoring activities to address the recommendation and strengthen oversight of county processing of Medi-Cal applications. In May 2024, DHCS issued Medi-Cal Eligibility Division Letter (MEDIL) 24-12, ending the temporary hold harmless provisions and resumed standard county performance accountability. Subsequently, DHCS issued ACWDL 24-17, which established the Department's transition to using system-generated eligibility data, rather than county self-certification, to monitor application timeliness. Under this approach, DHCS evaluates county performance using statewide eligibility data, publishes application timeliness performance through statewide dashboards, and uses the data to identify counties for focused reviews. Focused reviews evaluate both the timeliness and accuracy of county eligibility determinations. Counties that do not meet established performance expectations are subject to corrective actions consistent with the Welfare and Institutions Code (WIC) section 14154 performance monitoring framework, including the application of statutory performance corrective action plans (CAPS), and financial penalties where applicable. Collectively, these actions establish an ongoing oversight process that enables DHCS to monitor county compliance with Medi-Cal application timeliness requirements, identify performance issues, require counties to implement corrective actions to address any deficiencies identified through focused reviews, and promote continued improvement in the timely and accurate processing of Medi-Cal applications. In 2025, DHCS issued MEDIL I 25-19, Reinstatement of the Aid Code Clean-Up Effort, which reinstated the Department's statewide process for identifying beneficiaries assigned to obsolete pre-Affordable Care Act (ACA) aid codes, transitional aid codes, or other records that may require reevaluation of eligibility. As part of this effort, DHCS provides counties with standardized reports on a bi-monthly basis to assist in identifying records that require review and action. Counties are required to review records, and either transition beneficiaries to the appropriate Medi-Cal aid code or discontinue eligibility, as applicable. Through the reinstated Aid Code Clean-Up process, DHCS performs ongoing statewide monitoring of aid code usage, identifies obsolete or inappropriate aid codes, and requires counties to take the appropriate action to ensure these beneficiaries are enrolled under the correct Medi-Cal aid category. Estimated Implementation Date: Fully Implemented Contact - Sarah Crow, Medi-Cal Eligibility Division, Division Chief - Harold Higgins, Medi-Cal Eligibility Division, Branch Chief - Amy Halim, Medi-Cal Eligibility Division, Section Chief

2024-010

Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Children’s Health Insurance Program (CHIP) (Not a Major Program) State Administering Department: Department of Health Care Services (DHCS) ALN: 93.767 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305CA3002; October 1, 2022- September 30, 2024 2405CA5021; October 1, 2023- September 30, 2025 2505CA5021; October 1, 2024- September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally: - 42 CFR §435.916(a)(1) requires annual redeterminations every 12 months. - 42 CFR §457.320 and §457.340 require accurate and timely eligibility determinations for CHIP. - 42 CFR §435.912(c)(3) requires processing of nondisability applications within 45 days. Condition: Audit procedures included a review of 40 CHIP beneficiaries associated with current eligible participants. Of the 40 participants reviewed: - For eight of the 40 beneficiaries tested, required eligibility redeterminations were not completed within the prescribed timeframes. - Three beneficiaries received benefits despite not meeting eligibility requirements during the period the benefits were provided. - One beneficiary had an eligibility determination that exceeded the required 45-day processing timeframe. Questioned costs: $2,827 Context: See “Condition.” Cause: The exceptions identified were due to internal controls over the eligibility determination and redetermination processes not operating with sufficient precision to ensure consistent compliance with program requirements. Specifically, controls were not performing at a level of precision necessary to consistently enforce DHCS guidance, ensure timely completion of required verification procedures, and detect and correct errors through supervisory review. As a result, inaccuracies in eligibility determinations were not consistently prevented or identified, contributing to improper enrollment of ineligible beneficiaries. Effect: Failure to properly determine eligibility and terminate benefits in the eligibility system may result in individuals receiving improper benefit payments and noncompliance with grant award terms and conditions. Repeat finding: No Recommendation: DHCS should strengthen controls over eligibility determinations and redeterminations to ensure applications, redeterminations, and case updates are completed within required timeframes and that benefits are discontinued when eligibility requirements are no longer met. Procedures should include monitoring overdue redeterminations, resolving MEDS and CalSAWS alerts timely, documenting supervisory review of exception reports, and providing refresher training on timely eligibility processing and case closure requirements. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Eligibility California Department of Health Care Services DHCS reinstated county performance standards effective June 1, 2024, through Medi-Cal Eligibility Division Letter (MEDIL 24-12) and issued All County Welfare Directors Letter (ACWDL) 24-17 on November 25, 2024. ACWDL notified counties DHCS would leverage data to monitor application processing times. The data will be used to select counties for focused reviews targeting application processing times and procedures to ensure counties are performing eligibility determinations timely and accurately. DHCS has implemented multiple monitoring activities to address the recommendation and strengthen oversight of county processing of Medi-Cal applications. In May 2024, DHCS issued Medi-Cal Eligibility Division Letter (MEDIL) 24-12, ending the temporary hold harmless provisions and resumed standard county performance accountability. Subsequently, DHCS issued ACWDL 24-17, which established the Department's transition to using system-generated eligibility data, rather than county self-certification, to monitor application timeliness. Under this approach, DHCS evaluates county performance using statewide eligibility data, publishes application timeliness performance through statewide dashboards, and uses the data to identify counties for focused reviews. Focused reviews evaluate both the timeliness and accuracy of county eligibility determinations. Counties that do not meet established performance expectations are subject to corrective actions consistent with the Welfare and Institutions Code (WIC) section 14154 performance monitoring framework, including the application of statutory performance corrective action plans (CAPS), and financial penalties where applicable. Collectively, these actions establish an ongoing oversight process that enables DHCS to monitor county compliance with Medi-Cal application timeliness requirements, identify performance issues, require counties to implement corrective actions to address any deficiencies identified through focused reviews, and promote continued improvement in the timely and accurate processing of Medi-Cal applications. In 2025, DHCS issued MEDIL I 25-19, Reinstatement of the Aid Code Clean-Up Effort, which reinstated the Department's statewide process for identifying beneficiaries assigned to obsolete pre-Affordable Care Act (ACA) aid codes, transitional aid codes, or other records that may require reevaluation of eligibility. As part of this effort, DHCS provides counties with standardized reports on a bi-monthly basis to assist in identifying records that require review and action. Counties are required to review records, and either transition beneficiaries to the appropriate Medi-Cal aid code or discontinue eligibility, as applicable. Through the reinstated Aid Code Clean-Up process, DHCS performs ongoing statewide monitoring of aid code usage, identifies obsolete or inappropriate aid codes, and requires counties to take the appropriate action to ensure these beneficiaries are enrolled under the correct Medi-Cal aid category. Estimated Implementation Date: Fully Implemented Contact - Sarah Crow, Medi-Cal Eligibility Division, Division Chief - Harold Higgins, Medi-Cal Eligibility Division, Branch Chief - Amy Halim, Medi-Cal Eligibility Division, Section Chief

Period of Performance Federal Agency: Federal Emergency Management Agency Federal Program Title: Disaster Grants - Public Assistance State Administering Department: Governor’s Office of Emergency Services ALN: 97.036 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 4856DRCAP00000001; January 7, 2025 – January 9, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR 200.77 defines the period of performance as the time during which the non- Federal entity may incur new obligations to carry out the work authorized under the Federal award and requires that the Federal awarding agency or pass-through entity include the start and end dates of the period of performance in the Federal award. Effective internal controls should ensure that compliance with applicable requirements is achieved throughout the defined period of performance, beginning on the award start date. Condition: For awards with period of performance start dates occurring during the fiscal year, audit procedures included testing transactions recorded in the general ledger during the initial month of the award. We tested a sample of seven transactions totaling $23,576. Our testing identified one transaction, totaling $9,852, for which costs were incurred prior to the beginning of the period of performance. Specifically, the award period began on January 7, 2025; however, the associated costs were incurred between January 3 and January 6, 2025. Questioned costs: None Context: See “Condition.” Cause: Controls over the review of expenditures at the start of the period of performance were not operating with sufficient precision to ensure that only allowable costs incurred on or after the award start date were charged to the appropriate Federal award. Specifically, management did not consistently apply procedures to verify that expenditures were recorded to the correct grant and within the applicable period of performance, resulting in the misclassification of pre-award costs to the grant. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. Repeat finding: No Recommendation: The Department should strengthen controls over grant accounting by implementing procedures to ensure that expenditures are both charged to the correct grant and incurred within the applicable period of performance. This should include establishing controls to verify grant coding and transaction dates prior to posting or reimbursement, as well as enhancing supervisory review processes to detect and prevent misclassification of expenditures and the recording of unallowable pre-award costs. Additionally, the Department should provide training to personnel responsible for grant accounting on proper grant coding and period-ofperformance requirements. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Period of Performance California Governor’s Office of Emergency Services In July of 2024, Cal OES implemented EMPOWER, a new electronic time reporting system. EMPOWER captures employees' daily time worked, and activities identified with service locations (funding code) by cost category. The established EMPOWER Standard Operating Procedure instructs Cal OES Administrative Services staff on how to set the service location incident period start date, which creates system controls to not allow any activities to be entered prior to the start date. To address the transaction identified by CLA and prevent recurrence, Cal OES is troubleshooting and testing potential solutions to develop a systematic fix in EMPOWER. In addition, Cal OES will provide refresher training for all first-line managers to improve their oversight of funding codes and cost categories and ensure their staff submit time entries accordingly. Cal OES Administrative Services will also integrate a resource checklist into its monthly pre-labor review and posting process to add an extra layer of transaction oversight. Currently, Cal OES Administrative Services reviews and reconciles all cost category claims and supporting documentation before submitting to FEMA for obligation. This continuous review ensures Cal OES flags and corrects ineligible or out-of-period transactions before requesting reimbursement. Furthermore, Cal OES will review and correct the identified transaction. Estimated Implementation Date: October 2026 Contact: - Mary Rucker, Assistant Director Administrative Services, Finance & Logistics Administration

Special Tests and Provisions Federal Agency: Federal Emergency Management Agency Federal Program Title: Disaster Grants - Public Assistance State Administering Department: Governor’s Office of Emergency Services ALN: 97.036 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 4699DRCAP00000001; April 3, 2023 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Title 2 – Federal Financial Assistance Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. § 200.303 - Internal controls (2 CFR 200.303): The recipient and subrecipient must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 44 – Emergency Management and Assistance, §206.205 (Payment of Claims), requires that for large projects, the subrecipient must account for actual eligible costs and certify that: - Costs were incurred for eligible work - Work was completed in accordance with the approved scope - The project complied with the FEMA-State Agreement and grant conditions - Payments were made in accordance with applicable requirements For small projects, the subrecipient must certify completion of the approved scope of work through a Small Project Completion Certification. Additionally, 2 CFR §200.303 (Internal Controls) requires the entity to establish and maintain effective internal controls to ensure compliance with Federal statutes, regulations, and grant terms. Condition: During audit procedures, we tested a sample of 14 large FEMA Public Assistance projects. We identified one instance in which a project was incorrectly classified as a small project and was paid without the required large project reimbursement request and supporting validation. Questioned costs: None Context: See “Condition.” Cause: The error resulted from the incorrect application of FEMA’s large project threshold, as the control over project classification did not operate with sufficient precision to ensure the appropriate threshold was applied. Specifically, the project, totaling $1,044,653.84, exceeded the applicable 2023 large project threshold of $1,000,000; however, it was evaluated using the 2025 threshold of $1,062,900 based on the obligation date. Due to the lack of precision in the control, this error was not identified during review, resulting in the improper classification and processing of the project. Effect: A lack of precision of the controls to properly classify and process the project in accordance with FEMA requirements may result in noncompliance with federal grant provisions and inadequate oversight of project costs and reimbursements. Repeat finding: No Recommendation: The Department should strengthen its controls and procedures to ensure projects are classified using the correct FEMA large project thresholds. This should include implementing a review control to verify threshold applicability based on the appropriate timing criteria and ensuring that all required documentation, including reimbursement requests and validations, is completed prior to payment. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Special Tests and Provisions California Governor’s Office of Emergency Services On December 10, 2025, Cal OES implemented communication protocol improvements by reemphasizing correct threshold applicability prior to payment during team meetings. In addition, by August 31, 2026, Cal OES will revise its Project Threshold standard operating procedure to include a review control that verifies the applicability of project thresholds, specifically the Large Project threshold, based on the appropriate timing criteria. Cal OES will also provide training to all grants processing and support staff on the revised procedure, including how to correctly identify and enter Large Project Thresholds, verify disaster data against approved sources, and apply the appropriate thresholds for specific declaration dates. Refresher training will be provided as needed thereafter. Furthermore, guidance on Large Project Thresholds will be incorporated into the onboarding process for all new staff. Estimated Implementation Date: August 2026 Contact: - Heidi Palchik, Chief, Recovery Financial Administration Branch, lnteragency Recovery Coordination Section

Criteria or specific requirement: Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 – Employees’ Benefits. Chapter V – Employment and Training Administration, Department of Labor. Part 614 – Extended Benefits in the Federal-State Unemployment Compensation Program. Subpart B – Administration of Extended Benefits Program. § 614.11 Determinations of eligibility; notices to individuals (20 CFR 614.11): (f) Application of State law. (1) Except as indicated in paragraph (a) of this section, any provision of State law that may be applied for the recovery of overpayments or prosecution for fraud, and any provision of State law authorizing waiver of recovery of overpayments of unemployment compensation, shall be applicable to UCX. (2) In the case of any finding of false statement of representation under the Act and paragraph (a) of this section, or prosecution for fraud under 18 U.S.C. 1919 or pursuant to paragraph (f)(1) of this section, the individual shall be disqualified or penalized in accordance with the provision of the applicable State law relating to fraud in connection with a claim for State unemployment compensation. Condition: Audit procedures included a review of 60 beneficiary overpayments. Of the sample examined, we identified that one claimant voluntarily quit employment and did not demonstrate that the separation was necessary or that all reasonable alternatives were explored prior to quitting. Under applicable regulations, this disqualifies the claimant from receiving unemployment benefits and a penalty should have been assessed. However, no disqualification penalty was applied to the claimant’s benefits. The audit procedures also identified a lack of effective internal controls to ensure timely and accurate reporting, as there were no documented procedures or monitoring mechanisms in place to verify that subrecipient data was submitted in accordance with federal guidelines. Questioned costs: None Context: See “Condition.” Cause: Procedures to ensure that all applicable penalties and assessments are applied were not sufficiently detailed or comprehensive to guarantee consistent enforcement of program requirements. Effect: The lack of established procedures and internal controls overpayment penalties resulted in noncompliance, with one out of 60 overpayments lacking appropriate penalties. Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Department implement and strengthen internal controls over the application of penalties. This includes enhancing current procedures to outline the steps for reviewing claimant eligibility and applying disqualification penalties. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

The EDD has policies, procedures, and training in place instructing employees to include applicable penalty amounts when establishing overpayments in the database. When the overpayment for the sample in question was established, the employee did not follow the proper procedure to include the penalty. EDD accepts this oversight and is committed to reviewing its applicable policies and procedures to ensure they are clear, and the penalty requirements are emphasized. Regarding internal controls, EDD leverages a process known as the Field Office Basic Evaluation System (FOBES). This process includes a standardized form that is utilized by leadership to evaluate the quality of their employees’ work on a variety of processes, including overpayment processing. EDD continues to review and modernize the existing assessment form and FOBES process to ensure effectiveness and consistency while evaluating employee compliance with policies and procedures Estimated Implementation Date: Currently Implemented Contact: Diane Underwood, Division Chief, Unemployment Insurance Branch, California Employment Development Department

Criteria or specific requirement: Per 2 CFR 200.303(a), California Department of Transportation (Caltrans) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The process for establishing funding priorities in the financial system lacks sufficient controls to ensure accurate application of required federal and state match percentages. During testing, we noted that when a new funding priority was created, the state match requirement was not properly carried forward, resulting in the federal share being incorrectly set at 100%. Questioned costs: None Context: See “Condition.” Cause: The error occurred due to insufficient validation procedures and system checks during the setup of new funding priorities. Effect: Failure to meet matching requirements may result in a reduction in federal funding. Furthermore, failure to calculate, review, and approve final matching expenditures may lead to noncompliance with the terms of the grant and questioned costs. Repeat Finding: This is not a repeat finding. Recommendation: We recommend management strengthen internal controls over funding priority setup by implementing system validations and requiring independent review to confirm that federal and state match percentages are accurately applied before finalizing funding configurations. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

The HQ Budgets OFR will update FPFT guidance and development documentation to include specific references to a new required secondary data validation for the more complex funding scenarios. A set of core FPFT standard templates will be modified to include an automated requirement for secondary data validation for any project that includes complex funding scenarios, including cooperative agreements, multiple funding priorities, multiple federal program codes, multiple state funding programs, and funding earmarks. Calculated data cells for federal reimbursement ratios will be added, as well as an automated check for the total sum of funding line percentages to ensure any rounding errors are eliminated. Consistent training will be provided for key HQ Budgets OFR staff on a regular basis, including live sessions for practical FPFT case reviews and FPFT development during monthly team meetings. Estimated Implementation Date: • Updated FPFT guidance documentation: 11/25/2025 • Updated FPFT template (automated secondary validation): 12/01/2025 • Monthly live training sessions (1st Thursday each month): 12/04/2025 Contact: • Raul Lerma, Chief, Program and Project Management Branch, Office of Federal Resources, HQ Division of Budgets • Keith Duncan, Division Chief, HQ Division of Budgets

Criteria or specific requirement: Per 2 CFR 200.303(a), California Department of Health Care Services (CDHCS) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included a review of 40 CHIP beneficiaries associated with current eligible participants. Of the 40 participants, we identified one beneficiary coded erroneously to an obsolete aid code. Although participation appears to meet the criteria for eligibility, the aid code is used in the determination of the rates paid and therefore payments for this participant were paid at an incorrect rate. Questioned costs: $15,524,158 (known costs $332.64) Context: See “Condition.” Cause: The exceptions noted were due to a lack of system interface issue between CalSAWS and MEDS for aid codes that have been discontinued and a subsequent review was not completed. Effect: Failure to properly terminate benefits in the eligibility system resulted in individuals receiving improper benefit payments and noncompliance with grant award terms and conditions. Repeat Finding: This was reported in the previous year as finding 2023-015. Recommendation: CDHCS should enforce existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timeline. Additionally, DHCS should conduct periodic reviews of aid code usage to ensure obsolete codes are not being applied. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Effective June 1, 2024, DHCS reinstated county performance standards and reintroduced Focused Reviews. As outlined in All County Welfare Directors Letter (ACWDL) 24-17—Enhancing County Medi-Cal Eligibility Performance. DHCS has resumed monitoring county performance and timeliness standards. County performance standards measure the timeliness of county actions, while Focused Reviews evaluate both timeliness and accuracy of county determinations related to Medi-Cal applications, redeterminations, and Medi-Cal Eligibility Data System (MEDS) Alert processing. All counties will participate in a Focused Review on a biennial, rotating basis. Additionally, DHCS resumed the Aid Code Cleanup effort in September 2025, as outlined in MEDIL I 25-19. The purpose of the aid code cleanup effort is to assist counties in identifying records that require eligibility re-evaluation to either transition individuals to the correct Medi-Cal aid code or appropriately discontinue coverage. Through these initiatives, DHCS can identify and address eligibility concerns, such as processing timeliness and proper aid code usage. Estimated Implementation Date: Fully Implemented Contact: Sarah Crow, Medi-Cal Eligibility Division, Division Chief Harold Higgins, Medi-Cal Eligibility Division, Branch Chief Amy Halim, Medi-Cal Eligibility Division, Section Chief

2023-015

Criteria or specific requirement: Per 2 CFR 200.303(a), California Department of Health Care Services (CDHCS) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912, state Medicaid agencies must establish and adhere to timeliness and performance standards for determining and redetermining eligibility. These standards are intended to ensure that eligibility decisions are made promptly and accurately, and that benefits are not continued beyond the period of eligibility. Condition: Audit procedures included a review of 60 Medicaid beneficiaries associated with current eligible participants. Of the 60 participants, we identified two beneficiaries for which were considered eligible based on a pregnancy aid code, however the participants were no longer pregnant at the time of testing. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to a system interface issue between CalSAWS and MEDS. The termination of Medicaid benefits was not properly registered in MEDS after the case was closed in CalSAWS for failure to complete the annual redetermination. Effect: Failure to properly terminate benefits in the eligibility system may result in individuals receiving improper benefit payments and noncompliance with grant award terms and conditions. Repeat Finding: This is not a repeat finding. Recommendation: CDHCS should enhance its procedures for monitoring and resolving MEDS alerts, ensuring timely review and action on system-generated discrepancies. Additionally, staff should receive ongoing training on the importance of accurately updating pregnancy end dates in CalSAWS to ensure proper aid code closure and prevent inappropriate continuation of benefits. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Effective June 1, 2024, DHCS reinstated county performance standards and reintroduced Focused Reviews. As outlined in All County Welfare Directors Letter (ACWDL) 24-17—Enhancing County Medi-Cal Eligibility Performance, DHCS will resume monitoring county performance and timeliness standards. County performance standards measure the timeliness of county actions, while Focused Reviews evaluate both timeliness and accuracy of county determinations related to Medi-Cal applications, redeterminations, and Medi-Cal Eligibility Data System (MEDS) Alert processing. All counties will participate in a Focused Review on a biennial, rotating basis. Through the reinstatement of county performance standards and Focused Reviews, DHCS can identify and address eligibility concerns, such as the proper use of aid codes, and work with counties through the corrective action plan process to address staff training to ensure correct eligibility determinations for all Medi-Cal programs, including pregnancy programs. Estimated Implementation Date: Fully Implemented Contact: Sarah Crow, Medi-Cal Eligibility Division, Division Chief Harold Higgins, Medi-Cal Eligibility Division, Branch Chief Amy Halim, Medi-Cal Eligibility Division, Section Chief

Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our audit procedures, we reviewed 60 CMS Form 1539 documents related to provider recertification under the Medicaid program. We identified that three forms were not reviewed or signed by Public Health, indicating a breakdown in internal control processes. Questioned costs: None. Context: See “Condition.” Cause: Public Health did not review these forms because the surveys were conducted by Accrediting Organizations. However, CMS Form 1539 must still be completed and reviewed for all recertified providers, regardless of the agency conducting the survey. Effect: Failure to review CMS Form 1539 may result in noncompliance with federal grant provisions and oversight of provider eligibility for Medicaid participation. Repeat Finding: This was reported in the previous year as finding 2023-016. Recommendation: Public Health should strengthen internal controls to ensure that CMS Form 1539 is reviewed and signed for all provider recertifications, including those surveyed by Accrediting Organizations. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

CHCQ will address the audit findings by increasing outreach to local District Office management and by providing ongoing oversight to frontline staff. CHCQ will emphasize the importance of completing CMS 1539 forms with proper documentation and signatures for all recertification surveys, including surveys conducted by Accrediting Organizations. CHCQ has already taken steps by reiterating this requirement at a recent statewide management meeting. CHCQ will continue reminding staff of expectations at appropriate meetings and provide additional training as needed to ensure all offices follow consistent procedures when completing the required CMS 1539 forms. Headquarters management will provide oversight and conduct periodic audits to ensure staff complete and sign all CMS 1539 forms according to expectations. Estimated Implementation Date: Fiscal Year 2025-26 Contact: Nate Gilmore, State Surveyors Branch Chief, CHCQ

2023-016

Criteria or specific requirement: Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 – Public Welfare. Subtitle A – Department of Health and Human Services. Subchapter A – General Administration. Part 98 – Child Care and Development Fund. Subpart E – Program Operations (Child Care Services)—Lead Agency and Provider Requirements. §98.41 Health and safety requirements: (a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to child care providers of services for which assistance is provided under this part. Such requirements, which are subject to monitoring pursuant to §98.42, shall: (1) Include health and safety topics consisting of, at a minimum: (i) The prevention and control of infectious diseases (including immunizations); with respect to immunizations, [et. al.] (ii) Prevention of sudden infant death syndrome and use of safe sleeping practices; (iii) Administration of medication, consistent with standards for parental consent; (iv) Prevention and response to emergencies due to food and allergic reactions; (v) Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; (vi) Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; (vii) Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a man-caused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5195a(a)(1)) that shall include procedures for evacuation, relocation, shelter-in-place and lock down, staff and volunteer emergency preparedness training and practice drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions; (viii) Handling and storage of hazardous materials and the appropriate disposal of biocontaminants; (ix) Appropriate precautions in transporting children, if applicable; (x) Pediatric first aid and cardiopulmonary resuscitation; (xi) Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph (e) of this section; and (xii) May include requirements relating to: 1. Nutrition (including age-appropriate feeding); 2. Access to physical activity; 3. Caring for children with special needs; or 4. Any other subject area determined by the Lead Agency to be necessary to promote child development or to protect children’s health and safety. 2) Include minimum health and safety training on the topics above, as described in §98.44. Condition: The CDSS has not established health and safety monitoring procedures to ensure licensed-exempt providers serving children who receive subsidies comply with all applicable health and safety requirements. Accordingly, no monitoring procedures were performed on licensed-exempt providers during the fiscal year ended June 30, 2024. Questioned costs: None Context: See “Condition.” Cause: Although CDSS is in process of developing a health and safety monitoring process for licensed-exempt contractors, finalization and implementation is subject to statutory and budget actions which delay the process Effect: The CDSS is not in compliance with 45 CFR §98.41. Repeat Finding: This was reported in the previous year as finding 2023-014. Recommendation: We recommend CDSS complete its development and implementation of a monitoring process over the health and safety standards and develop a mechanism to identify and track all contracts requiring health and safety compliance monitoring. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

The Child Care and Development Division is working towards compliance with federal requirements for license-exempt health and safety monitoring with an anticipated completion date of July 1, 2029, assuming additional resources are secured. This plan has been outlined in Appendix A of the Federal Fiscal Year 2025-27 State Plan for California with Administration of Children and Families (State Plan). The State Plan can be provided upon request. Estimated Implementation Date: July 1, 2029 Contact: • Jeff Fowler, Child Care Administration Bureau Chief • Central Operations Branch • Child Care and Development Division • California Department of Social Services

2023-014

Criteria or specific requirement: Per 2 CFR 200.303(a), the State Administering Departments must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: For awards with period of performance beginning dates and ending dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the first and last month of the award. We noted the following instances of noncompliance: Pacific Coast Salmon Recovery Pacific Salmon Treaty Program- R&D Audit procedures included testing 5 sampled transactions from projects with period of performance ending dates during the fiscal year totaling $122,346. One of the expenditures, totaling $18,915, was related to costs incurred after the period of performance end date. The Project Period End Date for the grant award was August 31, 2023, however costs were incurred through September 30, 2023. Wildlife Restoration and Basic Hunter Education and Safety- R&D Audit procedures included testing 40 sampled transactions from projects with period of performance ending dates during the fiscal year totaling $540,319. One of the expenditures, totaling $2,784, was related to costs incurred after the period of performance end date. The Project Period End Date for the grant award was June 30, 2024, however costs were incurred on July 11, 2024. Highway Planning- R&D Audit procedures included testing 3 sampled transactions from projects with period of performance beginning dates during the fiscal year totaling $5,089. One of the expenditures, totaling $107, was related to costs incurred prior to the period of performance begin date. The Project Period Start Date for the grant award was July 1, 2023, however costs were incurred on June 8, 2023. Questioned costs: $21,699 Context: See “Condition.” Cause: Management failed to code the expenditure to the correct grant. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. Repeat Finding: This is not a repeat finding. Recommendation: The Departments should provide additional training over its review process to ensure that reviewers are verifying that transactions are posted to the proper grant. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

California Department of Fish and Wildlife • The Accounting Services Branch (ASB) will document the process by updating the respective desk procedures to clearly direct staff to only approve vouchers with dates consistent with the Project ID start and end date as identified on the FI$Cal Crosswalk. • Ensure new staff within ASB are trained on the desk procedures before they begin approving vouchers in FI$Cal. Estimated Implementation Date: March 31, 2026 Contact: Jing Lin, Branch Chief, Accounting Services Branch California Department of Transportation The Division of Research, Innovation and System Information staff have developed the following corrective actions in response to the audit finding: TEC Charging Guidance and Training To ensure research project Contract Managers properly code a Travel Expense Claim (TEC), the following guidance and training actions will be implemented. • The Division’s Contract Manager Handbook and Training documentation will be updated to provide staff with guidance ensuring that TEC charging information aligns with the fiscal year (FY) in which the travel expenses occurred. • DRISI Contract Managers and their first- and second-line supervisors will be trained on the change and will receive the annual reminder. A record of attendance of training will be maintained. • New hires will receive TEC charging practices training within 30 days of their start date. Annual TEC Coding Reminder To ensure TECs are coded accurately to the correct Federal Project Number, an annual email reminder will be sent to DRISI staff beginning in the month of May for coding/charging TECs. • The reminder will instruct staff to code and charge TECs to the fiscal year and federal project number in which the expense was incurred. • A list of tasks and project IDs will be attached to the email to minimize errors and ensure consistency. In addition, the program will send a reminder to the TEC/Accounting Office to: • Charge and post TECs and non-encumbered Operating Expense (OE) charges to the fiscal year in which they were incurred. • This process will help avoid audit findings related to charges being posted to the incorrect fiscal year or federal award number. Estimated Implementation Date: March 31, 2026 Contact: Chief, Division of Research, Innovation and System Information

Reference Number: 2023-003 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: Unemployment Insurance COVID-19 Unemployment Insurance Federal Award Number and Year: UI-34702-20-55-A-6; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 22 – Social Security, Division 1 – Employment Development Department, Subdivision 1 – Director of Employment Development, Division – 1 Unemployment and Disability Compensation, Part 1 – Unemployment Compensation, Chapter 5 Unemployment Compensation Benefits, Article 1 – Eligibility and Disqualifications §1256, §1257 and §1326 Eligibility and Disqualifications, §1256 California Code of Regulations: (a) An individual is disqualified for unemployment compensation benefits if the director finds that he or she left his or her most recent work voluntarily without good cause or that he or she has been discharged for misconduct connected with his or her most recent work. Eligibility and Disqualifications, §1257 California Code of Regulations: (a) An individual is also disqualified for unemployment compensation benefits if: He or she willfully, for the purpose of obtaining unemployment compensation benefits, either made a false statement or representation, including, but not limited to, using a false name, false social security number, or other false identification, with actual knowledge of the falsity thereof, or withheld a material fact in order to obtain any unemployment compensation benefits under this division. Continued Claim for Unemployment Benefits – Filing and Contents, §1326-6 California Code of Regulations: (c) The claimant shall, to maintain his or her eligibility to file continued claims during a continuous period of unemployment, file continued claims at intervals of not more than two weeks, or such other interval as the department shall require, unless he or she shows good cause for his or her delay in filing his or her continued claim. Condition In EDD’s administration of the Unemployment Insurance program, $198,804,488 in benefit payments were estimated by EDD to be potentially ineligible payments and have not been reported in the schedule of expenditures of federal awards. The estimate was based on data parameters to identify claimants who received benefits that matched ineligible criteria for identity or eligibility fraud due to misrepresented information. The Unemployment Insurance Branch of EDD reviews unemployment insurance claims of claimants for involuntary separation to ensure separations were for valid reasons under the Unemployment Insurance Code. Out of 138 unemployment insurance benefit payments tested, there was 1 claimant receiving benefits, whose reasons for involuntary separation indicated separation was due to misconduct, which was incorrectly categorized as eligible by EDD. Identification as a Repeat Finding Finding 2022-006 was reported in the immediate prior year. Cause EDD has acknowledged that the adjudication process for potential eligibility issues, which includes work separation, was inadequately or not timely performed due to the significant increase in claims resulting from the COVID-19 pandemic. Effect By EDD not performing timely and adequate review for potential eligibility issues, benefit payments were made to ineligible claimants. Questioned Costs Known questioned costs for the one claimant identified was paid unemployment compensation of $6,975 under Unemployment Insurance Program. Context Benefits paid to claimants under the Unemployment Insurance program for the fiscal year ended June 30, 2023, totaled $5,383,169,224. The sample was not a statistically valid sample. Recommendation EDD should enhance its adjudication process to support proper eligibility determinations and decrease improper payments to ineligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference No. 2023-003: The EDD resumed adjudicating all potential eligibility issues as of January 2021 and completed the retroactive determination workload on April 30, 2023. Estimated Implementation Date: Completed April 2024 Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

