State of Texas C/O Comptroller of Public AccountsState Government

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Period of Performance, Reporting, Subrecipient Monitoring – Information Technology – User Access Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant ALN: 93.558 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Temporary Assistance for Needy Families 2401TXTANF, 2501TXTANF October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 - September 30, 2024, October 1, 2023 - September 30, 2025, October 1, 2025 - September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Department of Family and Protective Services (DFPS) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user access termination controls, we identified two instances, out of a sample of 25 terminated users, in which individuals were not removed from the Network and IMPACT in a timely manner. In both cases, the users’ accounts remained active well beyond their documented termination dates, resulting in unauthorized active credentials during the post‑termination period. The two exceptions were as follows: User A: Termination date 11/05/2024; access not removed until 11/22/2024. User B: Termination date 11/17/2024; access not removed until 02/20/2025. Questioned costs: None. Context: See “Condition.” Cause: The delays appear to be the result of breakdowns in the coordination between HR separation processes and IT access revocation procedures, including delays in communication or gaps in the automated termination workflow. Effect: Failure to remove user access promptly increases the risk of: • Unauthorized access to confidential or sensitive information; • Potential manipulation, loss, or misuse of program data; • Increased exposure to operational and security risks. Although no misuse of access was identified, the presence of active credentials after termination represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend DFPS: • Strengthen coordination between HR and IT functions to ensure immediate notification upon employee separation. • Implement automated workflows that disable all user access promptly upon termination. • Conduct periodic reconciliations of HR separation lists against active user accounts to detect and remove any lingering access. • Enhance monitoring controls, including reporting dashboards or alerts triggered when access is not removed within a defined timeframe. Views of responsible officials: Management agrees with the findings.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Reporting – Information Technology – User Access Federal Agency: U.S. Department of Veterans Affairs Federal Program Title: Veteran's State Nursing Home Care ALN: 64.015 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: N/A Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), The General Land Office (GLO) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During our assessment of access controls, we noted that while GLO performs user access reviews for accounts with privileged (elevated) access to the network. No periodic user access review is performed for all network users (non‑privileged/general users) within the audit period. As a result, there is no documented verification that standard user accounts retain only appropriate, job‑related access. Questioned costs: None. Context: See “Condition.” Cause: The condition appears to result from policy and process gaps that focus review efforts primarily on privileged accounts, coupled with the absence of a formalized, agency‑wide schedule and procedure for reviewing all network users’ access and retaining evidence of those reviews. Effect: Failure to conduct and document periodic access reviews for all network users increases the risk that: • Excessive or outdated access persists undetected; • Unauthorized access to systems or data may occur; • Potential security, operational, and compliance exposures are elevated. No instances of misuse were identified during our procedures; however, the lack of comprehensive reviews represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend that GLO: • Establish a formal, documented access review program that covers all network users (privileged and non‑privileged) on at least an annual cadence. • Implement standardized templates and a central repository to capture review date, reviewer, population, exceptions identified, and remediation actions taken. • Periodically monitor adherence to the review schedule and report completion status and exceptions to management governance (e.g., IT leadership or an information security committee). Views of responsible officials: Management of the Texas General Land Office (GLO), Information Technology Services (ITS) Department, concurs with the audit finding and agrees that formalizing and documenting a periodic user access review process for all non-privileged network users will further strengthen the agency’s internal control framework and cybersecurity posture in alignment with 2 CFR §200.303 and applicable federal internal control standards.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Equipment and Real Property Management, Matching, Level of Effort and Earmarking, Period of Performance, Procurement and Suspension and Debarment, Reporting, Subrecipient Monitoring, Special Tests and Provisions – Information Technology – User Access Federal Agency: U.S. Department of Agriculture (USDA) U.S. Department of Education (USDE) U.S. Department of Health and Human Services Social Security Administration Federal Program Title: SNAP Cluster Special Education Grants for Infants and Families Temporary Assistance for Needy Families Social Services Block Grant Block Grants Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse Aging Cluster Medicaid Cluster Disability Insurance/ SSI Cluster ALN: 10.551, 10.561 84.181 93.558 93.667 93.958 93.959 93.044, 93.045, 93.053 93.775, 93.777, 93.778 96.001, 96.006 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SNAP Cluster 6TX400105, 6TX400106, USDA-FNS-SNAP-24-EVS-TX October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025, September 25, 2024 - September 30, 2025 Special Education Grants for Infants and Families H181A220171, H181A230171, H181A240171, H181A250171 July 1, 2022 - September 30, 2023, July 1, 2023 - September 30, 2024, July 1, 2024 - September 30, 2025, July 1, 2025 - September 30, 2025 Temporary Assistance for Needy Families 1601TXTANF, 1801TXTANF, 2101TXTANF, 2201TXTANF, 2301TXTANF, 2401TXTANF, 2501TXTANF October 1, 2015 - September 30, 2016, October 1, 2017 - September 30, 2018, October 1, 2020 - September 30, 2022, October 1, 2021 – September 30, 2022, October 1, 2022 - September 30, 2023, October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 - September 30, 2024, October 1, 2023 - September 30, 2025, October 1, 2025 - September 30, 2026 Block Grants Community Mental Health Services B09SM089610, B09SM087322, B09SM087345, B09SM085385, B09SM089380, B09SM089984, B09SM085913 October 1, 2023 - September 30, 2025, October 17, 2022 - October 16, 2024, October 1, 2022 - September 30, 2024, September 1, 2021 - March 24, 2025, September 30, 2023 - September 29, 2025, September 30, 2024 - September 29, 2026, September 1, 2021 - March 24, 2025 Block Grants For Prevention and Treatment of Substance Abuse B08TI087067, B08TI085835, B08TI084609, B08TI088134, B08TI083969 October 1, 2023 - September 30, 2025, October 1, 2022 - September 30, 2024, September 1, 2021 - March 24, 2025, October 1, 2024 - September 30, 2026, September 1, 2021 - March 24, 2025 Aging Cluster 2101TXSSC6, 2101TXCMC6, 2101TXHDC6, 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD, 2201TXSTPH, 2301TXOAHD, 2301TXOACM, 2301TXOASS, 2301TXOANS, 2401TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2501TXOASS, 2501TXOAHD, 2501TXOAHD, 2501TXOANS April 1, 2021 - September 30, 2025, October 1, 2021 - September 30, 2024, January 1, 2022 - September 30, 2024, October 1, 2022 – September 30, 2025, October 1, 2023 - September 30, 2025, October 1, 2024 - September 30, 2026 Medicaid Cluster 2405TXIMPL, 2405TX5000, 2505TXPACT, 2505TX5000, 2405TX5021, 2505TX5MAP, 2505TX5ADM October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2024, October 1, 2024 - September 30, 2024, October 1, 2024 – September 30, 2025, October 1, 2023 - September 30, 2025, October 1, 2024 - December 31, 2024 Disability Insurance/ SSI Cluster 2304TXDI00, 2404TXDI00, 2504TXDI00 October 1, 2023 - February 2, 2024, October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user access within the CAPPS FIN (PeopleSoft Financials) system, we identified two user accounts, out of 17 tested, that had been granted inappropriate access to the PeopleSoft Administrator role. This role provides elevated privileges beyond those required for their job duties and should be limited to authorized system administrators. Management remediated the inappropriate access on November 10, 2025. Questioned costs: None. Context: See “Condition.” Cause: The inappropriate access assignments appear to result from gaps in privileged access provisioning and periodic re‑certification controls within the CAPPS FIN environment. Effect: Improper assignment of elevated PeopleSoft Administrator access in CAPPS FIN increases the risk of: • Unauthorized changes to system configuration, accounting rules, or financial data; • Data modification or exposure, including information related to federal program expenditures; • Bypassing of compensating controls intended to maintain data integrity and separation of duties; Although management removed access on 11/10/2025, the presence of improper administrator‑level access before remediation represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend HHSC: • Strengthen privileged access provisioning by requiring documented approval, business justification, and periodic revalidation for all elevated roles in CAPPS FIN. • Implement a formal, recurring privileged access review across all CAPPS FIN modules, with documented results and timely remediation of exceptions. • Utilize identity governance tools or CAPPS FIN security reporting to automatically flag unauthorized assignments of administrator roles. Views of responsible officials: HHSC concurs with the recommendation.

Earmarking – Administrative Expenses Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1B09SM087322 October 17, 2022 – October 16, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 U.S.C 300x-5(b), a funding agreement for a grant under section 300x of this title is that the State involved will not expend more than 5 percent of the grant for administrative expenses with respect to the grant. Condition: HHSC expended $1,069,086 of the total grant award amount of $3,690,918 as of the end of the project period. Administrative expenditures for the grant totaled $54,672, which represents 5.11 percent of the federal funds expended, exceeding the allowable 5 percent threshold. Questioned costs: $1,217. Context: See “Condition.” Cause: The overage resulted from a delay in the grant’s start date, which subsequently postponed the initiation of related projects and led to lower overall expenditures. Effect: By exceeding the 5 percent administrative cap, HHSC did not comply with the statutory limitation on administrative costs, resulting in unallowable administrative expenditures charged to the grant. This noncompliance may require reimbursement to the federal agency and increases the risk of future questioned costs. Repeat Finding: No Recommendation: We recommend HHSC make necessary adjustments to federal expenditures in the event of program delays to ensure the agency stays within required percentage maximums. Views of responsible officials: HHSC concurs with the recommendation.