2022-006

Reference Number: 2023-004 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance Federal Award Number and Year: UI-34702-20-55-A-6; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 – Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 – Disaster Unemployment Assistance, §625.6 Weekly amount; jurisdictions; reductions Eligibility and Disqualifications, (b) If the weekly amount computed under paragraph (a) of this section is less than 50 percent of the average weekly payment of regular compensation in the State, as provided quarterly by the Department, or, if the individual has insufficient wages from employment or insufficient or no net income from self-employment (which includes individuals falling within paragraphs (a)(3) and (b)(3) of § 625.5) in the applicable base period to compute a weekly amount under paragraph (a) of this section, the individual shall be determined entitled to a weekly amount equal to 50 percent of the average weekly payment of regular compensation in the State. (e) The State agency shall immediately determine, upon the filing of an initial application for DUA, a weekly amount under the provisions of paragraphs (a) through (d) of this section, as the case may be, based on the individual’s statement of employment or self-employment preceding the individual’s unemployment that was a direct result of the major disaster, and wages earned or paid for such employment or self-employment. An immediate determination of a weekly amount shall also be made where, in conjunction with the filing of an initial application for DUA, the individual submits documentation substantiating employment or self-employment and wages earned or paid for such employment or self-employment, or, in the absence of documentation, where any State agency records of employment or self-employment and wages earned or paid for such employment or self-employment, justify the determination of a weekly amount. An immediate determination shall also be made based on the individual’s statement or in conjunction with the submittal of documentation in those cases where the individual was to commence employment or self-employment on or after the date the major disaster began but was prevented from doing so as a direct result of the disaster. (1) In the case of a weekly amount determined in accordance with paragraph (e) of this section, based only on the individual’s statement of earnings, the individual shall furnish documentation to substantiate the employment or self-employment or wages earned from or paid for such employment or self-employment or documentation to support that the individual was to commence employment or self-employment on or after the date the major disaster began. In either case, documentation shall be submitted within 21 calendar days of the filing of the initial application for DUA. (3) For purposes of a computation of a weekly amount under paragraph (a) of this section, if an individual submits documentation to substantiate employment or self-employment in accordance with paragraph (e)(1), but not documentation of wages earned or paid during the base period set forth in paragraph (a)(2) of this section, including those cases where the individual has not filed a tax return for the most recent tax year that has ended, the State agency shall immediately redetermine the weekly amount of DUA payable to the individual in accordance with paragraph (b) of this section. Condition During the fiscal year ended June 30, 2020, EDD implemented the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. The amount of PUA payable to an unemployed or unemployed self-employed individual for a week of total unemployment shall be the weekly amount of compensation the individual would have been paid as regular compensation, as computed under the provisions of the applicable State law for a week of total unemployment. The weekly amount determination is calculated using the wages reported by the claimant. Upon receipt of a PUA claim, EDD would verify wages reported to ensure accurate weekly benefit amounts under PUA. Out of 138 PUA benefit payments tested, there were 91 claimants with verification issues (either wages, self-employment, or both). Identification as a Repeat Finding Finding 2022-005 was reported in the immediate prior year. Cause EDD did not perform timely wage and employment verifications of the claimants due to the significant increase in claims resulting from the COVID-19 pandemic. Despite ongoing efforts to address the backlog of claims, EDD was approved by the Department of Labor (DOL) on May 21, 2024 under Unemployment Insurance Program Letter No. 05-24, to discontinue pursuing claims older than one year that were not a result of fraud, misrepresentation or willful nondisclosure. Effect EDD did not have adequate oversight controls to ensure that the claimant’s wages were timely and properly reviewed and approved. Accordingly, there was an increased risk for the occurrence of overpayment in benefits being provided to individuals, which was not timely prevented or detected. Questioned Costs Known questioned costs for the 91 claimants were $1,708,094. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2023, totaled $306,150,759, which was offset by prior years’ ineligible benefit payments of $90,034,050 and return of funds from EDD debit cards that were not activated within 12 months of card issuance of $620,694,399. The sample was not a statistically valid sample. Recommendation EDD should ensure that proper verification procedures are in place to minimize the number of claimants with wage and/or employment verification issues. Effective and robust verification procedures should assist EDD in processing unemployment benefits only to eligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

As reported in the prior year’s response, given the unprecedented volume of unemployment insurance claims during the federal disaster—approximately 20 million claims compared to 3.8 million during the Great Recession—EDD took action to speed payments to eligible claimants whenever possible. For example, EDD launched in July 2021 a Conditional Payment Program to speed payments to claimants who certified for benefits and already received at least one week of benefits in the past but whose payments were later pending for more than two weeks. EDD also boosted its capacity to process workloads, prioritized timely payments, and employed automation among other measures. EDD began automatically cross-matching EDD wage records and Franchise Tax Board records in November 2020 to assist in verifying the income of PUA claimants who could not be automatically verified through these procedures. Such claimants were required to submit additional documentation to EDD for a manual review. Regarding the manual processing of the income documents to substantiate the PUA weekly benefit amounts that have been increased above the minimum California WBA of $167, and the verification of employment or self-employment substantiation (known in California as “Self-employment/Employment Substantiation” or “SEES”), based on the U.S. Department of Labor’s (DOL) guidance in Unemployment Insurance Program Letter 05 24, EDD notified DOL on February 6, 2024, that California Unemployment Insurance Code (CUIC) section 1376 bars EDD from resolving the wage verification and self-employment verification items. Section 1376 provides that EDD cannot establish overpayments more than one year after the close of the benefit year in which the overpayment was made unless the overpayment is found to be a result of fraud, misrepresentation, or willful nondisclosure. Given that there is no fraud in creating these overpayments on the part of the individuals identified in these populations, EDD is no longer able to establish overpayments for these populations. On May 31, 2024, DOL notified EDD that the February 6, 2024, submission regarding how California’s finality laws affect the actions required to correct the wage verification and self-employment findings is sufficient to close these findings. Estimated Implementation Date: Completed May 2024 Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

2022-005

Reference Number: 2023-005 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance Federal Award Number and Year: UI-34702-20-55-A-6; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 – Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 – Disaster Unemployment Assistance, §625.14 Overpayments; disqualification for fraud: (h) Provisions in the procedures of each State with respect to detection and prevention of fraudulent overpayments of DUA shall be, as a minimum, commensurate with the procedures adopted by the State with respect to regular compensation and consistent with the Secretary’s “Standard for Fraud and Overpayment Detection,” Employment Security Manual, part V, sections 7510 et seq. (Appendix C of this part). (i) Any individual who, with respect to a major disaster, makes or causes another to make a false statement or misrepresentation of a material fact, knowing it to be false, or knowingly fails or causes another to fail to disclose a material fact, in order to obtain for the individual or any other person a payment of DUA to which the individual or any other person is not entitled, shall be disqualified as follows: (1) If the false statement, misrepresentation, or nondisclosure pertains to an initial application for DUA – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of any DUA with respect to that major disaster; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of any DUA with respect to that major disaster; and (2) If the false statement, misrepresentation, or nondisclosure pertains to a week for which application for a payment of DUA is made – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA. Title 15 – Commerce and Trade, Chapter 116, Coronavirus Economic (CARES Act) Subchapter II – Unemployment Insurance Provisions, §9023 Emergency Increase in Unemployment Compensation Benefits (f) Fraud and Overpayments: (1) In General – If an individual knowingly has made, or caused to be made by another, a false statement or representation of a material fact, or knowingly has failed, or caused another to fail, to disclose a material fact, and as a result of such false statement or representation or of such nondisclosure such individual has received an amount of Federal Pandemic Unemployment Compensation or Mixed Earner Unemployment Compensation to which such individual was not entitled, such individual— 1. shall be ineligible for further Federal Pandemic Unemployment Compensation Mixed Earner Unemployment Compensation in accordance with the provisions of the applicable State unemployment compensation law relating to fraud in connection with a claim for unemployment compensation. Condition During the fiscal year ended June 30, 2023, EDD continued its administration of the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. Claimants eligible for PUA benefits were paid additional benefits under the Federal Pandemic Unemployment Compensation program (FPUC). In EDD’s administration of the PUA and FPUC programs, $90,034,050 in benefit payments were estimated to be ineligible payments and have not been reported in the schedule of expenditures of federal awards. The estimate was made by the Unemployment Insurance Branch and was based on data parameters to identify claimants that received benefits that matched ineligible criteria for identity fraud or eligibility fraud for misrepresented information. Out of 138 PUA benefit payments tested, there was 1 benefit payment to a claimant determined to be ineligible whose identity was not sufficiently verified. Identification as a Repeat Finding Finding 2022-004 was reported in the immediate prior year. Cause EDD has acknowledged that there was inadequate or untimely review of claimant due to the significant increase in claims resulting from the COVID-19 pandemic. Effect EDD did not have adequate oversight controls to ensure that benefit payments were not being made to ineligible claimants. Accordingly, benefit payments were made to claimants who were not eligible. Questioned Costs Known questioned costs were $8,502 for PUA and $7,200 for FPUC. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2023, totaled $306,150,759 which was offset by prior years’ ineligible benefit payments of $90,034,050 and return of funds from EDD debit cards that were not activated within 12 months of card issuance of $620,694,399. The sample was not a statistically valid sample. Recommendation EDD should continue to strengthen controls, such as database identification cross-matches, ID.me verification, partnerships with law enforcement and Thompson Reuters, as well as system enhancements to mitigate the potential of further employment benefit fraud. Such improvements in internal controls should improve EDD’s ability to timely prevent and detect unemployment benefit fraud. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

As reported in the prior year’s response, since fiscal year 2020-21, the Employment Development Department (EDD) has implemented dozens of strict anti-fraud measures and has continued to evaluate and enhance its fraud detection. EDD has also developed internal fraud working groups and a multiagency fraud task force that reviews fraud data and fraud reports on a continual basis and recommends adjustments to filters and tools as necessary. EDD has successfully halted two large fraud scheme attempts over the previous two years and continues to work towards immediate detection and prevention of fraud attempts. EDD will continue to analyze and assess our processes to stay ahead of the ever-evolving fraud landscape. As previously described, EDD implemented the following measures to address the nationwide fraud attempts perpetrated against the new emergency federal benefit programs in 2020-21: • Implemented additional cross-matches in September 2020 to detect multiple claims per address. • Ceased automatically backdating PUA claims under federal rules in September 2020. • Strengthened identity verification procedures in October 2020 by implementing ID.me. • Implemented additional cross-matches in November 2020 against state inmate information. • Vetted applications against law enforcement databases and other tools provided by Thomson Reuters in December 2020 to further curb identity and non-identity fraud. • Established a 1099-G call center to help victims of identity theft deal with any tax-related questions. • Ceased printing Social Security numbers on mailed documents to reduce identity theft risk. • Enhanced benefit card security with Bank of America. • Partnered with state, local and federal law enforcement agencies to support thousands of criminal investigations, arrests, prosecutions and convictions. Estimated Implementation Date: Completed September 2024 Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

2022-004

Reference Number: 2023-013 Category of Finding: Special Tests and Provisions – Child Care Provider Eligibility for ARP Act Stabilization Funds Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575 Federal Program Title: Child Care and Development Block Grant (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2101CACSC6; 2021 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (d) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Assembly Bill (AB) 179 and AB 110 provided designated American Rescue Plan Act (ARPA) funding to provide supplemental rate payments and stipends to eligible child care providers. As prescribed by ARPA, to qualify for this funding a child care provider must apply and meet the following criteria: On the date of application for the award must either be: (1) open and available to provide child care services, or (2) closed due to public health, financial hardship, or other reasons relating to the COVID-19 public health emergency. In addition, the child care provider must either: (1) be eligible to serve children who receive CCDF subsidies at the time of application for stabilization funds, or (2) be licensed, regulated, or registered in the state, territory, or tribe as of March 11, 2021, and meet applicable state and local health and safety requirements at the time of application for stabilization funds. In their application for stabilization funds, a child care provider must certify: a. That the provider will, when open and providing services, implement policies in line with guidance and orders from corresponding state, territorial, tribal, and local authorities and, to the greatest extent possible, implement policies in line with guidance from the CDC. b. For each employee, the provider must pay at least the same amount in weekly wages and maintain the same benefits for the duration of the stabilization funding. c. The provider will provide relief from copayments and tuition payments for the families enrolled in the provider’s program, to the extent possible, and prioritize such relief for families struggling to make either type of payment. Condition CDSS uses a third-party service provider to administer payments to child care contractors and assist with the coordination and collection of certain information required to be eligible to receive state and federal child care funding. The third-party service provider is considered a fiduciary and not a subrecipient, thus CDSS is responsible for monitoring eligibility compliance related to the ARPA Stabilization funding. Of the 25 samples we selected for testing eligibility criteria related to the ARPA Stabilization funding, 22 contractors were determined eligible by the third-party service provider; however, the CDSS did not monitor that the third-party service provider appropriately discharged its duties and correctly determined that recipients were eligible. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause CDSS did not appropriately determine its responsibility for eligibility of ARPA Stabilization recipients and relied on the determinations of the third-party service provider without oversight. Effect CDSS did not fulfill its responsibilities for determining eligibility of ARPA Stabilization recipients. Questioned Costs $232,082,456 Context The third-party service provider used CDSS’ survey portal to capture and review information of the recipients it determined eligible. During the fiscal year ended June 30, 2023, CDSS paid the third-party service provider $232,082,456 to disburse to eligible contractors. The third-party service provider does not qualify as a subrecipient and thus is not subject to the Uniform Guidance requiring a single audit. Recommendation We recommend that CDSS review its contract with the third-party service provider and identify compliance requirements delegated to the provider and develop a monitoring program to ensure the third-party service provider is accurately fulfilling its responsibilities in determining compliance of contractors. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

The CDSS disagrees with the finding. California’s subsidized child care system is locally operated. The CDSS relies on hundreds of local county offices and nonprofit agencies to administer child care and development programs at the local level, rather than having the State pay subsidized providers directly. As a result, CDSS required Alternative Payment Programs, direct-service contractors that administer Family Child Care Home Education Networks, and fiscal partners to track survey completion as a prerequisite for awarding American Rescue Plan Act (ARPA) subgrants. This local infrastructure and the size of California’s subsidized child care and development system separates California from other states. As a result, CDSS worked very closely with the federal grantor, the Administration for Children and Families, to ensure that the ARPA survey methodology met federal monitoring requirements and tracked data elements required by the federal government. For this reason, CDSS believes it has fulfilled its responsibility and does not need to further establish a monitoring program. Estimated Implementation Date: Will not implement Contact: Jeff Fowler, Staff Services Manager III Child Care and Development Program California Department of Social Services

Reference Number: 2023-014 Category of Finding: Special Tests and Provisions – Health and Safety Requirements Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services (CDSS) Assistance Listing Number: 93.575 Federal Program Title: Child Care and Development Block Grant (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2101CACCDF; 2021 2101CACCC5; 2021 2101CACDC6; 2021 2234CACCDD; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (e) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 – Public Welfare. Subtitle A – Department of Health and Human Services. Subchapter A – General Administration. Part 98 – Child Care and Development Fund. Subpart E – Program Operations (Child Care Services)—Lead Agency and Provider Requirements. §98.41 Health and safety requirements: (a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to child care providers of services for which assistance is provided under this part. Such requirements, which are subject to monitoring pursuant to §98.42, shall: (1) Include health and safety topics consisting of, at a minimum: (i) The prevention and control of infectious diseases (including immunizations); with respect to immunizations, [et. al.] (ii) Prevention of sudden infant death syndrome and use of safe sleeping practices; (iii) Administration of medication, consistent with standards for parental consent; (iv) Prevention and response to emergencies due to food and allergic reactions; (v) Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; (vi) Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; (vii) Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a man-caused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5195a(a)(1)) that shall include procedures for evacuation, relocation, shelter-in-place and lock down, staff and volunteer emergency preparedness training and practice drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions; (viii) Handling and storage of hazardous materials and the appropriate disposal of biocontaminants; (ix) Appropriate precautions in transporting children, if applicable; (x) Pediatric first aid and cardiopulmonary resuscitation; (xi) Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph (e) of this section; and (xii) May include requirements relating to: (A) Nutrition (including age-appropriate feeding); (B) Access to physical activity; (C) Caring for children with special needs; or (D) Any other subject area determined by the Lead Agency to be necessary to promote child development or to protect children’s health and safety. (2) Include minimum health and safety training on the topics above, as described in §98.44. Condition The CDSS has not established health and safety monitoring procedures to ensure licensed-exempt providers serving children who receive subsidies comply with all applicable health and safety requirements. Accordingly, no monitoring procedures were performed on licensed-exempt providers during the fiscal year ended June 30, 2023. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Although CDSS is in process of developing a health and safety monitoring process for licensed-exempt contractors, finalization and implementation is subject to statutory and budget actions which delay the process. Effect The CDSS is not in compliance with 45 CFR §98.41. Questioned Costs No questioned costs were identified. Context CDSS was not able to isolate a complete list of subrecipient expenditures related to contractors receiving CCDF Cluster program funding that were subject to health and safety compliance for the fiscal year ended June 30, 2023; therefore, the magnitude of impact to the program cannot be determined. CDSS is in process of developing its health and safety monitoring program in collaboration with the Federal Administration of Children and Families and the State legislature. Recommendation We recommend CDSS complete its development and implementation of a monitoring process over the health and safety standards and develop a mechanism to identify and track all contracts requiring health and safety compliance monitoring. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

The CDSS will complete its development and implementation of a monitoring process over license-exempt health and safety standards in collaboration with the federal Administration of Children and Families and the State Legislature. Estimated Implementation Date: July 1, 2027 Contact: Jeff Fowler, Staff Services Manager III Child Care and Development Program California Department of Social Services

Reference Number: 2023-015 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2305CA5021; 2023 2305CA3002; 2023 2205CA5022; 2022 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2305CA5ADM; 2023 2305CA5MAP;2023 2205CA5ADM; 2022 2205CA5MAP; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code – WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year. §14713: (b) If the department determines that a mental health plan has failed to comply with the requirements of Chapter 7 (commencing with Section 14000), Chapter 8 (commencing with Section 14200), Chapter 8.8 (commencing with Section 14600), or this chapter, the department may impose sanctions and plans of correction pursuant to Section 14197.7. Condition Eighteen of 56 contractor counties of Short-Doyle funding were tested and seventeen had not submitted their cost reports by the December 31 due date. Five of the seventeen contractor counties have not submitted their cost reports for fiscal year 2021-22 (more than 12 months late) and thirteen of the seventeen contractor counties have subsequently submitted their cost reports for fiscal year 2021-22. Although the Mental Health Division of Health Care Services did take the required action of notifying the eighteen contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2022-008 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Medical Assistance Program to the eighteen contractor counties totaled $1,943,410,893, the seventeen noncompliant contractor counties totaled $1,871,058,835, and all 58 contractor counties totaled $2,338,031,915. For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven contractor counties totaled $94,521,685, the six noncompliant contractor counties totaled $88,716,942, and all 58 contractor counties totaled $191,348,628. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

DHCS implemented a process to impose payment withholds for significantly late cost reports, which addresses CSA’s recommendations. As of January 1, 2025, DHCS has issued 26 Notices of Delinquency to contracted counties of Short-Doyle funding (two notices for FY 2015-16, four notices for FY 2016-17, one notice for FY 2018-19, three notices for FY 2019-20, six notices for FY 2020-21, and ten notices for FY 2021-22). DHCS has received positive responses from some of the delinquent counties, stating the cost reports should be submitted shortly. If the counties do not submit their cost reports within 30 calendar days of the delinquency notice, DHCS will send a Notice of Intent to Impose Temporary Withhold of Funds with an option to meet and confer. If a county still has not submitted its cost report within 30 calendar days after Notice of Intent to Impose Temporary Withhold of Funds, the county will be put on Final Notice of Intent to Impose Temporary Withhold of Funds with an effective date of 30 days, at which time a withhold of funds will be processed. Estimated Implementation Date: January 1, 2025 Contact: California Department of Health Care Services • Primary – Ryan Whalen, Behavioral Health Interim Settlement, Section Chief, Audit & Investigations (A&I) Financial Review Outpatient and Behavioral Health Division (FROBHD) • Secondary – Lisa Alder, Behavioral Health Financial Review, Branch Chief, A&I FROBHD • Tertiary – Charles Anders, Behavioral Health Financing Branch, Chief, Local Governmental Financing Division (LGFD)

2022-008

Reference Number: 2023-016 Category of Finding: Special Tests and Provisions – Provider Health and Safety Standards Type of Finding: Material Weakness State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2305CA5ADM; 2023 2305CA5MAP;2023 2205CA5ADM; 2022 2205CA5MAP; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition There was no evidence of surveyor signature or supervisor review and approval on Form CMS 1539 for all 40 surveys of providers tested. Identification as a Repeat Finding Finding 2022-012 was reported in the immediate prior year. Cause California Department of Public Health (Public Health) did not adhere to their documented controls due to continued turnover of staff members within Public Health. Effect Nonadherence to internal controls over the review and approval process of the Form CMS-1539 can result in the risk of statewide noncompliance as providers may not meet the prescribed health and safety standards. Further, the integrity of the surveys can be compromised as they are being conducted with no documented oversight. Questioned Costs No questioned costs were identified. Context A total of 461 surveys were included in the population, which consisted of all surveys completed by Public Health for Hospitals, Intermediate Care Facilities and Individuals with Intellectual Disabilities and Nursing Facilities during the fiscal year ended June 30, 2023. The sample was not a statistically valid sample. Recommendation Public Health should update its processes and controls in place to ensure timely review and approval of the Form CMS-1539, including for situations when staff are on leave and/or have left the department. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

CDPH is addressing the findings of the audit through a combination of outreach and training for internal stakeholders, updated internal policies, and data verification to ensure proper review and approval of the Form CMS-1539. Estimated Implementation Date: April 2025 Contact: Nate Gilmore, Branch Chief Center for Health Care Quality California Department of Public Health

2022-012

Reference Number: 2023-017 Category of Finding: Eligibility Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.917 Federal Program Title: HIV Care Formula Grants COVID-19 HIV Care Formula Grants Federal Award Numbers and Years: 2 X07HA12778-14-00; 2022 6 X07HA12778-14-01; 2022 6 X07HA12778-14-02; 2023 6 X07HA12778-14-03; 2023 6 X07HA12778-14-04; 2023 6 X07HA12778-14-05; 2023 5 X07HA12778-15-00; 2023 6 X07HA12778-15-01; 2023 6 X07HA12778-15-02; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 – The Public Health and Welfare. Chapter 6A – Public Health Service. Subchapter XXIV – HIV Health Care Services Program. Part B – Care Grant Program. Subpart I – General Grant Provisions. Section 300ff-26 – Provision of Treatments: (a) In general A State shall use a portion of the amounts provided under a grant awarded under section 300ff–21 of this title to establish a program under section 300ff–22(b)(3)(B) of this title to provide therapeutics to treat HIV/AIDS or prevent the serious deterioration of health arising from HIV/AIDS in eligible individuals, including measures for the prevention and treatment of opportunistic infections. (b) Eligible individual To be eligible to receive assistance from a State under this section an individual shall: (1) Have a medical diagnosis of HIV/AIDS; and (2) Be a low-income individual, as defined by the State. California State AIDS Drug Assistance Program Guidelines January 2022: (1.1) AIDS Drug Assistance Program (ADAP) Eligibility Criteria: To be eligible for the ADAP program, a client must: • Have a positive HIV/AIDS diagnosis. • Be at least 18 years old. • Be a resident of California. • Have an annual Modified Adjusted Gross Income (MAGI) that does not exceed 500 percent Federal Poverty Level (FPL) based on household size and income. • Not be fully covered by Medi-Cal or any other third-party payers (an entity that reimburses and manages health care expenses such as private insurance or governmental agencies, employers, etc.). Health Resources and Services Administration, Policy Clarification Notice 15-04 (Revised 1/11/2019): The Ryan White HIV/AIDS Program (RWHAP) legislation requires that rebates collected on ADAP medication purchases be applied to the RWHAP Part B Program with a priority, but not a requirement, that the rebates be placed back into ADAP. Although ADAP rebates are neither program income nor refunds, they are subject to the same regulatory provision regarding expenditure. These rebates must be used for the statutorily permitted purposes under the RWHAP Part B Program, which are limited to core medical services including ADAP, support services, clinical quality management, and administrative expenses (including planning and evaluation) as part of a comprehensive system of care for low-income individuals living with HIV. Condition All applications must be reviewed internally by ADAP staff via an electronic secondary review process to confirm eligibility; however, one of sixty applications was not reviewed by ADAP staff. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause There was a backlog in the secondary review of applications due to staffing issues in the ADAP Branch. Effect Public Health did not have appropriate oversight controls to ensure that the applicant’s eligibility was properly reviewed and approved. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals that may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable because benefit costs were not tracked by individual participants. Context Pharmacy benefits management services are provided by a contractor who received administrative fees and reimbursements for prescription drug costs to program participants. Payments to the contractor totaled $106,505,302 for approximately 24,000 program participants for the fiscal year ended June 30, 2023. The sample was not a statistically valid sample. Recommendation The ADAP Branch should continue to monitor compliance with its policies to ensure secondary reviews of ADAP applications follow the established guidelines. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Public Health’s Office of AIDS (OA) agrees with the finding and recommendation. OA introduced and fully implemented an internal Secondary Review (SR) process for all AIDS Drug Assistance Program (ADAP) applications in March 2018. This SR process enables ADAP staff to verify that contracted and certified enrollment workers across California are consistently adhering to eligibility and documentation requirements. However, due to staffing challenges caused by the redirection of staff during the state of emergency declared for the COVID-19 pandemic, ADAP faced significant workforce shortages from March 2020 through much of 2023. This caused a backlog in SR processing, which delayed tasks, including the review of this client’s application. The client’s eligibility lapsed after 130 days, before SR could be conducted. The Eligibility Operations Section (EOS) of ADAP which conducts SR, is now fully staffed and has successfully addressed the backlog. As of early 2024, SR processing has returned to normal operations and is current. Estimated Implementation Date: Already implemented as of April 2024 Contact: Joseph Lagrama, ADAP Branch Chief California Department of Public Health

Reference Number: 2023-018 Category of Finding: Activities Allowed or Unallowed Type of Finding: Significant Deficiency State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.959 Federal Program Title: Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 1B08TI084632-01; 2022 6B08TI084632-01M001; 2022 6B08TI084632-01M002; 2022 1B08TI083437-01; 2021 6B08TI083437-01M002; 2021 6B08TI083437-01M003; 2021 6B08TI083437-01M004; 2021 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our testing of 60 employee timesheets, the Department of Health Care Services (DHCS) did not have documentation of the approval for time charged to the Prevention and Treatment of Substance Abuse (SAPT) program for 1 of the samples tested. Identification as a Repeat Finding This is not a repeat finding from the immediate prior year. Cause Due to staffing and organizational changes, DHCS has been unable to locate the requested documentation of timesheet approval. Effect Nonadherence to the internal controls over the documentation of employee timesheets can result in the risk of noncompliance with established policies and procedures. Furthermore, the integrity of the time charged to the program can be compromised when proper documentation of approval is not readily available. Questioned Costs No questioned costs were identified. Context Expenditures related to payroll costs charged to the SAPT program for the fiscal year ended June 30, 2023 totaled $12,743,522. The sample was not a statistically valid sample. Recommendation DHCS should adhere to its processes and controls in place to ensure all timesheets are reviewed and approved by a manager or supervisor. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

DHCS recently implemented and instructed all staff on an improved leave management and timesheet submission process, effective November 20, 2024, beginning with the December 2024 pay period. The change addresses the recommendations from CSA by streamlining the submission, review, and storage of employee timesheets, ensuring efficient and transparent management of time-related data across DHCS. Furthermore, the new process ensures a manager or supervisor reviews and approves all timesheets before submission. Estimated Implementation Date: November 20, 2024 Contact: California Department of Health Care Services • Primary – Erika Cristo Assistant Deputy Director, Behavioral Health • Secondary – Wendy Rasmussen, Chief, Office of Compliance - Internal Audits

2022-009

Reference Number: 2023-019 Category of Finding: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Social Services (CDSS) Assistance Listing Numbers: 96.001 Federal Program Title: Disability Insurance/SSI Cluster: Social Security Disability Insurance Federal Award Number and Year: 04-2204CADI00; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart E – Cost Principles. §200.403 Factors affecting allowability of costs. Except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (g) Be adequately documented. See §200.300 through §200.309.   Condition The documentation for one of forty samples selected for testing did not agree to the payment disbursed to a provider for medical evidence of record (MER) services. The provider was overpaid by $5. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause CDSS has represented that the cause was an input error in the Midas subledger when processing the vendor payment. Effect CDSS did not have appropriate oversight controls to ensure that the data entry was accurate. Accordingly, there is an increased risk for data entry directly affecting the amount reported on the schedule of expenditures of federal awards to be inaccurate. Questioned Costs Questioned costs are projected to be $54,398. Context The total MER expenditures for the fiscal year ended June 30, 2023, were $4,432,781, which represents 1.8% of the total program expenditures of the Disability Insurance/SSI Cluster of $242,946,482. The sample was not a statistically valid sample. Recommendation CDSS should strengthen its controls over the review for accuracy of the provider invoice amounts input into Midas. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

The CDSS’ Disability Determination Services Division (DDSD) has implemented corrective measures to address inaccuracies in the Modernized Integrated Disability Adjudicative System (MIDAS) and Disability Case Processing System (DCPS) invoice review processes. This includes an internal quality control process to monitor and review additional invoice samples from Branches after they have been processed and reviewed by Branch Program Technicians and Branch Auditors. Additionally, the DDSD Central Support Services Branch implemented a secondary audit process and created a new Auditor role to routinely sample additional Medical Evidence of Record (MER) and Consultative Examination (CE) contracts. Findings are provided to branches to reinforce accuracy and assure compliance. The DDSD, also transitioned from MIDAS to DCPS, which provides more sophisticated fiscal controls. To remediate any inaccuracies, DDSD’s centralized auditor will assess findings and develop an action plan to prevent erroneous invoices. The CDSS ensures that all necessary controls are in place to verify the accuracy and proper documentation of invoices. The CDSS concludes that the sample size of 15 MER cases does not provide sufficient audit evidence that controls are not operating effectively resulting in a calculated $54,398 in potential costs. However, CDSS agrees with the finding and is committed to the control and mitigation of risk related to the audit recommendation. Estimated Implementation Date: Implemented Contact: Bernice Stanfield, Fiscal and Procurement Section Chief Central Support Services Branch Disability Determination Service Division California Department of Social Services

EMPLOYMENT DEVELOPMENT DEPARTMENT Reference Number: 2022-001 Type of Finding: Material Weakness and Material Instance of Noncompliance Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart F - Audit Requirements. §200.510 Financial statements (2 CFR 200.510): (b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. For example, when a Federal program has multiple Federal award years, the auditee may list the amount of Federal awards expended for each Federal award year separately. At a minimum, the schedule must: (3) Provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available. For a cluster of programs also provide the total for the cluster. Condition The State of California (State) has a decentralized financial reporting process, which requires State agencies and departments to provide specific financial information to the Department of Finance (Finance) in order to annually compile the Schedule of Expenditures of Federal Awards (Schedule). In its effort to more efficiently and accurately prepare the Schedule in accordance with the requirements of Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Finance developed the Single Audit Expenditures Reporting Database (Database). Finance developed the Database to include all of the relevant data fields necessary to compile and produce the Schedule. Finance also created a Single Audit Database User Manual, which provides specific guidance to users for accessing and navigating through the database. Due to the unprecedented impacts from the COVID-19 pandemic, the Employment Development Department (EDD) was unable to timely report to Finance through the Database with accurate and reliable federal cash basis expenditures for its largest federal award program that it administers, the Unemployment Insurance (ALN 17.225) program. The delay resulted in Finance being unable to compile and produce a complete and final approved Schedule until December 2023. Although an initial estimated expenditure amount was reported by EDD of $27.0 billion, the final amount reported in the Schedule was $23.3 billion. Cause Given the substantial increase in claimants seeking assistance under the Unemployment Insurance program resulting from the COVID-19 pandemic, EDD was overwhelmed with the administration of the Unemployment Insurance program. Effect The difficulties that EDD encountered from the COVID-19 pandemic, resulted in the late reporting and submission of final federal cash basis expenditures to Finance. The untimely submission continued to limit and constrain Finance from compiling and producing a final complete and accurate Schedule. Questioned Costs Questioned costs were not determinable. Recommendation EDD should continue to evaluate existing processes and controls related to its ability to properly report, and timely submit complete and accurate federal award cash basis expenditures to the Database, which affords Finance the ability to timely compile and produce a final Schedule pursuant to the Uniform Guidance. Views of Responsible Officials and Corrective Action Plan EDD agrees with this finding. The deferred transition to FI$Cal and the difficulties experienced thereafter have continued to cause EDD to be late with submitting year-end financials and its ability to submit timely the cash basis expenditures into the Single Audit Expenditures Reporting Database (Database). In addition, the onset of the COVID-19 pandemic created additional issues which ultimately impacted the EDD’s ability to submit timely year-end financials. However, the EDD continues to make progress to gain ground in the department’s efforts to follow the State’s deadlines for submitting year-end financials and entering the cash basis expenditures into the Database. During fiscal year 2022-23, the EDD completed a restructuring within the accounting area which realigned workload amongst the units and provided additional resources in critical areas. These changes will have a lasting effect and help the department to be better positioned going forward in processing the accounting workload and ultimately be able to catch up and submit year-end financials and enter the cash basis expenditures into the Database by the State’s deadlines. In addition, the EDD took lessons learned from the financial audits from the prior two fiscal years to update processes and procedures and applied that knowledge going forward. Also, staff continue to participate in various trainings offered by the Department of Finance and the Department of FI$Cal. In addition, staff work with the control agencies when issues arise that would impact our accounting functions.

EDD agrees with this finding. The deferred transition to FI$Cal and the difficulties experienced thereafter have continued to cause EDD to be late with submitting year-end financials and its ability to submit timely the cash basis expenditures into the Single Audit Expenditures Reporting Database (Database). In addition, the onset of the COVID-19 pandemic created additional issues which ultimately impacted the EDD’s ability to submit timely year-end financials. However, the EDD continues to make progress to gain ground in the department’s efforts to follow the State’s deadlines for submitting year-end financials and entering the cash basis expenditures into the Database. During fiscal year 2022-23, the EDD completed a restructuring within the accounting area which realigned workload amongst the units and provided additional resources in critical areas. These changes will have a lasting effect and help the department to be better positioned going forward in processing the accounting workload and ultimately be able to catch up and submit year-end financials and enter the cash basis expenditures into the Database by the State’s deadlines. In addition, the EDD took lessons learned from the financial audits from the prior two fiscal years to update processes and procedures and applied that knowledge going forward. Also, staff continue to participate in various trainings offered by the Department of Finance and the Department of FI$Cal. In addition, staff work with the control agencies when issues arise that would impact our accounting functions. While the EDD has been behind in submitting year-end financials for prior years, the department is making great progress on catching up. The EDD submitted the last of its fiscal year 2021-22 financials in May 2023 and submitted the last of its fiscal year 2022-23 financials in January 2024. The department is now working on identifying the ineligible payment data needed in order to accurately reflect the cash basis expenditures to enter into the Database. The EDD’s goal is to submit fiscal year 2023-24 financials in November 2024. Similar to the 2020-21 financial audit, the EDD will take the knowledge learned during prior audit seasons and continue to engage with the control agencies, and continue to train and develop staff in order to keep progressing towards the department’s goal of becoming timely with the submission of the year-end financials and the entering of the cash basis expenditures into the Database.

2021-001

DDEPARTMENT OF PUBLIC HEALTH Reference Number: 2022-002 Type of Finding: Material Weakness and Instance of Noncompliance Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart F - Audit Requirements. §200.510 Financial statements (2 CFR 200.510): (b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. For example, when a Federal program has multiple Federal award years, the auditee may list the amount of Federal awards expended for each Federal award year separately. At a minimum, the schedule must: (3) Provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available. For a cluster of programs also provide the total for the cluster. (4) Include the total amount provided to subrecipients from each Federal program. Condition The State of California (State) has a decentralized financial reporting process, which requires State agencies and departments to provide specific financial information to the Department of Finance (Finance) in order to annually compile the Schedule of Expenditures of Federal Awards (Schedule). In its effort to more efficiently and accurately prepare the Schedule in accordance with the requirements of 2 CFR 200.510, Finance developed the Single Audit Expenditures Reporting Database (Database) to include all relevant data fields necessary to compile and produce the Schedule. Finance also created a Single Audit Database User Manual, which provides specific guidance to users for accessing and navigating through the database. Departments are given access to the centralized Database by Finance in order to upload and report federal award information for all federal award programs which they administer.   The California Department of Public Health (Public Health) understated federal expenditures and overstated amounts passed through to subrecipients for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program (ALN No. 93.323). The error, which was subsequently corrected, is indicative of a lack of sufficient controls for ensuring the Schedule’s completeness and accuracy prior to submission to Finance. Cause Public Health was a subrecipient of federal funds provided by their bona fide agent, Heluna Health, during the fiscal year ended June 30, 2022. Initially, the ELC program funds were not identified and recognized as federal expenditures until January 2023. During its compilation of federal award expenditures for reporting in Finance’s Database, Public Health did not properly analyze and capture all relevant financial transactions related to the ELC program. Effect Federal expenditures originally reported in the Schedule by Public Health for the ELC program were understated by $154,155,192 and the amounts passed through to subrecipients were overstated by $516,650,718. Questioned Costs No questioned costs were identified. Recommendation Public Health should establish a more thorough internal review and communication process between ELC program administration and accounting personnel to ensure information submitted to Finance for compilation of the Schedule is complete and accurate. Views of Responsible Officials and Corrective Action Plan Public Health’s Accounting Office will generate the FI$Cal Year End Close report (KK_12 expenditure) and collaborate with the ELC program to ensure that all expenditures captured are complete and accurate, ensuring timely reporting of the SEFA data for FY 2023-24 and beyond. Please note that the ELC program has been reported in the FY 2022-23 SEFA. Additionally, we will update the procedures to document the SEFA reporting for the ELC program. Estimated Implementation Date: September 2024 Contact: Jennifer Chan, Accounting Administrator II Federal Reporting Unit, Financial Management Division California Department of Public Health

Public Health’s Accounting Office will generate the FI$Cal Year End Close report (KK_12 expenditure) and collaborate with the ELC program to ensure that all expenditures captured are complete and accurate, ensuring timely reporting of the SEFA data for FY 2023-24 and beyond. Please note that the ELC program has been reported in the FY 2022-23 SEFA. Additionally, we will update the procedures to document the SEFA reporting for the ELC program. Estimated Implementation Date: September 2024 Contact: Jennifer Chan, Accounting Administrator II Federal Reporting Unit, Financial Management Division California Department of Public Health

2021-002

Reference Number: 2022-003 Category of Finding: Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 10.557 Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children COVID-19 Special Supplemental Nutrition Program for Women, Infants, and Children Federal Award Numbers and Years: 202019W100647; 2020 202020W100347, 2020 202020W100647, 2020 202120W600347, 2021 202120W600647, 2021 202121W100347, 2021 202121W100647, 2021 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 7 – Agriculture. Subtitle B - Regulations of the Department of Agriculture. Chapter II – Food and Nutrition Service, Department of Agriculture. Subchapter A – Child Nutrition Programs. Part 246 - Special Supplemental Nutrition Program for Women, Infants and Children, §246.7 - Certification of participants: (c) Eligibility criteria and basic certification procedures. (1) To qualify for the Program, infants, children, and pregnant, postpartum, and breastfeeding women must: (i) Reside within the jurisdiction of the State (except for Indian State agencies). Indian State agencies may establish a similar requirement. All State agencies may determine a service area for any local agency, and may require that an applicant reside within the service area. However, the State agency may not use length of residency as an eligibility requirement. (ii) Meet the income criteria specified in paragraph (d) of this section. (iii) Meet the nutritional risk criteria specified in paragraph (e) of this section. (2) (i) At certification, the State or local agency must require each applicant to present proof of residency (i.e., location or address where the applicant routinely lives or spends the night) and proof of identity. The State or local agency must also check the identity of participants, or in the case of infants or children, the identity of the parent or guardian, or proxies when issuing food, cash-value vouchers or food instruments. The State agency may authorize the certification of applicants when no proof of residency or identity exists (such as when an applicant or an applicant's parent is a victim of theft, loss, or disaster; a homeless individual; or a migrant farmworker). In these cases, the State or local agency must require the applicant to confirm in writing his/her residency or identity. Further, an individual residing in a remote Indian or Native village or an individual served by an Indian tribal organization and residing on a reservation or pueblo may establish proof of residency by providing the State agency their mailing address and the name of the remote Indian or Native village. (e) Nutritional risk. To be certified as eligible for the Program, applicants who meet the Program's eligibility standards specified in paragraph (c) of this section must be determined to be at nutritional risk. … Nutritional risk data shall be documented in the participant's file and shall be used to assess an applicant's nutritional status and risk; tailor the food package to address nutritional needs; design appropriate nutrition education, including breastfeeding promotion and support; and make referrals to health and social services for follow-up, as necessary and appropriate. (1) Determination of nutritional risk. (ii) Timing of nutritional risk data. (A) Weight and height or length. Weight and height or length shall be measured not more than 60 days prior to certification for program participation. (B) Hematological test for anemia. (1) For pregnant, breastfeeding, and postpartum women, and child applicants, the hematological test for anemia shall be performed or obtained from referral sources at the time of certification or within 90 days of the date of certification. The hematological test for anemia may be deferred for up to 90 days from the time of certification for applicants who have at least one qualifying nutritional risk factor present at the time of certification. If no qualifying risk factor is identified, a hematological test for anemia must be performed or obtained from referral sources (with the exception of presumptively eligible pregnant women). (2) Infants nine months of age and older (who have not already had a hematological test performed, between six and nine months of age, by a competent professional authority or obtained from referral sources), shall between nine and twelve months of age have a hematological test performed or obtained from referral sources. Such a test may be performed more than 90 days after the date of certification. (3) For pregnant women, the hematological test for anemia shall be performed during their pregnancy. For persons certified as postpartum or breastfeeding women, the hematological test for anemia shall be performed after the termination of their pregnancy. For breastfeeding women who are 6-12 months postpartum, no additional blood test is necessary if a test was performed after the termination of their pregnancy. The participant or parent/guardian shall be informed of the test results when there is a finding of anemia, and notations reflecting the outcome of the tests shall be made in the participant's file. Nutrition education, food package tailoring, and referral services shall be provided to the participant or parent/guardian, as necessary and appropriate. Condition During the fiscal year ended June 30, 2020, the Special Supplemental Food Program for Women, Infants and Children (WIC) nutrition program implemented phase 1 of a new management information system known as the Women, Infants, and Children Web Information System Exchange (WIC-WISE) in a two-phased approach to replace the WIC Management Information Systems (WIC-MIS). WIC-WISE is programmed such that updates to eligibility information overwrites existing data. As a result, key data and documentation to support the initial participant eligibility is removed during the recertification process. The California Department of Public Health, WIC Division requested a correction to WIC-WISE to retain eligibility history in the “Cert History Report” when subsequent eligibility information is inputted. The correction had not been implemented and the system defect still existed during the fiscal year ended June 30, 2022. Identification as a Repeat Finding Finding 2021-003 was reported in the immediate prior year. Cause The phase 1 implementation of WIC-WISE did not include system functionality to retain historical eligibility documentation when subsequent information was entered during the participant recertification process. Effect The system limitation of WIC-WISE does not allow for the retention of proper documentation of eligibility information. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals, which may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable. Context Total food vouchers disbursed to program participants during the fiscal year ended June 30, 2022, totaled $566,045,030. Recommendation WIC-WISE system updates should be promptly implemented and tested to ensure that participant data and eligibility documentation is appropriately retained within the system. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

The California Department of Public Health (Public Health) Women, Infants, and Children (WIC) Division had agreed that the WIC Web Information System Exchange (WISE) system does not currently store eligibility history that should be included in the “Cert History Report,” and the initial eligibility data is overwritten when subsequent eligibility information is keyed into WIC WISE. However, WIC WISE does include preventative internal stops or checkpoints that do not allow ineligible individuals to be certified and issued benefits (e.g., over income, not a California resident, no nutrition risk factor, etc.). User acceptance testing vetted these items prior to system implementation in 2019/20. The certification history condition discussed was remediated via a system Defect Correction to WIC WISE that was in user acceptance testing for implementation in Fall 2023. Public Health/WIC has entered Defect Correction #6972 in TFS (Team Foundation Services), the tracking system previously used to capture system changes and defects. The defect correction supports a system change to ensure initial eligibility information is retained when subsequent eligibility information is entered into WIC WISE. Estimated Implementation Date: August 2023 Contact: William Welch, Assistant Division Chief, Operations Women, Infants, and Children Division California Department of Public Health

2021-003

Reference Number: 2022-004 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance Federal Award Number and Year: UI-37212-22-55-A-6; 2022 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 - Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 - Disaster Unemployment Assistance, §625.14 Overpayments; disqualification for fraud: (h) Provisions in the procedures of each State with respect to detection and prevention of fraudulent overpayments of DUA shall be, as a minimum, commensurate with the procedures adopted by the State with respect to regular compensation and consistent with the Secretary's “Standard for Fraud and Overpayment Detection,” Employment Security Manual, part V, sections 7510 et seq. (Appendix C of this part). (i) Any individual who, with respect to a major disaster, makes or causes another to make a false statement or misrepresentation of a material fact, knowing it to be false, or knowingly fails or causes another to fail to disclose a material fact, in order to obtain for the individual or any other person a payment of DUA to which the individual or any other person is not entitled, shall be disqualified as follows: (1) If the false statement, misrepresentation, or nondisclosure pertains to an initial application for DUA – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of any DUA with respect to that major disaster; and   ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of any DUA with respect to that major disaster; and (2) If the false statement, misrepresentation, or nondisclosure pertains to a week for which application for a payment of DUA is made – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA. Title 15 - Commerce and Trade, Chapter 116, Coronavirus Economic (CARES Act) Subchapter II - Unemployment Insurance Provisions, §9023 Emergency Increase in Unemployment Compensation Benefits (f) Fraud and Overpayments: (1) In General – If an individual knowingly has made, or caused to be made by another, a false statement or representation of a material fact, or knowingly has failed, or caused another to fail, to disclose a material fact, and as a result of such false statement or representation or of such nondisclosure such individual has received an amount of Federal Pandemic Unemployment Compensation or Mixed Earner Unemployment Compensation to which such individual was not entitled, such individual— 1. shall be ineligible for further Federal Pandemic Unemployment Compensation Mixed Earner Unemployment Compensation in accordance with the provisions of the applicable State unemployment compensation law relating to fraud in connection with a claim for unemployment compensation Condition During the fiscal year ended June 30, 2022, EDD continued its administration of the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. Claimants eligible for PUA benefits were paid additional benefits under the Federal Pandemic Unemployment Compensation program (FPUC). In EDD’s administration of the PUA and FPUC programs, $3,559,865,590 in benefit payments were estimated to be ineligible payments and have not been reported in the schedule of expenditures of federal awards. The estimate was made by the Unemployment Insurance Branch and was based on data parameters to identify claimants that received benefits that matched ineligible criteria for identity fraud or eligibility fraud for misrepresented information.   Out of 138 PUA benefit payments tested, there were 27 benefit payments to claimants determined to be ineligible whose identity or employment was not sufficiently verified. Identification as a Repeat Finding Finding 2021-004 was reported in the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, instances of potential fraud for benefit payments for the following reasons. • There was a significant increase in unemployment claims that overwhelmed EDD’s existing fraud detection process. • There were insufficient controls in place to prevent or detect fraud associated with benefit payments related to incarceration, identity, and multiple claims from the same address. Effect EDD did not have adequate oversight controls to ensure that benefit payments were not being made to fraudulent claimants. Accordingly, benefit payments were made to fraudulent claimants who were not eligible. Questioned Costs Likely questioned costs were estimated to be $3,559,865,590 for fiscal year 2021-22. Known questioned costs were $417,860. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2022, totaled $15,246,314,741. The sample was not a statistically valid sample. Recommendation EDD should continue to strengthen controls, such as database identification cross-matches, ID.me verification, partnerships with law enforcement and Thompson Reuters, as well as system enhancements to mitigate the potential of further employment benefit fraud. Such improvements in internal controls should improve EDD’s ability to timely prevent and detect unemployment benefit fraud. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

As reported in the prior year’s response, since fiscal year 2020-21, the Employment Development Department (EDD) has implemented dozens of strict anti-fraud measures and has continued to evaluate and enhance its fraud detection. EDD has also developed internal fraud working groups and a multiagency fraud task force that reviews fraud data and fraud reports on a continual basis and recommends adjustments to filters and tools as necessary. EDD has successfully halted two large fraud scheme attempts over the previous two years and continues to work towards immediate detection and prevention of fraud attempts. EDD will continue to analyze and assess our processes to stay ahead of the ever-evolving fraud landscape. As previously described, EDD implemented the following measures to address the nationwide fraud attempts perpetrated against the new emergency federal benefit programs in 2020-21: • Implemented additional cross-matches in September 2020 to detect multiple claims per address. • Ceased automatically backdating PUA claims under federal rules in September 2020. • Strengthened identity verification procedures in October 2020 by implementing ID.me. • Implemented additional cross-matches in November 2020 against state inmate information. • Vetted applications against law enforcement databases and other tools provided by Thomson Reuters in December 2020 to further curb identity and non-identity fraud. • Established a 1099-G call center to help victims of identity theft deal with any tax-related questions. • Ceased printing Social Security numbers on mailed documents to reduce identity theft risk. • Enhanced benefit card security with Bank of America. • Partnered with state, local and federal law enforcement agencies to support thousands of criminal investigations, arrests, prosecutions and convictions. The EDD has and will continue to evaluate and enhance the fraud detection/prevention tools that have been put in place. Estimated Implementation Date: Annual reassessment to be completed September 2024 Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

2021-004

Reference Number: 2022-005 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance Federal Award Number and Year: UI-37212-22-55-A-6; 2022 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 - Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 - Disaster Unemployment Assistance, §625.6 Weekly amount; jurisdictions; reductions Eligibility and Disqualifications, (b) If the weekly amount computed under paragraph (a) of this section is less than 50 percent of the average weekly payment of regular compensation in the State, as provided quarterly by the Department, or, if the individual has insufficient wages from employment or insufficient or no net income from self-employment (which includes individuals falling within paragraphs (a)(3) and (b)(3) of § 625.5) in the applicable base period to compute a weekly amount under paragraph (a) of this section, the individual shall be determined entitled to a weekly amount equal to 50 percent of the average weekly payment of regular compensation in the State. (e) The State agency shall immediately determine, upon the filing of an initial application for DUA, a weekly amount under the provisions of paragraphs (a) through (d) of this section, as the case may be, based on the individual's statement of employment or self-employment preceding the individual's unemployment that was a direct result of the major disaster, and wages earned or paid for such employment or self-employment. An immediate determination of a weekly amount shall also be made where, in conjunction with the filing of an initial application for DUA, the individual submits documentation substantiating employment or self-employment and wages earned or paid for such employment or self-employment, or, in the absence of documentation, where any State agency records of employment or self-employment and wages earned or paid for such employment or self-employment, justify the determination of a weekly amount. An immediate determination shall also be made based   on the individual's statement or in conjunction with the submittal of documentation in those cases where the individual was to commence employment or self-employment on or after the date the major disaster began but was prevented from doing so as a direct result of the disaster. (1) In the case of a weekly amount determined in accordance with paragraph (e) of this section, based only on the individual's statement of earnings, the individual shall furnish documentation to substantiate the employment or self-employment or wages earned from or paid for such employment or self-employment or documentation to support that the individual was to commence employment or self-employment on or after the date the major disaster began. In either case, documentation shall be submitted within 21 calendar days of the filing of the initial application for DUA. (3) For purposes of a computation of a weekly amount under paragraph (a) of this section, if an individual submits documentation to substantiate employment or self-employment in accordance with paragraph (e)(1), but not documentation of wages earned or paid during the base period set forth in paragraph (a)(2) of this section, including those cases where the individual has not filed a tax return for the most recent tax year that has ended, the State agency shall immediately redetermine the weekly amount of DUA payable to the individual in accordance with paragraph (b) of this section. Condition During the fiscal year ended June 30, 2020, EDD implemented the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. The amount of PUA payable to an unemployed or unemployed self-employed individual for a week of total unemployment shall be the weekly amount of compensation the individual would have been paid as regular compensation, as computed under the provisions of the applicable State law for a week of total unemployment. The weekly amount determination is calculated using the wages reported by the claimant. Upon receipt of a PUA claim, EDD would verify wages reported to ensure accurate weekly benefit amounts under PUA. Out of 138 PUA benefit payments tested, there were 67 claimants with verification issues (either wages, self-employment, or both). Identification as a Repeat Finding Finding 2021-005 was reported in the immediate prior year. Cause EDD did not perform timely wage and employment verifications of the claimants due to the significant increase in claims resulting from the COVID-19 pandemic. Effect EDD did not have adequate oversight controls to ensure that the claimant’s wages were timely and properly reviewed and approved. Accordingly, there was an increased risk for the occurrence of overpayment in benefits being provided to individuals, which was not timely prevented or detected. Questioned Costs Known questioned costs for the 67 claimants were $702,538.   Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2022, totaled $15,246,314,741. The sample was not a statisitcally valid sample. Recommendation EDD should ensure that proper verification procedures are in place to minimize the number of claimants with wage and/or employment verification issues. Effective and robust verification procedures should assist EDD in processing unemployment benefits only to eligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Given the unprecedented volume of unemployment insurance claims during the federal disaster—approximately 20 million claims compared to 3.8 million during the Great Recession—EDD took action to speed payments to eligible claimants whenever possible. For example, EDD launched in July 2021 a Conditional Payment Program to speed payments to claimants who certified for benefits and already received at least one week of benefits in the past but whose payments were later pending for more than two weeks. EDD also boosted its capacity to process workloads, prioritized timely payments, and employed automation among other measures. As reported in Reference Number 2020-006 in fiscal year 2019-2020, EDD began automatically cross-matching EDD wage records and Franchise Tax Board records in November 2020 to assist in verifying the income of PUA claimants who could not be automatically verified through these procedures. Such claimants were required to submit additional documentation to EDD for a manual review. Regarding the manual processing of the income documents to substantiate the PUA weekly benefit amounts that have been increased above the minimum California WBA of $167, and the verification of employment or self-employment substantiation (known in California as “Self-employment/Employment Substantiation” or “SEES”), on February 6, 2024, in accordance with the U.S. Department of Labor (DOL) Unemployment Insurance Program Letter 05-24, the California Employment Development Department (EDD) identified that the processing of PUA income documents and the SEES workloads must be considered resolved due to California’s finality laws. The EDD is prohibited by law from resolving these items by California Unemployment Insurance Code section 1376, which provides that EDD cannot establish overpayments more than one year after the close of the benefit year in which the overpayment was made unless the overpayment is found to be a result of fraud, misrepresentation, or willful nondisclosure. Given that there is no fraud or fault on the part of the individuals identified in these populations, EDD is unable to take the required actions to resolve the workload due to California’s finality law provisions. EDD is expecting a response from DOL agreeing with the application of California’s finality laws to the PUA income verification and the SEES workloads. Estimated Implementation Date: Upon DOL response, to be determined Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

2021-005

Reference Number: 2022-006 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: Unemployment Insurance COVID-19 Unemployment Insurance Federal Award Number and Year: UI-37212-22-55-A-6; 2022 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 22 - Social Security, Division 1 - Employment Development Department, Subdivision 1 - Director of Employment Development, Division - 1 Unemployment and Disability Compensation, Part 1 - Unemployment Compensation, Chapter 5 Unemployment Compensation Benefits, Article 1 - Eligibility and Disqualifications §1256, §1257 and §1326 Eligibility and Disqualifications, §1256 California Code of Regulations: (a) An individual is disqualified for unemployment compensation benefits if the director finds that he or she left his or her most recent work voluntarily without good cause or that he or she has been discharged for misconduct connected with his or her most recent work. Eligibility and Disqualifications, §1257 California Code of Regulations: (a) An individual is also disqualified for unemployment compensation benefits if: He or she willfully, for the purpose of obtaining unemployment compensation benefits, either made a false statement or representation, including, but not limited to, using a false name, false social security number, or other false identification, with actual knowledge of the falsity thereof, or withheld a material fact in order to obtain any unemployment compensation benefits under this division.   Continued Claim for Unemployment Benefits - Filing and Contents, §1326-6 California Code of Regulations: (c) The claimant shall, to maintain his or her eligibility to file continued claims during a continuous period of unemployment, file continued claims at intervals of not more than two weeks, or such other interval as the department shall require, unless he or she shows good cause for his or her delay in filing his or her continued claim. Condition In EDD’s administration of the Unemployment Insurance program, $525,494,406 in benefit payments were estimated by EDD to be potentially ineligible payments and have not been reported in the schedule of expenditures of federal awards. The estimate was based on data parameters to identify claimants whom received benefits that matched ineligible criteria for identity or eligibility fraud due to misrepresented information. The Unemployment Insurance Branch of EDD reviews unemployment insurance claims of claimants for involuntary separation to ensure separations were for valid reasons under the Unemployment Insurance Code. Out of 88 unemployment insurance benefit payments tested, there were 6 claimants receiving benefits, whose reasons for involuntary separation indicated separation reasons due to voluntary quitting without good cause and 6 claimants receiving benefits that made false statements regarding wages. In addition to the Unemployment Insurance program, EDD continued its administration of the Pandemic Emergency Unemployment Compensation (PEUC) program for the fiscal year ended June 30, 2022. Under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19, the PEUC program eligibility was determined from individuals who have exhausted all rights to regular unemployment compensation (UC) under state or Federal law and have no rights to regular UC under any other state or Federal law. A claimant must have an eligible existing Unemployment Insurance program claim that has been exhausted prior to being eligible for PEUC. Out of 50 PEUC benefit payments tested, 1 claimant received benefits, whose reason for involuntary separation indicated separation reasons due to voluntary quitting without good cause, 1 claimant received benefits without completing weekly certifications, and 1 claimant was receiving full benefits while earning wages. Identification as a Repeat Finding Finding 2021-006 was reported in the immediate prior year. Cause EDD has acknowledged that the adjudication process for potential eligibility issues, which includes work separation, was inadequately or not timely performed due to the significant increase in claims resulting from the COVID-19 pandemic. Effect By EDD not performing timely and adequate review for potential eligibility issues, benefit payments were made to ineligible claimants.   Questioned Costs Known questioned costs for the 12 claimants identified for the unemployment compensation were $57,752 for Unemployment Insurance Program and $31,800 for the Federal Pandemic Unemployment Compensation program of the COVID-19 Unemployment Insurance. Known questioned costs for the 3 claimants identified were $9,386 for the PEUC program and $6,000 for the Federal Pandemic Unemployment Compensation (FPUC) program of the COVID-19 Unemployment Insurance. Context Benefits paid to claimants under the Unemployment Insurance program for the fiscal year ended June 30, 2022, totaled $7,720,873,424. Benefits to claimants under the PEUC and FPUC programs were $1,713,827,584 and $11,923,097,900, respectively. The sample was not a statistically valid sample. Recommendation EDD should enhance its adjudication process to support proper eligibility determinations and decrease improper payments to ineligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

The EDD resumed adjudicating all potential eligibility issues as of January 2021 and completed the retroactive determination workload on April 30, 2023. Estimated Implementation Date: April 2023 Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

2021-006

Reference Number: 2022-007 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: Department of Finance (Finance) Assistance Listing Number: 21.027 Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds Federal Award Number and Years: N/A; 2021 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Sections 602(c)(1)(C) and 603(c)(1)(C) of the Social Security Act provide that State and Local Fiscal Recovery Funds (SLFRF) may be used “for the provision of government services to the extent of the reduction in revenue of such…government due to the COVID-19 public health emergency relative to the revenues collected in the most recent full fiscal year of the …government prior to the emergency”. The interim final rule adopted a definition based largely on the components reported under “General Revenue from Own Sources” in the Census Bureau’s Annual Survey of State and Local Government Finances. Under the interim final rule, general revenue included revenue collected by a recipient and generated from its underlying economy, and it would capture a range of different types of tax revenues, as well as other types of revenue that are available to support government services. Specifically, revenue under the interim final rule included money that is received from tax revenue, current charges, and miscellaneous general revenues and excluded refunds and other correcting transactions, proceeds from issuance of debt or the sale of investments, agency or private trust transactions, revenue from utilities, social insurance trust revenues, and intergovernmental transfers from the federal government, including transfers made pursuant to section 9901 of the ARPA. Condition Finance included contributions by State employees to 457(b) and 401(k) deferred compensation plans in the calculation of base year revenues. The contributions from State employees are deposited directly with the third-party deferred compensation plan administrator and do not result in revenue reported by the State in its basic financial statements. Furthermore, the employee contributions do not represent revenues available to the State for the provision of government services and should have been excluded from the calculation of general revenue for the base year and preceding fiscal years establishing the average annual growth rate of general revenues.  Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause The process established by Finance to review and determine the proper inclusion or exclusion of the State’s general ledger revenue accounts in its calculation of base year revenue and preceding fiscal year revenues did not consider whether certain general ledger revenue accounts were reported within the State’s basic financial statements. Additionally, the review controls over the revenue loss calculation did not detect the inclusion of specific general ledger revenue accounts which are included in revenues for budgetary purposes, but which are excluded for financial reporting purposes in the State’s basic financial statements. Effect By including the employee contributions as general revenues in the base revenue calculation, the amount of total revenue loss calculated as available to potentially fund general government services was overstated by $977,898,160. Questioned Costs No questioned costs were identified. Context The amount of revenue loss available to the State to fund general government services was initially calculated as $17,823,151,622. Subsequently, the State revised its calculation by removing contribution amounts by State employees to 457(b) and 401(k) deferred compensation plans, resulting in a revenue loss calculation of $16,845,253,462, a reduction of 5.5%. As of June 30, 2022, the State has reported $11,158,313,000 of total revenue loss utilized for the provision of government services. The amount of revenue loss funded expenditures reported for fiscal year 2022 was not impacted by the reduction. Recommendation Finance should include a reconciliation between general revenues identified for inclusion in the revenue loss calculation and the State’s basic financial statements, to ensure that all revenue recorded in the identified general ledger revenue accounts are in compliance with the definition of general revenues as established by the U.S. Treasury in the Final Rule. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

California received $27 billion in State Fiscal Recovery Funds (SFRF) under the American Rescue Plan Act of 2021 to cover costs and mitigate the impacts of the COVID-19 pandemic. States that lost revenue due to the pandemic are permitted to use an amount of SFRF equivalent to their lost revenue, as calculated pursuant to the U.S. Treasury’s Final Rule, to fund government services. The Department of Finance (Finance) acknowledges that its established review processes did not detect the inclusion of state employee contributions to deferred compensation plans in its revenue loss calculation and that these contributions did not constitute eligible revenue codes as they were not reported as revenues in the state’s basic financial statements. Due to unclear federal guidance, Finance’s original analysis and screening questions accounted for revenue codes that constituted revenues to the state from a budgetary perspective. Finance agrees that this oversight is a material weakness and has since adjusted its approach to the revenue loss calculation by excluding revenue codes that do not constitute revenues from a financial statement accounting perspective. However, Finance maintains that its overall controls and calculation process is sound and disagrees that this oversight was categorized as a material noncompliance finding. As stated in the finding, the overstated revenue loss amount did not impact expenditures reported for fiscal year 2022, and corrective action was taken before this finding and the state’s annual comprehensive financial report were released. The overstated revenue loss amount of $977,898,160 was not transferred from Fund 8506, which was established for the administration of the State Fiscal Recovery Funds received from the federal government, and was not used for the provision of government services. Estimated Implementation Date: January 2024 Contact: Mary Halterman, Assistant Program Budget Manager Federal Funds Cost Tracking & Accountability Unit California Department of Finance

Reference Number: 2022-008 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2205CA5021; 2022 2105CA5021; 2021 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2205CA5ADM; 2022 2205CA5MAP; 2022 2105CA5ADM; 2021 2105CA5MAP; 2021 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code - WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year.   §14713: (b) If the department determines that a mental health plan has failed to comply with the requirements of Chapter 7 (commencing with Section 14000), Chapter 8 (commencing with Section 14200), Chapter 8.8 (commencing with Section 14600), or this chapter, the department may impose sanctions and plans of correction pursuant to Section 14197.7. Condition Fifteen of 56 contractor counties of Short-Doyle funding were tested and 10 had not submitted their cost reports by the December 31 due date. Three of the 10 contractor counties had not submitted their cost reports for fiscal year 2020-21 (more than 12 months late) and 7 of the 10 contractor counties have subsequently submitted their cost reports for fiscal year 2020-21. Although the Mental Health Division of Health Care Services did take the required action of notifying the ten contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2021-008 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2022, disbursements of Short-Doyle funding from the Medical Assistance Program to the 10 noncompliant contractor counties totaled $1,521,017,226, the 15 tested contractor counties totaled $1,827,939,268, and all 56 contractor counties totaled $2,511,609,039. For the fiscal year ended June 30, 2022, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the 10 noncompliant contractor counties totaled $143,710,692, the 15 tested contractor counties totaled $165,488,866, and all 56 contractor counties totaled $218,883,485. The sample was not a statistically valid sample.   Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

The Local Governmental Financing Division, in collaboration with the Audits and Investigations Division, agrees that policies and procedures will be developed to take additional action for significantly late-cost reports and non-compliant counties. As of July 1, 2023, the California Department of Health Care Services transitioned counties away from cost reconciliation financing, and for any state fiscal year after July 1, 2023, counties will no longer be required to submit cost reports. Estimated Implementation Date: July 2023 Contact: Wendy Griffe, Chief Internal Audits California Department of Health Care Services

2021-008

Reference Number: 2022-009 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.959 Federal Program Title: Block Grants for Prevention and Treatment of Substance Abuse (SAPT) Federal Award Numbers and Years: 1B08TI083437-01; 2021 6B08TI083437-01M002; 2021 6B08TI083437-01M003; 2021 6B08TI083437-01M004; 2021 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our testing of 40 employee timesheets, 19 of the 40 employees did not prepare and submit timesheets as required by the Department of Health Care Services (Health Care Services) internal control procedures. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Health Care Services did not adhere to its documented controls due to the effects of COVID-19. The effects resulted in high staff turnover and increased demand on staff resources. Effect Nonadherence to the internal controls over the documentation of employee timesheets can result in the risk of noncompliance with established policies and procedures. Questioned Costs None. Context Expenditures related to payroll costs charged to the SAPT program for fiscal year 2021-22 totaled $11,606,958. Recommendation Health Care Services should adhere to its processes and controls in place to ensure all required employees submit a timesheet. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

The Behavioral Health Administrative support team will endeavor to ensure that timesheets are collected and submitted appropriately. As the payroll system (SCO) and leave accounting (HRIS) are two completely separate programs that do not interact, the Behavioral Health (BH) Administrative Support Team will maintain a master file detailing the funding information for each position. For example, if a position is funded by two different grants, the file would reflect the percentage of work associated with each. It must be noted that as employee leave is tracked and maintained in a separate system, the Absence and Additional Time Worked Reports (STD 634) only reflect hours worked and leave used and does not reflect how a position is funded. Additionally, staff who are in Work Week Group E and are exempt from coverage under the Fair Labor Standards Act (FLSA) are not required to document hours worked for payroll purposes. Therefore, this form would only reflect leave credits used in whole-day increments. This means that on their timesheets, you will only find time used to cover full-day leave usage. These are generally our Supervisors and Managers. Estimated Implementation Date: July 2024 Contact: Raberta Gannon, Chief Behavioral Health Administrative Support Services Section Deputy Diretor’s Office, Behavioral Health California Department of Health Care Services