Earmarking – Evidence Based Programs Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1B09SM085385 September 1, 2021 – March 24, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Noncompliance Criteria or specific requirement: Per 42 USC 300x-9(c), (1) except as provided in paragraph (2), a State shall expend not less than 10 percent of the amount the State receives for carrying out this section for each fiscal year to support evidence-based programs (EBP) that address the needs of individuals with early serious mental illness (ESMI), including psychotic disorders, regardless of the age of the individual at onset. (2) In lieu of expending 10 percent of the amount the State receives under this section for a fiscal year as required under paragraph (1), a State may elect to expend not less than 20 percent of such amount by the end of such succeeding fiscal year. Condition: HHSC expended $4,114,245 on evidence‑based programs related to ESMI out of $86,184,653 in total grant expenditures as of the end of the project period, representing 4.77% of total expenditures. This percentage is below the required 10% annual EBP set‑aside and also does not meet the 20% by the end of the succeeding fiscal year alternative as the grant ended March 24, 2025. Consequently, expenditures under this award did not meet statutory EBP set‑aside requirements. Questioned costs: Unknown. Context: See “Condition.” Cause: The noncompliance occurred because the grant was abruptly terminated by the federal government on March 24, 2025, approximately six months earlier than the original end date of September 30, 2025. The early termination limited HHSC’s ability to fully implement planned activities and make the remaining expenditures necessary to meet the statutory minimum EBP set‑aside requirement. Had the grant period continued as originally awarded, HHSC may have had sufficient time to achieve the required expenditure level. Effect: Because the grant was terminated earlier than anticipated, HHSC was unable to expend the statutorily required minimum amount on evidence‑based programs for early serious mental illness. As a result, HHSC did not meet the expenditure requirements under 42 U.S.C. § 300x‑9(c), creating a condition of federal noncompliance. This may expose HHSC to potential corrective actions by the federal awarding agency and limits assurance that the intended level of evidence‑based services for individuals with early serious mental illness was fully delivered during the grant period. Repeat Finding: No Recommendation: HHSC should consider formally requesting a waiver or exception from the federal awarding agency for the unmet evidence‑based program expenditure requirement, given that the early termination of the grant was outside the agency’s control and materially limited its ability to meet the statutory set‑aside. In addition, HHSC should document the impact of the shortened project period, including planned but unspent EBP activities, to support the waiver request. Seeking this relief will help ensure that HHSC is not penalized for circumstances beyond its control and will provide federal officials with the necessary context to evaluate compliance in light of the unexpected grant termination. Views of responsible officials: HHSC concurs with the recommendation.

Level of Effort - Supplement not Supplant Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster ALN: 93.044, 93.045, 93.053 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD October 1, 2021 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §1321.9(c)(2)(xvi), funds awarded under Title III of the Older Americans Act for services provided under section 321(d) (42 U.S.C 3030d(d)) must be used to supplement, not supplant existing Federal, State, and local funds expended to support those activities. Condition: A comparison of supportive services and senior center funding between fiscal years 2023 and 2024 showed that total service levels increased by approximately 5 percent, rising from $40,354,713 in FY2023 to $42,267,130 in FY2024. During the same period, federal expenditures increased by 8 percent, from $31,170,863 to $33,755,005, while non‑federal expenditures decreased by 7 percent, from $9,183,850 to $8,512,125. Because the increase in federal funding outpaced the increase in total services, and was accompanied by a reduction in non‑federal contributions, federal funds effectively replaced rather than supplemented state or other non‑federal resources. Accordingly, HHSC supplanted non‑federal funds with federal funds for the 2024 grant. To quantify the financial impact, total services increased by 5 percent; therefore, the federal contribution would be expected to increase proportionally by 5 percent. Applying a 5 percent growth rate to the FY2023 federal amount of $31,170,863 yields an expected level of $32,729,406 for FY2024. However, actual federal expenditures totaled $33,755,005, resulting in excess federal funding of $1,025,599 beyond what would be needed to support the observed service increase. Questioned costs: $1,025,599. Context: See “Condition.” Cause: HHSC has followed supplement not supplant policies and procedures that were implemented based on compliance with total level of services (i.e., all services) and not specifically for supportive services and senior centers, as required. Effect: HHSC has supplanted non-federal funds used for supportive services and senior centers, resulting in questioned costs and noncompliance. Repeat Finding: No Recommendation: HHSC should revise existing policies and procedures to ensure they are not supplanting nonfederal funds specifically related to supportive services and senior centers. Views of responsible officials: HHSC concurs with the recommendation.

Reporting – Post-Expenditure Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant ALN: 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXSOSR October 1, 2023 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The 42 USC 1397e requires states and territories to submit to the federal administering agency, the Office of Community Services, an annual Post Expenditure Report no later than six months following the close of the fiscal year. The report includes certain critical key line information including: • TANF Funds Transferred into SSBG –Amount reported on this line item should be consistent with the TANF federal financial report (ACF-196R). The Federal Funds Office (FFO) is responsible for the completeness, accuracy, and timely submission of the Post Expenditure Report. Federal Reporting Fiscal Management personnel are responsible for proper reporting and submission of the ACF-196R Report. Condition: During testing of key line items for the FY2024 Post Expenditure Report submitted in March 2025, we noted that TANF Funds Transferred into SSBG was reported as $41,623,634. However, the amount reported on the ACF-196R report was $38,778,521, resulting in a variance of $2,845,113. Questioned costs: None Context: See “Condition.” Cause: FFO did not properly coordinate efforts with the Federal Reporting personnel to ensure the amounts noted on the ACF-196R report were consistent with the amount on the Post Expenditure Report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: 2023-013, 2024-008 Recommendation: We recommend the FFO coordinate with the appropriate Federal Reporting Team personnel regarding amounts noted for the TANF Funds Transferred into SSBG to ensure the amount in the Post Expenditure Report matches with the amount in the ACF-196R. Views of responsible officials: HHSC concurs with the recommendation.

Reporting – ACF-196R Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF October 1, 2023 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR §265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. The ACF-204 report (Annual Report on State Maintenance-of-Effort Programs) must be completed and submitted in accordance with the requirements at 45 CFR §265.9(c). The report includes several line items that contain critical information, including “Total State MOE Expenditures.” Input for the Total State MOE expenditures line item is provided by the Texas Education Agency (TEA), the Texas Workforce Commission (TWC), and HHSC. The MOE amounts in the ACF-204 report are to agree to the amounts in the final ACF-196R report. For the FY2024 ACF-196R report, the contributing agencies reported State MOE expenditures on various line items including but not limited to: HHSC – Line 6a (Basic Assistance (excluding Relative Foster Care Maintenance Payments and Adoption and Guardianship Subsidies) TEA – Line 11b (Pre-Kindergarten/Head Start) Condition: All key line items in the FY 2024 ACF‑204 report were tested and agreed to supporting documentation without exception. However, the Total State Maintenance of Effort (MOE) Expenditures reported in the ACF‑204 by HHSC and the Texas Education Agency (TEA) did not reconcile to the amounts reported in the ACF‑196R as shown below: Amounts reported in the ACF‑204 were accurate and supported; the variances occurred because the ACF‑196R reflected higher MOE expenditures than those reported on the ACF‑204. Questioned costs: None. Context: See “Condition.” Cause: The variance in line 11b was due to miscommunication between the relevant HHSC personnel regarding revisions to an initial submission. The variance in line 6a was due to the HHSC Federal Reporting Team incorrectly including period 1 of 2025 in the MOE calculation. The agency did not perform a complete reconciliation between the ACF‑204 and ACF‑196R prior to submission, resulting in inconsistent MOE reporting across the required reports. Effect: Inaccurate or inconsistent reporting of MOE expenditures increases the risk of noncompliance with federal reporting requirements under 2 CFR §200.302 (financial management) and 2 CFR §200.329 (performance and financial reporting). These discrepancies may impair the federal awarding agency’s ability to evaluate program performance, assess State MOE compliance, and rely on the accuracy of reported financial information. Repeat Finding: No. Recommendation: HHSC should strengthen their financial reporting controls to ensure consistency between the ACF‑204 and ACF‑196R reports. Specifically, the agency should implement a formal reconciliation process that: • Compares all MOE expenditure amounts reported on the ACF‑204 to those reported on the ACF‑196R prior to submission; • Requires documented review and approval of the reconciliation by management; and • Ensures any discrepancies are researched, resolved, and corrected before the reports are finalized. Views of responsible officials: HHSC concurs with the recommendation.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Block Grants for Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.044, 93.045, 93.053 93.558 93.667 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXSSC6, 2101TXCMC6, 2101TXHDC6, 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD, 2201TXSTPH, 2301TXOAHD, 2301TXOACM, 2301TXOASS, 2301TXOANS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS, 2501TXOASS, 2501TXOAHD, 2501TXOACM, 2501TXOANS April 1, 2021 – September 30, 2025, October 1, 2021 – September 30, 2024, January 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 TANF 2401TXTANF and 2501TXTANF October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Block Grants for Community Mental Health Services 1B09SM085913, 1B09SM085385, 1B09SM087345, 1B09SM087322, 1B09SM089380, 1B09SM089610, 1B09SM089984 September 1, 2021 – March 24, 2025, October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, September 30, 2023 – September 29, 2025, October 1, 2023 – September 30, 2025, September 30, 2024 – September 29, 2026 Block Grants for Prevention and Treatment of Substance Abuse 1B08TI083969, 1B08TI084609, 1B08TI085835, 1B08TI087067, 1B08TI088134 September 1, 2021 – March 24, 2025, September 1, 2021 – March 24, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Nonmajor programs Opioid STR 6H79TI083288, 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. As of March 8, 2025, fsrs.gov was retired, and all subaward reporting data and functionality are now on SAM.gov. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards on FSRS.gov or SAM.gov. A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligation at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS.gov or SAM.gov. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2024-005, 2023-010, 2022-013, 2021-007 Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – Child Support Non-Cooperation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF, 2501TXTANF October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 U.S.C 608 (a)(2), if the agency responsible for administering the State plan approved under part D determines that an individual is not cooperating with the State in establishing paternity or in establishing, modifying, or enforcing a support order with respect to a child of the individual, and the individual does not qualify for any good cause or other exception established by the State pursuant to section 654(29) of this title, then the State: (1) shall deduct from the assistance that would otherwise be provided to the family of the individual under the State program funded under this part an amount equal to not less than 25 percent of the amount of such assistance; and (2) may deny the family any assistance under the State program. The State’s policy is to reduce benefits 100% for non-cooperation. HHSC policy requires that when the Office of the Attorney General (OAG) identifies a TANF recipient who has failed to cooperate with child support requirements, OAG must notify HHSC within seven days of the non‑cooperation date. Upon receipt, HHSC must apply the sanction within five working days. Condition: A sample of 40 TANF beneficiaries who were reported as non‑cooperating with program requirements during fiscal year 2025 was selected for testing. Two instances of untimely sanction application were identified: • One case in which HHSC reduced benefits one month late, resulting in an overpayment of $320. • One case in which HHSC reduced benefits two months late, resulting in an overpayment of $890. Questioned costs: $1,210 Context: See “Condition.” Cause: HHSC’s internal controls did not consistently ensure timely processing of sanctions upon receipt of non‑cooperation referrals from OAG. Existing monitoring and workflow procedures were insufficient to detect or prevent delays in applying benefit reductions. Effect: Failure to apply sanctions within required timeframes can lead to inaccurate benefit issuance, questioned costs, and weakened program integrity. Repeat Finding: No. Recommendation: HHSC should strengthen internal controls over the processing of TANF non‑cooperation sanctions to ensure timely application in accordance with program requirements. Specifically, HHSC should: • Implement an automated or workflow‑based tracking mechanism to monitor the timeliness of sanctions received from OAG. • Provide refresher training to eligibility staff on timely sanction procedures and the importance of preventing improper payments. Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – ADP Risk Analysis and System Security Review Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster CFDA Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2405TXIMPL, 2405TX5000, 2505TXPACT, 2505TX5000, 2405TX5001, 2505TX5021, 2505TX5MAP, 2505TX5ADM October 1, 2023 – September 30, 2024, October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2024, October 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – December 31, 2024, October 1, 2024 – December 31, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §95.621, State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. Condition: HHSC maintains a total of 35 in-house and third-party systems that are used in the administration of Medicaid, which are required to be reviewed each biennial period. During the fiscal year 2024-2025 biennial, only 15 risk assessments were executed based on internal methodology or third-party assessments. HHSC did not perform risk assessments over the remaining 20 systems during the two-year period. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to it’s current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2024-012, 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2405TXIMPL, 2405TX5000, 2505TXPACT, 2505TX5000, 2405TX5001, 2505TX5021, 2505TX5MAP, 2505TX5ADM October 1, 2023 – September 30, 2024, October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2024, October 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – December 31, 2024, October 1, 2024 – December 31, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC policies require the completion of Form 2567 Statement of Deficiencies and Plan of Correction to include the prefix tag, the deficiency that contains the code of federal regulations (CFR) or life safety code (LSC) reference for each health and safety survey conducted. HHSC is required to mail a copy of the completed form to the provider within ten business days after the exit date of the survey to ensure any deficiencies noted are addressed timely. For one of 40 health surveys conducted during the fiscal year, Form 2567 was mailed out to the provider 162 business days after the exit date of the survey. While the form was mailed after the required timeline per HHSC policy, it did not include any cited deficiencies. Questioned costs: None. Context: See “Condition.” Cause: After the provider's exit date, HHSC regional staff subsequently determined, several months later, that the required notice had not been issued to the facility. This oversight occurred during a period of transition within the ICF team. Effect: Failure to notify a provider of identified deficiencies in a timely manner may prevent the provider from implementing corrective actions within the required timeframe to meet compliance deadlines. Such delays increase the risk of continued noncompliance and may result in inappropriate payments for new admissions before the provider agreement is terminated. Repeat Finding: No. Recommendation: HHSC should enhance and/or reinforce existing internal controls to ensure timely completion and mailing of Form 2567 to meet standards in 42 CFR Part 442 and related policy requirements. This could include developing automated tracking systems or checklists to monitor survey deadlines and/or providing refresher training for all regional staff involved in the survey and notification process. Views of responsible officials: HHSC concurs with the recommendation.