Reference Number: 2022-010 Category of Finding: Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.917 Federal Program Title: HIV Care Formula Grants COVID-19 HIV Care Formula Grants Federal Award Numbers and Years: 5 X07HA12778-13-00; 2021 6 X07HA12778-13-01; 2021 6 X07HA12778-13-02; 2022 6 X07HA12778-13-03; 2022 6 X07HA12778-13-04; 2022 2 X07HA12778-14-00; 2022 6 X07HA12778-14-01; 2022 6 X07HA12778-14-02; 2022 6 X07HA12778-14-03; 2022 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - The Public Health and Welfare. Chapter 6A - Public Health Service. Subchapter XXIV - HIV Health Care Services Program. Part B - Care Grant Program. Subpart I - General Grant Provisions. Section 300ff-26 - Provision of Treatments: (a) In general A State shall use a portion of the amounts provided under a grant awarded under section 300ff–21 of this title to establish a program under section 300ff–22(b)(3)(B) of this title to provide therapeutics to treat HIV/AIDS or prevent the serious deterioration of health arising from HIV/AIDS in eligible individuals, including measures for the prevention and treatment of opportunistic infections. (b) Eligible individual To be eligible to receive assistance from a State under this section an individual shall: (1) Have a medical diagnosis of HIV/AIDS; and (2) Be a low-income individual, as defined by the State.   California State AIDS Drug Assistance Program Guidelines January 2022: (1.1) AIDS Drug Assistance Program (ADAP) Eligibility Criteria: To be eligible for the ADAP program, a client must: • Have a positive HIV/AIDS diagnosis. • Be at least 18 years old. • Be a resident of California. • Have an annual Modified Adjusted Gross Income (MAGI) that does not exceed 500 percent Federal Poverty Level (FPL) based on household size and income. • Not be fully covered by Medi-Cal or any other third-party payers (an entity that reimburses and manages health care expenses such as private insurance or governmental agencies, employers, etc.). HRSA PCN 15-04 (Revised 1/11/2019): The RWHAP legislation requires that rebates collected on ADAP medication purchases be applied to the RWHAP Part B Program with a priority, but not a requirement, that the rebates be placed back into ADAP. Although ADAP rebates are neither program income nor refunds, they are subject to the same regulatory provision regarding expenditure. These rebates must be used for the statutorily permitted purposes under the RWHAP Part B Program, which are limited to core medical services including ADAP, support services, clinical quality management, and administrative expenses (including planning and evaluation) as part of a comprehensive system of care for low-income individuals living with HIV. Condition Our sample of 60 participants from a population of 25,749 participants who received benefits during the fiscal year identified 10 participants who did not submit all required documentation, including proof of HIV/AIDS diagnosis, proof of residency, and income documentation to verify their annual MAGI did not exceed 500 percent Federal Poverty Level based on household size and income. Identification as a Repeat Finding Finding 2021-011 was reported in the immediate prior year pertaining to not submitting all required documentation. Cause Procedures that required the collection of valid supporting documents were not followed. Existing internal controls did not prevent, or detect and correct, the occurrence of benefits being provided to potentially ineligible individuals. Effect Public Health did not have adequate oversight controls to ensure that the applicant’s eligibility was properly reviewed and approved. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals that may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable because benefit costs were not tracked by individual participants.   Context Pharmacy benefits management services are provided by a contractor who received administrative fees and reimbursements for prescription drug costs to program participants. Payments to the contractor totaled $108,210,356 for approximately 26,000 program participants for the fiscal year ended June 30, 2022. The sample was not a statistically valid sample. Recommendation The ADAP Branch should continue to monitor compliance with its policies to ensure enrollment workers and secondary reviews of ADAP applications follow the established guidelines and retain acceptable documentation to support eligibility determinations. Applications that have been granted an eligibility exception (i.e., Temporary Access Period, Medi-Cal Eligibility Exception Request, or Eligibility Exception Request) should be reviewed in a timely manner to ensure clients who do not provide the required documentation within the approved extension period are disenrolled in a timely manner. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Public Health’s Office of Aids (OA) agrees with the finding and recommendation. OA developed and implemented additional internal quality assurance (QA) processes in April of 2022 to ensure that secondary reviews of AIDS Drug Assistance Program (ADAP) applications are consistently enforcing the existing guidelines, including acceptable supporting documentation and accurate eligibility requirements. Prior to this audit period, and through December 2021, ADAP had issued multiple policy memos to respond to the COVID-19 pandemic, which enabled staff and enrollment workers to defer documentation collection, when necessary, to remain flexible and ensure clients impacted by the pandemic, and associated site closures, did not lose eligibility and access to life-saving medications and comprehensive healthcare. These flexibilities in our guidelines were implemented based on guidance received from our federal funder, the Health Resources and Services Administration, which encouraged ADAP to reassess its organization's eligibility and recertification policies and procedures, and remove any barriers that may impede social distancing, or other public health strategies, necessary to minimize COVID-19 transmission. This documentation deferral was terminated on December 31, 2021, and since January 1, 2022, full documentation and eligibility requirements have been enforced. This, combined with ongoing QA efforts, will help mitigate future findings in ADAP applications. Estimated Implementation Date: Implemented as of April 2022 Contact: Joseph Lagrama, Branch Chief AIDS Drug Assistance Program Branch California Department of Public Health

2021-011

Reference Number: 2022-012 Category of Finding: Special Tests and Provisions – Provider Health and Safety Standards Type of Finding: Material Weakness State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2205CA5ADM; 2022 2205CA5MAP; 2022 2105CA5ADM; 2021 2105CA5MAP; 2021 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition There was no evidence of surveyor signature or supervisor review and approval on Form CMS-1539 for all 40 surveys of providers tested. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause California Department of Public Health (Public Health) did not adhere to its documented controls due to staff members either no longer working with Public Health or being on extended leave. Effect Nonadherence to internal controls over the review and approval process of the Form CMS-1539 can result in the risk of statewide noncompliance as providers may not meet the prescribed health and safety standards. Further, the integrity of the surveys can be compromised because they are being conducted with no apparent oversight. Questioned Costs No questioned costs were identified. Context A total of 987 surveys were included in the population, which consisted of all surveys completed by Public Health for Hospitals, Intermediate Care Facility and Individuals with Intellectual Disabilities and Nursing Facilities during fiscal year 2021-22. Recommendation Public Health should update its processes and controls in place to ensure compliance with established procedures and performance of timely review and approval of the Form CMS-1539, including for situations when staff is on leave and/or has left the department. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Public Health agrees that Form CMS-1539 should be signed. We are exploring reasons why so many forms were not signed, and we will work with our District office management to ensure that they are all signed going forward. Further, we will address this issue at our next meeting of District Managers, District Administrators, and Health Facilities Evaluator Supervisors, and will work to update our training materials as necessary. Finally, we will also explore periodically pulling a sample of completed CMS-1539 forms to verify that signatures are present. Estimated Implementation Date: May 1, 2024 Contact: Elizabeth Moreno, Section Chief Business Operation Section Center for Health Care Quality, Office of Internal Operations California Department of Public Health

Reference Number: 2021-001 Type of Finding: Material Weakness and Material Instance of Noncompliance Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart F - Audit Requirements. §200.510 Financial statements (2 CFR 200.510): (b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. For example, when a Federal program has multiple Federal award years, the auditee may list the amount of Federal awards expended for each Federal award year separately. At a minimum, the schedule must: (3) Provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available. For a cluster of programs also provide the total for the cluster. Condition The State of California (State) has a decentralized financial reporting process, which requires State agencies and departments to provide specific financial information to the Department of Finance (Finance) in order to annually compile the Schedule of Expenditures of Federal Awards (Schedule). In its effort to more efficiently and accurately prepare the Schedule in accordance with the requirements of Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Finance developed the Single Audit Expenditures Reporting Database (Database). Finance developed the Database to include all of the relevant data fields necessary to compile and produce the Schedule. Finance also created a Single Audit Database User Manual, which provides specific guidance to users for accessing and navigating through the database. Due to the unprecedented impacts from the COVID-19 pandemic, the Employment Development Department (EDD) was unable to timely report to Finance through the Database with accurate and reliable federal cash basis expenditures for its largest federal award programs that it administers, the Unemployment Insurance (ALN 17.225) and Presidential Declared Disaster Assistance to Individuals and Households – Other Needs (ALN 97.050) programs. The delay resulted in Finance being unable to compile and produce a complete and final approved Schedule until December 2022. Although initial estimated expenditure amounts were reported by EDD for both programs, $90.6 billion and $7.5 billion, respectively, the final amounts reported in the Schedule for both programs were ultimately updated to $92.7 billion and $6.5 billion, respectively. Cause Given the substantial increase in claimants seeking assistance under the Unemployment Insurance program resulting from the COVID-19 pandemic, EDD was overwhelmed with the overall administration of the Unemployment Insurance program. Also, EDD was still contending with accounting and control issues from the implementation of the State’s Financial Information System for California (FI$Cal), which replaced the legacy system. Effect The difficulties that EDD encountered from the COVID-19 pandemic and continuing FI$Cal implementation issues, resulted in the late reporting and submission of final federal cash basis expenditures to Finance. The untimely submission limited and constrained Finance from compiling and producing a final complete and accurate Schedule. Questioned Costs Questioned costs were not determinable. Recommendation EDD should continue to evaluate its existing process and controls related to its ability to properly account for, report, and timely submit complete and accurate federal award cash basis expenditures to the Database, which affords Finance the ability to timely compile and produce a final Schedule pursuant to the Uniform Guidance. Views of Responsible Officials and Corrective Action Plan EDD agrees with this finding. The deferred transition to FI$Cal and the difficulties experienced thereafter have continued to cause EDD to be late with submitting year-end financials and its ability to submit timely the cash basis expenditures into the Single Audit Expenditures Reporting Database (Database). In addition, the onset of the COVID-19 pandemic created additional issues which ultimately impacted the EDD’s ability to submit timely year-end financials. However, the EDD is making progress and continues to gain ground in the department’s efforts to follow the State’s deadlines for submitting year-end financials and entering the cash basis expenditures into the Database. By the end of fiscal year 2021-22 and into fiscal year 2022-23, the EDD did a restructuring within the accounting area which realigned workload amongst the units and provided additional resources in critical areas. These changes will have a lasting effect and help the department to be better positioned going forward in processing the accounting workload and ultimately be able to catch up and submit year-end financials and enter the cash basis expenditures into the Database by the State’s deadlines. In addition, the EDD took lessons learned from the fiscal year 2019-20 financial audit to update processes and procedures and applied that knowledge going forward. Also, staff have been participating in various trainings offered by Finance and the Department of FISCal and staff continue to work with the control agencies when issues arise that would impact our accounting functions. While the EDD is still behind, the department is making great progress on catching up. The EDD submitted the last of its fiscal year 2020-21 financials in July 2022 and is targeting to submit the last of its fiscal year 2021-22 financials by the end of March 2023. The EDD’s goal is to submit fiscal year 2022-23 financials by the end of December 2023. Similar to the 2019-20 financial audit, the EDD will take the knowledge learned during the 2020-21 audit season, continue to engage with the control agencies, and continue to train and develop staff in order to keep progressing towards the department’s goal of becoming timely with the submission of the year-end financials and entering of the cash basis expenditures into the Database.

EDD agrees with this finding. The deferred transition to FI$Cal and the difficulties experienced thereafter have continued to cause EDD to be late with submitting year-end financials and its ability to submit timely the cash basis expenditures into the Single Audit Expenditures Reporting Database (Database). In addition, the onset of the COVID-19 pandemic created additional issues which ultimately impacted the EDD’s ability to submit timely year-end financials. However, the EDD is making progress and continues to gain ground in the department’s efforts to follow the State’s deadlines for submitting year-end financials and entering the cash basis expenditures into the Database. By the end of fiscal year 2021-22 and into fiscal year 2022-23, the EDD did a restructuring within the accounting area which realigned workload amongst the units and provided additional resources in critical areas. These changes will have a lasting effect and help the department to be better positioned going forward in processing the accounting workload and ultimately be able to catch up and submit year-end financials and enter the cash basis expenditures into the Database by the State’s deadlines. In addition, the EDD took lessons learned from the fiscal year 2019-20 financial audit to update processes and procedures and applied that knowledge going forward. Also, staff have been participating in various trainings offered by Finance and the Department of FISCal and staff continue to work with the control agencies when issues arise that would impact our accounting functions. While the EDD is still behind, the department is making great progress on catching up. The EDD submitted the last of its fiscal year 2020-21 financials in July 2022 and is targeting to submit the last of its fiscal year 2021-22 financials by the end of March 2023. The EDD’s goal is to submit fiscal year 2022-23 financials by the end of December 2023. Similar to the 2019-20 financial audit, the EDD will take the knowledge learned during the 2020-21 audit season, continue to engage with the control agencies, and continue to train and develop staff in order to keep progressing towards the department’s goal of becoming timely with the submission of the year-end financials and entering of the cash basis expenditures into the Database.

See Schedule of Findings and Questioned Costs

The Women, Infants, and Children Division (WIC) of the California Department of Public Health (Public Health) agrees that the WIC WISE system does not currently store eligibility history that should be included in the ?Cert History Report.? Currently, the initial eligibility data is overwritten when subsequent eligibility information is keyed into WIC WISE. WIC WISE does include preventative internal stops or check points that do not allow ineligible individuals to be certified and issued benefits (e.g., over income, not a CA resident, no nutrition risk factor, etc.). User acceptance testing vetted these items prior to system implementation. The certification history condition will be remediated via a system Defect Correction to WIC WISE. WIC has entered Defect Correction #6972 in Team Foundation Services (TFS), the tracking system used to capture system changes and defects. This correction is included in a release that is currently being tested and is targeted for release into production by May 2023. The defect supports a system change to ensure initial eligibility information is retained when subsequent eligibility information is entered into WIC WISE. Estimated Implementation Date: May 2023 Contact: William Welch, Assistant Division Chief, Operations Women, Infants, and Children Division California Department of Public Health

2020-002

Reference Number: 2021-002 Type of Finding: Material Weakness and Instance of Noncompliance Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart F - Audit Requirements. §200.510 Financial statements (2 CFR 200.510): (b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. For example, when a Federal program has multiple Federal award years, the auditee may list the amount of Federal awards expended for each Federal award year separately. At a minimum, the schedule must: (3) Provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available. For a cluster of programs also provide the total for the cluster. (4) Include the total amount provided to subrecipients from each Federal program. Condition The State of California (State) has a decentralized financial reporting process, which requires State agencies and departments to provide specific financial information to the Department of Finance (Finance) in order to annually compile the Schedule of Expenditures of Federal Awards (Schedule). In its effort to more efficiently and accurately prepare the Schedule in accordance with the requirements of 2 CFR 200.510, Finance developed the Single Audit Expenditures Reporting Database (Database) to include all relevant data fields necessary to compile and produce the Schedule. Finance also created a Single Audit Database User Manual, which provides specific guidance to users for accessing and navigating through the database. Departments are given access to the centralized Database by Finance in order to upload and report federal award information for all federal award programs which they administer. The California Department of Public Health (Public Health) failed to include $479,996,082 of federal expenditures and $367,405,431 of subrecipient expenditures for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program (ALN No. 93.323) in the Database, which Finance uses to prepare the State’s annual Schedule. The error resulted in an additional major program that had to be audited in accordance with the Uniform Guidance and the State having to re-issue its federal compliance audit report for the fiscal year ended June 30, 2021. Cause Public Health entered into a Bona Fide Agent Designation arrangement with Public Health Foundation Enterprises, Inc., dba Heluna Health, for the submission of a grant application under the State of California’s eligibility in lieu of a direct State application for the U.S. Department of Health and Human Services (HHS), Centers for Disease Control and Prevention (CDC) funding opportunity: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Cooperative Agreement. Subsequent to the bona fide agent arrangement, Public Health entered into a separate subrecipient agreement with Heluna Health on March 2, 2021, to provide Heluna Health with certain services related to the performance of its obligations under the ELC program grant award received from HHS. Since Public Health is typically not a subrecipient of federal awards and the accounting control for ELC program revenues and expenditures was established within the State’s General Fund rather than the Federal Trust Fund, which is State standard operating procedure, Public Health failed to identify and report the $479,996,082 of federal expenditures in the Schedule. Effect Because of the ELC program’s inclusion in the State’s Schedule for the fiscal year ended June 30, 2021, the ELC program had to be audited as a major program under requirements of the Uniform Guidance and the State’s federal compliance report had to be reissued. Questioned Costs No questioned costs were identified. Recommendation When infrequent and unusual arrangements occur impacting processes and procedures surrounding federal award programs, Public Health should ensure there is sufficient identification and understanding of the administrative and operational changes from standard operating procedures. Public Health should then design appropriate internal controls commensurate with such changes to ensure adherence to applicable laws and regulations. Views of Responsible Officials and Corrective Action Plan Management's response is reported in "Management's Response and Corrective Action Plan" included in a separate section at the end of this report.

Public Health’s Accounting Office will generate the FI$Cal Year End Close report (KK_12 expenditure) and collaborate with the ELC program to ensure that all expenditures captured are complete and accurate, ensuring timely reporting of the SEFA data for FY 2023-24 and beyond. Additionally, we will update the procedures to document the SEFA reporting for the ELC program.

See Schedule of Findings and Questioned Costs

Since fiscal year 2020-21, EDD has implemented dozens of strict anti-fraud measures to continue to evaluate and enhance its fraud detection. These measures, described in last year?s response to finding Reference Number 2020-005, included, but were not limited to, cross matching claimant information against law enforcement and government databases and implementing rigorous new identity verification procedures. As a result, EDD caught and stopped multiple fraud attempts starting in September 2020. As previously described, EDD implemented the following measures to address the nationwide fraud attempts perpetrated against the new emergency federal benefit programs in 2020-21: ? Implemented additional cross-matches in September 2020 to detect multiple claims per address. ? Ceased automatically backdating Pandemic Unemployment Assistance (PUA) claims under federal rules in September 2020. ? Strengthened identity verification procedures in October 2020 by implementing ID.me. ? Implemented additional cross-matches in November 2020 against state inmate information. ? Vetted applications against law enforcement databases and other tools provided by Thomson Reuters in December 2020 to further curb identity and non-identity fraud. ? Established a 1099-G call center to help victims of identity theft deal with any tax-related questions. ? Ceased printing Social Security numbers on mailed documents to reduce identity theft risk. ? Enhanced benefit card security with Bank of America. ? Partnered with state, local and federal law enforcement agencies to support thousands of criminal investigations, arrests, prosecutions and convictions. The EDD will continue to evaluate and enhance the fraud detection/prevention tools that have been put in place. Estimated Implementation Date: September 2020 Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

2020-005

Reference Number: 2021-003 Category of Finding: Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 10.557 Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children COVID-19 Special Supplemental Nutrition Program for Women, Infants, and Children Federal Award Numbers and Years: 202019W100647; 2020 202020W100347, 2020 202020W100647, 2020 202120W600347, 2021 202120W600647, 2021 202121W100347, 2021 202121W100647, 2021 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 7 – Agriculture. Subtitle B - Regulations of the Department of Agriculture. Chapter II – Food and Nutrition Service, Department of Agriculture. Subchapter A – Child Nutrition Programs. Part 246 - Special Supplemental Nutrition Program for Women, Infants and Children. §246.7 - Certification of participants: (c) Eligibility criteria and basic certification procedures. (1) To qualify for the Program, infants, children, and pregnant, postpartum, and breastfeeding women must: (i) Reside within the jurisdiction of the State (except for Indian State agencies). Indian State agencies may establish a similar requirement. All State agencies may determine a service area for any local agency, and may require that an applicant reside within the service area. However, the State agency may not use length of residency as an eligibility requirement. (ii) Meet the income criteria specified in paragraph (d) of this section. (iii) Meet the nutritional risk criteria specified in paragraph (e) of this section. (2) (i) At certification, the State or local agency must require each applicant to present proof of residency (i.e., location or address where the applicant routinely lives or spends the night) and proof of identity. The State or local agency must also check the identity of participants, or in the case of infants or children, the identity of the parent or guardian, or proxies when issuing food, cash-value vouchers or food instruments. The State agency may authorize the certification of applicants when no proof of residency or identity exists (such as when an applicant or an applicant's parent is a victim of theft, loss, or disaster; a homeless individual; or a migrant farmworker). In these cases, the State or local agency must require the applicant to confirm in writing his/her residency or identity. Further, an individual residing in a remote Indian or Native village or an individual served by an Indian tribal organization and residing on a reservation or pueblo may establish proof of residency by providing the State agency their mailing address and the name of the remote Indian or Native village. (e) Nutritional risk. To be certified as eligible for the Program, applicants who meet the Program's eligibility standards specified in paragraph (c) of this section must be determined to be at nutritional risk. … Nutritional risk data shall be documented in the participant's file and shall be used to assess an applicant's nutritional status and risk; tailor the food package to address nutritional needs; design appropriate nutrition education, including breastfeeding promotion and support; and make referrals to health and social services for follow-up, as necessary and appropriate. (1) Determination of nutritional risk. (ii) Timing of nutritional risk data. (A) Weight and height or length. Weight and height or length shall be measured not more than 60 days prior to certification for program participation. (B) Hematological test for anemia. (1) For pregnant, breastfeeding, and postpartum women, and child applicants, the hematological test for anemia shall be performed or obtained from referral sources at the time of certification or within 90 days of the date of certification. The hematological test for anemia may be deferred for up to 90 days from the time of certification for applicants who have at least one qualifying nutritional risk factor present at the time of certification. If no qualifying risk factor is identified, a hematological test for anemia must be performed or obtained from referral sources (with the exception of presumptively eligible pregnant women). (2) Infants nine months of age and older (who have not already had a hematological test performed, between six and nine months of age, by a competent professional authority or obtained from referral sources), shall between nine and twelve months of age have a hematological test performed or obtained from referral sources. Such a test may be performed more than 90 days after the date of certification. (3) For pregnant women, the hematological test for anemia shall be performed during their pregnancy. For persons certified as postpartum or breastfeeding women, the hematological test for anemia shall be performed after the termination of their pregnancy. For breastfeeding women who are 6-12 months postpartum, no additional blood test is necessary if a test was performed after the termination of their pregnancy. The participant or parent/guardian shall be informed of the test results when there is a finding of anemia, and notations reflecting the outcome of the tests shall be made in the participant's file. Nutrition education, food package tailoring, and referral services shall be provided to the participant or parent/guardian, as necessary and appropriate. Condition During the fiscal year ended June 30, 2020, the Special Supplemental Food Program for Women, Infants and Children (WIC) nutrition program implemented phase 1 of a new management information system known as the Women, Infants, and Children Web Information System Exchange (WIC-WISE) in a two-phased approach to replace the WIC Management Information Systems (WIC-MIS). WIC-WISE is programmed such that updates to eligibility information overwrites existing data. As a result, key data and documentation to support the initial participant eligibility is removed during the recertification process. The California Department of Public Health, WIC Division requested a correction to WIC-WISE to retain eligibility history in the “Cert History Report” when subsequent eligibility information is entered. This correction will be included in a future release targeted for May 2023. As such, the system defect still existed during the fiscal year ended June 30, 2021. Accordingly, sample testing was not performed. Identification as a Repeat Finding Finding 2020-002 was reported in the immediate prior year. Cause The phase 1 implementation of WIC-WISE did not include system functionality to retain historical eligibility documentation when subsequent information was entered during the participant recertification process. Effect The system limitation of WIC-WISE does not allow for the retention of proper documentation of eligibility information. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals, which may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable. Context Total food vouchers disbursed to program participants during the fiscal year ended June 30, 2021, totaled $471,612,402. Recommendation WIC-WISE system updates should be promptly implemented and tested to ensure that participant data and eligibility documentation is appropriately retained within the system. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

The Women, Infants, and Children Division (WIC) of the California Department of Public Health (Public Health) agrees that the WIC WISE system does not currently store eligibility history that should be included in the “Cert History Report.” Currently, the initial eligibility data is overwritten when subsequent eligibility information is keyed into WIC WISE. WIC WISE does include preventative internal stops or check points that do not allow ineligible individuals to be certified and issued benefits (e.g., over income, not a CA resident, no nutrition risk factor, etc.). User acceptance testing vetted these items prior to system implementation. The certification history condition will be remediated via a system Defect Correction to WIC WISE. WIC has entered Defect Correction #6972 in Team Foundation Services (TFS), the tracking system used to capture system changes and defects. This correction is included in a release that is currently being tested and is targeted for release into production by May 2023. The defect supports a system change to ensure initial eligibility information is retained when subsequent eligibility information is entered into WIC WISE. Estimated Implementation Date: May 2023 Contact: William Welch, Assistant Division Chief, Operations Women, Infants, and Children Division California Department of Public Health

2020-002

See Schedule of Findings and Questioned Costs

Given the unprecedented volume of unemployment insurance claims during the federal disaster -approximately 20 million claims compared to 3.8 million during the Great Recession - EDD took action to speed payments to eligible claimants whenever possible. For example, EDD launched in July 2021 a Conditional Payment Program to speed payments to claimants who certified for benefits and already received at least one week of benefits in the past but whose payments were later pending for more than two weeks. EDD also boosted its capacity to process workloads, prioritized timely payments, and employed automation among other measures. As reported in Reference Number 2020-006 in fiscal year 2019-2020, EDD began automatically cross-matching EDD wage records and Franchise Tax Board (FTB) records in November 2020 to assist in verifying the income of PUA claimants. Claimants who could not be automatically verified through the FTB wage record match were required to submit additional documentation to EDD for a manual review. Regarding the manual processing of the income documents to substantiate the PUA weekly benefit amounts that have been increased above the minimum California weekly benefit amount (WBA) of $167, in June 2022, the EDD submitted a blanket waiver application to the U.S. Department of Labor (DOL), pursuant to the DOL Unemployment Insurance Program Letter 20-21, Change 1. EDD?s application is pending the DOL?s determination. If approved, our blanket waiver application would cover any overpayments for claimants who, through no fault of their own, failed to provide proof of income substantiation to support the increase or whose WBA will be decreased because the proof they provided was insufficient. Regarding the verification of employment or self-employment substantiation (known in California as ?Self-employment/Employment Substantiation? or ?SEES?), this verification process is being implemented in two phases. Phase 1 of the SEES effort was implemented on November 10, 2021, and involved notifying claimants registered in California?s UI Online (UIO) system by email and text of their requirement to provide SEES documentation. Phase 2 will involve notifying claimants who did not respond to the UIO request for SEES documentation, and those who are not registered in UIO, via a paper notice mailed through the United States Postal Service (USPS). EDD submitted a blanket overpayment waiver application in June 2022 to DOL regarding this issue. EDD will assess further implementation based on the DOL?s decision. If approved, our blanket waiver application would cover any overpayments for claimants who, through no fault of their own, provided insufficient documentation or did not provide any documentation. Estimated Implementation Date: To be determined once the DOL provides a decision on the waiver application. Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

2020-006

Reference Number: 2021-004 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance (HR748/2020) Federal Award Numbers and Year: UI-34702-20-55-A-6; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 - Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 - Disaster Unemployment Assistance, §625.14 Overpayments; disqualification for fraud: (h) Provisions in the procedures of each State with respect to detection and prevention of fraudulent overpayments of DUA shall be, as a minimum, commensurate with the procedures adopted by the State with respect to regular compensation and consistent with the Secretary's “Standard for Fraud and Overpayment Detection,” Employment Security Manual, part V, sections 7510 et seq. (Appendix C of this part). (i) Any individual who, with respect to a major disaster, makes or causes another to make a false statement or misrepresentation of a material fact, knowing it to be false, or knowingly fails or causes another to fail to disclose a material fact, in order to obtain for the individual or any other person a payment of DUA to which the individual or any other person is not entitled, shall be disqualified as follows: (1) If the false statement, misrepresentation, or nondisclosure pertains to an initial application for DUA – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of any DUA with respect to that major disaster; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of any DUA with respect to that major disaster; and (2) If the false statement, misrepresentation, or nondisclosure pertains to a week for which application for a payment of DUA is made – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA. Title 15 - Commerce and Trade, Chapter 116, Coronavirus Economic (CARES Act) Subchapter II - Unemployment Insurance Provisions, §9023 Emergency Increase in Unemployment Compensation Benefits (f) Fraud and Overpayments: (1) In General – If an individual knowingly has made, or caused to be made by another, a false statement or representation of a material fact, or knowingly has failed, or caused another to fail, to disclose a material fact, and as a result of such false statement or representation or of such nondisclosure such individual has received an amount of Federal Pandemic Unemployment Compensation or Mixed Earner Unemployment Compensation to which such individual was not entitled, such individual— (A) shall be ineligible for further Federal Pandemic Unemployment Compensation Mixed Earner Unemployment Compensation in accordance with the provisions of the applicable State unemployment compensation law relating to fraud in connection with a claim for unemployment compensation Condition During the fiscal year ended June 30, 2021, EDD continued its administration of the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. Claimants eligible for PUA benefits were paid additional benefits under the Federal Pandemic Unemployment Compensation program (FPUC). In EDD’s administration of the PUA and FPUC programs, $17,143,006,979 in benefit payments were estimated to be potentially fraudulent payments. The estimate was made by the Unemployment Insurance Branch and was based on data parameters to identify claimants that received benefits that matched imposter fraud for identity or eligibility fraud for misrepresented information. Out of 138 PUA benefit payments tested, there were 26 benefit payments to claimants determined to be potentially fraudulent whose identity was not sufficiently verified. Identification as a Repeat Finding Finding 2020-005 was reported in the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, instances of potential fraud for benefit payments for the following reasons. • There was a significant increase in unemployment claims that overwhelmed EDD’s existing fraud detection process. • There were insufficient controls in place to prevent or detect fraud associated with benefit payments related to incarceration, identity, and multiple claims from the same address. Effect EDD did not have adequate oversight controls to ensure that benefit payments were not being made to fraudulent claimants. Accordingly, benefit payments were made to fraudulent claimants who were not eligible. Questioned Costs Likely questioned costs were estimated to be $17,143,006,979 for fiscal year 2020-21. Known questioned costs were $570,802. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2021, totaled $66,108,457,174. The sample was not a statistically valid sample. Recommendation EDD should continue to evaluate and enhance it fraud detection and prevention internal controls, increasing the use of automation features and other analytical tools in an effort to increase efficiency, continue to reduce workload, and enhance detection and timely identification of unemployment benefit fraud. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Since fiscal year 2020-21, EDD has implemented dozens of strict anti-fraud measures to continue to evaluate and enhance its fraud detection. These measures, described in last year’s response to finding Reference Number 2020-005, included, but were not limited to, cross matching claimant information against law enforcement and government databases and implementing rigorous new identity verification procedures. As a result, EDD caught and stopped multiple fraud attempts starting in September 2020. As previously described, EDD implemented the following measures to address the nationwide fraud attempts perpetrated against the new emergency federal benefit programs in 2020-21: • Implemented additional cross-matches in September 2020 to detect multiple claims per address. • Ceased automatically backdating Pandemic Unemployment Assistance (PUA) claims under federal rules in September 2020. • Strengthened identity verification procedures in October 2020 by implementing ID.me. • Implemented additional cross-matches in November 2020 against state inmate information. • Vetted applications against law enforcement databases and other tools provided by Thomson Reuters in December 2020 to further curb identity and non-identity fraud. • Established a 1099-G call center to help victims of identity theft deal with any tax-related questions. • Ceased printing Social Security numbers on mailed documents to reduce identity theft risk. • Enhanced benefit card security with Bank of America. • Partnered with state, local and federal law enforcement agencies to support thousands of criminal investigations, arrests, prosecutions and convictions. The EDD will continue to evaluate and enhance the fraud detection/prevention tools that have been put in place. Estimated Implementation Date: September 2020 Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

2020-005

See Schedule of Findings and Questioned Costs

The EDD resumed adjudicating all potential eligibility issues as of January 2021 and will complete any remaining retroactive workload by April 30, 2023. Estimated Implementation Date: January 2021 Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

2020-004

Reference Number: 2021-005 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance (HR748/2021) Federal Award Numbers and Years: UI-34702-20-55-A-6; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 - Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 - Disaster Unemployment Assistance, §625.6 Weekly amount; jurisdictions; reductions Eligibility and Disqualifications, (b) If the weekly amount computed under paragraph (a) of this section is less than 50 percent of the average weekly payment of regular compensation in the State, as provided quarterly by the Department, or, if the individual has insufficient wages from employment or insufficient or no net income from self-employment (which includes individuals falling within paragraphs (a)(3) and (b)(3) of § 625.5) in the applicable base period to compute a weekly amount under paragraph (a) of this section, the individual shall be determined entitled to a weekly amount equal to 50 percent of the average weekly payment of regular compensation in the State. (e) The State agency shall immediately determine, upon the filing of an initial application for DUA, a weekly amount under the provisions of paragraphs (a) through (d) of this section, as the case may be, based on the individual's statement of employment or self-employment preceding the individual's unemployment that was a direct result of the major disaster, and wages earned or paid for such employment or self-employment. An immediate determination of a weekly amount shall also be made where, in conjunction with the filing of an initial application for DUA, the individual submits documentation substantiating employment or self-employment and wages earned or paid for such employment or self-employment, or, in the absence of documentation, where any State agency records of employment or self-employment and wages earned or paid for such employment or self-employment, justify the determination of a weekly amount. An immediate determination shall also be made based on the individual's statement or in conjunction with the submittal of documentation in those cases where the individual was to commence employment or self-employment on or after the date the major disaster began but was prevented from doing so as a direct result of the disaster. (1) In the case of a weekly amount determined in accordance with paragraph (e) of this section, based only on the individual's statement of earnings, the individual shall furnish documentation to substantiate the employment or self-employment or wages earned from or paid for such employment or self-employment or documentation to support that the individual was to commence employment or self-employment on or after the date the major disaster began. In either case, documentation shall be submitted within 21 calendar days of the filing of the initial application for DUA. (3) For purposes of a computation of a weekly amount under paragraph (a) of this section, if an individual submits documentation to substantiate employment or self-employment in accordance with paragraph (e)(1), but not documentation of wages earned or paid during the base period set forth in paragraph (a)(2) of this section, including those cases where the individual has not filed a tax return for the most recent tax year that has ended, the State agency shall immediately redetermine the weekly amount of DUA payable to the individual in accordance with paragraph (b) of this section. Condition During the fiscal year ended June 30, 2020, EDD implemented the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. The amount of PUA payable to an unemployed or unemployed self-employed individual for a week of total unemployment shall be the weekly amount of compensation the individual would have been paid as regular compensation, as computed under the provisions of the applicable State law for a week of total unemployment. The weekly amount determination is calculated using the wages reported by the claimant. Upon receipt of a PUA claim, EDD would verify wages reported to ensure accurate weekly benefit amounts under PUA. Out of 138 PUA benefit payments tested, there were 4 claimants whose wages were not reduced or suspended due to a lack of wage verification and 8 claimants whose self-employment were not verified. Identification as a Repeat Finding Finding 2020-006 was reported in the immediate prior year. Cause EDD did not perform timely wage verifications of the claimants due to the significant increase in claims resulting from the COVID-19 pandemic. Effect EDD did not have adequate oversight controls to ensure that the claimant’s wages were timely and properly reviewed and approved. Accordingly, there was an increased risk for the occurrence of overpayment in benefits being provided to individuals, which was not timely prevented or detected. Questioned Costs Known questioned costs for the 12 claimants were $325,948. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2021, totaled $66,108,457,174. The sample was not a statistically valid sample. Recommendation EDD should continue to look for ways to enhance its capacity to perform timely wage verifications to ensure accurate eligibility determinations and claimant benefit payments. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Given the unprecedented volume of unemployment insurance claims during the federal disaster -approximately 20 million claims compared to 3.8 million during the Great Recession - EDD took action to speed payments to eligible claimants whenever possible. For example, EDD launched in July 2021 a Conditional Payment Program to speed payments to claimants who certified for benefits and already received at least one week of benefits in the past but whose payments were later pending for more than two weeks. EDD also boosted its capacity to process workloads, prioritized timely payments, and employed automation among other measures. As reported in Reference Number 2020-006 in fiscal year 2019-2020, EDD began automatically cross-matching EDD wage records and Franchise Tax Board (FTB) records in November 2020 to assist in verifying the income of PUA claimants. Claimants who could not be automatically verified through the FTB wage record match were required to submit additional documentation to EDD for a manual review. Regarding the manual processing of the income documents to substantiate the PUA weekly benefit amounts that have been increased above the minimum California weekly benefit amount (WBA) of $167, in June 2022, the EDD submitted a blanket waiver application to the U.S. Department of Labor (DOL), pursuant to the DOL Unemployment Insurance Program Letter 20-21, Change 1. EDD’s application is pending the DOL’s determination. If approved, our blanket waiver application would cover any overpayments for claimants who, through no fault of their own, failed to provide proof of income substantiation to support the increase or whose WBA will be decreased because the proof they provided was insufficient. Regarding the verification of employment or self-employment substantiation (known in California as “Self-employment/Employment Substantiation” or “SEES”), this verification process is being implemented in two phases. Phase 1 of the SEES effort was implemented on November 10, 2021, and involved notifying claimants registered in California’s UI Online (UIO) system by email and text of their requirement to provide SEES documentation. Phase 2 will involve notifying claimants who did not respond to the UIO request for SEES documentation, and those who are not registered in UIO, via a paper notice mailed through the United States Postal Service (USPS). EDD submitted a blanket overpayment waiver application in June 2022 to DOL regarding this issue. EDD will assess further implementation based on the DOL’s decision. If approved, our blanket waiver application would cover any overpayments for claimants who, through no fault of their own, provided insufficient documentation or did not provide any documentation. Estimated Implementation Date: To be determined once the DOL provides a decision on the waiver application. Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

2020-006

Reference Number: 2021-006 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: Unemployment Insurance COVID-19 Unemployment Insurance Federal Award Numbers and Years: UI-35637-21-55-A-6; 2021 UI-34702-20-55-A-6; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 22 - Social Security, Division 1 - Employment Development Department, Subdivision 1 - Director of Employment Development, Division - 1 Unemployment and Disability Compensation, Part 1 - Unemployment Compensation, Chapter 5 Unemployment Compensation Benefits, Article 1 - Eligibility and Disqualifications §1256 and §1257 Eligibility and Disqualifications, §1256 California Code of Regulations: (a) An individual is disqualified for unemployment compensation benefits if the director finds that he or she left his or her most recent work voluntarily without good cause or that he or she has been discharged for misconduct connected with his or her most recent work. Eligibility and Disqualifications, §1257 California Code of Regulations: (a) An individual is also disqualified for unemployment compensation benefits if: He or she willfully, for the purpose of obtaining unemployment compensation benefits, either made a false statement or representation, including, but not limited to, using a false name, false social security number, or other false identification, with actual knowledge of the falsity thereof, or withheld a material fact in order to obtain any unemployment compensation benefits under this division. Condition In EDD’s administration of the Unemployment Insurance program, $1,440,071,129 in benefit payments were estimated to be potentially fraudulent payments. The estimate was made by the Unemployment Insurance Branch and was based on data parameters to identify claimants that received benefits that matched imposter fraud for identity or eligibility fraud for misrepresented information. The Unemployment Insurance Branch of EDD reviews unemployment insurance claims of claimants for involuntary separation to ensure separations were for valid reasons under the Unemployment Insurance Code. Out of 138 unemployment insurance benefit payments tested, there were 4 claimants receiving benefits, whose reasons for involuntary separation indicated separation reasons due to voluntary quitting without good cause. Identification as a Repeat Finding Finding 2020-004 was reported in the immediate prior year. Cause The adjudication process for potential eligibility issues, which includes work separation, was not timely reviewed due to the significant increase in claims resulting from the COVID-19 pandemic. Effect By EDD not performing timely review for potential eligibility issues, benefit payments were made to ineligible claimants. Questioned Costs Known questioned costs for the 4 claimants were $13,720 for the Unemployment Insurance program and $16,200 for the Federal Pandemic Unemployment Compensation program of the COVID-19 Unemployment Insurance program. Context Benefits paid to claimants under the Unemployment Insurance program for the fiscal year ended June 30, 2021, totaled $25,554,569,761. The sample was not a statistically valid sample. Recommendation EDD should continue its work catching up with the adjudication process to support proper eligibility determinations and decrease improper payments to ineligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

The EDD resumed adjudicating all potential eligibility issues as of January 2021 and will complete any remaining retroactive workload by April 30, 2023. Estimated Implementation Date: January 2021 Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

2020-004

See Schedule of Findings and Questioned Costs

Health Care Services agrees with the recommendation and implemented corrective action by October 31, 2022. Health Care Services, or DHCS, published Behavioral Health Information Notice (BHIN) 22-045 which outlines Health Care Services sanctions policy. The BHIN states ?Under state and federal law DHCS must enforce compliance with the terms of the DHCS? contracts with Mental Health Plans and Drug Medi-Cal Organized Delivery System counties, as well as ensure compliance with applicable state and federal laws and regulations, in accordance with its authority and obligations under state and federal requirements.? Lastly, under the section titled `Exhibit A - Attachment 3? of the County Mental Health Plan Contract counties are required to submit cost reports timely which would allow Health Care Services to impose sanctions on counties who do not submit cost reports in a timely manner. This BHIN resolves the finding. Additionally, Health Care Services will not be collecting cost reports for dates of service after State Fiscal Year 2022-23. Under the California Advancing and Innovating Medi-Cal (CalAIM) initiative, and pursuant to Welfare and Institutions Code, Section 14184.403(b), Health Care Services will replace the current Certified Public Expenditures (CPE) reimbursement methodology with an intergovernmental transfer (IGT) reimbursement methodology. The IGT reimbursement methodology will make a single and final payment for services provided to the county, which includes the non-federal portion of the claims. This change will eliminate the requirement for the county submission of cost reports. Estimated Implementation Date: October 31, 2022 Contact: Wendy Griffe, Chief Internal Audits California Department of Health Care Services

2020-007

Reference Number: 2021-008 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code - WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year.   §14712: (e) Whenever the department determines that a mental health plan has failed to comply with this chapter or any regulations, contractual requirements, state plan, or waivers adopted pursuant to this chapter, the department shall notify the mental health plan in writing within 30 days of its determination and may impose sanctions, including, but not limited to, fines, penalties, the withholding of payments, special requirements, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Condition Fifteen of 56 contractor counties of Short-Doyle funding were tested and seven had not submitted their cost reports by the December 31 due date. Two of the seven contractor counties had not submitted their cost reports for fiscal year 2019-20 (more than 12 months late) and five of the seven contractor counties have subsequently submitted their cost reports for fiscal year 2020-21. Although the Mental Health Division of Health Care Services did take the required action of notifying the seven contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2020-007 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Medical Assistance Program to the seven noncompliant contractor counties totaled $990,507,492, the 15 tested contractor counties totaled $1,766,996,894, and all 56 contractor counties totaled $2,189,728,183. For the fiscal year ended June 30, 2021, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven noncompliant contractor counties totaled $99,333,754, the 15 tested contractor counties totaled $183,713,347, and all 56 contractor counties totaled $215,971,858. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Health Care Services agrees with the recommendation and implemented corrective action by October 31, 2022. Health Care Services, or DHCS, published Behavioral Health Information Notice (BHIN) 22-045 which outlines Health Care Services sanctions policy. The BHIN states “Under state and federal law DHCS must enforce compliance with the terms of the DHCS’ contracts with Mental Health Plans and Drug Medi-Cal Organized Delivery System counties, as well as ensure compliance with applicable state and federal laws and regulations, in accordance with its authority and obligations under state and federal requirements.” Lastly, under the section titled ‘Exhibit A - Attachment 3’ of the County Mental Health Plan Contract counties are required to submit cost reports timely which would allow Health Care Services to impose sanctions on counties who do not submit cost reports in a timely manner. This BHIN resolves the finding. Additionally, Health Care Services will not be collecting cost reports for dates of service after State Fiscal Year 2022-23. Under the California Advancing and Innovating Medi-Cal (CalAIM) initiative, and pursuant to Welfare and Institutions Code, Section 14184.403(b), Health Care Services will replace the current Certified Public Expenditures (CPE) reimbursement methodology with an intergovernmental transfer (IGT) reimbursement methodology. The IGT reimbursement methodology will make a single and final payment for services provided to the county, which includes the non-federal portion of the claims. This change will eliminate the requirement for the county submission of cost reports. Estimated Implementation Date: October 31, 2022 Contact: Wendy Griffe, Chief Internal Audits California Department of Health Care Services

2020-007

See Schedule of Findings and Questioned Costs

Health Care Services agrees with the finding. The U.S. Centers for Medicare and Medicaid Services (CMS) has confirmed the continuous enrollment requirement is now delinked from the Public Health Emergency (PHE) in the Consolidation Appropriations Act of 2023, (enacted December 29, 2022), which ends on March 31, 2023. Health Care Services will begin the continuous coverage requirement unwinding activities, including the resumption of renewals, on April 1, 2023. Per the current county oversight timeline established within the California Advancing and Innovating Medi-Cal (CalAIM) implementation timeline, the resumption of oversight and monitoring activities shall begin 14 months after the onset of continuous coverage requirement unwinding activities; therefore, the new implementation date to initiate these activities is May 1, 2024. Estimated Implementation Date: May 1, 2024 Contact: Wendy Griffe, Chief Internal Audits California Department of Health Care Services

See Schedule of Findings and Questioned Costs

The Office of AIDS (OA) agrees with the finding and recommendation. OA developed and implemented additional, internal quality assurance (QA) processes in April of 2022 to ensure that secondary reviews of AIDS Drug Assistance Program (ADAP) applications are consistently enforcing the existing guidelines, including acceptable supporting documentation and accurate eligibility requirements. During this audit period, and through December 2021, ADAP had issued multiple policy memos to respond to the COVID-19 pandemic, which enabled staff and enrollment workers to defer documentation collection, when necessary, to remain flexible and ensure clients impacted by the pandemic, and associated site closures, did not lose eligibility and access to life saving medications and comprehensive healthcare. These flexibilities in our guidelines were implemented based on guidance received from our federal funder, Health Resources and Services Administration (HRSA), which encouraged ADAPs to reassess their organization's eligibility and recertification policies and procedures, and remove any barriers that may impede social distancing, or other public health strategies, necessary to minimize COVID-19 transmission. This documentation deferral was terminated on December 31, 2021, and since January 1, 2022, full documentation and eligibility requirements have been enforced. This, combined with ongoing QA efforts, will help to mitigate future findings in ADAP applications dated January 1, 2022 onward. Estimated Implementation Date: Already implemented as of April 2022 Contact: Sharisse Kemp, Branch Chief AIDS Drug Assistance Program Branch California Department of Public Health

2020-009

Reference Number: 2021-010 Category of Finding: Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services: Subchapter D - State Children’s Health Insurance Program (SCHIPs), Part 457 - Allotments and Grants to States, Subpart C - State Plan Requirements: Eligibility, Screening, Applications, and Enrollment: § 457.340 Application for and enrollment in CHIP (e) Notice of eligibility determinations: The State must provide each applicant or enrollee with timely and adequate written notice of any decision affecting his or her eligibility, including an approval, denial or termination, or suspension of eligibility, consistent with §§ 457.315, 457.348, and 457.350. The notice must be written in plain language; and accessible to persons who are limited English proficient and individuals with disabilities, consistent with § 435.905(b) of this chapter and § 457.110. 42 CFR § 457.353 - Monitoring and evaluation of screening process States must establish a mechanism and monitor to evaluate the screen and enroll process described at § 457.350 of this subpart to ensure that children who are: (a) Screened as potentially eligible for other insurance affordability programs are enrolled in such programs, if eligible; or (b) Determined ineligible for other insurance affordability programs are enrolled in CHIP, if eligible. Condition Out of 40 Children’s Health Insurance Program (CHIP) beneficiaries tested, there was one beneficiary where the transaction sent to terminate eligibility failed and eligibility continued in error, and one instance where the beneficiary remained in a transitional aid code for an extended period. Through subawards, Health Care Services has delegated performance of eligibility determinations to California county welfare agencies that collect and record this information in their respective eligibility systems (collectively known as the Statewide Automated Welfare System [SAWS]) and the California Healthcare Eligibility, Enrollment, and Retention System (CalHEERS), which transmit eligibility data to the Health Care Services’ Medi-Cal Eligibility Data System (MEDS). Health Care Services then pays: (1) managed care plans monthly to provide eligible services for beneficiaries (Managed Care); (2) medical providers for services provided directly to beneficiaries (Fee for Service), and (3) the U.S. Centers for Medicare and Medicaid Services (CMS) for Medicare premiums (Premiums). Supplemental Information to Provide Additional Perspective on the Condition In addition to the above exceptions noted during this audit, in February 2018, the U.S. Department of Health and Human Services Office of Inspector General (OIG) issued a report titled “California Made Medicaid Payments on Behalf of Newly Eligible Beneficiaries Who Did Not Meet Federal and State Requirements.” The OIG sampled 150 beneficiaries and found California made Medicaid payments on behalf of 112 eligible beneficiaries. However, for the remaining 38 beneficiaries, California made payments on behalf of ineligible and potentially ineligible beneficiaries. On the basis of the OIG’s sample results, they estimated that California made Medi-Cal payments of $738.2 million ($628.8 million Federal share) on behalf of 366,078 ineligible beneficiaries and $416.5 million ($402.4 million Federal share) on behalf of 79,055 potentially ineligible beneficiaries. These deficiencies occurred because, at the time, California’s eligibility systems lacked the necessary system functionality and county welfare agencies’ eligibility caseworkers made errors. In October 2018, the California State Auditor (CSA) issued a report titled “Department of Health Care Services: It Paid Billions in Questionable Medi-Cal Premiums and Claims Because It Failed to Follow Up on Eligibility Discrepancies.” This report presents the results of CSA’s high risk audit concerning $4 billion (includes both Federal and State funding) in questionable Medi-Cal payments that Health Care Services made from 2014 through 2017 because it failed to ensure that counties resolved discrepancies between SAWS/CalHEERS and MEDS. Both of these reports came to the attention of the United States Senate Committee on Homeland Security and Governmental Affairs, which requested CMS’ plans to address the findings noted in these reports. CMS conducted a review of California’s Medicaid beneficiary eligibility system to assess the accuracy of eligibility determinations and Federal Medical Assistance Percentage (FMAP) claiming. One of the primary objectives of this review was to compare review findings to similar reviews conducted in the past by the OIG to ensure the identified findings have been addressed. However, due to the Coronavirus Disease of 2019 (COVID-19), the release of the draft report of the review has been delayed. It should also be noted that due to COVID-19, the Secretary of Health and Human Services declared a Public Health Emergency (PHE) that was effective January 27, 2020. On March 13, 2020, the President of the United States of America declared a National Emergency, retroactive to March 1, 2020, due to COVID-19. As a result of the President’s declaration, CMS issued a federal directive granting states an exception for meeting the periodic renewal requirements for cases that were up for redetermination as of March 1, 2020 through the end of the PHE. This exemption prevents states from denying or terminating eligibility or reducing benefits to Medi-Cal and CHIP beneficiaries during the PHE unless the beneficiary dies, no longer is a state resident, is a non-MAGI Medi-Cal individual moving from a non-Long-Term Care (LTC) aid code into a LTC aid code, or voluntarily discontinues their eligibility. After the month in which the PHE is declared over, states will be given an ample period of time to complete all renewals and redeterminations. As a result of COVID-19, the periodic renewal requirements were not tested for the fiscal year ended June 30, 2021. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, instances of benefits provided to ineligible beneficiaries for the following reasons. • The MEDS alert functionality is used to communicate information to county welfare agencies on changes in beneficiary circumstance, i.e., exceeding the age threshold for the assigned aid category, and discrepancies between eligibility systems, and MEDS. MEDS alerts will be triggered for various reasons that include:  Problems encountered in processing updates submitted by county welfare agencies;  Problems encountered in processing updates generated as a result of a reconciliation of county welfare agencies records with MEDS records;  Updates submitted by other entities that impact beneficiaries’ eligibility or require action by county welfare agencies; and  Upcoming changes in a beneficiaries’ status that will require action by county welfare agencies. Health Care Services did not have an established process for monitoring the county welfare agencies’ progress in addressing these alerts, which created the runaway MEDS issue. • The process to ensure that individuals do not remain in a transitional aid code past the allotted time was not followed. Effect One of the two CHIP beneficiaries with eligibility exceptions was determined to be ineligible and benefits were not discontinued during the fiscal year; therefore, the individual received ineligible benefits from the date the individual should have been discontinued. The second CHIP beneficiary with eligibility exception was not transitioned from a transitional aid code to a regular program code, if eligible, or discontinued. Questioned Costs Benefits paid to the CHIP beneficiary after the beneficiary was determined to be ineligible and the CHIP beneficiary without supporting eligibility documentation totaled $3,752 ($3,208 Managed Care and $544 Fee for Service) for the fiscal year ended June 30, 2021. Context A total of $2,163 ($2,163 Managed Care, $0 Fee for Service, and $0 Premiums) was disbursed during the fiscal year ended June 30, 2021 on behalf of one beneficiary later determined to be ineligible. A total of $1,589 ($1,045 Managed Care and $544 Fee for Service) was disbursed during the fiscal year ended June 30, 2021 on behalf of one beneficiary who did not have any documents supporting the eligibility. Total benefits paid on behalf of the 40 CHIP beneficiaries tested were $45,075 ($36,733 Managed Care and $8,342 Fee for Service). The 40 tested CHIP beneficiaries were selected from ten of California’s 58 counties. The total federal CHIP benefits paid on behalf of approximately 1.5 million beneficiaries for the fiscal year ended June 30, 2021 was $2,550,506,655 ($2,058,210,982 for Managed Care and $492,295,673 Fee for Service). The sample was not a statistically valid sample. Recommendation Health Care Services should continue with the quality control process used to monitor all MEDS alerts to ensure that the system has a process of identifying and alerting caseworkers to the review of beneficiaries that may be still receiving benefits when deemed ineligible. Health Care Services should continue its efforts to utilize focus reviews to assess counties’ risk of delays in renewal activities. Health Care Services should then work directly with those county welfare agencies to implement policies and procedures to improve their compliance status. Health Care Services should ensure there are controls in place to ensure all beneficiaries have the proper supporting documentation to be eligible. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference No. 2021-010: Health Care Services agrees with the finding. The U.S. Centers for Medicare and Medicaid Services (CMS) has confirmed the continuous enrollment requirement is now delinked from the Public Health Emergency (PHE) in the Consolidation Appropriations Act of 2023, (enacted December 29, 2022), which ends on March 31, 2023. Health Care Services will begin the continuous coverage requirement unwinding activities, including the resumption of renewals, on April 1, 2023. Per the current county oversight timeline established within the California Advancing and Innovating Medi-Cal (CalAIM) implementation timeline, the resumption of oversight and monitoring activities shall begin 14 months after the onset of continuous coverage requirement unwinding activities; therefore, the new implementation date to initiate these activities is May 1, 2024. Estimated Implementation Date: May 1, 2024 Contact: Wendy Griffe, Chief Internal Audits California Department of Health Care Services

Reference Number: 2021-011 Category of Finding: Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.917 Federal Program Title: HIV Care Formula Grants Federal Award Numbers and Years: 5 X07HA12778-12; 2020 5 X07HA12778-13; 2021 2 X09HA28342-06; 2020 2 X09HA28342-07; 2021 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - The Public Health and Welfare. Chapter 6A - Public Health Service. Subchapter XXIV - HIV Health Care Services Program. Part B - Care Grant Program. Subpart I - General Grant Provisions. Section 300ff-26 - Provision of Treatments: (a) In general A State shall use a portion of the amounts provided under a grant awarded under section 300ff–21 of this title to establish a program under section 300ff–22(b)(3)(B) of this title to provide therapeutics to treat HIV/AIDS or prevent the serious deterioration of health arising from HIV/AIDS in eligible individuals, including measures for the prevention and treatment of opportunistic infections. (b) Eligible individual To be eligible to receive assistance from a State under this section an individual shall: (1) Have a medical diagnosis of HIV/AIDS; and (2) Be a low-income individual, as defined by the State.   California State AIDS Drug Assistance Program Guidelines December 2018 and April 2020: (1.1) AIDS Drug Assistance Program (ADAP) Eligibility Criteria: To be eligible for the ADAP program, a client must: • Have a positive HIV/AIDS diagnosis. • Be at least 18 years old. • Be a resident of California. • Have an annual Modified Adjusted Gross Income (MAGI) that does not exceed 500 percent Federal Poverty Level (FPL) based on household size and income. • Not be fully covered by Medi-Cal or any other third-party payers (an entity that reimburses and manages health care expenses such as private insurance or governmental agencies, employers, etc.). Health Resources and Services Administration (HRSA) Policy Clarification Notice (PCN) 13-02 (Revised 5/1/2019): For both initial/annual and six-month recertification procedures, eligibility determinations may be performed simultaneously with testing and treatment. Recipients and subrecipients assume the risk of recouping any HRSA RWHAP funds utilized for clients ultimately determined to be ineligible, and instead charge an alternate payment source, or otherwise ensure that funds are returned to the HRSA RWHAP program. HRSA PCN 15-04 (Revised 1/11/2019): The RWHAP legislation requires that rebates collected on ADAP medication purchases be applied to the RWHAP Part B Program with a priority, but not a requirement, that the rebates be placed back into ADAP. Although ADAP rebates are neither program income nor refunds, they are subject to the same regulatory provision regarding expenditure. These rebates must be used for the statutorily permitted purposes under the RWHAP Part B Program, which are limited to core medical services including ADAP, support services, clinical quality management, and administrative expenses (including planning and evaluation) as part of a comprehensive system of care for low-income individuals living with HIV. HRSA PCN 13-02 (Revised 5/1/2019): To maintain eligibility for HRSA RWHAP services, clients must be recertified at least every six months. The primary purposes of the recertification process are to ensure that an individual’s residency, income, and insurance statuses continue to meet the recipient eligibility requirements and to verify that the HRSA RWHAP is the payor of last resort. The recertification process includes checking for the availability of all other third party payers. Recipients have flexibility with regard to timing and process, especially in consideration of health care coverage enrollment periods, but all recipients across all Parts must engage in eligibility determination and recertification. Condition Our sample of 60 participants from a population of 28,417 participants who received benefits during the fiscal year identified 1 participant’s annual recertification was not conducted in a timely manner and 16 participants who did not submit all required documentation, including proof of HIV/AIDS diagnosis, proof of residency, and income documentation to verify their annual MAGI did not exceed 500 percent Federal Poverty Level based on household size and income. Identification as a Repeat Finding With the exception of the one instance of untimely annual recertification, finding 2020-009 was reported in the immediate prior year pertaining to not submitting all required documentation. Cause Procedures that required the collection of valid supporting documents were not followed. Existing internal controls did not prevent, or detect and correct, the occurrence of benefits being provided to potentially ineligible individuals. Effect Public Health did not have adequate oversight controls to ensure that the applicant’s eligibility was properly reviewed and approved. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals that may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable because benefit costs were not tracked by individual participants. Context Pharmacy benefits management services are provided by a contractor who received administrative fees and reimbursements for prescription drug costs to program participants. Payments to the contractor totaled $109,619,714 for approximately 30,000 program participants for the fiscal year ended June 30, 2021. Based on the budget in the contract, the contractor’s administrative fees and other charges are estimated to be $237,759 annually. As such, net prescription drug costs are approximately $109,381,955 for the fiscal year ended June 30, 2021. The sample was not a statistically valid sample. Recommendation The ADAP Branch should continue to monitor compliance with its policies to ensure enrollment workers and secondary reviews of ADAP applications follow the established guidelines and retain acceptable documentation to support eligibility determinations and timely annual recertification. Applications that have been granted an eligibility exception (i.e., Temporary Access Period, Medi-Cal Eligibility Exception Request, or Eligibility Exception Request) should be reviewed in a timely manner to ensure clients who do not provide the required documentation within the approved extension period are disenrolled in a timely manner. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

The Office of AIDS (OA) agrees with the finding and recommendation. OA developed and implemented additional, internal quality assurance (QA) processes in April of 2022 to ensure that secondary reviews of AIDS Drug Assistance Program (ADAP) applications are consistently enforcing the existing guidelines, including acceptable supporting documentation and accurate eligibility requirements. During this audit period, and through December 2021, ADAP had issued multiple policy memos to respond to the COVID-19 pandemic, which enabled staff and enrollment workers to defer documentation collection, when necessary, to remain flexible and ensure clients impacted by the pandemic, and associated site closures, did not lose eligibility and access to life saving medications and comprehensive healthcare. These flexibilities in our guidelines were implemented based on guidance received from our federal funder, Health Resources and Services Administration (HRSA), which encouraged ADAPs to reassess their organization's eligibility and recertification policies and procedures, and remove any barriers that may impede social distancing, or other public health strategies, necessary to minimize COVID-19 transmission. This documentation deferral was terminated on December 31, 2021, and since January 1, 2022, full documentation and eligibility requirements have been enforced. This, combined with ongoing QA efforts, will help to mitigate future findings in ADAP applications dated January 1, 2022 onward. Estimated Implementation Date: Already implemented as of April 2022 Contact: Sharisse Kemp, Branch Chief AIDS Drug Assistance Program Branch California Department of Public Health

2020-009

See Schedule of Findings and Questioned Costs

Health Care Services agrees with the recommendation. Effective September 1, 2021, System Development Notice (SDN) 20039 made updates to the Claims Processing Accounts Receivable System, requiring the Fiscal Intermediary (FI) to record the FFP rate including the Budget Program (i.e., Medicaid Assistance Program vs. Children?s Health Insurance Program) for each overpayment account receivable set up after the effective date. The FFP rate and Budget Program information for each overpayment is provided on the Action Notices to the FI. The SDN also made updates to the California Omnibus Budget Reconciliation Act of 1985 (COBRA) system to enable the system to receive the FFP rate and Budget Program information for each overpayment set up by the FI and updated COBRA reports, thereby allowing Health Care Services to report the correct FFP rate for overpayments on the CMS-64 and CMS-21. Estimated Implementation Date: September 30, 2021 Contact: Wendy Griffe, Chief Internal Audits California Department of Health Care Services

2020-012

See Schedule of Findings and Questioned Costs

Of the 20 claimants the auditor determined to be ineligible for Lost Wages Assistance (LWA) benefits, 17 were Pandemic Unemployment Assistance (PUA) claimants disqualified due to identity issues discovered through the EDD?s new fraud enhancements outlined in the response to the finding for Reference Number 2021-003. The other three claimants were receiving regular Unemployment Insurance (UI) benefits (one claimant) and Pandemic Emergency Unemployment Compensation (PEUC) benefits (two claimants). Those three claimants were paid pending the adjudication of potential eligibility issues, which were later found to be disqualifying. EDD has corrected both issues that resulted in the LWA payments being made to ineligible claimants. Regarding the issue of PUA claimants paid prior to the discovery of the potential identity issues, as outlined in the response to the finding for Reference Number 2021-003, during the years 2020 and 2021, the EDD implemented multiple new fraud prevention measures. Regarding the issue of the regular UI and PEUC claimants being paid prior to the adjudication of the potential eligibility issues, the EDD resumed adjudicating all potential eligibility issues as of January 2021 and will complete the remaining retroactive workload by April 30, 2023. Estimated Implementation Date: September 2020 (Fraud Enhancements) and January 2021 (Resumption of Adjudications) Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

Reference Number: 2021-015 Category of Finding: Special Tests and Provisions – Refunding of Federal Share of Medicaid/CHIP Overpayments to Providers Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2105CA5021; 2021 2005CA5021; 2020 [includes COVID-19 FFCRA (HR6201/2020)] 1905CA5021; 2019 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2105CA5ADM; 2021 2105CA5MAP; 2021 2005CA5ADM; 2020 2005CA5MAP; 2020 [includes COVID-19 FFCRA (HR6201/2020)] Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services: Subchapter C - Medical Assistance Programs, Part 433 - State Fiscal Administration, Subpart F - Refunding of Federal Share of Medicaid Overpayments to Providers: §433.300 Basis (42 CFR 433.300). This subpart implements: (a) Section 1903(d)(2)(C) and (D) of the Act, which provides that a State has 1 year from discovery of an overpayment for Medicaid services to recover or attempt to recover the overpayment from the provider before adjustment in the Federal Medicaid payment to the State is made; and that adjustment will be made at the end of the 1-year period, whether or not recovery is made, unless the State is unable to recover from a provider because the overpayment is a debt that has been discharged in bankruptcy or is otherwise uncollectable. §433.320 Procedures for refunds to CMS (42 CFR 433.320): (a) Basic requirements: (1) The agency must refund the Federal share of overpayments that are subject to recovery to CMS through a credit on its Quarterly Statement of Expenditures (Form CMS-64). (2) The agency must credit CMS with the Federal share of overpayments subject to recovery on the earlier of – (i) The Form CMS-64 submission due to CMS for the quarter in which the State recovers the overpayment from the provider; or (ii) The Form CMS-64 due to CMS for the quarter in which the 1-year period following discovery, established in accordance with §433.316, ends. (3) A credit on the Form CMS-64 must be made whether or not the overpayment has been recovered by the State from the provider. (4) If the State does not refund the Federal share of such overpayment as indicated in paragraph (a)(2) of this section, the State will be liable for interest on the amount equal to the Federal share of the non-recovered, non-refunded overpayment amount. Interest during this period will be at the Current Value of Funds Rate (CVFR), and will accrue beginning on the day after the end of the 1-year period following discovery until the last day of the quarter for which the State submits a CMS-64 report refunding the Federal share of the overpayment. Subchapter D – State Children’s Health Insurance Programs (SCHIPs), Part 457 - Allotments and Grants to States, Subpart F - Payment to States: §457.628 Other applicable Federal regulations (42 CFR 457.628): Other regulations applicable to CHIP programs include the following: (a) HHS regulations in §§433.312 through 433.322 of this chapter (related to Overpayments) apply to State's CHIP programs in the same manner as they apply to State's Medicaid programs. Note that while for the Medical Assistance Program, the overpayments of the federal share must be refunded to the Centers for Medicare & Medicaid Services (CMS) via Form CMS-64 Summary, Line 9C1 - Fraud, Waste & Abuse Amounts, for the Children’s Health Insurance Program, the overpayments of the federal share must be refunded to CMS via Form CMS-21 Summary, Line 4 - Adjustments Decreasing Claims - Collections. Condition The Medical Assistance Program reporting of overpayments tested did not reflect the correct federal share because Form CMS-64 included all CHIP overpayments (42 CFR 433.320). All 20 CHIP overpayments tested did not reflect the correct federal share (Federal Financial Participation or FFP rate) and were not correctly reported on Form CMS-21 (42 CFR 433.320 via 42 CFR 457.628). Identification as a Repeat Finding Finding 2020-012 was reported in the immediate prior year. Cause The overpayments for the Medical Assistance Program (Medicaid) and CHIP on the CMS-64 and CMS-21, was due to Health Care Services Claims Processing Accounts Receivable (AR) System’s inability to distinguish between CHIP and Medicaid overpayments. When Audits and Investigations (A&I) identifies an overpayment, they do not distinguish between the two programs. A&I then sends an Action Notice (AN) and the findings of overpayments to the Fiscal Intermediary (FI) to establish an AR on the system with a copy to TPLRD for collection purposes. Once the FI establishes an AR for an overpayment, the overpayment is recorded in the California Omnibus Budget Reconciliation Act of 1985 (COBRA) system (a department-developed application) and is automatically assigned the Medicaid FFP rate in effect upon AR creation. Due to system limitations, the COBRA system automatically assigns the Medicaid FFP rate in effect at AR creation for all overpayments and cannot assign a CHIP FFP rate to a CHIP overpayment. As such, all types of overpayments will utilize the Medicaid FFP rate. Therefore, when it is reported on the CMS-64 and CMS-21, they are allocating all refunds to the CMS-64. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments The incorrect FFP rate being applied to the Children’s Health Insurance Program (CHIP) overpayments was due to the same reason outlined above. The existing controls did not prevent, or detect and correct, instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children’s Health Insurance Program overpayments. Effect Reporting of CHIP overpayments in the Medicaid CMS-64 report and utilizing an incorrect CHIP FFP rate resulted in under/over funding and noncompliance with refunding the Federal share of Medicaid and CHIP overpayments. Questioned Costs Overpayments for Medicaid caused by allocating all CHIP overpayments on the CMS-64 resulted in known questioned costs of $27,994 for the 2020-21 fiscal year. Overpayments for CHIP caused by utilizing the incorrect CHIP FFP rate resulted in known questioned costs of $10,112 for the 2020-21 fiscal year. Context Expenditures for the 2020-21 fiscal year totaled $75,291,112,265 for Medicaid and $3,054,233,806 for CHIP. The $27,994 known questioned costs for inaccurate reporting of Medicaid overpayments were identified from a total of $38,717,058 for the 40 Medicaid samples tested. The $10,112 known questioned costs for using the incorrect CHIP FFP rate were identified from a total of $27,994 for the twenty CHIP samples tested. The sample was not a statistically valid sample. Recommendation Health Care Services should have a process in place to ensure that the CMS-64 and CMS-21 reports properly report CHIP and Medicaid overpayments. Health Care Services should update the system to assign the appropriate FFP rate for each overpayment. With this implementation, CHIP overpayments can be appropriately identified with the correct FFP rate and reported on the CMS-21. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Health Care Services agrees with the recommendation. Effective September 1, 2021, System Development Notice (SDN) 20039 made updates to the Claims Processing Accounts Receivable System, requiring the Fiscal Intermediary (FI) to record the FFP rate including the Budget Program (i.e., Medicaid Assistance Program vs. Children’s Health Insurance Program) for each overpayment account receivable set up after the effective date. The FFP rate and Budget Program information for each overpayment is provided on the Action Notices to the FI. The SDN also made updates to the California Omnibus Budget Reconciliation Act of 1985 (COBRA) system to enable the system to receive the FFP rate and Budget Program information for each overpayment set up by the FI and updated COBRA reports, thereby allowing Health Care Services to report the correct FFP rate for overpayments on the CMS-64 and CMS-21. Estimated Implementation Date: September 30, 2021 Contact: Wendy Griffe, Chief Internal Audits California Department of Health Care Services