Subrecipient Monitoring – Missing Contract Elements Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Special Education – Grants for Infants and Families Temporary Assistance for Needy Families (TANF) Block Grants for Prevention and Treatment of Substance Abuse ALN: 84.181 93.558 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Special Education – Grants for Infants and Families H181A200171, H181A210171, H181A220171, H181A230171, H181A240171, H181A250171 July 1, 2020 – September 30, 2021, July 1, 2021 – September 30, 2022, July 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2024, July 1, 2024 – September 30, 2025, July 1, 2025 – September 30, 2026 TANF 2001TXTANF, 2101TXTANF, 2201TXTANF, 2301TXTANF, 2401TXTANF and 2501TXTANF October 1, 2019 – September 30, 2020, October 1, 2020 – September 30, 2021, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 and October 1, 2024 – September 30, 2025 Block Grants for Prevention and Treatment of Substance Abuse 1B08TI083969, 1B08TI084609, 1B08TI083054, 1B08TI083478, 1B08I084673, 1B08TI085835, 1B08TI087067, 1B08TI088134 September 1, 2021 – March 24, 2025, September 1, 2021 – March 24, 2025, October 1, 2019 – September 30, 2021, October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR §200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the certain required information provided. A pass-through entity must provide the best available information when some of the required information is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes the subrecipient’s unique entity identifier (UEI), assistance listings numbers (ALN), and title of the program. Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Special Education – Grants for Infants and Families (SEGIF) –The UEI was not included in the base subaward agreement for seven of the eight agreements selected for testing. The last amendment to the original agreement included the UEI number, however, it did not reference the ALN and title of the program. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Temporary Assistance for Needy Families – The ALN and title of the program was not included in four of the seven subaward agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Block Grants for Prevention and Treatment of Substance Abuse –The UEI was not included in one of the 18 agreements selected for testing. The start and end dates for the agreement was September 1, 2020 – August 31, 2025. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR §200.332 prior to execution is not at the correct precision level. Effect: Because required subaward information was omitted, HHSC increased the risk that subrecipients were not fully informed of the federal award details necessary to properly administer the funds in compliance with the applicable statutes, regulations, and award terms. Missing UEI, ALN, and program titles may impede subrecipients’ ability to accurately identify the federal program, appropriately report activities, and meet federal requirements, including those related to financial management, performance, subrecipient monitoring, and audit preparation. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements noted in 2 CFR §200.332. Views of responsible officials: HHSC concurs with the recommendation.

Cash Management, Eligibility, Matching and Earmarking, Period of Performance, Suspension and Debarment, Reporting, Subrecipient Monitoring, Special Tests and Provisions – Information Technology – Change Management Federal Agency: U.S. Department of Justice Federal Program Title: Crime Victim Assistance ALN: 16.575 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 15POVC-25-GG-00366-ASSI, 15POVC-24-GG-00728-ASSI, 15POVC-23-GG- 00468-ASSI, 15POVC-22-GG-00468-ASSI, 2020-V2-GX-0040 October 1, 2024 – September 30, 2028, October 1, 2023 – September 30, 2027, October 1, 2022 – September 30, 2026, October 1, 2021 – September 30, 2025, October 1, 2020 – September 30, 2025, October 1, 2019 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Office of the Governor must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During our review of information technology general controls related to network change management, we noted that the organization does not have a formal, documented change control process governing changes and approvals to the network hardware components and systems. As a result, network changes may not be consistently documented, reviewed, or formally approved. For purposes of this control, network changes include any additions, modifications, or removals affecting the network infrastructure, including but not limited to: • Network hardware (e.g., routers, switches, firewalls, wireless devices) • Network device configurations • Network related software, firmware, or operating system components Questioned costs: None. Context: See “Condition.” Cause: Management is aware of this matter and a draft policy initiative is already underway and targeted for completion during fiscal year 2026. Effect: In the absence of a formal documented change management process, there is an increased risk that unauthorized or untested network changes could adversely impact the confidentiality, integrity, or availability of systems and data. Repeat Finding: No Recommendation: We recommend that management finalize and implement the formal, documented network change management process to ensure all changes to network hardware, configurations, and related software are properly requested, reviewed, approved, tested, and documented. Views of responsible officials: A formal but not documented process has been utilized which requires CIO approval of all changes. A Project was instigated in 2024 to formalize and embed the verbal process into a written process with auditable execution logs. The project is in its final stages

Procurement and Suspension and Debarment Federal Agency: U.S. Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund (DWSRF) ALN: 66.468 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2521902915 September 1, 2024 - August 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: "Per 2 CFR §200.303(a), Texas Commission on Environmental Quality (TCEQ) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR §200.318, the recipient or subrecipient must maintain and use documented procedures for procurement transactions under a federal award or subaward, including for acquisition of property or services. These documented procurement procedures must be consistent with State, local, and tribal laws and regulations and the standards identified in §§ 200.317 through 200.327. Per 2 CFR §200.214, recipients and subrecipients are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, as well as 2 CFR part 180. The regulations in 2 CFR part 180 restrict making Federal awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from receiving or participating in Federal awards. Condition: Audit procedures included a review of five procurements conducted during the fiscal year to assess whether TCEQ adhered to required procurement procedures and performed vendor eligibility verifications prior to entering into covered transactions. For one procurement, totaling $16,175, the required procurement processes were not followed, and the necessary vendor compliance checks, including verification of suspension and debarment status, were not completed before executing the transaction. Questioned costs: None. Context: See “Condition.” Cause: The procurement was initiated directly by the program area without notifying or coordinating with the Procurement and Contracts Section. Program staff proceeded with the purchase under the assumption that procurement involvement was unnecessary because the selected vendor was the sole provider of the required item. As a result, established procurement procedures and vendor compliance verification processes were not followed. Effect: Failure to follow procurement procedures and complete proper vendor compliance checks prior to entering into a covered transaction may lead to entering contracts with suspended or debarred vendors that could result in noncompliance and questioned costs. Repeat Finding: No Recommendation: TCEQ should provide targeted training to program staff on federal procurement requirements, including the necessity of coordinating all purchases through the P&C Section and completing required vendor compliance checks. Training should emphasize procedures for sole‑source or limited‑source procurements and reinforce staff responsibilities under 2 CFR procurement and internal control standards. Regular refresher sessions and documented guidance will help ensure consistent understanding and adherence to required procurement practices across all program areas. Views of responsible officials: The Financial Administration Division (FAD) will implement the audit’s recommendations. FAD will reinforce the guidance provided through continuous training, documentation, and improved internal controls.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Suspension and Debarment, Reporting, Special Tests and Provisions – Information Technology – User Access Federal Agency: U.S. Department of Agriculture (USDA) Federal Program Title: Food Distribution Cluster Texas 1944 Water Treaty Grant ALN: 10.565, 10.568, 10.560 10.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Food Distribution Cluster 246TX816Y8105, 256TX816Y7105, 246TX818Y8613, 238TX000I1003, 246TX816Q2204 October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025, November 3, 2023 - November 2, 2024, May 23, 2023 - June 30, 2025, October 1, 2023 - September 30, 2024 Texas 1944 Water Treaty Grant FSA25GRA0012028 March 19, 2025 - March 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Department of Agriculture (TDA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user termination controls, we identified two instances, out of a sample of 14 terminated users, in which access was not removed within the timeframe required by TDA’s System Administrator separation process (i.e., application access removed on the date of the ticket/same day of termination and network access within one business day): Application (TX‑UNPS): User A was terminated on 06/13/2025. Network access was removed on 06/16/2025 (within one business day), but TX‑UNPS application access remained active until 06/19/2025 (removed after four business days), which does not meet the same‑day requirement for application access. Network: User B was terminated on 09/13/2024. Network access was removed on 09/17/2024 (removed after one business day due to weekend/holiday schedule), which does not meet the requirement for removal within one business day. Questioned costs: None. Context: See “Condition.” Cause: The delays appear to be the result of breakdowns in the coordination between HR separation processes and IT access revocation procedures, including delays in communication or gaps in the automated termination workflow. Effect: Failure to remove user access promptly increases the risk of: • Unauthorized access to confidential or sensitive information; • Potential manipulation, loss, or misuse of program data; • Increased exposure to operational and security risks. Although no misuse of access was identified, the presence of active credentials after termination represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend that TDA: • Strengthen coordination between HR and IT functions to ensure immediate notification upon employee separation. • Implement automated workflows that disable all user access promptly upon termination. • Conduct periodic reconciliations of HR separation lists against active user accounts to detect and remove any lingering access. • Enhance monitoring controls, including reporting dashboards or alerts triggered when access is not removed within a defined timeframe. Views of responsible officials: TDA agrees with the finding. TDA acknowledges that improvements can be made to the separation process.