2020-012

Reference Number: 2021-016 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 97.050 Federal Program Title: Presidential Declared Disaster Assistance to Individuals and Households - Other Needs Federal Award Number and Year: 4482DRCASPLW; 2020 Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - The Public Health and Welfare, Chapter 68, Disaster Relief, Subchapter IV, §5174 Federal assistance to individuals and households: (e) Financial Assistance to Address Other Needs (2) Personal Property, Transportation, and Other Expenses: In accordance with this section, the President, in consultation with the Governor of a State, may provide financial assistance, and, if necessary, direct services, to individuals and households in the State who, as a direct result of a major disaster, have necessary expenses and serious needs in cases in which the individuals and households are unable to meet such expenses or needs through other means. (f) State role (3) Requirements: d. Before approving an application submitted under this section, the President, or the designee of the President, shall institute adequate policies, procedures, and internal controls to prevent waste, fraud, abuse, and program mismanagement for this program and for programs under subsections (c)(1)(B), (c)(4), and (e). The President shall monitor and conduct quality assurance activities on a State or Indian tribal government’s implementation of programs under subsections (c)(1)(B), (c)(4), and (e). If, after approving an application of a State or Indian tribal government submitted under this paragraph, the President determines that the State or Indian tribal government is not administering the program established by this section in a manner satisfactory to the President, the President shall withdraw the approval. Condition During the fiscal year ended June 30, 2021, EDD implemented the Lost Wages Assistance (LWA) program, which was funded through the disaster relief funds from the Federal Emergency Management Agency (FEMA) under the Presidential Memorandum on Authorizing the Other Needs Assistance Program for Major Disaster Declarations Related to Coronavirus Disease 2019 (COVID-19). Under the memorandum, the LWA program was to be administered in accordance with the Robert T. Stafford Disaster Relief and Emergency Assistance Act section 408(e)(2) and (f), Title 42 U.S.C §5174(e)(2), (f). In EDD’s administration of the LWA program, $1,013,541,600 in benefit payments were estimated by EDD to represent potentially fraudulent payments. The estimate was based on data parameters to identify claimants that received benefits which matched imposter fraud for identity or eligibility fraud for misrepresented information. Out of 223 LWA benefit payments tested, 20 claimants were determined to be ineligible for LWA benefits. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, instances of fraud for benefit payments for the following reasons. • There was a significant increase in unemployment claims that overwhelmed EDD’s existing fraud detection processes. • There were insufficient controls in place to prevent or detect fraud associated with benefit payments related to incarceration, identity, and multiple claims from the same address. Effect EDD did not have adequate oversight controls to ensure that benefit payments were not being made to fraudulent claimants. Accordingly, benefit payments were made to fraudulent claimants who were not eligible. Questioned Costs Likely questioned costs were estimated to be $1,013,541,600 for fiscal year 2020-21. Known questioned costs for the 20 claimants determined to be ineligible was $30,000. Context Benefits paid to claimants under the Presidential Declared Disaster Assistance to Individuals and Households - Other Needs for the fiscal year ended June 30, 2021, totaled $6,464,467,210. The LWA program ended in December 2020. The sample was not a statistically valid sample. Recommendation EDD should continue to evaluate and enhance its fraud detection and prevention internal controls, increasing the use of automation features and other analytical tools in an effort to increase efficiency, continue to reduce workload, and enhance detection and timely identification of unemployment benefit fraud. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Of the 20 claimants the auditor determined to be ineligible for Lost Wages Assistance (LWA) benefits, 17 were Pandemic Unemployment Assistance (PUA) claimants disqualified due to identity issues discovered through the EDD’s new fraud enhancements outlined in the response to the finding for Reference Number 2021-003. The other three claimants were receiving regular Unemployment Insurance (UI) benefits (one claimant) and Pandemic Emergency Unemployment Compensation (PEUC) benefits (two claimants). Those three claimants were paid pending the adjudication of potential eligibility issues, which were later found to be disqualifying. EDD has corrected both issues that resulted in the LWA payments being made to ineligible claimants. Regarding the issue of PUA claimants paid prior to the discovery of the potential identity issues, as outlined in the response to the finding for Reference Number 2021-003, during the years 2020 and 2021, the EDD implemented multiple new fraud prevention measures. Regarding the issue of the regular UI and PEUC claimants being paid prior to the adjudication of the potential eligibility issues, the EDD resumed adjudicating all potential eligibility issues as of January 2021 and will complete the remaining retroactive workload by April 30, 2023. Estimated Implementation Date: September 2020 (Fraud Enhancements) and January 2021 (Resumption of Adjudications) Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

"See Schedule of Findings and Questioned Costs for Chart/Table" Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. ?200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 7 ? Agriculture, Subtitle B - Regulations of the Department of Agriculture. Chapter II ? Food and Nutrition Service, Department of Agriculture. Subchapter A ? Child Nutrition Programs. Part 246 - Special Supplemental Nutrition Program for Women, Infants and Children, ?246.7 - Certification of participants: (c) Eligibility criteria and basic certification procedures. (1) To qualify for the Program, infants, children, and pregnant, postpartum, and breastfeeding women must: (i) Reside within the jurisdiction of the State (except for Indian State agencies). Indian State agencies may establish a similar requirement. All State agencies may determine a service area for any local agency, and may require that an applicant reside within the service area. However, the State agency may not use length of residency as an eligibility requirement. (ii) Meet the income criteria specified in paragraph (d) of this section. (iii) Meet the nutritional risk criteria specified in paragraph (e) of this section. (2) (i) At certification, the State or local agency must require each applicant to present proof of residency (i.e., location or address where the applicant routinely lives or spends the night) and proof of identity. The State or local agency must also check the identity of participants, or in the case of infants or children, the identity of the parent or guardian, or proxies when issuing food, cash-value vouchers or food instruments. The State agency may authorize the certification of applicants when no proof of residency or identity exists (such as when an applicant or an applicant's parent is a victim of theft, loss, or disaster; a homeless individual; or a migrant farmworker). In these cases, the State or local agency must require the applicant to confirm in writing his/her residency or identity. Further, an individual residing in a remote Indian or Native village or an individual served by an Indian tribal organization and residing on a reservation or pueblo may establish proof of residency by providing the State agency their mailing address and the name of the remote Indian or Native village. (e) Nutritional risk. To be certified as eligible for the Program, applicants who meet the Program's eligibility standards specified in paragraph (c) of this section must be determined to be at nutritional risk. ? Nutritional risk data shall be documented in the participant's file and shall be used to assess an applicant's nutritional status and risk; tailor the food package to address nutritional needs; design appropriate nutrition education, including breastfeeding promotion and support; and make referrals to health and social services for follow-up, as necessary and appropriate. (1) Determination of nutritional risk. (ii) Timing of nutritional risk data. (A) Weight and height or length. Weight and height or length shall be measured not more than 60 days prior to certification for program participation. (B) Hematological test for anemia. (1) For pregnant, breastfeeding, and postpartum women, and child applicants, the hematological test for anemia shall be performed or obtained from referral sources at the time of certification or within 90 days of the date of certification. The hematological test for anemia may be deferred for up to 90 days from the time of certification for applicants who have at least one qualifying nutritional risk factor present at the time of certification. If no qualifying risk factor is identified, a hematological test for anemia must be performed or obtained from referral sources (with the exception of presumptively eligible pregnant women). (2) Infants nine months of age and older (who have not already had a hematological test performed, between six and nine months of age, by a competent professional authority or obtained from referral sources), shall between nine and twelve months of age have a hematological test performed or obtained from referral sources. Such a test may be performed more than 90 days after the date of certification. (3) For pregnant women, the hematological test for anemia shall be performed during their pregnancy. For persons certified as postpartum or breastfeeding women, the hematological test for anemia shall be performed after the termination of their pregnancy. For breastfeeding women who are 6-12 months postpartum, no additional blood test is necessary if a test was performed after the termination of their pregnancy. The participant or parent/guardian shall be informed of the test results when there is a finding of anemia, and notations reflecting the outcome of the tests shall be made in the participant's file. Nutrition education, food package tailoring, and referral services shall be provided to the participant or parent/guardian, as necessary and appropriate. Condition During the fiscal year ended June 30, 2020, the WIC Special Supplemental Food Program for Women, Infants, and Children (WIC) nutrition program implemented phase 1 of a new management information system known as the Women, Infants, and Children Web Information System Exchange (WIC WISE) in a two-phased approach to replace the WIC Management Information Systems (WIC-MIS). A sample of 150 program participants included 60 participants whose data were maintained in WIC-MIS and 90 participants whose data were maintained in WIC WISE. Of the 90 participants in WIC WISE, 16 participants did not have proper documentation to support their eligibility: ? 7 participants did not have documentation to support basic certification procedures. The missing documentation included proof of identification, residency proof, and proof of presence. ? 9 participants did not have documentation to support their nutritional status and risk, including height and weight measurements and hematological tests. Cause The documentation of certification for the 16 participants was inaccessible or missing from the WIC WISE system. Existing internal controls did not prevent, or detect and correct, the occurrence of benefits being provided to potentially ineligible individuals. Effect Public Health did not have adequate oversight controls to ensure that the applicant?s eligibility was properly reviewed and approved. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals, which may not be prevented or detected in a timely manner. Questioned Costs Known questioned costs of $8,479 pertained to food vouchers issued to the 16 participants whose files did not contain all required documentation, and represented 18% of food vouchers issued to the 90 WIC WISE participants in the sample. Likely questioned costs cannot be determined because total food vouchers issued to participants whose data were maintained in WIC WISE cannot be readily determined. Context Total food vouchers disbursed to program participants during the fiscal year ended June 30, 2020, totaled $459,847,935. All identified exceptions related to participants whose data were maintained in WIC WISE; however, the amount of food vouchers disbursed to participants whose data were maintained in WIC WISE was not readily determinable. The sample was not a statistically valid sample. Recommendation Public Health should continue to monitor compliance with its policies to ensure enrollment workers follow the established guidelines and retain acceptable documentation to support eligibility determinations. Views of Responsible Officials and Corrective Action Plan Management?s response is reported in ?Management?s Response and Corrective Action Plan? included in a separate section at the end of this report.

The Women, Infants, and Children Division (WIC) of the California Department of Public Health (Public Health) agrees that the WIC WISE system does not currently store eligibility history that should be included in the ?Cert History Report?. Currently, the initial eligibility data is overwritten when subsequent eligibility information is keyed into WIC WISE. WIC WISE does include preventative internal stops or check points that do not allow ineligible individuals to be certified and issued benefits (e.g., over income, not a CA resident, no nutrition risk factor, etc.). User acceptance testing vetted these items prior to system implementation. The certification history condition will be remediated via a system Defect Correction to WIC WISE. WIC has entered Defect Correction #6972 in Team Foundation Services (TFS), the tracking system used to capture system changes and defects. This correction will be included in a future release, which is targeted for late 2022. The defect supports a system change to ensure initial eligibility information is retained when subsequent eligibility information is entered into WIC WISE. Estimated Implementation Date: December 2022 Contact: William Welch, Assistant Division Chief, Operations Women, Infants, and Children Division California Department of Public Health

"See Schedule of Findings and Questioned Costs for Chart/Table" Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. ?200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). U.S. Code, Title 15 - Commerce and Trade, Chapter 116 - Coronavirus Economic Stabilization (CARES Act), Subchapter II - Unemployment Insurance Provisions, ?9023 - Emergency Increase in Unemployment Compensation Benefits (b) Provisions of Agreement (1) Any agreement under this section shall provide that the State agency of the State will make payments of regular compensation to individuals in amounts and to the extent that they would be determined if the State law of the State were applied, with respect to any week for which the individual is (disregarding this section) otherwise entitled under the State law to receive regular compensation, as if such State law had been modified in a manner such that the amount of regular compensation (including dependents? allowances) payable for any week shall be equal to? (A) the amount determined under the State law (before the application of this paragraph), plus (B) an additional amount equal to the amount specified in paragraph (3) (in this section referred to as ?Federal Pandemic Unemployment Compensation?), plus (C) an additional amount of $100 (in this section referred to as ?Mixed Earner Unemployment Compensation?) in any case in which the individual received at least $5,000 of self-employment income (as defined in section 1402(b) of title 26) in the most recent taxable year ending prior to the individual?s application for regular compensation. (f) Fraud and Overpayments (4) Any determination by a State agency under this section shall be subject to review in the same manner and to the same extent as determinations under the State unemployment compensation law, and only in that manner and to that extent. Title 22 ? Social Security, Division 1 - Employment Development Department, Subdivision 1 - Director of Employment Development, Division - 1 Unemployment and Disability Compensation, Part 1 - Unemployment Compensation, Chapter 5 - Unemployment Compensation Benefits, Article 1 ? Eligibility and Disqualifications ?1256 Eligibility and Disqualifications, ?1256 California Code of Regulations: (a) An individual is disqualified for unemployment compensation benefits if the director finds that he or she left his or her most recent work voluntarily without good cause or that he or she has been discharged for misconduct connected with his or her most recent work. Condition The Unemployment Insurance Branch of EDD reviews unemployment insurance claims made by claimants for involuntary separation to ensure separations were for valid reasons under the Unemployment Insurance Code. Out of 60 unemployment insurance benefit payments tested, there were 2 claimants receiving benefits, whose reasons for involuntary separation indicated separation reasons were for voluntarily quitting without good cause and discharge for misconduct. Cause The adjudication process for potential eligibility issues, which includes work separation, was suspended by EDD to allow for additional internal bandwidth of its human resources for claims processing due to the significant increase in claims resulting from the COVID-19 pandemic during the 4th quarter of fiscal year 2019-20. Effect By EDD suspending the adjudication process for potential eligibility issues, there were benefit payments made to ineligible claimants. Questioned Costs Known questioned costs of $8,929 for Unemployment Insurance program benefits and $9,600 for Federal Pandemic Unemployment Compensation program of the COVID-19 Unemployment Insurance pertaining to the two claimants whose benefit payments were tested. Context Benefits paid to claimants under the Unemployment Insurance Program and the COVID-19 Unemployment Insurance Program for the fiscal year ended June 30, 2020, totaled $13,186,536,299 and $27,156,377,360, respectively. The sample was not a statistically valid sample. Recommendation EDD should resume its adjudication process to support eligibility determinations and reduce the risk of unemployment insurance benefit payments being made to ineligible claimants. Views of Responsible Officials and Corrective Action Plan Management?s response is reported in ?Management?s Response and Corrective Action Plan? included in a separate section at the end of this report.

From the beginning of the pandemic in March 2020 through mid-January 2021, the Employment Development Department (EDD) was forced to suspend the adjudication of most potential eligibility issues due to the historic number of claims filed during the pandemic, limited trained staffing resources, and the need to ensure timely filing of claims and payment of benefits to the extent possible. The EDD resumed adjudicating all potential eligibility issues as of January 2021. We are also currently adjudicating the potential eligibility issues not adjudicated prior to January 2021, have brought on a vendor to assist with this workload, and expect to complete that effort no later than September 2022. Estimated Implementation Date: January 2021 Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

"See Schedule of Findings and Questioned Costs for Chart/Table" Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements, Standards for Financial and Program Management. ?200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (c) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). U.S. Code, Title 15 - Commerce and Trade, Chapter 116 - Coronavirus Economic Stabilization (CARES Act), Subchapter II - Unemployment Insurance Provisions, ?9023 - Emergency Increase in Unemployment Compensation Benefits (b) Provisions of Agreement (1) Federal Pandemic Unemployment Compensation Any agreement under this section shall provide that the State agency of the State will make payments of regular compensation to individuals in amounts and to the extent that they would be determined if the State law of the State were applied, with respect to any week for which the individual is (disregarding this section) otherwise entitled under the State law to receive regular compensation, as if such State law had been modified in a manner such that the amount of regular compensation (including dependents? allowances) payable for any week shall be equal to? (A) the amount determined under the State law (before the application of this paragraph), plus (B) an additional amount equal to the amount specified in paragraph (3) (in this section referred to as ?Federal Pandemic Unemployment Compensation?), plus (f) Fraud and Overpayments (4) Review Any determination by a State agency under this section shall be subject to review in the same manner and to the same extent as determinations under the State unemployment compensation law, and only in that manner and to that extent. U.S. Code, Title 15 - Commerce and Trade, Chapter 116 - Coronavirus Economic Stabilization (CARES Act), Subchapter II - Unemployment Insurance Provisions, ?9025 ? Pandemic Emergency Unemployment Assistance (e) Relationship between pandemic unemployment assistance and disaster unemployment assistance: Except as otherwise provided in this section or to the extent there is a conflict between this section and part 625 of title 20, Code of Federal Regulations, such part 625 shall apply to this section as if? (1) the term ?COVID?19 public health emergency? were substituted for the term ?major disaster? each place it appears in such part 625; and (2) the term ?pandemic? were substituted for the term ?disaster? each place it appears in such part 625. Title 20 - Employees? Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 - Disaster Unemployment Assistance, ?625.14 Overpayments; disqualification for fraud: (h) Provisions in the procedures of each State with respect to detection and prevention of fraudulent overpayments of DUA shall be, as a minimum, commensurate with the procedures adopted by the State with respect to regular compensation and consistent with the Secretary's ?Standard for Fraud and Overpayment Detection,? Employment Security Manual, part V, sections 7510 et seq. (Appendix C of this part). (i) Any individual who, with respect to a major disaster, makes or causes another to make a false statement or misrepresentation of a material fact, knowing it to be false, or knowingly fails or causes another to fail to disclose a material fact, in order to obtain for the individual or any other person a payment of DUA to which the individual or any other person is not entitled, shall be disqualified as follows: (1) If the false statement, misrepresentation, or nondisclosure pertains to an initial application for DUA ? i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of any DUA with respect to that major disaster; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of any DUA with respect to that major disaster; and (2) If the false statement, misrepresentation, or nondisclosure pertains to a week for which application for a payment of DUA is made ? i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA. Condition During the fiscal year ended June 30, 2020, in addition to the regular Unemployment Insurance (UI) program, EDD implemented the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. Claimants eligible for PUA will also receive additional weekly benefits from the Federal Pandemic Unemployment Compensation (FPUC) program of $600 up until July 31, 2020. Out of 138 PUA benefit payments tested, there were 7 benefit payments to claimants determined to be potentially fraudulent. ? 2 claimants received benefits while being incarcerated. ? 5 claimants received benefits whose identity was not verified. Data analysis was performed over benefit payments made during fiscal year 2019-20 in regards to multiple claimants using the same address, which resulted in 16,791 addresses with 5 or more claimants using the same address. The top 3 street addresses and top 3 PO Box addresses were selected for review. The top 3 street addresses were identified to be potentially fraudulent. Out of the top 3 PO Box addresses, 1 PO Box address was identified to be fraudulent. Cause Due to the COVID-19 pandemic, there was a significant increase in unemployment claims that overwhelmed EDD?s staffing resources and current detection process. In addition, existing internal controls did not prevent, or detect and correct, instances of fraud for benefit payments. Effect EDD did not have adequate staffing resources and oversight controls to ensure that benefit payments were not being made to fraudulent claimants. Accordingly, benefit payments were made to fraudulent claimants or who were ineligible. Questioned Costs Questioned costs identified for the fiscal year ended June 30, 2020 were as follows: ? Claims associated with incarcerated individuals, questioned costs totaled $8,532 for PUA and $12,000 FPUC. ? Claims associated with insufficient identity verification, questioned costs totaled $30,952 for PUA and $35,400 FPUC. ? Claims associated with addresses subsequently reviewed, questioned costs totaled $345,287 for PUA, $1,443,952 for UI, and $2,011,200 for FPUC. Context Benefits paid to claimants under the Unemployment Insurance program and the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2020, totaled $13,186,536,299 and $27,156,377,360, respectively. The sample was not a statistically valid sample. Recommendation EDD should look for ways to enhance its fraud prevention and detection efforts by utilizing other databases or State agencies to verify claimants? information, and increase the use of automation features and other analytical tools in an effort to reduce workload. In addition, EDD should implement policies and procedures to strengthen internal controls that might better prevent and detect fraudulent activities. Views of Responsible Officials and Corrective Action Plan Management?s response is reported in ?Management?s Response and Corrective Action Plan? included in a separate section at the end of this report.

As with all other states nationwide, the EDD experienced an increase in fraudulent activity during the pandemic, especially related to the new federal Pandemic Unemployment Assistance (PUA) program. In addition to employing the fraud detection activities the EDD already had in place, which included but were not limited to cross-matches with Social Security Administration data and Department of Motor Vehicle records, as well as regular queries to identify claims containing known indicators of potential fraud, the EDD has taken action to implement additional measures to identify potential fraudulent activity not already being detected in order to stop individuals committing fraud from being paid unemployment benefits. To enhance the measures the EDD already had in place when the pandemic started, during the years 2020 and 2021, the EDD implemented the following major fraud prevention measures, which have enabled the EDD to detect further instances of fraud and stop those individuals from being paid benefits. "See Corrective Action Plan for Chart/Table" Furthermore, the EDD continues to work in concert with a state-led task force comprised of state and local agencies in an effort to support unemployment fraud investigation, and, with the Governor?s Office appointment of a Fraud Special Counsel that brings former U.S. Attorney and federal prosecutor experience. Additionally, the EDD Investigation Division is directly involved in hundreds of joint criminal investigations with local, state and federal law enforcement entities in an ongoing effort to identify and prosecute the individuals who participated in fraud schemes during the pandemic. Moving forward, the EDD will continue to look for ways to enhance our detection and prevention tools in order to protect against fraud in the unemployment program. Estimated Implementation Date: September 2020 Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

"See Schedule of Findings and Questioned Costs for Chart/Table" Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance, Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. ?200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (2) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). U.S. Code, Title 15 - Commerce and Trade, Chapter 116 - Coronavirus Economic Stabilization (CARES Act), Subchapter II - Unemployment Insurance Provisions, ?9023 - Emergency Increase in Unemployment Compensation Benefits (b) Provisions of Agreement (1) Federal Pandemic Unemployment Compensation Any agreement under this section shall provide that the State agency of the State will make payments of regular compensation to individuals in amounts and to the extent that they would be determined if the State law of the State were applied, with respect to any week for which the individual is (disregarding this section) otherwise entitled under the State law to receive regular compensation, as if such State law had been modified in a manner such that the amount of regular compensation (including dependents? allowances) payable for any week shall be equal to? (A) the amount determined under the State law (before the application of this paragraph), plus (B) an additional amount equal to the amount specified in paragraph (3) (in this section referred to as ?Federal Pandemic Unemployment Compensation?), plus (C) an additional amount of $100 (in this section referred to as ?Mixed Earner Unemployment Compensation?) in any case in which the individual received at least $5,000 of self-employment income (as defined in section 1402(b) of title 26) in the most recent taxable year ending prior to the individual?s application for regular compensation. (f) Fraud and Overpayments (4) Review Any determination by a State agency under this section shall be subject to review in the same manner and to the same extent as determinations under the State unemployment compensation law, and only in that manner and to that extent. U.S. Code, Title 15 - Commerce and Trade, Chapter 116 - Coronavirus Economic Stabilization (CARES Act), Subchapter II - Unemployment Insurance Provisions, ?9025 - Pandemic Unemployment Assistance (3) Relationship between pandemic unemployment assistance and disaster unemployment assistance: Except as otherwise provided in this section or to the extent there is a conflict between this section and part 625 of title 20, Code of Federal Regulations, such part 625 shall apply to this section as if? a. the term ?COVID?19 public health emergency? were substituted for the term ?major disaster? each place it appears in such part 625; and b. the term ?pandemic? were substituted for the term ?disaster? each place it appears in such part 625. Title 20 - Employees? Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 - Disaster Unemployment Assistance, ?625.6 Weekly amount; jurisdictions; reductions Eligibility and Disqualifications: (c) If the weekly amount computed under paragraph (a) of this section is less than 50 percent of the average weekly payment of regular compensation in the State, as provided quarterly by the Department, or, if the individual has insufficient wages from employment or insufficient or no net income from self-employment (which includes individuals falling within paragraphs (a)(3) and (b)(3) of ? 625.5) in the applicable base period to compute a weekly amount under paragraph (a) of this section, the individual shall be determined entitled to a weekly amount equal to 50 percent of the average weekly payment of regular compensation in the State. (f) The State agency shall immediately determine, upon the filing of an initial application for DUA, a weekly amount under the provisions of paragraphs (a) through (d) of this section, as the case may be, based on the individual's statement of employment or self-employment preceding the individual's unemployment that was a direct result of the major disaster, and wages earned or paid for such employment or self-employment. An immediate determination of a weekly amount shall also be made where, in conjunction with the filing of an initial application for DUA, the individual submits documentation substantiating employment or self-employment and wages earned or paid for such employment or self-employment, or, in the absence of documentation, where any State agency records of employment or self-employment and wages earned or paid for such employment or self-employment, justify the determination of a weekly amount. An immediate determination shall also be made based on the individual's statement or in conjunction with the submittal of documentation in those cases where the individual was to commence employment or self-employment on or after the date the major disaster began but was prevented from doing so as a direct result of the disaster. (1) In the case of a weekly amount determined in accordance with paragraph (e) of this section, based only on the individual's statement of earnings, the individual shall furnish documentation to substantiate the employment or self-employment or wages earned from or paid for such employment or self-employment or documentation to support that the individual was to commence employment or self-employment on or after the date the major disaster began. In either case, documentation shall be submitted within 21 calendar days of the filing of the initial application for DUA. (3) For purposes of a computation of a weekly amount under paragraph (a) of this section, if an individual submits documentation to substantiate employment or self-employment in accordance with paragraph (e)(1), but not documentation of wages earned or paid during the base period set forth in paragraph (a)(2) of this section, including those cases where the individual has not filed a tax return for the most recent tax year that has ended, the State agency shall immediately re-determine the weekly amount of DUA payable to the individual in accordance with paragraph (b) of this section. Condition During the fiscal year ended June 30, 2020, EDD implemented the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act Section 2102(h), the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations (CFR) or to the extent there is a conflict between section 2102 and 20 CFR Part 625. The amount of PUA payable to an unemployed or unemployed self-employed individual for a week of total unemployment shall be the weekly amount of compensation the individual would have been paid as regular compensation, as computed under the provisions of the applicable State law for a week of total unemployment. The weekly amount determination is calculated using the wages reported by the claimant. Upon receipt of a PUA claim, EDD would verify wages reported to ensure accurate weekly benefit amounts under PUA. Claimants eligible for PUA will also receive additional weekly benefits from the Federal Pandemic Unemployment Compensation (FPUC) program of $600 up until July 31, 2020. Out of 138 PUA benefit payments tested, there were 68 benefit payments for which claimants did not have their wages verified. Cause EDD was not performing timely wage verifications of PUA claimants due to the significant increase in claims resulting from the COVID-19 pandemic beginning in the 4th quarter of fiscal year 2019-20. Effect EDD did not have adequate staffing and oversight controls to ensure that the claimant?s wages were being properly and timely reviewed and approved. Accordingly, there was an increased risk for the occurrence of improper payments in benefits being provided to individuals, which was not prevented or detected. Questioned Costs PUA benefits paid to claimants whose wages were not verified totaled $335,147 for the fiscal year ended June 30, 2020. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2020, totaled $27,156,377,360. The sample was not a statistically valid sample. Recommendation EDD should continue to look for ways to enhance its capacity for performing eligibility reviews regarding wages and to increase automation features and other analytical tools in an effort to reduce the workload of its eligibility workers. Views of Responsible Officials and Corrective Action Plan Management?s response is reported in ?Management?s Response and Corrective Action Plan? included in a separate section at the end of this report.

Since the beginning of the pandemic in March 2020, the EDD has continued to face many challenges in processing unemployment claims workloads given the historic number of claims filed, which were beyond even the worst of recessions, as well as the limited trained staffing resources to work these workloads. The EDD has been increasing our capacity to process these workloads and prioritizing our workloads with the primary focus being on ensuring that timely payments of benefits are being made to the extent possible. The workloads include those associated with the regular Unemployment Insurance (UI) claims, as well as the multiple federal pandemic programs, including the Pandemic Unemployment Assistance (PUA) program. The PUA income verification workload is one such workload. In November 2020, the EDD implemented programming to perform an automated cross-match of the EDD wage records and records available from the Franchise Tax Board to assist in verifying the income of PUA claimants who received a weekly benefit amount greater than the minimum $167 available in California. The EDD uses this automation to the extent possible to verify income to support the increase in claimants? weekly benefit amount and limit the amount of staffing resources required to process this work. For the claims that the EDD cannot verify through this automated cross-match process, the claimants were required to submit documents to substantiate their income, which must be reviewed by staff. The EDD has continued to prioritize the review of these documents among the other workloads that need to be completed and expects to begin the processing of these documents in March 2022. Estimated Implementation Date: November 2020 Contact: Diane Underwood, Division Chief Unemployment Insurance Branch California Employment Development Department

"See Schedule of Findings and Questioned Costs for Chart/Table" Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance, Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. ?200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code - WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: ?14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year. ?14712: (e) Whenever the department determines that a mental health plan has failed to comply with this chapter or any regulations, contractual requirements, state plan, or waivers adopted pursuant to this chapter, the department shall notify the mental health plan in writing within 30 days of its determination and may impose sanctions, including, but not limited to, fines, penalties, the withholding of payments, special requirements, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Condition Fifteen of 56 contractor counties of Short-Doyle funding were tested and six had not submitted their cost reports by the December 31 due date. One of the six contractor counties had not submitted its cost reports for fiscal years 2017-18 (more than 22 months late) and 2018-19 (more than 10 months late) and five of the six contractor counties had not submitted their cost reports for fiscal year 2018-19. Four of those five contractor counties have subsequently submitted their cost reports for fiscal year 2018-19. Although the Mental Health Division of Health Care Services did take the required action of notifying the six contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2019-003 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2020, disbursements of Short-Doyle funding from the Medical Assistance Program to the six noncompliant contractor counties totaled $917,071,626, the 15 tested contractor counties totaled $1,450,497,919, and all 56 contractor counties totaled $1,902,380,732. For the fiscal year ended June 30, 2020, disbursements of Short-Doyle funding from the Children?s Health Insurance Program to the six noncompliant contractor counties totaled $119,901,661, the 15 tested contractor counties totaled $188,712,085, and all 56 contractor counties totaled $233,896,921. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management?s response is reported in ?Management?s Response and Corrective Action Plan? included in a separate section at the end of this report.

Health Care Services agrees with the recommendation and is developing the draft policy and procedure to impose sanctions, fines, and penalties on mental health plans which submit late cost reports. While much of the documentation is completed, Health Care Services is strategizing how to best operationalize the comprehensive sanction policies including sanctions for network adequacy and contract compliance. As such, Health Care Services plans to include the specific sanction policy in the contract compliance sanctions policy, which is anticipated to be released by October 31, 2022. Estimated Implementation Date: October 31, 2022 Contact: Wendy Griffe, Chief Internal Audits California Department of Health Care Services

2019-003

"See Schedule of Findings and Questioned Costs for Chart/Table" Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance, Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. ?200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (d) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services (Continued): Subchapter C - Medical Assistance Programs, Part 435 - Eligibility in the States, District of Columbia, the Northern Mariana Islands, and American Samoa, Subpart J - Eligibility in the States and District of Columbia: Redeterminations of Medicaid Eligibility, ?435.916 Periodic renewal of Medicaid eligibility (42 CFR 435.916): (e) Renewal of individuals whose Medicaid eligibility is based on modified adjusted gross income methods (MAGI). (1) Except as provided in paragraph (d) of this section, the eligibility of Medicaid beneficiaries whose financial eligibility is determined using MAGI-based income must be renewed once every 12 months, and no more frequently than once every 12 months. (2) Renewal on basis of information available to agency. The agency must make a redetermination of eligibility without requiring information from the individual if able to do so based on reliable information contained in the individual?s account or other more current information available to the agency, including but not limited to information accessed through any data bases accessed by the agency under ?435.948, ?435.949 and ?435.956 of this part. (f) Redetermination of individuals whose Medicaid eligibility is determined on a basis other than modified adjusted gross income. The agency must redetermine the eligibility of Medicaid beneficiaries excepted from modified adjusted gross income under ?435.603(j) of this part, for circumstances that may change, at least every 12 months. The agency must make a redetermination of eligibility in accordance with the provisions of paragraph (a)(2) of this section, if sufficient information is available to do so. Subchapter D - State Children?s Health Insurance Program (SCHIPs), Part 457 - Allotments and Grants to States, Subpart C - State Plan Requirements: Eligibility, Screening, Applications, and Enrollment: ? 457.343 Periodic renewal of CHIP eligibility (42 CFR 457.343): The renewal procedures described in ?435.916 of this chapter apply equally to the State in administering a separate CHIP, except that the State shall verify information needed to renew CHIP eligibility in accordance with ?457.380 of this subpart, shall provide notice regarding the State?s determination of renewed eligibility or termination in accordance with ?457.340(e) of this subpart and shall comply with the requirements set forth in ?457.350 of this subpart for screening individuals for other insurance affordability programs and transmitting such individuals? electronic account and other relevant information to the appropriate program. Condition Out of 100 Medical Assistance Program (Medi-Cal) beneficiaries tested, there were 12 beneficiaries with instances in which redeterminations had not been performed within a year (42 CFR 435.916). Out of 60 Children?s Health Insurance Program (CHIP) beneficiaries tested, there were five beneficiaries with instances in which redeterminations had not been performed within a year (42 CFR 457.343). Through subawards, Health Care Services has delegated performance of eligibility determinations to California county welfare agencies that collect and record this information in their respective eligibility systems (collectively known as the Statewide Automated Welfare System [SAWS]) and the California Healthcare Eligibility, Enrollment, and Retention System (CalHEERS), which transmit eligibility data to the Health Care Services? Medi-Cal Eligibility Data System (MEDS). Health Care Services then pays: (1) managed care plans monthly to provide eligible services for beneficiaries (Managed Care); (2) medical providers for services provided directly to beneficiaries (Fee for Service), and (3) the U.S. Centers for Medicare and Medicaid Services (CMS) for Medicare premiums (Premiums). Supplemental Information to Provide Additional Perspective on the Condition In addition to the above exceptions noted during this audit, in February 2018, the U.S. Department of Health and Human Services Office of Inspector General (OIG) issued a report titled ?California Made Medicaid Payments on Behalf of Newly Eligible Beneficiaries Who Did Not Meet Federal and State Requirements.? The OIG sampled 150 beneficiaries and found California made Medicaid payments on behalf of 112 eligible beneficiaries. However, for the remaining 38 beneficiaries, California made payments on behalf of ineligible and potentially ineligible beneficiaries. On the basis of the OIG?s sample results, they estimated that California made Medi-Cal payments of $738.2 million ($628.8 million Federal share) on behalf of 366,078 ineligible beneficiaries and $416.5 million ($402.4 million Federal share) on behalf of 79,055 potentially ineligible beneficiaries. These deficiencies occurred because, at the time, California?s eligibility systems lacked the necessary system functionality and county welfare agencies? eligibility caseworkers made errors. In October 2018, the California State Auditor (CSA) issued a report titled ?Department of Health Care Services: It Paid Billions in Questionable Medi-Cal Premiums and Claims Because It Failed to Follow Up on Eligibility Discrepancies.? This report presents the results of CSA?s high risk audit concerning $4 billion (includes both Federal and State funding) in questionable Medi-Cal payments that Health Care Services made from 2014 through 2017 because it failed to ensure that counties resolved discrepancies between SAWS/CalHEERS and MEDS. Both of these reports came to the attention of the United States Senate Committee on Homeland Security and Governmental Affairs, which requested CMS? plans to address the findings noted in these reports. CMS conducted a review of California?s Medicaid beneficiary eligibility system to assess the accuracy of eligibility determinations and Federal Medical Assistance Percentage (FMAP) claiming. One of the primary objectives of this review was to compare review findings to similar reviews conducted in the past by the OIG to ensure the identified findings have been addressed. However, due to the Coronavirus Disease of 2019 (COVID-19), the release of the draft report of the review has been delayed. It should also be noted that due to COVID-19, the Secretary of Health and Human Services declared a Public Health Emergency (PHE) that was effective January 27, 2020. On March 13, 2020, the President of the United States of America declared a National Emergency, retroactive to March 1, 2020, due to COVID-19. As a result of the President?s declaration, CMS issued a federal directive granting states an exception for meeting the periodic renewal requirements for cases that were up for redetermination as of March 1, 2020 through the end of the PHE. This exemption prevents states from denying or terminating eligibility or reducing benefits to Medi-Cal and CHIP beneficiaries during the PHE unless the beneficiary dies, no longer is a state resident, is a non-MAGI Medi-Cal individual moving from a non-Long-Term Care (LTC) aid code into a LTC aid code, or voluntarily discontinues their eligibility. After the month in which the PHE is declared over, states will be given an ample period of time to complete all renewals and redeterminations. As a result of COVID-19, the periodic renewal requirements were not tested for the last four months of the fiscal year ended June 30, 2020. Identification as a Repeat Finding Finding 2019-005 was reported in the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, instances of untimely redeterminations and instances of benefits provided to ineligible beneficiaries for the following reasons. ? There was a decrease in the eligibility exceptions from the prior year (decline of 15 and 4 exceptions for Medicaid and CHIP, respectively). Enhancements made to the functionality of CalHEERS that increased the use of automation features, and increased monitoring and collaboration with county welfare agencies were the main causes for the decline in the number of exceptions. The increased use of automation features reduced the risk of human errors as well as decreased the workload on eligibility caseworkers allowing them to perform application and eligibility redeterminations in a timely manner. Also, Health Care Services had established new procedures to monitor whether county welfare agencies were effectively managing this increased workload to ensure eligibility caseworkers were appropriately applying the eligibility procedures and documentation requirements. Since 2017, Health Care Services resumed performing focus reviews on select county welfare agencies that were suspended during the early stages of health care reform implementation. Through this effort, Health Care Services is working collaboratively with county partners to identify areas of weaknesses that contribute to delays in renewal processing time. In some instances, counties are required to submit a corrective action plan to Health Care Services that describes implementation of additional business processes/quality control mechanisms that are anticipated to increase both the accuracy and timeliness of renewals. ? The MEDS alert functionality is used to communicate information to county welfare agencies on changes in beneficiary circumstance, i.e., exceeding the age threshold for the assigned aid category, and discrepancies between eligibility systems, and MEDS. MEDS alerts will be triggered for various reasons that include: ? Problems encountered in processing updates submitted by county welfare agencies; ? Problems encountered in processing updates generated as a result of a reconciliation of county welfare agencies records with MEDS records; ? Updates submitted by other entities that impact beneficiaries? eligibility or require action by county welfare agencies; and ? Upcoming changes in a beneficiaries? status that will require action by county welfare agencies. Health Care Services did not have an established process for monitoring the county welfare agencies? progress in addressing these alerts. To address this, Health Care Services implemented a quality control pilot on June 25, 2019 to monitor MEDS alerts processing activities in the six counties that were responsible for over 85% of the discrepancies found in CSA?s October 2018 report previously mentioned to be able to quickly identify county welfare agencies that are not resolving MEDS, to identify the cause of these alerts, and work with counties to develop and implement best practices that are effective in reducing the number of new alerts, and efficiently reducing the number of unresolved alerts. In addition, Health Care Services has represented that MEDS also has the functionality to alert county welfare agencies when eligibility redeterminations are required or overdue. However, currently Health Care Services is working to refine this functionality to effectively be used to identify overdue renewals. Effect Two of the 12 Medi-Cal beneficiaries with eligibility redetermination exceptions were determined to be ineligible and benefits were ultimately discontinued; however, since those redeterminations were late, they received ineligible benefits between the date they should have been discontinued and the date they were actually discontinued. Another beneficiary was determined to be ineligible and benefits were not discontinued during the fiscal year; therefore, they received ineligible benefits from the date they should have been discontinued. The remaining nine beneficiaries were determined to be eligible. One of the five CHIP beneficiaries with eligibility redetermination exceptions was determined to be ineligible and benefits were not discontinued during the fiscal year; therefore, they received ineligible benefits from the date they should have been discontinued. The remaining four beneficiaries were determined to be eligible. Questioned Costs Benefits paid to Medi-Cal beneficiaries after they were determined to be ineligible totaled $9,967 ($5,178 Managed Care, $4,789 Fee for Service, and $0 Premiums) for the fiscal year ended June 30, 2020. Benefits paid to the CHIP beneficiary after the beneficiary was determined to be ineligible totaled $617 ($617 Managed Care and $0 Fee for Service) for the fiscal year ended June 30, 2020. Context A total of $161,516 ($25,935 Managed Care, $133,263 Fee for Service, and $2,318 Premiums) was disbursed during the fiscal year ended June 30, 2020 on behalf of the 12 Medi-Cal beneficiaries with eligibility exceptions, and a total of $14,337 ($9,548 Managed Care, $4,789 Fee for Service, and $0 Premiums) was disbursed during the fiscal year ended June 30, 2020 on behalf of the three beneficiaries later determined to be ineligible. Total benefits paid on behalf of the 100 Medi-Cal beneficiaries tested were $432,554 ($213,065 Managed Care, $211,022 Fee for Service, and $8,467 Premiums). The 100 tested Medi-Cal beneficiaries were selected from ten of California?s 58 counties. The total federal Medi-Cal benefits paid on behalf of approximately 11.4 million beneficiaries for the fiscal year ended June 30, 2020 was $46,261,934,366 ($29,738,474,418 Managed Care, $14,881,770,120 Fee for Service, and $1,641,689,828 Premiums). A total of $5,587 ($4,954 Managed Care and $633 Fee for Service) was disbursed during the fiscal year ended June 30, 2020 on behalf of the five CHIP beneficiaries with eligibility redetermination exceptions and a total of $1,208 ($1,208 Managed Care and $0 Fee for Service) was disbursed during the fiscal year ended June 30, 2020 on behalf of the one beneficiary later determined to be ineligible. Total benefits paid on behalf of the 60 CHIP beneficiaries tested were $129,947 ($24,452 Managed Care and $105,495 Fee for Service). The 60 tested CHIP beneficiaries were selected from ten of California?s 58 counties. The total federal CHIP benefits paid on behalf of approximately 1.5 million beneficiaries for the fiscal year ended June 30, 2020 was $2,594,624,735 ($1,968,269,210 Managed Care and $626,355,525 Fee for Service). The samples were not statistically valid samples. Recommendation Health Care Services should continue looking for ways to enhance the functionality of CalHEERS for application and eligibility redetermination for those individuals who are eligible on a MAGI-basis and to increase the use of automation features in an effort to reduce workload for eligibility caseworkers. In addition, Health Care Services should continue its practice of conducting regular focus reviews on county welfare agencies to identify factors contributing to the delays and errors in the redetermination process such as misinterpretations of policies, systems issues, business practices, etc., and then work with county welfare agencies to provide appropriate training and/or creating corrective action plans. Health Care Services should continue with the quality control process used to monitor all critical and urgent level MEDS alerts to be able to quickly identify county welfare agencies that are not resolving MEDS alerts in a timely manner. Health Care Services should continue its efforts to incorporate into the MEDS alert functionality the ability to alert county welfare agencies when eligibility redeterminations are required or overdue. Health Care Services should then work directly with those county welfare agencies that are not performing eligibility redeterminations in a timely manner and who may not be correctly verifying eligibility through training and site visits to implement policies and procedures to improve their compliance status. Views of Responsible Officials and Corrective Action Plan Management?s response is reported in ?Management?s Response and Corrective Action Plan? included in a separate section at the end of this report.

Health Care Services agrees with the recommendation. Health Care Services performs focus reviews on counties to identify factors (training issues, misinterpretation of policy, systems issues, and business practices) contributing to delays/error in renewal processing. Depending on the outcome of each review, counties may be required to submit a corrective action plan (CAP). The CAP must include: 1. A timeframe for the development and implementation of policies/procedures to address the issues identified. 2. How the policies/procedures, once implemented, will reduce similar occurrences in future renewals. Health Care Services allots the county six months after the date the CAP is implemented to demonstrate improvement, and follows up with the county on a regular basis to affirm the policies/procedures implemented are effective. If sufficient improvement is not seen, counties will be required to amend the CAP. Health Care Services then performs a subsequent review within a year after the original review. Health Care Services continues to conduct regular focused reviews of counties to ensure eligibility determinations are performed in accordance with federal/state regulations. Through the course of the reviews Health Care Services staff confirm the following: ? The appropriate documents (manual and/or electronic) were received prior to the completion of the eligibility determinations. ? All required data elements were electronically/manually verified prior to the completion of eligibility determinations. ? Eligibility systems are updated with current information, and used appropriately in eligibility determinations. ? Applicant information is correctly entered into eligibility systems (data entry errors). ? Eligibility determinations are performed for only individuals who request an evaluation for eligibility to health insurance programs. ? All documents used in the eligibility information are: o Appropriately retained in the case file. o Received in the last 12 months. o Used appropriately in the eligibility determination. o Confirms eligibility to the assigned aid category. The reviews are used to identify: ? Error trends attributed to caseworker actions. ? Errors trends related to systems issues. ? Gaps in policy that need further clarification/guidance. Upon implementation of the Focus Review Monitoring program, which was developed in response to external audit findings to identify business and operational issues at the county level that contribute to issues with eligibility determinations, Health Care Services selected counties based on the population size. Counties with the highest population were reviewed first, since high-population counties are responsible for the majority of determinations made statewide. Health Care Services plans to review each county on a biennial basis once an initial review is performed in all 58 counties. Health Care Services completed a focus review for the following counties: Alameda, Calaveras, Colusa, Contra Costa, El Dorado, Fresno, Kern, Kings, Lake, Los Angeles, Madera, Marin, Mendocino, Merced, Monterey, Napa, Orange, Placer, Plumas, Riverside, Sacramento, San Bernardino, San Diego, San Francisco, San Joaquin, San Luis Obispo, Santa Barbara, Santa Clara, Shasta, Siskiyou, Solano, Sonoma, Stanislaus, Sutter, Tulare, Tuolumne, Ventura, Yuba, and Yolo. Health Care Services had reviewed the 39 counties listed above and had planned to review the remaining 19 counties listed below by December 31, 2020: Alpine, Amador, Butte, Del Norte, Glenn, Humboldt, Imperial, Inyo, Lassen, Mariposa, Modoc, Mono, Nevada, San Benito, San Mateo, Santa Cruz, Sierra, Tehama, and Trinity. Due to the COVID-19 pandemic, Health Care Services temporarily suspended the 2020 site visits and focus reviews. Health Care Services will resume efforts upon termination of the COVID-19 pandemic. Health Care Services is working to develop two new MEDS alerts, which will be used to notify counties of past due renewals and track the number of months since the last renewal. The alerts will be used by Health Care Services? quality control staff to monitor overdue renewals and quickly identify counties accruing a high volume of alerts. Health Care Services will work with counties to implement processes/procedures to reduce the number of renewals processed in excess of federal/state timeframes. Please note, due to the public health emergency, Health Care Services suspended this effort through December 31, 2022. Health Care Services continues to work with its business partners to enhance CalHEERS functionality on an as-needed basis, and add additional features to increase automation of the Medi-Cal eligibility application and renewal process, to the extent possible. Estimated Implementation Date: December 31, 2022 Contact: Wendy Griffe, Chief Internal Audits California Department of Health Care Services

2019-005

"See Schedule of Findings and Questioned Costs for Chart/Table" Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. ?200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - The Public Health and Welfare. Chapter 6A - Public Health Service. Subchapter XXIV - HIV Health Care Services Program. Part B - Care Grant Program. Subpart I - General Grant Provisions. Section 300ff-26 - Provision of Treatments: (a) In general A State shall use a portion of the amounts provided under a grant awarded under section 300ff?21 of this title to establish a program under section 300ff?22(b)(3)(B) of this title to provide therapeutics to treat HIV/AIDS or prevent the serious deterioration of health arising from HIV/AIDS in eligible individuals, including measures for the prevention and treatment of opportunistic infections. (b) Eligible individual To be eligible to receive assistance from a State under this section an individual shall: (1) Have a medical diagnosis of HIV/AIDS; and (2) Be a low-income individual, as defined by the State. California State AIDS Drug Assistance Program Guidelines March 2017 and December 2018: (1.1) AIDS Drug Assistance Program (ADAP) Eligibility Criteria: To be eligible for the ADAP program, a client must: ? Have a positive HIV/AIDS diagnosis. ? Be at least 18 years old. ? Be a resident of California. ? Have an annual Modified Adjusted Gross Income (MAGI) that does not exceed 500 percent Federal Poverty Level (FPL) based on household size and income. ? Not be fully covered by Medi-Cal or any other third-party payers (an entity that reimburses and manages health care expenses such as private insurance or governmental agencies, employers, etc.). Health Resources and Services Administration (HRSA) Policy Clarification Notice (PCN) 13-02 (Revised 5/1/2019): For both initial/annual and six-month recertification procedures, eligibility determinations may be performed simultaneously with testing and treatment. Recipients and subrecipients assume the risk of recouping any HRSA RWHAP funds utilized for clients ultimately determined to be ineligible, and instead charge an alternate payment source, or otherwise ensure that funds are returned to the HRSA RWHAP program. HRSA PCN 15-04 (Revised 1/11/2019): The RWHAP legislation requires that rebates collected on ADAP medication purchases be applied to the RWHAP Part B Program with a priority, but not a requirement, that the rebates be placed back into ADAP. Although ADAP rebates are neither program income nor refunds, they are subject to the same regulatory provision regarding expenditure. These rebates must be used for the statutorily permitted purposes under the RWHAP Part B Program, which are limited to core medical services including ADAP, support services, clinical quality management, and administrative expenses (including planning and evaluation) as part of a comprehensive system of care for low-income individuals living with HIV. Condition Out of 60 individuals reviewed, 11 individuals did not submit all required documentation, including medical reports to support a positive HIV/AIDS diagnosis or income documentation to verify their annual MAGI did not exceed 500 percent Federal Poverty Level based on household size and income. Three of these individuals were placed on a temporary access period without meeting the necessary eligibility requirements. Pharmaceutical rebate funds were utilized during the temporary access and extension periods for all 11 individuals. Identification as a Repeat Finding Finding 2019-006 was reported in the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, the occurrence of benefits being provided to ineligible individuals. Effect Public Health did not have adequate oversight controls to ensure that the applicant?s eligibility was properly reviewed and approved. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals, which may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable because benefit costs are not tracked by individual participants. Context Pharmacy benefits management services are provided by a contractor who received administrative fees and reimbursements for prescription drug costs to program participants. Payments to the contractor totaled $116,013,571 for approximately 30,000 program participants for the fiscal year ended June 30, 2020. Based on the budget in the contract, the contractor?s administrative fees and other charges are estimated to be $657,876 annually. As such, net prescription drug costs are approximately $115,355,695 for the fiscal year ended June 30, 2020. The sample was not a statistically valid sample. Recommendation The ADAP Branch should continue to monitor compliance with its policies to ensure enrollment workers and secondary reviews of ADAP applications follow the established guidelines and retain acceptable documentation to support eligibility determinations. Applications that have been granted an eligibility exception (i.e., Temporary Access Period, Medi-Cal Eligibility Exception Request, or Eligibility Exception Request) should be reviewed in a timely manner to ensure clients who do not provide the required documentation within the approved extension period are disenrolled in the a timely manner. Views of Responsible Officials and Corrective Action Plan Management?s response is reported in ?Management?s Response and Corrective Action Plan? included in a separate section at the end of this report.

The California Department of Public Health, Office of AIDS (OA) is in agreement with the finding. The OA will work to continue monitoring compliance with established policies to ensure enrollment workers and secondary reviews of the AIDS Drug Assistance Program (ADAP) applications follow the guidelines, and retain acceptable documentation to support eligibility determinations. Additionally, ADAP Eligibility and ADAP Fiscal Forecasting, Evaluation, & Monitoring Section (AFFEM) will work with Public Health?s surveillance system development contractor to implement the necessary reporting mechanism to identify ADAP clients who receive eligibility extensions to ensure that a more in-depth analysis of eligibility can be determined. Estimated Implementation Date: June 2022 Contact: Sharisse Kemp, Assistant Division Chief Office of AIDS California Department of Public Health

2019-006

"See Schedule of Findings and Questioned Costs for Chart/Table" Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. ?200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services (Continued): Subchapter C - Medical Assistance Programs, Part 433 - State Fiscal Administration, Subpart F - Refunding of Federal Share of Medicaid Overpayments to Providers: ?433.300 Basis (42 CFR 433.300). This subpart implements: Section 1903(d)(2)(C) and (D) of the Act, which provides that a State has 1 year from discovery of an overpayment for Medicaid services to recover or attempt to recover the overpayment from the provider before adjustment in the Federal Medicaid payment to the State is made; and that adjustment will be made at the end of the 1-year period, whether or not recovery is made, unless the State is unable to recover from a provider because the overpayment is a debt that has been discharged in bankruptcy or is otherwise uncollectable. ?433.320 Procedures for refunds to CMS (42 CFR 433.320): (a) Basic requirements: (1) The agency must refund the Federal share of overpayments that are subject to recovery to CMS through a credit on its Quarterly Statement of Expenditures (Form CMS-64). (2) The agency must credit CMS with the Federal share of overpayments subject to recovery on the earlier of ? (i) The Form CMS-64 submission due to CMS for the quarter in which the State recovers the overpayment from the provider; or (ii) The Form CMS-64 due to CMS for the quarter in which the 1-year period following discovery, established in accordance with ?433.316, ends. (3) A credit on the Form CMS-64 must be made whether or not the overpayment has been recovered by the State from the provider. (4) If the State does not refund the Federal share of such overpayment as indicated in paragraph (a)(2) of this section, the State will be liable for interest on the amount equal to the Federal share of the non-recovered, non-refunded overpayment amount. Interest during this period will be at the Current Value of Funds Rate (CVFR), and will accrue beginning on the day after the end of the 1-year period following discovery until the last day of the quarter for which the State submits a CMS-64 report refunding the Federal share of the overpayment. Subchapter D - State Children?s Health Insurance Programs (SCHIPs), Part 457 - Allotments and Grants to States, Subpart F - Payment to States: ?457.628 Other applicable Federal regulations (42 CFR 457.628): Other regulations applicable to CHIP programs include the following: (a) HHS regulations in ??433.312 through 433.322 of this chapter (related to Overpayments) apply to State's CHIP programs in the same manner as they apply to State's Medicaid programs. Note that while for the Medical Assistance Program, the overpayments of the federal share must be refunded to the Centers for Medicare & Medicaid Services (CMS) via Form CMS-64 Summary, Line 9C1 - Fraud, Waste & Abuse Amounts, for the Children?s Health Insurance Program, the overpayments of the federal share must be refunded to CMS via Form CMS-21 Summary, Line 4 - Adjustments Decreasing Claims - Collections. Condition There was a difference of $51,947,058 between the overpayment report (MCC-R-032) of $152,314,213 that was provided for this audit and the CMS-64 report of $100,367,155 submitted for the second quarter of the 2019-20 fiscal year (42 CFR 433.320). All 15 CHIP overpayments tested did not reflect the correct federal share (Federal Financial Participation or FFP rate). (42 CFR 433.320 via 42 CFR 457.628). Cause The difference between the MCC-R-032 report and the CMS-64 report for the second quarter of the 2019-20 fiscal year was due to Health Care Services using the amounts from an MCC-R-032 report that had been pulled prematurely, which resulted in the underreporting of FFP. After the auditors brought this discrepancy to its attention, the Third Party Liability and Recovery Division (TPLRD) corrected the issue by submitting an adjustment to account for the difference, based on the finalized report for the quarter. The existing internal controls did not prevent, or detect and correct, instances of reporting the incorrect total overpayment for the quarter. The incorrect FFP rate being applied to the Children?s Health Insurance Program (CHIP) overpayments was due to Health Care Services Claims Processing Accounts Receivable (AR) System?s inability to distinguish between CHIP and Medical Assistance Program (Medicaid) overpayments. When Audits and Investigations (A&I) identifies an overpayment, they do not distinguish between the two programs. A&I then sends an Action Notice (AN) and the findings of overpayments to the Fiscal Intermediary (FI) to establish an AR on the system with a copy to TPLRD for collection purposes. Once the FI establishes an AR for an overpayment, the overpayment is recorded in the California Omnibus Budget Reconciliation Act of 1985 (COBRA) system (a department-developed application) and is automatically assigned the Medicaid FFP rate in effect upon AR creation. Due to system limitations (at the time), the COBRA system automatically assigns the Medicaid FFP rate in effect at AR creation for all overpayments and cannot assign a CHIP FFP rate to a CHIP overpayment. As such, all types of overpayments will utilize the Medicaid FFP rate. The existing controls did not prevent, or detect and correct instances of utilizing the correct FFP rate to differentiate between Medical Assistance Program and Children?s Health Insurance Program overpayments. Effect Inaccurate reporting on the CMS-64 report and using incorrect CHIP FFP rates resulted in under/over funding and noncompliance with refunding the Federal share of Medicaid and CHIP overpayments. Questioned Costs Overpayments were underreported on the CMS-64 reports for the 2019-20 fiscal year for both Medicaid and CHIP by a total of $51,947,058. Using the Medicaid FFP rate of 50% since the overpayments were all reported on the Medicaid CMS-64, questioned costs would be $25,973,529. However, Health Care Services does not have a process in place that identifies the overpayments between the Medicaid and CHIP programs, and therefore, are not able to determine how much of the overpayments were for CHIP, which had a higher FFP rate of 76.5% during the second quarter. Overpayments utilizing the incorrect CHIP FFP rate resulted in known questioned costs of $26,719 for the 2019-20 fiscal year. Context Expenditures for the 2019-20 fiscal year totaled $61,561,477,130 for Medicaid and $2,958,448,448 for CHIP. The $26,719 known questioned costs for using the incorrect CHIP FFP rate resulted from a total of $60,770 for the fifteen CHIP samples tested. In addition, a total of $487,727,920 in overpayments were reported for the 2019-20 fiscal year that applied the Medicaid FFP rate even though a portion of that total was for CHIP. Recommendation Health Care Services should have a process in place to ensure the reports are not pulled prematurely so that the correct amounts are reported on the CMS-64. Health Care Services should update the system to assign the appropriate FFP rate for each overpayment. With this implementation, CHIP overpayments can be appropriately identified with the correct FFP rate and reported on the CMS-21. Views of Responsible Officials and Corrective Action Plan Management?s response is reported in ?Management?s Response and Corrective Action Plan? included in a separate section at the end of this report.

Health Care Services agrees with the recommendation. To ensure reports are not pulled prematurely so the correct amounts are reported in the CMS-64, Health Care Services confirmed when the California Omnibus Budget Reconciliation Act of 1985 (COBRA) reports are finalized each month, and created a calendar to display the earliest date COBRA reports can be pulled each month. In addition, Health Care Services pulls the finalized COBRA reports and reports the overpayment amounts for Centers for Medicare & Medicaid Services (CMS) reporting. Effective, September 1, 2021, System Development Notice (SDN) 20039 made updates to the Claims Processing Accounts Receivable System, requiring the Fiscal Intermediary (FI) to record the Federal Financial Participation (FFP) rate including the Budget Program (i.e., Medicaid Assistance Program vs. Children?s Health Insurance Program) for each overpayment account receivable set up after the effective date. The FFP rate and Budget Program information for each overpayment is provided on the Action Notices to the FI. The SDN also made updates to the COBRA system to enable the system to receive the FFP rate and Budget Program information for each overpayment set up by the FI and updated COBRA reports, thereby allowing Health Care Services to report the correct FFP rate for overpayments on the CMS-64 and CMS-21. Estimated Implementation Date: September 1, 2021 Contact: Wendy Griffe, Chief Internal Audits California Department of Health Care Services

Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. ?200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 23 ? Highways - Chapter I ? Federal Highway Administration, Department of Transportation - Subchapter G ? Engineering and Traffic Operations ? Part 637 Construction Inspection and Approval ? Subpart B ? Quality Assurance Procedures for Construction - ?637.207 Quality Assurance Program: (a)(3) The preparation of a materials certification, conforming in substance to appendix A of this subpart, shall be submitted to the FHWA Division Administrator for each construction project which is subject to FHWA construction oversight activities. Condition Transportation established a Federal Highway Administration (FHWA) approved quality assurance program over construction projects on the National Highway System to ensure the materials and workmanship conformed to the approved plans and specifications. At the completion of a construction project, the resident engineer reviews all quality assurance documents within the project records and certifies all materials and workmanship for the project and the required specifications on the final materials certification form for submission to the FHWA. This form is required per Transportation?s policies and procedures to be retained within the permanent project records. For 3 of 25 projects sampled, Transportation could not locate the final materials certificate within the project records. However, the FHWA approved and closed the three projects. Cause Transportation?s current document retention method is paper based. Management represented that the transition of project files from active storage locations to completed, and finally archived project file storage resulted in the misplacement of required quality assurance project documentation. Effect Transportation?s incomplete project documentation creates a risk that compliance with requirements may not be substantiated for audit and federal oversight purposes. Questioned Costs No questioned costs were identified. Context A total of 881 projects were closed and final voucher reports submitted to the U.S. Department of Transportation, Federal Highway Administration during FY2018-19. The sample was not a statistically valid sample. Recommendation Transportation should develop a more robust file storage process, as well as consider an electronic storage method for key required permanent project records, which would provide for permanent project records to be available as requested. Views of Responsible Officials and Corrective Action Plan Management?s response is reported in ?Management?s Response and Corrective Action Plan? included in a separate section at the end of this report.

MGO noted that for three of 25 projects sampled, Caltrans could not locate the final materials certificate within the project records. The final materials certificate is required by Caltrans? policies and procedures to be retained within the permanent project records. At the completion of a construction project, the resident engineer reviews all quality assurance documents within the project records and certifies all project materials and workmanship comply with the project?s specifications on the final materials certification form for submission to the FHWA. In response to the finding, Caltrans will perform the following actions: ? Continue the ongoing procurement process of a document management system that will provide for electronic storage, management, and retrieval of project records, including permanent project records such as the final materials certification. Current forecasting estimates statewide procurement of the document management system by July 2022. Bi-annual status updates on the procurement of the document management system will be made available to interested parties upon request. ? Issue a memorandum to Caltrans district and region construction management that identifies the final materials certification audit finding and reaffirms the existing guidance in the Caltrans Construction Manual concerning completion and proper retention of the final materials certification for each completed project. This memorandum will highlight those requirements for projects on the state highway system that are administered by others, such as transportation agencies, and stress Caltrans? role of quality assurance for these oversight projects. This memorandum was issued in May 2020. Upon securing the document management system, modify the Construction Manual to provide for uniform electronic storage of project records to aid in retrieval of documents as needed. This will be completed within six months of obtaining the document management system. Estimated Implementation Date: July 2022 Contact: Chuck Suszko, Chief Office of Contract Administration Division of Construction California Department of Transportation

Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. ?200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code - WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: ?14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year. ?14712: (e) Whenever the department determines that a mental health plan has failed to comply with this chapter or any regulations, contractual requirements, state plan, or waivers adopted pursuant to this chapter, the department shall notify the mental health plan in writing within 30 days of its determination and may impose sanctions, including, but not limited to, fines, penalties, the withholding of payments, special requirements, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Condition Twenty-one of 56 contractor counties of Short-Doyle funding were tested and seven had not submitted their cost reports by the December 31 due date. One of the seven contractor counties had not submitted its cost reports for FY2016-2017 (more than 22 months late) and FY2017-2018 (more than 10 months late) and six of the seven contractor counties had not submitted their cost reports for FY2017-2018 (more than 10 months late). Although the Mental Health Division of Health Care Services did take the required action of notifying the seven contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2018-004 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable because the cost reports were not available. Context For the fiscal year ended June 30, 2019, disbursements of Short-Doyle funding from the Medical Assistance Program to the seven noncompliant contractor counties totaled $870,514,936, the 21 tested contractor counties totaled $1,582,137,830, and all 56 contractor counties totaled $1,948,203,200. For the fiscal year ended June 30, 2019, disbursements of Short-Doyle funding from the Children?s Health Insurance Program to the seven noncompliant contractor counties totaled $118,651,458, the 21 tested contractor counties totaled $214,899,179. and all 56 contractor counties totaled $259,138,445. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management?s response is reported in ?Management?s Response and Corrective Action Plan? included in a separate section at the end of this report.