Cash Management – Cash Management Improvement Act Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance Program (LIHEAP) ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2301TXLIEA, 2301TXLIEE, 2401TXLIEA, 2401TXLIEI, 2501TXLIEA, 2501TXLIEI October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 31 CFR §205.20, states use clearance patterns to project when funds are paid out, given a known dollar amount and a known date of disbursement. A state must ensure that clearance patterns meet the following standards: (a) A clearance pattern must be auditable. (b) A clearance pattern must accurately represent the flow of Federal funds under the Federal assistance programs to which it is applied. (c) A clearance pattern must include seasonal or other periodic variations in clearance activity. (d) A clearance pattern must be based on at least three consecutive months of disbursement data, unless additional data is required to accurately represent the flow of Federal funds. (e) If a State uses statistical sampling to develop a clearance pattern, the sample size must be sufficient to ensure a 96 percent confidence interval no more than plus or minus 0.25 weighted days above or below the estimated mean. (f) A clearance pattern must extend, at a minimum, until 99 percent of the dollars in a disbursement have been paid out for Federal assistance program purposes. (g) We and a State may agree to other procedures, such as estimates to project when funds are paid out when the dollar amount and/or the timing of disbursements are not known. Condition: The LIHEAP program is included in the Treasury-State Agreement effective for the fiscal year ending August 31, 2025, and it meets the threshold for inclusion under the Cash Management Improvement Act (CMIA). As such, TDHCA is required to prepare Period 1 clearance pattern calculations supported by verifiable disbursement data to ensure federal funds are drawn in accordance with the program’s required average clearance pattern of three days. TDHCA did not prepare a Period 1 clearance pattern calculation for LIHEAP based on at least three consecutive months of disbursement data as required. Although the Treasury-State Agreement specifies a three‑day average clearance pattern for the program, TDHCA did not maintain or provide documentation supporting how this clearance pattern was developed. As a result, the clearance pattern was not auditable, and we were unable to determine whether TDHCA’s practices for drawing federal funds aligned with the CMIA requirements. Questioned costs: None. Context: See “Condition.” Cause: Management noted their clearance pattern reflected their established funding techniques and prior reports; therefore, they overlooked the specific Treasury-State Agreement documentation requirements. Effect: Although we were able to perform testing over TDHCA’s cash management practices for LIHEAP and concluded that no federal interest was earned as a result of timing differences, the absence of a documented Period 1 clearance pattern calculation prevented us from validating the accuracy of the three‑day clearance pattern prescribed in the Treasury–State Agreement. Without an auditable calculation, TDHCA cannot demonstrate that the established clearance pattern is supported by actual disbursement data, which limits assurance that the methodology used for federal draws fully complies with CMIA requirements. Repeat Finding: No Recommendation: TDHCA should establish and implement procedures to ensure that a Period 1 clearance pattern calculation is completed and retained for LIHEAP in accordance with CMIA and Treasury–State Agreement requirements. This calculation should be based on at least three consecutive months of actual disbursement data and documented in a manner that is readily auditable. TDHCA should also provide training to staff responsible for CMIA compliance to ensure they are aware of the requirement to prepare and maintain this calculation. Views of responsible officials: The Texas Department of Housing and Community Affairs acknowledges and agrees with the finding.

Reporting – Quarterly Performance and Management Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance Program (LIHEAP) ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2501TXLIEI October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §96.82(a), each grantee which is a State or an insular area which receives an annual allotment of at least $200,000 shall submit to the Department, as part of its LIHEAP grant application, the data required by section 2605(c)(1)(G) of Public Law 97-35 (42 U.S.C. 8624(c)(1)(G)) for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance. Key Line Items containing critical information include: 1. Section 1 – Total Households Assisted 2. Section 2 – Performance Management 3. Section 3 – Estimated Use of Funds 4. Section 4 – LIHEAP Program Implementation and Support Condition: As part of our testing of the Quarterly Performance and Management Report for award 2501TXLIEI, we selected 2 of the 4 reports submitted during the fiscal year. During our review, we identified a discrepancy in the quarter 1 report (October 1 – December 31). The report stated that $159,463,428 in LIHEAP funds had been obligated by funding source in Section 3 – Estimated Use of Funds; however, supporting documentation reflected obligated funds totaling $174,447,109, resulting in a variance of $(14,983,681). Questioned costs: None. Context: See “Condition.” Cause: An error was made when TDHCA staff entered the amount of funds obligated into the report, and existing internal controls did not detect the error before the report was submitted to U.S. Department of Health and Human Services (HHS) Effect: Inaccurate reporting may lead to misstated financial information at the federal level, hinder management’s ability to make informed decisions, and could affect federal oversight and monitoring of program activity. These discrepancies increase the risk of noncompliance with federal reporting requirements and may impact the integrity of cumulative statewide LIHEAP reporting. Repeat Finding: No Recommendation: We recommend that TDHCA strengthen its review and reconciliation procedures for quarterly LIHEAP reporting to ensure that amounts reported are fully supported by accurate and complete documentation. This should include implementing a formal review process that requires verification of reported obligation amounts against source records prior to submission, as well as enhanced training for staff responsible for report preparation. Views of responsible officials: The Texas Department of Housing and Community Affairs acknowledges and agrees with the finding.

Cash Management, Eligibility, Level of Effort, Earmarking, Period of Performance, Subrecipient Monitoring – Information Technology – User Access Federal Agency: U.S. Department of Education (USDE) Federal Program Title: Career and Technical Education - Basic Grants to States ALN: 84.048 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: V048A220043, V048A230043, V048A240043 July 1, 2022 - September 30, 2023, July 1, 2023 - September 30, 2024, July 1, 2024 - September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Higher Education Coordinating Board (THECB) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of access controls, we noted that while THECB performs user access reviews for individuals with network access, the reviews were not documented. The absence of documented evidence prevents verification that the reviews were completed, who performed them, when they were performed, and whether identified issues were appropriately resolved. Questioned costs: None. Context: See “Condition.” Cause: The lack of documented access reviews appears to result from informal review processes and insufficient procedures requiring reviewers to maintain written evidence of the review. Additionally, there may be no standardized template or centralized repository for retention of such documentation. Effect: Without documentation of the network access review, THECB cannot demonstrate that: • Reviews were performed within the applicable audit period • Access rights were validated for appropriateness • Unauthorized or outdated access was identified and removed This lack of documentation increases the risk of unauthorized system access, potential misuse of systems or data, and noncompliance with federal internal control requirements. Repeat Finding: No Recommendation: We recommend that THECB: • Develop and implement a standardized documentation process for all user access reviews, including a required template documenting review date, reviewer identity, scope, results, and remediation actions. • Maintain all documentation in a centralized repository accessible to IT management and audit personnel. • Implement periodic monitoring to ensure reviews are performed timely and documentation is consistently retained. • Consider using automated access review tools to support completeness, timeliness, and auditability of reviews. Views of responsible officials: THECB ITS agrees with the finding.

Reporting – Financial, Performance and Special Reporting Federal Agency: U.S. Department of Labor (DOL) Federal Program Title: Unemployment Insurance (UI) ALN: 17.225 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: UI372522255A48, UI380082260A48, UI382492255A48, 23A03UI0389351, 23A60UR000007, 23A60UB000060, 24A55UI000051, 24A55UT000017, 24A60UR000091, 24A60UD000038, 25A55UE000005, 25A60UB000137, 25A60UB000149, 25A60UB000176, 25A60UB000187, 25A60UD000047, 25A55UI000094, 25A55UT000066, 25A60UR000102 October 1, 2021 – December 31, 2024, January 1, 2022 – September 30, 2024, January 1, 2022 – March 31, 2025, October 1, 2022 – December 31, 2025, January 1, 2023 – September 30, 2025, April 1, 2023 – May 22, 2025, October 1, 2023 – December 31, 2026, October 1, 2023 – September 30, 2024, January 1, 2024 – September 30, 2026, May 17, 2024 – May 17, 2027, July 1, 2024 – December 31, 2025, July 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2025, July 9, 2024 – July 9, 2027, October 1, 2024 – December 31, 2027, October 1, 2024 – September 30, 2025, January 1, 2025 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: "Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of financial, performance, and special reporting, we identified gaps in TWC’s documentation and oversight of its reporting processes. Specifically, for the ETA 2112 – UI Financial Transaction Summary, we tested three monthly reports, and none contained evidence of review or approval prior to submission. Similarly, for the ETA 9050 – Time Lapse of All First Payments Except Workshare and the ETA 9052 – Nonmonetary Determination Time Lapse Detection performance reports, we tested three monthly submissions for each report type, and all lacked documentation demonstrating that a formal accuracy and completeness review was performed. In addition, our testing of two quarterly ETA 2208A – Quarterly UI Above-Base Reports identified a lack of segregation of duties. For both reports tested, the individual responsible for preparing the report also performed the review function. Questioned costs: None. Context: See “Condition.” Cause: The absence of documented reviews and approvals appears to result from insufficient internal controls over the reporting process, including unclear staff responsibilities. These control gaps contributed to inconsistent application of review procedures and allowed instances where documentation of required oversight did not occur or was performed by the same individual responsible for report preparation. Repeat Finding: No Recommendation: TWC should strengthen internal controls over the reporting process by establishing clear roles and responsibilities for the preparation, review, and approval of all required ETA reports. Management should ensure that each report undergoes a documented, independent review to verify accuracy and completeness before submission. Additionally, TWC should provide targeted training to staff on reporting requirements and internal control expectations to reinforce consistent application of review procedures and prevent situations where the preparer and reviewer are the same individual. Views of responsible officials: Management agrees on the importance of the ETA reports and the accuracy of the information in the reports.

Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF, 2501TXTANF October 1, 2023 – September 30, 2024 and October 1, 2024 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §261.60(a)-(c), a State must report the actual hours that an individual participates in an activity. It is not sufficient to report the hours an individual is scheduled to participate in an activity. For unsubsidized employment, subsidized employment, and on-the-job training, the State may report projected actual hours of employment participation for up to six months based on current, documented actual hours of work. Any time the State receives information that the client's actual hours of work have changed, or no later than the end of any six-month period, the agency must re-verify the client's current actual average hours of work and may report these projected actual hours of participation for another six-month period. Condition: Audit procedures included independently recalculating average work participation hours for a sample of 40 TANF cases and comparing those results to the hours reported to the U.S. Department of Health and Human Services on the ACF‑199 report. For one of the 40 cases tested, the recalculated average work hours did not agree with the hours reported on the ACF‑199. This discrepancy resulted in a net overstatement of 9 hours on the ACF‑199 report. Questioned costs: No. Context: See “Condition.” Cause: The variance in reported hours for the affected case resulted from a system processing error by the third‑party vendor. During extraction from the WorkInTexas (WIT) system, TWC’s case management system, and file creation for transmission to HHSC, certain hour entries were inadvertently duplicated, leading to the double‑counting of participation hours and, consequently, an overstatement in the ACF‑199 reporting. Effect: Inaccurate reporting of work participation hours affects the reliability of the State’s TANF data submitted to the federal government and may compromise the accuracy of the State’s calculated work participation rates. Such reporting inaccuracies increase the risk of noncompliance with federal work verification requirements and may expose the State to potential penalties if similar errors are systemic or not promptly addressed. Repeat Finding: No. Recommendation: TWC, in coordination with the system vendor, should strengthen controls over the extraction, translation, and transmission of work participation hour data used in the ACF‑199 report. Specifically, TWC should: • Require the third-party vendor to implement system safeguards that prevent the duplication of hour entries during data extraction from the WIT system and subsequent file creation. • Establish automated validation checks to detect anomalies such as duplicate lines, unexpected variances, or irregular hour totals prior to ingesting vendor files into TWC systems. • Enhance supervisory review procedures to ensure that data received from third‑party vendors is reconciled to source records and verified for completeness and accuracy before inclusion in federal reporting. Views of responsible officials: TWC’s Divisions of Workforce Development, Information Technology, and Information, Innovation and Insight agree with the recommendations.

Special Provisions- Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Cluster (CCDF) ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCDC6, 2201TXCCDD, 2201TXCCDF, 2301TXCCDF, 2301TXCCDD, 2501TXCCDF, 2401TXCCDM, 2401TXCCDF, 2401TXCCDD, 2501TXCCDD, 2501TXCCDM, 2501TXCCDY October 1, 2020 – September 30, 2024, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2025, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026, October 1, 2024 – September 30, 2026, October 1, 2024 – September 30, 2027, and December 21, 2024 – September 30, 2028. Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing fraud. In order to identify and recover payments, pursuant to TWC’s Childcare Services Guide (November 2024), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. TWC must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: According to the TWC Division of Fraud Deterrence and Compliance Monitoring’s Standard Operating Procedures for Workforce Board PIRTS Audits, when a Workforce Development Board identifies an improper payment, the Board is required to issue a Notice of Determination informing the participant of their ineligibility, the amount and time period of the improper payment, and the reason for the determination. If the improper payment results from fraud, the Board must issue a first collection letter within 30 days of sending the determination notice to initiate recoupment of the ineligible amount. If repayment is not received or an active payment plan is not established, the Board must issue a final collection letter and refer the participant to TWC for a warrant hold, which restricts the individual from receiving future services until the outstanding amount is recovered. All correspondence is to be documented and maintained in the Program Integrity Reporting Tracking System (PIRTS), the system used by Boards to report and track childcare fact‑finding, fraud determinations, and recoupment activities. As part of our audit procedures, we tested 40 of the 297 closed cases reported to TWC in fiscal year 2025 to verify that TWC followed its procedures related to authenticating that a payment was fraudulent and subsequently recovered payment, if applicable. Of the 40 cases tested, 12 cases did not follow the prescribed procedures and lacked evidence that the Workforce Boards issued the required 1st collection letter within the 30‑day timeframe. Questioned costs: None. Context: See “Condition.” Cause: The exceptions identified occurred because TWC did not provide adequate oversight or monitoring of Workforce Board compliance with established PIRTS procedures. Without routine monitoring, follow‑up, or enforcement mechanisms to ensure Boards issued collection letters within required timeframes, lapses in adherence to the 30‑day requirement went undetected. This lack of oversight contributed to inconsistent application of required fraud‑recovery processes across Boards. Effect: Failure to ensure that Workforce Development Boards issued required first collection letters within the prescribed 30‑day timeframe impeded timely initiation of recoupment efforts for fraudulent childcare payments. This condition increases the risk that improper payments resulting from fraud may not be recovered in a timely manner and that individuals with outstanding fraudulent overpayments may continue to seek or receive services. Repeat Finding: No Recommendation: TWC should strengthen its oversight of Workforce Board compliance with PIRTS requirements by implementing routine monitoring procedures to verify that Boards issue first collection letters within the required 30‑day timeframe. This may include periodic reviews of PIRTS documentation, automated tracking or alerts for timeliness, and follow‑up with Boards when deadlines are missed. Additionally, TWC should provide guidance or refresher training to reinforce expectations and ensure consistent application of improper payment recovery procedures across all Boards. Strengthening these oversight mechanisms will help reduce the risk of delayed collection efforts and improve adherence to established fraud‑deterrence processes. Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. TWC’s Division of Fraud Deterrence and Compliance Monitoring’s Office of Investigations (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. Additionally, TWC’s Subrecipient Monitoring Department (SRM) tests Board compliance with respect to childcare improper payment reporting and recoupment. TWC currently conducts routine monitoring and follow-up to ensure Boards issue collections letters in a timely fashion. That being said, TWC does agree that our objectives would be better served with more robust measures. Currently, FDCM/OI investigators review a sample of PIRTS reports on a monthly basis to ensure that Boards are uploading all required documentation related to childcare improper payments and undertaking collection efforts. Investigators review two randomly selected cases for each Board per month on a rolling basis for the prior three months. FDCM/OI also conducts periodic PIRTS training and retraining with Board staff. Additionally, the PIRTS system sends automated reminder notifications for Board staff to issue collection letters. FDCM/OI realizes the importance of issuing collection letters in a timely matter. Doing so not only increases the likelihood that important child care funds are remitted, but also assists with additional enforcement activities including prosecution of substantiated fraud. FDCM/OI takes the integrity of child care funds very seriously and will aid prosecution where appropriate.

Allowable Costs/Activities Allowed – Personal Services Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Epidemiology and Laboratory Capacity for Infectious Diseases ALN: 93.323 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6 NU50CK000501-01-08, 6 NU50CK000501-02-17 August 1, 2019 – July 31, 2024, August 1, 2019 – July 31, 2027 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the Texas Department of State Health Services (DSHS) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.430 Standards for Documentation of Personnel Expenses, Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by an internal control system that ensures the charges are accurate, allowable, and properly allocated; (ii) be incorporated into the official records of the non-Federal entity; (iii) reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) encompass federally-assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) comply with the established accounting policies and practices of the non-Federal entity; (vi) support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (vii) Budget estimates (meaning, estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes, provided that: (A) The system for establishing the estimates produces reasonable approximations of the activity performed; (B) Significant changes in the related work activity (as defined by the recipient's or subrecipient's written policies) are promptly identified and entered into the records. Short-term (such as one or two months) fluctuations between workload categories do not need to be considered as long as the distribution of salaries and wages is reasonable over the longer term; and (C) The recipient's or subrecipient's system of internal controls includes processes to perform periodic after-the-fact reviews of interim charges made to a Federal award based on budget estimates. All necessary adjustments must be made so that the final amount charged to the Federal award is accurate, allowable, and properly allocated. Condition: DSHS requires its employees to complete monthly time and leave reporting, regardless of whether the employee works solely on a single federal award or cost objective, or on multiple activities or cost objectives. Each employee has a default task profile based on their position in the agency that determines how their payroll and payroll-related dollars are allocated. Employees are instructed and given training on how to report any deviations from their profile as well as report any vacation time, sick time, leave of absence, etc. Employees are required to certify their time by the 10th of the month for the previous months’ time. Like all DSHS employees, supervisors are required to certify their time monthly. However, their time certification includes an additional affirmation which states the supervisor has performed the following:  Reviewed the default task profile/labor account code for each of their direct reports.  Reviewed the timesheets for all direct reports as compared to the default task profiles/labor account codes for accuracy of time worked and adjusted if necessary.  For direct reports who have reported deviations, reviewed and verified the deviations reported and approved the respective timesheet. This documented affirmation provides sufficient documentation to indicate that the supervisors have reviewed after the fact interim payroll and payroll-related charges made to federal awards based on budget estimates. Audit procedures included a selection of 40 payroll-related expenditures incurred during the fiscal year totaling $191,809. For five of the 40 samples selected, the employee supervisor did not certify their monthly timesheet, and thus did not acknowledge neither the review of the employees’ default task profile/account labor code or their timesheets. Questioned costs: None. Context: See “Condition.” Cause: All five of the exceptions noted were directly reporting to the same supervisor. The monthly timesheets selected were during the months of July and August 2024. The supervisor was recently hired in April 2024 and was unaware of the requirement to certify monthly. Effect: Without the supervisor timesheet certification, there is a lack of sufficient documentation to indicate that they have reviewed after-the-fact interim payroll and payroll-related charges made to the federal awards based on budget estimates. Repeat Finding: No Recommendation: DSHS should enhance new hire training policies and procedures to ensure all new hire trainings clearly address labor account codes, monthly time reporting, and task profiles. Views of responsible officials: DSHS has robust timekeeping controls but recognizes this opportunity to enhance training with reinforcement for new supervisors.

Cash Management – Cash Management Improvement Act Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Epidemiology and Laboratory Capacity for Infectious Diseases ALN: 93.323 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6 NU50CK000501, 6 NU51CK000353 August 1, 2019 – July 31, 2024, August 1, 2019 – July 31, 2027, August 1, 2024 – July 31, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the Texas Department of State Health Services (DSHS) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 31 CFR Part 205, a Federal assistance program must abide by the rules in Subpart A, interest calculation procedures, if it falls within the funding threshold set forth by the Federal government. The dollar threshold is calculated using the most recent Single Audit data. Programs not subject to these rules are considered under Subpart B. Rather than incurring an interest liability for programs in Subpart B, the funds transferred to the State will be limited to the immediate cash needs of the agency and should be times so as to minimize the period between drawdown and disbursement. Condition: The State determines each major program subject to interest liability calculations every year and communicates the covered programs to each agency. Funding techniques and clearance patterns are set out in the Treasury-State Agreement. Per the Texas Cash Management Improvement Act (CMIA) Handbook (based on the Treasury-State agreement), each state agency that administers a major program has the following responsibilities including but not limited to the following:  Review flow of funds for affected programs and determine appropriate funding technique.  Develop sample data and calculate clearance days on federal funds from the time of deposit in the State Treasury until warrants are issued on the funds (Period 1).  Comply with the Subpart B requirements for programs not covered by Subpart A. Per the 2024 Texas Treasury-State Agreement, DSHS was required to submit a Period 1 calculation for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. Audit procedures included selecting a sample of federal cash draws and verifying that the timing of the federal cash draws was in compliance with the applicable funding techniques specified in the Treasury-State Agreement. Cash draws included in the Period 1 calculation submitted to the Texas Comptroller of Public Accounts’ web application totaled $89,236,255; however, the final amount of expenditures reported on the Schedule of Expenditures of Federal Awards (SEFA) for the program was $289,534,627. Accordingly, the Period 1 calculation submission was understated by $200,298,372 and the calculation of the interest obligation owed to or by the federal government was incorrect. Questioned costs: None. Context: See “Condition.” Cause: DSHS made significant adjustments to the SEFA subsequent to the submission of the Period 1 calculation in the Texas Comptroller of Public Accounts’ web application. Once submitted, the web application is locked and DSHS must request for it to be unlocked in order to make revisions. Due to the timing of the adjustments to the SEFA and the conclusion of audit work, DSHS did not have sufficient time to request and submit the revisions. Effect: The calculation of the interest obligation owed to or by the federal government may be misstated if the Period 1 calculation is incorrect. Repeat Finding: No Recommendation: DSHS should enhance reviews of its SEFA to avoid significant adjustments subsequent to the submission of its Period 1 calculation. Views of responsible officials: DSHS acknowledges and agrees with the finding as stated.

Matching and Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster ALN: 93.044 93.045 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXOACM, 2101TXOAHD, 2101TXOASS 10/1/2020 – 9/30/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 USC 3029(b) Matching funds; percentage limitation (1) For each fiscal year, not less than 25 percent of the non-Federal share of the total expenditures under the State plan which is required by section 3024(d) of this title shall be met from funds from State or local public sources. (2) Funds required to meet the non-Federal share required by section 3024(d)(1)(D) of this title, in amounts exceeding 10 percent of the cost of the services specified in such section 3024(d)(1)(D) of this title, shall be met from State sources. Condition: During our testing of the program’s matching requirements, we noted the following:  HHSC’s required match under 42 USC 3029(b)(1) for the fiscal year 2021 grant, which ended on September 30, 2023, was $979,430. State administration expenditures totaled $3,917,721, of which 25%, or 979,430 must be from non-Federal sources. HHSC provided a population of $1,206,534 of administration expenditures paid from non-Federal sources used to meet the matching requirement. Of this amount, audit procedures included testing 159 expenditures, totaling $771,585 that were paid from non-Federal sources used to meet the 25% matching requirement. We noted that 134 of the expenditures, totaling $744,159 were not administrative costs incurred by the State. Rather these were amounts paid to subrecipients. Accordingly, allowable non-federal expenditures were $462,376, which is less than the required match amount of $979,430 or 13.6% of the of the cost of state plan administration. HHSC did not meet the matching requirement per 42 USC 3029(b)(1). Additionally, the recipient share of expenditures (line j) and the remaining recipient share to be provided (line k) on the corresponding SF_x0002_425 report for 2101TXOASS was incorrectly reported. HHSC reported the recipient share of expenditures of $7,452,949; however, allowable non-federal expenditures were only $6,708,790.  HHSC calculates its required recipient share of expenditures related to the state and Area Agencies on Aging (AAA’s) costs of administration of area plans and reports it on line i of the SF-425 report. For the fiscal year 2021 grant, we noted that while the match amount was met, the required match as reported on the SF-425 was calculated incorrectly as follows: See chart or table in the Schedule of Findings and Questioned Costs.  HHSC’s required match under 42 USC 3029(b)(2) for the fiscal year 2021 grant, which ended on September 30, 2023, was $11,355,969. Of this amount, $3,785,323 was required to be funded from state sources, while the remaining $7,570,646, would be met by amounts paid by the AAA’s. HHSC provided a calculation of $30,107,759 of expenditures incurred to meet the AAA portion of the requirement. However, CLA was unable to substantiate that amount based on supporting documentation as final expenditures submitted by the AAA’s had been revised, however, HHSC did not revise their calculations. Questioned costs: Unknown Context: See “Condition.” Cause: Management calculates matching requirements and identifies actual expenditures to meet these requirements. For the exceptions noted for 42 USC 3029(b)(1), management failed to exclude unallowable expenditures when identifying expenditures incurred to meet the matching requirements. For the exception noted for 42 USC 3029(b)(2), management did not revise the matching calculation based on final amounts received from the AAA’s. Effect: Failure to meet matching requirements may result in a reduction in federal funding. Furthermore, failure to calculate, review, and approve final matching expenditures may lead to noncompliance with the terms of the grant and questioned costs. Repeat Finding: No. Recommendation: We recommend management enhance existing controls around the review of all expenditures that are used to meet the minimum required matching requirements. Views of responsible officials: HHSC concurs with the finding.

Reporting – Financial Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster ALN: 93.044 93.045 93.053 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXOACM 10/1/2021 – 9/30/2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.328(c), the recipient or subrecipient must submit financial reports as required by the Federal award. Per 2 CFR 200.302(b)(2), the recipient's and subrecipient's financial management system must provide for the following: accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. Condition: Audit procedures included a sample of six SF-425 reports submitted during the fiscal year. For the March 31, 2024, report for the 2201TXOACM award, audit procedures included comparing the reported amounts to the general ledger. We noted the following variances: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None. Context: See “Condition.” Cause: Amounts in the supporting general ledger documentation were accurate. However, the corresponding line items on the SF-425 report were not reported accurately. Management did not revise the March 31, 2024, report as the report is cumulative and the final report for the 2201TXOACM grant will include the corrected amounts. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: No. Recommendation: We recommend management reconcile all amounts reported on the SF-425 reports to the general ledger or other supporting documentation to ensure completeness and accuracy prior to submission. Views of responsible officials: HHSC concurs with the finding.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Opioid STR Block Grants for Community Mental Health Services Block Grants for Substance Abuse, Prevention, Treatment and Recovery Services ALN: 93.044, 93.045, 93.053 93.558 93.667 93.788 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXOACM, 2101TXOAHD, 2101TXOANS, 2101TXOASS 2201TXOACM, 2201TXOAHD, 2201TXOANS, 2201TXOASS, 2301TXOACM, 2301TXOAHD, 2301TXOANS, 2301TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS October 1, 2020 – September 30, 2023, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025 and October 1, 2023 – September 30, 2025 TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 Social Services Block Grant 2201TXSOSR, 2301TXSOSR and 2401TXSOSR October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 and October 1, 2023 – September 30, 2025 Opioid STR 6H79TI083288 and 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Block Grants for Community Mental Health Services 6B09SM083999, 1B09SM085994, 6B09SM085994, 1B09SM087322, 1B09SM087345, 6B09SM087345, 1B09SM09610, 1B09SM085385, 6B09SM089380, 1B09SM085913, 1B09SM089984 March 15, 2021 – March 14, 2024, October 1, 2021 – September 30, 2023, October 17, 2022 – October 16, 2024, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, September 1, 2021 – September 30, 2025, September 30, 2023 – September 29, 2025, September 30, 2024 – September 29, 2026 Block Grants for Substance Use Prevention, Treatment and Recovery Services 6B08TI084673, 1B08TI085835, 6B08TI085835, 1B08TI083969, 1B08TI084609, 6B08TI085835, 1B08TI087067, 6B08TI083545 October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, September 1, 2021 – September 30, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, March 15, 2021 – March 15, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2023-010, 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC concurs with the finding.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) ALN: 93.558 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 SSBG 2401TXSOSR October 1, 2023 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in the subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes the subrecipient’s unique entity identifier (UEI). Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Temporary Assistance for Needy Families – The UEI was not included in eight of the eight agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2024. Social Services Block Grant –The UEI was not included in one of the 19 agreements selected for testing. The start and end dates for the agreement was January 1, 2021 – August 31, 2024. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR 200 §200.332 prior to execution is not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: 2023-011 Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: HHSC concurs with the finding.

Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Social Services Block Grant 2401TXSOSR October 1, 2023 – September 30, 2025 Block Grants for Community Mental Health Services 1B09SM085994, 6B09SM085994 October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to § 200.308(e)(3). Condition: For awards with period of performance beginning dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the first month of the award. For awards with period of performance end dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the last month and after the period of performance end date. We noted the following instances of noncompliance: Social Services Block Grant (SSBG) – Audit procedures included testing 40 sampled transactions from projects with period of performance beginning dates during the fiscal year totaling $5,034. Two of the expenditures, totaling $486, were related to costs incurred prior to the period of performance begin date. The Project Period Start Date per the grant award was October 1, 2023, however costs were incurred on September 6, 2023 and September 11, 2023. Block Grants for Community Mental Health Services (MHBG) – Audit procedures included testing 40 sampled transactions, totaling $1,695,512, from projects with period of performance end dates during the fiscal year for which the obligation had not been paid as of the end of the period of performance. Twelve of the expenditures, totaling $312,929, were not paid within 120 days of the period of performance end date, which is the allowed time period to liquidate obligations. The required liquidation date was December 29, 2023; however, these obligations were paid between January 2, 2024 and April 11, 2024. Questioned costs: Social Services Block Grant: $486 Block Grants for Community Mental Health Services: $312,929 Context: See “Condition.” Cause: The two exceptions for SSBG were related to travel costs where the employee’s supervisor approved the transaction, which was coded to the incorrect grant. For the exceptions noted in the liquidation period testing for MHBG, the late payments are due to the HHSC’s reconciliation and closeout process not being performed in a timely manner. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. In addition, costs paid with non-federal sources remain in the population which is being included on the schedule of federal expenditures (SEFA) for the current fiscal year. Repeat Finding: 2023-016 Recommendation: HHSC should provide additional training over its review process to ensure that reviewers are verifying that transactions are posted to the proper grant. Additionally, HHSC should verify that all obligations incurred are liquidated during the closeout process and adjustments are not made subsequent to closeout. Views of responsible officials: HHSC concurs with the finding.

Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant ALN: 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXSOSR October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The 42 USC 1397e requires states and territories to submit to the federal administering agency, the Office of Community Services, an annual Post Expenditure Report no later than six months following the close of the fiscal year. The report includes certain critical key line information including:  TANF Funds Transferred into SSBG –Amount reported on this line item should be consistent with the TANF federal financial report (ACF-196R). The Federal Funds Office (FFO) is responsible for the completeness, accuracy, and timely submission of the Post Expenditure Report. Federal Reporting Fiscal Management personnel are responsible for proper reporting and submission of the ACF-196R. Condition: During testing of key line items for the FY2023 Annual Post Expenditure Report submitted in March 2024, we noted that TANF Funds Transferred into SSBG, as reported on the ACF-196R report was $45,104,976, however, the amount reported on the FY2023 Post Expenditure Report was $40,351,905, resulting in a variance of $4,753,071. Questioned costs: None Context: See “Condition.” Cause: FFO did not properly coordinate efforts with the Federal Reporting personnel to ensure the amounts noted on the ACF-196R were consistent with the amount on the Post Expenditure Report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: 2023-013 Recommendation: We recommend the FFO coordinate with the appropriate Federal Reporting Team personnel regarding amounts noted for the TANF Funds Transferred into SSBG to ensure the amount in the Post Expenditure Report matches with the amount in the ACF-196R. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: B09SM087345 October 1, 2022 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included a sample of 40 general disbursements, totaling $440,324, incurred during the fiscal year. For one general disbursement selected, totaling $7,185, there was no evidence of review and approval of the disbursement prior to payment. Total general disbursements, which excludes salaries and benefits and indirect costs, incurred for the program during the fiscal year was $796,639. Questioned costs: None. Context: See “Condition.” Cause: Management did not retain evidence of the approval for this transaction. Effect: Failure to review expenditure transactions pertinent to a federal award and maintain adequate documentation evidencing review may result in noncompliance with grant terms and conditions as well as payment of unallowed costs. Repeat Finding: No Recommendation: HHSC should enforce policies and procedures to ensure all disbursements are reviewed and approved prior to payment. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions – Provider Eligibility – Information Technology – Vendor Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2405TXIMPL, 2405TX5000, 2405TX5MAP, October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC contracted with Conduent State Healthcare, LLC (Conduent Pharmacy) to administer the Vendor Drug Program for the Medicaid Cluster through March 2024. Conduent Pharmacy performs services related to processing pharmacy claims and managing the rebate administration function for the HHSC Vendor Drug Program. HHSC utilizes the Conduent Drug Rebate Administration Management (DRAMS) application to validate and bill drug manufacturers for rebates and the Open Systems Plus (OS+) application to construct drug coverage rules related to payment for pharmacy services. A Service Organization Controls 1 (SOC 1) Type 2 report validates the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process HHSC’s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. We noted that the SOC 1 Type 2 report for the third-party administrator for DRAMS and OS+ was not completed for the seven month period during which the applications were being utilized. As such, HHSC was unable to evaluate whether reasonable controls were in place over this third-party service to determine if they are secure, accurate and available, and support processing integrity during the period in which the applications were being used. Questioned costs: None Context: See “Condition.” Cause: DRAMS and OS+ were used to manage the Vendor Drug Program through March 2024, after which HHSC moved to a different third-party administrator. Despite HHSC’s request, Conduent did not engage an auditor to complete the SOC 1 Type 2 report for the period September 1, 2023 – March 30, 2024. Effect: Failure to obtain and review findings and complementary user entity controls within a third-party vendor’s SOC 1 Type 2 report may result in inappropriate reliance on the third-party vendor’s internal controls, which could result in noncompliance. Repeat finding: No Recommendation: HHSC should strengthen its vendor management policies to ensure SOC 1 Type 2 reports are completed and received in a timeframe that allows management to determine if the third-party services are secure, accurate and available, and support processing integrity for the fiscal year. This may be accomplished by including clauses into vendor contracts to require SOC 1 Type 2 reports or allow HHSC rights to audit if alternative procedures are necessary. Views of responsible officials: HHSC concurs with the finding.

Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control):  Ninety days for applicants who apply for Medicaid on the basis of disability; and  Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.

Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.

Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.

Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.

Special Tests and Provisions – Medical Loss Ratio (MLR) Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR section 438.8(k) - The State, through its contracts, must require each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), or Prepaid Ambulatory Health Plan (PAHP) to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC reviews MLR reports received from MCOs to verify the reports contain the required data elements. Audit procedures included a review of six MLR reports from MCOs submitted to the FRAC during the fiscal year. One of six reports did not contain two of the thirteen required elements as follows:  Methodology(ies) for allocation of expenditures  A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all required data elements are included in the MLR reports. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: The FRAC should enhance existing controls around the review of MLR report submissions to ensure they are complete and accurate. Views of responsible officials: HHSC concurs with the finding.

Subrecipient Monitoring Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Home Investment Partnerships Program ALN: 14.239 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: M18-SG480100, M19-SP480100, M20-SG480100 September 12, 2018 – September 1, 2026, and July 12, 2019 – September 1, 2027, August 13, 2020 – September 1, 2028 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR sections 200.332 (c), TDHCA must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, TDHCA should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). Condition: TDHCA maintains a Master Compliance Subrecipient Monitoring (CMSM) Planning Summary (MPS) to track all active subrecipient contracts that have expenditures in the planning phase to evaluate each subrecipient's fraud risk and risk of noncompliance with the subaward to determine the appropriate subrecipient monitoring to be performed. During our testing, we noted three subrecipient contracts with expenditures during the fiscal year were not included on the MPS for evaluation of fraud risk and risk of noncompliance. Accordingly, no determination was made for the appropriate subrecipient monitoring to be performed for these subrecipients. Questioned costs: None. Context: See “Condition.” Cause: The preparation of the MPS is a manual process wherein a senior analyst identifies the active contracts that have expenditures in the planning phase. The subrecipients were inadvertently omitted due to oversight. Effect: Failure to complete proper monitoring over subrecipients may lead to noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend TDHCA establish internal controls that require a review to be completed over the completeness and accuracy of the MPS by an individual other than the preparer. Views of responsible officials: Compliance Subrecipient Monitoring (CMSM) has historically utilized the Department’s Housing Contract system to populate its risk population. “Active” contracts with expenditures are selected for risk consideration while “Expired”, “Closed” or unexpended contracts are excluded to promote internal efficiency in the monitoring process. During interviews with the auditor and the Department’s HOME staff, it was identified that there are circumstances where “Expired” or “Closed” contracts may demonstrate expenditure activity and inadvertently exclude contracts that could be included for risk consideration. Of note, this system generated discrepancy has not contributed to a material variance in contracts considered for risk assessment.

Special Tests and Provisions – Housing Quality Standards Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Home Investment Partnerships Program ALN: 14.239 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: M16-SG480100, M18-SG480100, M19-SG480100, M20-SG480100, M21SG480100, M21-SP480100 August 3, 2016 – September 1, 2024, September 12, 2018 – September 1, 2026, July 17, 2019 -September 1, 2027, August 13, 2020 – September 1, 2028, July 30, 2021 – September 1, 2029, September 20, 2021 – September 30, 2030 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per CFR 92.504(d)(1)(ii)- Ongoing periodic inspections of HOME-assisted rental housing. During the period of affordability, the participating jurisdiction must perform on-site inspections of HOME-assisted rental housing to determine compliance with the property standards of § 92.251 and to verify the information submitted by the owners in accordance with the requirements of § 92.252. The inspections must be in accordance with the inspection procedures that the participating jurisdiction establishes to meet the inspection requirements of § 92.251. Per CFR 92.504(d)(1)(ii)(A)- The on-site inspections must occur within 12 months after project completion and at least once every 3 years thereafter during the period of affordability. Condition: Audit procedures included testing seven multifamily and 38 single family home properties to verify whether on-site inspections of the HOME-assisted rental property had been completed at least once every 3 years during the period of affordability. During our testing, we noted that one of the seven multifamily property’s last inspection was completed on March 6, 2020. Questioned costs: None. Context: See “Condition.” Cause: The on-site inspection was not completed due to management oversight. Effect: Failure to complete proper inspections over HOME assisted properties may lead to noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend that TDHCA strengthen its internal controls to ensure that all properties are inspected at least once during every three years of the period of affordability. Views of responsible officials: Compliance Monitoring Section (CMS) has historically utilized reports from the Compliance Monitoring Tracking System (CMTS) to generate a list of properties to inspect. The list of properties to inspect are then broken up into trips using Excel and assigned to physical inspection staff. During the review, the auditor identified a HOME-rental property that was not inspected within the required three (3) year period. The CMTS system correctly identified the property for timely inspection; the oversight was an internal error in the planning process.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement Program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3–48–SBGP–148–2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TxDOT) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403, except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. (d) Be accorded consistent treatment. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for State and local governments and Indian Tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing requirements of any other federally – financed program in either the current or a prior period. (g) Be adequately documented. Condition: Audit procedures included a sample of 40 expenditures, totaling $9,426,808, to test allowability with grant awards. We noted that for one of the 40 samples, TxDOT overpaid an invoice to a vendor by $70,000. Upon detection by the vendor, TxDOT corrected the overpayment by reducing a subsequent payment to the vendor by the $70,000. Questioned costs: None Context: See “Condition.” Cause: The amount requested to be reimbursed was manually entered incorrectly in eGrants. TxDOT did not detect the discrepancy during the review and approval process prior to the payment. Effect: Failure to thoroughly review invoices prior to payment may lead to overpayment or underpayment of funds to vendors and potential questioned costs. Repeat Finding: No Recommendation: We recommend that TxDOT provide additional training to individuals performing reviews of expenditures. We also recommend TxDOT establish internal controls to monitor that reviews of expenditures are being completed to the level of detail required by internal policies and procedures. Views of responsible officials: TxDOT AVN agrees with the finding.

Reporting – Financial Reporting Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3-48-SBGP-147-2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TXDOT): Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TXDOT is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.328(c), the recipient or subrecipient must submit financial reports as required by the Federal award. Per 2 CFR 200.302(b)(2), the recipient's and subrecipient's financial management system must provide for the following: accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. Condition: Audit procedures included a sample of five SF-425, Federal Financial Reports submitted during the fiscal year. For the SF-425 report for the 3-48-SBGP-147-2022 grant award submitted on March 6, 2024, we noted TXDOT did not report the recipient share of expenditures required. The recipient share of expenditures was incurred for the project; however, they were inadvertently omitted from the report. Questioned costs: None Context: See “Condition.” Cause: TXDOT prepares financial reports based on expenditures reported in its Peoplesoft system. The project for grant 3-48-SBGP-147-2022 was set up as 100% federal as the match was being met by the subrecipient. As such, TXDOT was reimbursing the subrecipient at 100% while the subrecipient met the 10% match with local funds. Accordingly, the matching funds, as incurred by the subrecipient, were not considered when preparing and reviewing the SF-425 report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: No Recommendation: We recommend management enhance its internal controls over the review and approval of the SF-425 reports to include a review of the grant award to ensure the subrecipient share of expenditures are reported properly reported. Views of responsible officials: TxDOT AVN agrees with this finding.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Various Various Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), TxDOT must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TxDOT is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: As the direct recipient of grant funding, TxDOT is responsible for reporting first-tier subawards of $30,000 or more in FSRS. Audit procedures included testing 9 subawards made during the fiscal year for FFATA requirements. During our testing, we noted that there was no segregation of duties in the FFATA reporting process as the same employee was preparing and submitting the reports. During our testing, we also noted the following compliance exceptions: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None Context: See “Condition.” Cause: FFATA reports are prepared quarterly rather than monthly. This leads to reports being noncompliant if they are awarded in a month other than the quarter-ending month. Furthermore, TXDOT's policies and procedures do not require a review of FFATA reports prior to submission. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Improperly designed internal controls over reporting may result in a misstatement of amounts reporting on federal reports. Repeat Finding: No Recommendation: We recommend that TXDOT update its policies and procedures to (a) require monthly submission of FFATA reports and (b) establish review and approval of FFATA reports by a person other than the person preparing the report. Views of responsible officials: TxDOT AVN agrees with this finding.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles – Personal Services Federal Agency: U.S. Department of Labor Federal Program Title: Employment Service Cluster ALN: 17.207, 17.801 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: DV373362255548–01, 23555DV000036–01, 24555DV000076–01 October 1, 2021 – December 31, 2023, October 1, 2022 – December 31, 2024, October 1, 2023 – December 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Nonompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Veterans Commission (TVC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Per 2 CFR 200.430 Standards for Documentation of Personnel Expenses, Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the recipient or subrecipient; (iii) Reasonably reflect the total activity for which the employee is compensated by the recipient or subrecipient, not exceeding 100 percent of compensated activities (iv) Encompass federally-assisted and all other activities compensated by the recipient or subrecipient on an integrated basis but may include the use of subsidiary records as defined in the recipient's or subrecipient's written policy; (v) Comply with the established accounting policies and procedures of the recipient or subrecipient (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (vii) Budget estimates (meaning, estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes, provided that: (A) The system for establishing the estimates produces reasonable approximations of the activity performed; (B) Significant changes in the related work activity (as defined by the recipient's or subrecipient's written policies) are promptly identified and entered into the records. Short-term (such as one or two months) fluctuations between workload categories do not need to be considered as long as the distribution of salaries and wages is reasonable over the longer term; and (C) The recipient's or subrecipient's system of internal controls includes processes to perform periodic after-the-fact reviews of interim charges made to a Federal award based on budget estimates. All necessary adjustments must be made so that the final amount charged to the Federal award is accurate, allowable, and properly allocated. Condition: Audit procedures included a sample of 40 expenditures for incurred for personnel services during the fiscal year to test whether the expenditures for salaries and wages were allowable and based on the records that accurately reflect the work performed. We noted that TVC prepares monthly budget reports that are reviewed by the program’s budget analyst and the respective program director or manager. Expenditures related to personnel services are recorded based on the budgeted amount for each individual. No periodic after-the-fact review is performed to verify that the final amount charged to the Federal award is accurate, allowable, and properly allocated. Questioned costs: None Context: See “Condition.” Cause: The employees working on the federal grant program are budgeted to work on the grant 100% of their time. Management deemed this sufficient to substantiate the final amounts charged to the grant. Effect: Lack of a periodic after-the-fact review to verify that the final amounts charged to the Federal award are accurate, allowable, and properly allocated may result in noncompliance with grant terms and conditions and questioned costs. Repeat Finding: No Recommendation: We recommend that management establish procedures and internal controls to perform an after-the-fact review of personnel services to verify that the final amounts charged to the Federal award are accurate, allowable, and properly allocated. This can be accomplished by a supervisor’s review and approval of the employee’s timesheet each pay period or an annual review where necessary adjustments are made. Views of responsible officials: TVC agrees to the recommendation of documenting review and approvals. To note, the monthly Veteran Employment Services (VES) Forecasts and Payroll reports had been reviewed with VES’s Director and/or Operations Manager as well as VES’s Annual State Plan before submission to the U.S. Department of Labor. VES’s Director or Operations Manager’s signature of approval was never documented for confirmation of review.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles – Indirect Costs Federal Agency: U.S. Department of Labor Federal Program Title: Employment Service Cluster ALN: 17.207, 17.801 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 23555DV000036 – 01, 24555DV000076 – 01 October 1, 2022 – December 31, 2024, October 1, 2023 – December 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Veterans Commission (TVC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403, except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. (d) Be accorded consistent treatment. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for State and local governments and Indian Tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing requirements of any other federally – financed program in either the current or a prior period. (g) Be adequately documented. Condition: Audit procedures included a sample of five indirect cost expenditures, totaling $1,248,175, incurred during the fiscal year to verify that the rates used were in accordance with the terms and conditions of the award and the amounts claimed were applied to the appropriate base. During our testing, we noted one sample in which an incorrect rate was applied to the base, resulting in $69,481 of unallowed indirect costs. In addition, there was no evidence of review and approval for three of the five expenditures selected for testing, including the expenditure noted in the preceding paragraph. Questioned costs: $69,481 Context: See “Condition.” Cause: Management failed to retain documentation that would support the review and approval of the indirect cost amounts. The exceptions were caused due to high turnover within the agency. Employees who were responsible for the approvals are no longer employed through TVC. Effect: Lack of formal documentation of reviews may result in questioned costs. In addition, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend TVC enforce establish document retention processes to ensure it has access to documentation for review in the event of management turnover. In addition, we recommend TVC strengthen its controls over the review of the indirect cost calculations to ensure accuracy of costs being calculated. Views of responsible officials: TVC agrees to the recommendation of improved record retention in the event of management turnover. TVC also agrees to the recommendation of strengthening its internal controls over the review of VES’s grant costs associated with the indirect revenues being calculated.

Reporting Federal Agency: U.S. Department of Labor Federal Program Title: Employment Services Cluster ALN: 17.207, 17.801 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 23555DV000036 – 01, 24555DV000076 – 01 October 1, 2022 – December 31, 2024, October 1, 2023 – December 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Veterans Commission (TVC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included testing of five SF – 425 Federal Financial Reports and five VETS –402 (A/B) Expenditure Detail Reports that were submitted during the fiscal year. During our testing, we noted the following:  SF-425 Federal Financial Reports – there was no evidence of review and approval of the report prior to submission for four of the five reports.  VETS-402 (A/B) Expenditure Detail Reports – there was no evidence of review and approval of the report prior to submission for four of the five reports. Questioned costs: None Context: See “Condition.” Cause: Employees who were responsible for the approvals are no longer employed at TVC. Management was unable to locate documentation that would support the review and approval of reports. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. In addition, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend TVC enforce establish document retention processes to ensure it has access to documentation for review in the event of management turnover. Views of responsible officials: TVC agrees to the recommendation of establishing a document retention process in the event of management turnover.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Labor Federal Program Title: Workforce Innovation and Opportunity Act Cluster ALN: 17.258, 17.259, 17.278 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 23A55AY000040–01–00 April 1, 2023 – June 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Workforce (TWC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TWC is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: As the prime recipient of grant funding, TWC is responsible for reporting first-tier subawards of $30,000 or more in FSRS. Audit procedures included testing 59 subawards made during the fiscal year for FFATA requirements, including subawards made by Texas Education Agency (TEA) using state pass through funds from TWC. TWC passed through $3,000,000 of federal grant funds to TEA who in turn made 33 subawards totaling $2,911,755. Based on Part 3 of the 2024 compliance supplement, transfers of federal awards to another component of the same auditee under 2 CFR Part 200, Subpart F, do not constitute a subrecipient or contractor relationship. Accordingly, subawards made by TEA should be reported in FSRS by TWC as the prime recipient. The following compliance exceptions were identified: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None Context: See “Condition.” Cause: TWC considered the funds passed through to TEA as a subaward and reported these amounts in FSRS. However, as TEA is an agency of the State of Texas, it does not meet the definition of a subrecipient. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Repeat Finding: No Recommendation: We recommend that, as the prime recipient, TWC coordinate with state pass through entities to obtain the information needed for FFATA reporting in order to be compliant with FFATA requirements. Views of responsible officials: In this situation, TWC disagrees with the applicability of the following statement “Transfers of federal awards to another component of the same auditee under 2 CFR Part 200, Subpart F, do not constitute a subrecipient or contractor relationship” from the Fiscal Year 2024 2 CFR Part 200, Appendix XI Compliance Supplement. According to 2 CFR Part 170, TWC is required to report first-tier subawards. In the case of TWC and TEA, there is an Interagency Agreement Contract (IAC) which designates TEA as a subrecipient of TWC making TEA a first_x0002_tier grantee of TWC. Neither TWC nor TEA considers this funding a “transfer.” The definition of a pass-through entity according to 2 CFR Part 200, means a recipient or subrecipient that provides a subaward to a subrecipient (including lower tier subrecipients) to carry out a federal program. In the case of TWC and TEA, there is an Interagency Agreement Contract (IAC) that establishes a relationship that would not be considered a transfer but a first tier subaward. The IAC establishes TWC as a pass-through entity and TEA as a subrecipient per the definitions of these terms in 2 CFR 200.1. Under the requirements for pass-through entities at 2 CFR 200.332, TWC is responsible for monitoring TEA performance under