Health Care Services drafted policies and procedures prior to the end of the 2019 legislative session, to impose administrative and financial sanctions, such as but not limited to, fines, penalties, and corrective actions, when a county does not comply with existing requirements to submit cost reports by December 31 following the close of each fiscal year. Before the new policies and procedures can be implemented, additional work is required to confirm they do not conflict with state or federal laws and regulations, contract provisions, or other applicable guidance and requirements adopted during the 2019 legislative session. Work efforts to finalize the new policies and procedures are currently delayed due to the COVID-19 pandemic and will resume in earnest following the end of the emergency. Health Care Services is tentatively targeting a new implementation date of December 31, 2020, but actual implementation will depend on when the COVID-19 pandemic ends. Estimated Implementation Date: December 31, 2020 Contact: Alex Watt, Assistant Chief Audits & Investigations ? Internal Audits California Department of Health Care Services

2018-004

Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. ?200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health, Chapter IV - Centers for Medicare & Medicaid Services, Department of Health and Human Services (Continued): Subchapter C - Medical Assistance Programs, Part 435 - Eligibility in the States, District of Columbia, the Northern Mariana Islands, and American Samoa, Subpart J - Eligibility in the States and District of Columbia: Applications, ?435.907 Application (42 CFR 435.907): (a) Basis and implementation. In accordance with section 1413(b)(1)(A) of the Affordable Care Act, the agency must accept an application from the applicant, an adult who is in the applicant?s household, as defined in ?435.603(f), or family, as defined in section 36B(d)(1) of the Code, an authorized representative, or if the applicant is a minor or incapacitated, someone acting responsibly for the applicant, and any documentation required to establish eligibility? (1) Via the internet Web site described in ?435.1200(f) of this part; (2) By telephone; (3) Via mail; (4) In person; and (5) Through other commonly available electronic means. (b) The application must be? (1) The single, streamlined application for all insurance affordability programs developed by the Secretary; or (2) An alternative single streamlined application for all insurance affordability programs, which may be no more burdensome on the applicant than the application described in paragraph (b)(1) of this section, approved by the Secretary. Applications, ?435.910 Use of social security number (42 CFR 435.910): (a) The agency must verify the SSN furnished by an applicant or beneficiary with SSA to ensure the SSN was issued to that individual, and to determine whether any other SSNs were issued to that individual. Redeterminations of Medicaid Eligibility, ?435.916 Periodic renewal of Medicaid eligibility (42 CFR 435.916): (a) Renewal of individuals whose Medicaid eligibility is based on modified adjusted gross income methods (MAGI). (1) Except as provided in paragraph (d) of this section, the eligibility of Medicaid beneficiaries whose financial eligibility is determined using MAGI-based income must be renewed once every 12 months, and no more frequently than once every 12 months. (2) Renewal on basis of information available to agency. The agency must make a redetermination of eligibility without requiring information from the individual if able to do so based on reliable information contained in the individual?s account or other more current information available to the agency, including but not limited to information accessed through any data bases accessed by the agency under ?435.948, ?435.949 and ?435.956 of this part. (b) Redetermination of individuals whose Medicaid eligibility is determined on a basis other than modified adjusted gross income. The agency must redetermine the eligibility of Medicaid beneficiaries excepted from modified adjusted gross income under ?435.603(j) of this part, for circumstances that may change, at least every 12 months. The agency must make a redetermination of eligibility in accordance with the provisions of paragraph (a)(2) of this section, if sufficient information is available to do so. Income and Eligibility Verification Requirements, ?435.948 Verifying financial information (42 CFR 435.948): (a) The agency must in accordance with this section request the following information relating to financial eligibility from other agencies in the State and other States and Federal programs to the extent the agency determines such information is useful to verifying eligibility of an individual: (1) Information related to wages, net earnings from self-employment, unearned income and resources from the State Wage Information Collection Agency (SWICA), the Internal Revenue Service (IRS), the Social Security Administration (SSA), the agencies administering the State unemployment compensation laws, the State-administered supplementary payment programs under section 1616(a) of the Act, and any State program administered under a plan approved under Titles I, X, XIV, or XVI of the Act; Subchapter D - State Children?s Health Insurance Program (SCHIPs), Part 457 - Allotments and Grants to States, Subpart C - State Plan Requirements: Eligibility, Screening, Applications, and Enrollment: ? 457.320 Other eligibility standards (42 CFR 457.320): (a) Eligibility standards. To the extent consistent with title XXI of the Act and except as provided in paragraph (b) of this section, the State plan may adopt eligibility standards for one or more groups of children related to - (1) Geographic area(s) served by the plan; (2) Age (up to, but not including, age 19); (3) Income; (4) Spenddowns; (5) Residency, in accordance with paragraph (d) of this section; (6) Disability status, provided that such standards do not restrict eligibility; (7) Access to, or coverage under, other health coverage; and (8) Duration of eligibility, in accordance with paragraph (e) of this section. ? 457.330 Application (42 CFR 457.330): The State shall use the single, streamlined application used by the State in accordance with paragraph (b) of ?435.907 of this chapter, and otherwise comply with such section, except that the terms of ?435.907(c) of this chapter (relating to applicants seeking coverage on a basis other than modified adjusted gross income) do not apply. ? 457.343 Periodic renewal of CHIP eligibility (42 CFR 457.343): The renewal procedures described in ?435.916 of this chapter apply equally to the State in administering a separate CHIP, except that the State shall verify information needed to renew CHIP eligibility in accordance with ?457.380 of this subpart, shall provide notice regarding the State?s determination of renewed eligibility or termination in accordance with ?457.340(e) of this subpart and shall comply with the requirements set forth in ?457.350 of this subpart for screening individuals for other insurance affordability programs and transmitting such individuals? electronic account and other relevant information to the appropriate program. Title 42 - The Public Health and Welfare, Chapter 7 - Social Security, Subchapter XI - General Provisions, Peer Review, and Administrative Simplification, Part A - General Provisions, ?1320b?7 - Income and eligibility verification system, (d) Citizenship or immigration status requirements; documentation; verification by Immigration and Naturalization Service; denial of benefits; hearing (42 USC?1320b?7(d)): The requirements of this subsection, with respect to an income and eligibility verification system of a State, are as follows: (1)(A) The State shall require, as a condition of an individual?s eligibility for benefits under a program listed in subsection (b), a declaration in writing, under penalty of perjury? (i) by the individual, (ii) in the case in which eligibility for program benefits is determined on a family or household basis, by any adult member of such individual?s family or household (as applicable), or (iii) in the case of an individual born into a family or household receiving benefits under such program, by any adult member of such family or household no later than the next redetermination of eligibility of such family or household following the birth of such individual, stating whether the individual is a citizen or national of the United States, and, if that individual is not a citizen or national of the United States, that the individual is in a satisfactory immigration status. Condition Out of 75 Medical Assistance Program (Medi-Cal) beneficiaries tested, there were 27 beneficiaries with the following eligibility exceptions: ? There were four instances in which a completed initial application was not on file to establish eligibility (42 CFR 435.907); ? There was one instance in which a social security number had not been verified with the Social Security Administration (42 CFR 435.910); ? There were thirteen instances in which redeterminations had not been performed within a year (42 CFR 435.916); ? There were eight instances where the Income and Eligibility Verification Requirements were not met (42 CFR 435.948); and ? There was one instance of an undocumented individual incorrectly determined to be eligible for full benefits and five additional instances of individuals classified as US citizens and determined to be eligible for full benefits that did not have support of such citizenship on file (42 USC?1320b?7). Out of 60 Children?s Health Insurance Program (CHIP) beneficiaries tested, there were nine beneficiaries with the following eligibility exceptions: ? There were three instances where the Other Eligibility Standards were not met (42 CFR 457.320), ? There were six instances in which a completed initial application was not on file to establish eligibility (42 CFR 457.330), and ? There were six instances in which redeterminations had not been performed within a year (42 CFR 457.343). Through subawards, Health Care Services has delegated performance of eligibility determinations to California county welfare agencies that collect and record this information in their respective eligibility systems (collectively known as the Statewide Automated Welfare System [SAWS]) and transmit data to the Health Care Services? Medi-Cal Eligibility Data System (MEDS). Health Care Services then pays: (1) managed care plans monthly to provide eligible services for beneficiaries (Managed Care); (2) medical providers for services provided directly to beneficiaries (Fee for Service), and (3) the U.S. Centers for Medicare and Medicaid Services (CMS) for Medicare premiums (Premiums). Supplemental Information to Provide Additional Perspective on the Condition In addition to the above exceptions noted during this audit, in February 2018, the U.S. Department of Health and Human Services Office of Inspector General (OIG) issued a report titled ?California Made Medicaid Payments on Behalf of Newly Eligible Beneficiaries Who Did Not Meet Federal and State Requirements.? The OIG sampled 150 beneficiaries and found California made Medicaid payments on behalf of 112 eligible beneficiaries. However, for the remaining 38 beneficiaries, California made payments on behalf of ineligible and potentially ineligible beneficiaries. On the basis of the OIG?s sample results, they estimated that California made Medi-Cal payments of $738.2 million ($628.8 million Federal share) on behalf of 366,078 ineligible beneficiaries and $416.5 million ($402.4 million Federal share) on behalf of 79,055 potentially ineligible beneficiaries. These deficiencies occurred because California?s eligibility determination systems lacked the necessary system functionality and county welfare agencies? eligibility caseworkers made errors. In October 2018, the California State Auditor (CSA) issued a report titled ?Department of Health Care Services: It Paid Billions in Questionable Medi-Cal Premiums and Claims Because It Failed to Follow Up on Eligibility Discrepancies.? This report presents the results of CSA?s high risk audit concerning $4 billion (includes both Federal and State funding) in questionable Medi-Cal payments that Health Care Services made from 2014 through 2017 because it failed to ensure that counties resolved discrepancies between the state and county Medi-Cal eligibility systems. Both of these reports came to the attention of the United States Senate Committee on Homeland Security and Governmental Affairs, which requested CMS? plans to address the findings noted in these reports. CMS is currently conducting a review of California?s Medicaid beneficiary eligibility system to assess the accuracy of eligibility determinations and Federal Medical Assistance Percentage (FMAP) claiming. One of the primary objectives of this review is to compare review findings to similar reviews conducted in the past by the OIG to ensure the identified findings have been addressed. Identification as a Repeat Finding Finding 2018-007 was reported in the immediate prior year for the Medical Assistance Program. Eligibility for the Children?s Health Insurance Program was not required to be tested in FY2017-2018. Cause Existing internal controls did not prevent, or detect and correct, instances of untimely redeterminations and instances of benefits provided to ineligible beneficiaries for the following reasons. ? County welfare agencies? eligibility caseworkers made errors that Health Care Services represented may be the result of deploying the new eligibility and enrollment system, the California Healthcare Eligibility, Enrollment, and Retention System (CalHEERS) and the significant increase in enrollment due to California adopting Medicaid expansion pursuant to the Affordable Care Act. The increase in enrollment created a backlog of applications and eligibility redeterminations. Also, Health Care Services had not established new procedures to monitor whether county welfare agencies were effectively managing this increased workload to ensure eligibility caseworkers were appropriately applying the eligibility procedures and documentation requirements. Since 2017, Health Care Services resumed performing focus reviews on select county welfare agencies that were suspended during the early stages of health care reform implementation. Through this effort, Health Care Services is working collaboratively with county partners to identify areas of weaknesses that contribute to delays in renewal processing time. In some instances, counties are required to submit a corrective action plan to Health Care Services that describes implementation of additional business processes/quality control mechanisms that are anticipated to increase both the accuracy and timeliness of renewals. ? The MEDS alert functionality is used to communicate information to county welfare agencies on MEDS updates, changes, discrepancies between eligibility systems, and MEDS. MEDS alerts will be triggered for various reasons that include: ? Problems encountered in processing updates submitted by county welfare agencies; ? Problems encountered in processing updates generated as a result of a reconciliation of county welfare agencies records with MEDS records; ? Updates submitted by other entities that impact beneficiaries? eligibility or require action by county welfare agencies; and ? Upcoming changes in a beneficiaries? status that will require action by county welfare agencies. Currently, Health Care Services does not have an established process for monitoring the county welfare agencies? progress in addressing these alerts. To address this, Health Care Services implemented a quality control pilot on June 25, 2019 to monitor all critical and urgent level MEDS alerts to be able to quickly identify county welfare agencies that are not resolving MEDS, to identify the cause of these alerts, and work with counties to develop and implement best practices that are effective in reducing the number of new alerts, and efficiently reducing the number of unresolved alerts. In addition, Health Care Services has represented that MEDS also has the functionality to alert county welfare agencies when eligibility redeterminations are required or overdue. However, currently Health Care Services is working to refine this functionality to effectively be used to identify overdue renewals. Effect Eleven of the 27 Medi-Cal beneficiaries with eligibility exceptions were determined to be ineligible and benefits were ultimately discontinued; however, since those redeterminations were late, they received ineligible benefits between the date they should have been discontinued and the date they were actually discontinued. Another six of the 27 beneficiaries were determined to be ineligible and benefits were not discontinued during the fiscal year; therefore, they received ineligible benefits from the date they should have been discontinued. The remaining ten beneficiaries were determined to be eligible. Three of the nine CHIP beneficiaries with eligibility exceptions were determined to be ineligible and benefits were ultimately discontinued; however, since those redeterminations were late, they received ineligible benefits between the date they should have been discontinued and the date they were actually discontinued. Another four of the nine beneficiaries were determined to be ineligible and benefits were not discontinued during the fiscal year; therefore, they received ineligible benefits from the date they should have been discontinued. The remaining two beneficiaries were determined to be eligible. Questioned Costs Benefits paid to Medi-Cal beneficiaries after they were determined to be ineligible totaled $23,041 ($21,237 Managed Care, $0 Fee for Service, and $1,804 Premiums) for the fiscal year ended June 30, 2019. Benefits paid to CHIP beneficiaries after they were determined to be ineligible totaled $3,283 ($3,283 Managed Care and $0 Fee for Service) for the fiscal year ended June 30, 2019. Due to the extent of the errors identified in the sample populations, likely questioned costs could be significant. Context A total of $58,843 ($50,312 Managed Care, $5,784 Fee for Service, and $2,747 Premiums) was disbursed during the fiscal year ended June 30, 2019 on behalf of the 27 Medi-Cal beneficiaries with eligibility exceptions and a total of $36,449 ($33,878 Managed Care, $633 Fee for Service, and $1,938 Premiums) was disbursed during the fiscal year ended June 30, 2019 on behalf of the 17 beneficiaries later determined to be ineligible. Total benefits paid on behalf of the 75 Medi-Cal beneficiaries tested were $143,275 ($130,490 Managed Care, $5,804 Fee for Service, and $6,981 Premiums). The 75 tested Medi-Cal beneficiaries were selected from seven of California?s 58 counties. The total federal Medi-Cal benefits paid on behalf of approximately 11.7 million beneficiaries for the fiscal year ended June 30, 2019 was $42,236,703,313 ($25,895,504,101 Managed Care, $14,813,612,164 Fee for Service, and $1,527,587,048 Premiums). A total of $6,774 ($6,774 Managed Care and $0 Fee for Service) was disbursed during the fiscal year ended June 30, 2019 on behalf of the nine CHIP beneficiaries with eligibility exceptions and a total of $5,012 ($5,012 Managed Care and $0 Fee for Service) was disbursed during the fiscal year ended June 30, 2019 on behalf of the seven beneficiaries later determined to be ineligible. Total benefits paid on behalf of the 60 CHIP beneficiaries tested were $35,848 ($35,574 Managed Care and $274 Fee for Service). The 60 tested CHIP beneficiaries were selected from ten of California?s 58 counties. The total federal CHIP benefits paid on behalf of approximately 1.6 million beneficiaries for the fiscal year ended June 30, 2019 was $2,471,696,056 ($1,871,635,054 Managed Care and $600,061,002 Fee for Service). The samples were not statistically valid samples. Recommendation Health Care Services should continue its practice of performing regular focus reviews on county welfare agencies to identify factors contributing to the delays and errors in the redetermination process such as misinterpretations of policies, systems issues, business practices, etc., and then work with county welfare agencies to provide appropriate training and/or creating corrective action plans. Health Care Services should continue with the pilot quality control process used to monitor all critical and urgent level MEDS alerts to be able to quickly identify county welfare agencies that are not resolving MEDS alerts in a timely manner. Health Care Services should continue its efforts to incorporate into the MEDS alert functionality the ability to alert county welfare agencies when eligibility redeterminations are required or overdue. Health Care Services should then work directly with those county welfare agencies that are not performing eligibility redeterminations in a timely manner and who may not be correctly verifying eligibility through training and site visits to implement policies and procedures to improve their compliance status. Views of Responsible Officials and Corrective Action Plan Management?s response is reported in ?Management?s Response and Corrective Action Plan? included in a separate section at the end of this report.

Health Care Services performs site visits/focus reviews on counties to identify factors (training issues, misinterpretation of policy, systems issues, and business practices) contributing to delays/errors in renewal processing. Depending on the outcome of the reviews, counties may be required to submit a corrective action plan. The corrective action plan must include: ? A timeframe for the development and implementation of policies/procedures to address the issues identified. ? How the policies/procedures implemented will reduce similar occurrences in future renewals. Health Care Services allots the county six months after the date the corrective action plan is implemented to demonstrate improvement, and will follow up with the county on a regular basis to affirm the policies/procedures implemented are effective. If sufficient improvement is not seen, counties will be required to amend the corrective action plan. Health Care Services will perform a subsequent review within a year after the original review. Health Care Services continues to conduct regular focused reviews of counties to ensure eligibility determinations are performed in accordance with federal/state regulations. During the reviews Health Care Services? staff confirm: ? The appropriate documents (manual and/or electronic) were received prior to the completion of the eligibility determination. ? All required data elements were electronically/manually verified prior to the completion of eligibility determinations. ? Eligibility systems are updated with current information, and used appropriately in eligibility determinations. ? Applicant information is correctly entered into eligibility systems (data entry errors). ? Eligibility determinations are performed for only the beneficiaries who request an evaluation for eligibility to health insurance programs. ? All documents used in the eligibility determination: o Are appropriately retained in the case file. o Were received within the last 12 months. o Are used appropriately in the eligibility determination. o Confirm eligibility to the assigned aid category. Reviews are used to identify: ? Error trends attributed to caseworker actions. ? Errors trends related to systems issues. ? Gaps in policy needing further clarification/guidance. Upon implementation of the Focus Review Monitoring program, Health Care Services selected counties based on the population size. Counties with the highest population were reviewed first, since higher-population counties are responsible for the majority of determinations made statewide. Health Care Services plans to review each county on a biennial basis once an initial review is performed in all 58 counties. Health Care Services completed focus reviews for 39 counties and planned to review the remaining 19 counties by December 31, 2020. Due to the COVID-19 pandemic, Health Care Services has temporarily suspended the 2020 site visits and focus reviews. Health Care Services will resume efforts upon termination of the pandemic. Health Care Services is working to develop two new MEDS alerts, which will be used to notify counties of past due renewals and track the number of months since the last renewal. Alerts will be used by Health Care Services? quality control staff to monitor overdue renewals and quickly identify counties accruing a high volume of past due renewal alerts. Health Care Services will work with counties to implement processes/procedures that are effective in reducing the number of renewals processed in excess of federal/state timeframes. Estimated Implementation Date: Unknown Contact: Alex Watt, Assistant Chief Audits & Investigations ? Internal Audits California Department of Health Care Services

2018-007

Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. ?200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - The Public Health and Welfare. Chapter 6A - Public Health Service. Subchapter XXIV - HIV Health Care Services Program. Part B - Care Grant Program. Subpart I - General Grant Provisions. Section 300ff-26 - Provision of Treatments: (a) In general A State shall use a portion of the amounts provided under a grant awarded under section 300ff?21 of this title to establish a program under section 300ff?22(b)(3)(B) of this title to provide therapeutics to treat HIV/AIDS or prevent the serious deterioration of health arising from HIV/AIDS in eligible individuals, including measures for the prevention and treatment of opportunistic infections. (b) Eligible individual To be eligible to receive assistance from a State under this section an individual shall: (1) Have a medical diagnosis of HIV/AIDS; and (2) Be a low-income individual, as defined by the State. California State AIDS Drug Assistance Program Guidelines March 2017 and December 2018: (1.1) AIDS Drug Assistance Program (ADAP) Eligibility Criteria: To be eligible for the ADAP program, a client must: ? Have a positive HIV/AIDS diagnosis. ? Be at least 18 years old. ? Be a resident of California. ? Have an annual Modified Adjusted Gross Income (MAGI) that does not exceed 500 percent Federal Poverty Level (FPL) based on household size and income. ? Not be fully covered by Medi-Cal or any other third-party payers (an entity that reimburses and manages health care expenses such as private insurance or governmental agencies, employers, etc.). Health Resources and Services Administration (HRSA) Policy Clarification Notice (PCN) 13-02 (Revised 5/1/2019): For both initial/annual and six-month recertification procedures, eligibility determinations may be performed simultaneously with testing and treatment. Recipients and subrecipients assume the risk of recouping any HRSA RWHAP funds utilized for clients ultimately determined to be ineligible, and instead charge an alternate payment source, or otherwise ensure that funds are returned to the HRSA RWHAP program. Condition Out of 60 individuals reviewed, 6 individuals did not submit all required documentation including medical reports to support a positive HIV/AIDS diagnosis or income documentation to verify their annual MAGI did not exceed 500 percent Federal Poverty Level based on household size and income. These individuals were placed on a temporary access period without meeting the necessary eligibility requirements. This practice was unallowable prior to the revised PCN 13-02 in May 2019, and was acceptable after the release of the PCN if Public Health used a funding source other than the Ryan White HIV/AIDS Program for individuals ultimately determined to be ineligible. Identification as a Repeat Finding Finding 2018-008 was reported in the immediate prior year. Cause Existing internal controls did not prevent, or detect and correct, the occurrence of benefits being provided to ineligible individuals. Effect Public Health did not have adequate oversight controls to ensure that the applicant?s eligibility was properly reviewed and approved. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals, which may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable because benefit costs were not tracked by individual participants. Context Pharmacy benefits management services are provided by a contractor who received administrative fees and reimbursements for prescription drug costs to program participants. Payments to the contractor totaled $128,253,879 for 29,895 program participants for the fiscal year ended June 30, 2019. Based on the budget in the contract, the contractor?s administrative fees and other charges are estimated to be $657,876 annually. As such, net prescription drug costs are approximately $127,596,003 for the fiscal year ended June 30, 2019. The sample was not a statistically valid sample. Recommendation In December 2018, the ADAP guidelines were updated to include a secondary review of ADAP applications that requires a review of specified eligibility criteria. The ADAP Branch should continue to monitor compliance with its policies to ensure enrollment workers follow the established guidelines and retain acceptable documentation to support eligibility determinations. Views of Responsible Officials and Corrective Action Plan Management?s response is reported in ?Management?s Response and Corrective Action Plan? included in a separate section at the end of this report.

The California Department of Public Health, Office of AIDS (OA) is in agreement with the finding, but will note that while these clients were indeed placed on a Temporary Access Period (TAP), during an August 2019 site visit, the HRSA did not consider this a finding in light of the release of PCN 13-02. This determination was made after a review of client enrollment samples from the 2018-19 fiscal year, including eligibility granted prior to the release of PCN 13-02 in May 2019. Additionally, as noted above, this item was a finding in the 2017-18 Single Audit. As part of the corrective action response to this finding last year, OA communicated a process change that was initiated prior to the commencement of 2017-18 that would enable OA to flag expenditures incurred while clients were on a TAP, giving OA the ability to charge separate funding other than federal funds. Estimated Implementation Date: This process was fully implemented in July 2019. In order to ensure that TAPs are paid out of a separate fund source, TAP reports are run for the specified billing period to verify the total TAP costs. OA then ensures these costs are coded separately upon invoice submission to Public Health?s Accounting Section. Contact: Adrian Barraza, Assistant Division Chief Office of AIDS California Department of Public Health

2018-008

Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. ?200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 - Public Health and Welfare. Chapter VII - Social Security. Subchapter XIX - Grants to States for Medical Assistance Programs. Section 1396s Program for Distribution of Pediatric Vaccines: (a) Establishment of program (1) In general In order to meet the requirement of section 1396a(a)(62) of this title, each State shall establish a pediatric vaccine distribution program (which may be administered by the State department of health), consistent with the requirements of this section, under which (A) each vaccine-eligible child (as defined in subsection (b) of this section), in receiving an immunization with a qualified pediatric vaccine (as defined in subsection (h)(8) of this section) from a program-registered provider (as defined in subsection (c) of this section) on or after October 1, 1994, is entitled to receive the immunization without charge for the cost of such vaccine; and (B) (i) each program-registered provider who administers such a pediatric vaccine to a vaccine-eligible child on or after such date is entitled to receive such vaccine under the program without charge either for the vaccine or its delivery to the provider, and (ii) no vaccine is distributed under the program to a provider unless the provider is a program- registered provider. Centers for Disease Control and Prevention. National Center for Immunization and Respiratory Diseases. 2013 - 2018 Immunization Program Operations Manual (IPOM) for January 1, 2013 to June 30, 2018 Immunization Project Period, and 2019 - 2024 Immunization Program Operations Manual (IPOM) for January 1, 2019 to June 30, 2024 Immunization Project Period: Required Awardee Objective: A-6. Assure that Vaccines for Children Program (VFC) enrolled providers comply with VFC program requirements through performance of VFC site visits as defined in the current VFC Operations Guide. Required Activities: 1) Conduct standardized Provider, Education, Assessment and Reporting (PEAR) compliance site visits with each enrolled VFC provider at least every other year (once every two years). National Center for Immunization and Respiratory Diseases. Immunization Services Division. July 1, 2018 ? June 30, 2019 Vaccines for Children Operations Guide: Module 4 - Ensuring Provider Compliance: Requirement: Awardees must conduct and record VFC compliance visits covering areas of provider details, eligibility, documentation, storage and handling (per unit and site wide), and inventory management with each VFC provider every 24 months. Condition The Immunization Branch of Public Health has about 3,700 enrolled and active VFC providers located in the State of California. For the period from July 1, 2018 to June 30, 2019, 214 active providers were overdue for a visit as required by the Center for Disease Control and Prevention, representing approximately 6% of the program?s total enrolled and active VFC providers. In addition, 819 of 1,249 outstanding follow-up actions for the same period were overdue. Identification as a Repeat Finding Finding 2018-015 was reported in the immediate prior year. Cause The Immunization Branch of Public Health misinterpreted the visit frequency requirement such that a provider should be visited within 2 calendar years of the last compliance visit date. However, the Center for Disease Control and Prevention?s timeframe requirement is within 24 months from the date of the last compliance visit. The Immunization Branch of Public Health also experienced a staff shortage in Southern California where approximately 70% of these overdue providers were located. Effect The Immunization Branch of Public Health did not monitor the overdue providers to ensure that they maintained proper control and accountability for vaccine and adequately safeguarded and used vaccine solely for authorized purposes during the fiscal year ended June 30, 2019. Questioned Costs No questioned costs were identified. Context For the fiscal year ended June 30, 2019, the total value of federally funded vaccines which was distributed, in lieu of cash, directly to Immunization Cooperative Agreements vaccinating providers was $501,813,107, representing 95.6% of the program?s total federal expenditures. Recommendation The Immunization Branch of Public Health should develop a plan to perform the VFC Compliance Site Visits, including any follow-up actions, within the required timeframe. Views of Responsible Officials and Corrective Action Plan Management?s response is reported in ?Management?s Response and Corrective Action Plan? included in a separate section at the end of this report.

In March 2020, as the pandemic necessitated shelter-in-place orders throughout California, the program paused in-person visit activities to follow CDC guidelines of social distancing and to protect the health of our staff and program participants. As of today, the Program has not yet resumed in-person visits into VFC Program participating clinics. Given the novelty of the process of converting these visits, which were always done in-person, into a virtual format, we will be resuming provider visits in phases. The phased approach will allow us to refine our procedures to meet challenges as they arise. We are in the current stages of implementing our first phase of virtual visits, starting first with Storage and Handling visits and Immunization Quality Improvement for Provider Visits (IQIP). We anticipate starting virtual compliance visits in December. We also anticipate conducting visits in numbers that will not meet our CDC requirements. As of October 5, 2020, from CDC?s PEAR database, 828 providers are considered overdue. This high number is directly related to our suspension of visits since late March 2020 when all Public Health Immunization Branch Staff began working from home due to COVID. Providers Due for Compliance Visit * (10/5/20 data) Total number of providers due for a visit (July 2020 ? June 2021) 2,152 Number of providers that are overdue for a visit 828 Number of providers that will become overdue if not visited in this period 1,324 However, CDC has assured immunization programs nationwide and specifically in California that it will not impose penalties on programs who fail to meet their visit requirements. Additionally, acknowledging the impact of the COVID pandemic has not only been on program staff, but nationally on immunization service delivery of providers and patients. CDC also has assured our program that we have the option of suspending VFC visits, in person as well as virtually, at our discretion. Estimated Implementation Date: Once visits have returned to normal and we have received guidance from the CDC around expectations for missed visits during the pandemic, we will assess our staffing and determine if additional changes are needed. We will also need to be diligent in our process to dis-enroll providers who have not completed their mandatory corrective actions. Contact: Karen Turner, Section Chief Field Services, CDPH Immunization Branch Betty Tran, QA/QI Manager, Field Services, CDPH Immunization Branch

2018-015

Criteria Title 2 - Grants and Agreements. Subtitle A - Office of Management and Budget Guidance for Grants and Agreements. Chapter II - Office of Management and Budget Guidance. Part 200 - Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D - Post Federal Award Requirements. Standards for Financial and Program Management. ?200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 45 - Public Welfare, Subtitle A - Department of Health and Human Services, Subchapter A - General Administration, Part 95 - General Administration - Grant Programs (Public Assistance, Medical Assistance and State Children?s Health Insurance Programs), Subpart F - Automatic Data Processing Equipment and Services - Conditions for Federal Financial Participation (FFP), Specific Conditions for FFP, ?95.621 ADP reviews (45 CFR 95.621): The Department will conduct periodic onsite surveys and reviews of State and local agency ADP methods and practices to determine the adequacy of such methods and practices and to assure that ADP equipment and services are utilized for the purposes consistent with proper and efficient administration under the Act. Where practical, the Department will develop a mutually acceptable schedule between the Department and State or local agencies prior to conducting such surveys or reviews, which may include but are not limited to: (f) ADP System Security Requirements and Review Process: (3) ADP System Security Reviews. State agencies shall review the ADP system security of installations involved in the administration of HHS programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. Condition The California Medicaid Management Information System (CA-MMIS) Division of Health Care Services is responsible for appropriate, cost-effective safeguards over the information systems used in the administration of the Medical Assistance Program. The CA-MMIS Division uses a service organization/fiscal intermediary to perform many fiscal components of the administration of the program. The CA-MMIS Division obtained from the fiscal intermediary an independent service auditor?s service organization control report on the suitability of the design and operating effectiveness of controls for the period July 1, 2015 to June 30, 2016, which was performed in accordance with AICPA Statement on Standards for Attestation Engagements Section 801, Reporting on Controls at a Service Organization (SOC 1 type 2 report). The report included a number of exceptions, three of which were significant enough to warrant the service auditor to modify its opinion on controls. Since then, the CA-MMIS Division has not been able to procure a SOC 1 type 2 report for the fiscal intermediary, so it now conducts on-going ADP system security reviews, including evaluating physical and data security operating procedures and personnel practices. As part of that process, the CA-MMIS Division continued to monitor the fiscal intermediary?s efforts to implement required corrective actions to resolve the exceptions noted in the SOC 1 type 2 report. However, the fiscal intermediary has demonstrated its inability to implement the required corrective actions as supported by the sample testing performed as described in the context section below. Identification as a Repeat Finding Finding 2018-016 was reported in the immediate prior year. Cause The three significant exceptions noted in the SOC 1 type 2 report were that the fiscal intermediary did not have (1) adequate controls that restrict access to authorized personnel to promote changes to the production environment, (2) an adequate process to terminate employees? access to the network and applications upon notification, and (3) adequate controls that restrict access to Automatic Transaction Generators (ATGs) to authorized personnel, nor an adequate process to approve ATGs prior to implementation. Furthermore, the fiscal intermediary has not been effectively implementing the corrective actions required by the CA-MMIS Division to resolve the exceptions identified in the SOC 1 type 2 report. Effect There is an increased risk of unauthorized access to the CA-MMIS system, which could result in unauthorized modifications being made to the production environment and/or the information within it. As a result, given the continued inability of the fiscal intermediary to timely remove terminated users? logical access and the findings in the SOC 1 type 2 report, we were not able to place reliance on the ADP Risk Analysis and System Security Review for testing compliance with Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Eligibility for individuals for the federal program. Questioned Costs No questioned costs were identified. Context Limited testing was performed on a sample of ten developer and employee users judgmentally selected from a population of 379 users terminated by the fiscal intermediary during the fiscal year ended June 30, 2019, of which the fiscal intermediary was unable to provide support of the timely removal of six users? logical access from all applications and/or networks. Recommendation Since the fiscal intermediary has not been effective in implementing the CA-MMIS Division?s corrective actions required to resolve exceptions noted for general controls over logical access to systems, programs and data, the CA-MMIS Division should evaluate the continued risks associated with these exceptions and consider further actions permitted under its contract to remediate the exceptions or consider alternative service providers. Views of Responsible Officials and Corrective Action Plan Management?s response is reported in ?Management?s Response and Corrective Action Plan? included in a separate section at the end of this report.

Adoption of the new service management framework and assumption of operations to the new International Business Machines Corporation contract occurred on October 1, 2019. Some Health Care Services? owned access control activities have started. Further improvements, such as automated workflows, will evolve over time as we mature our Information Technology Service Management operating model. Full implementation of the audit recommendation has been rescheduled to July 1, 2020, due to the ongoing Digital Transformation Company Phase II Takeover and higher priority COVID-19 pandemic activities. Estimated Implementation Date: September 1, 2020 Contact: Alex Watt, Assistant Chief Audits & Investigations ? Internal Audits California Department of Health Care Services

2018-016

GSA_MIGRATION

GSA_MIGRATION

2017-021

GSA_MIGRATION

GSA_MIGRATION

2017-009

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

2016-013

GSA_MIGRATION

GSA_MIGRATION

2016-015

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

2015-009

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

2015-006

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION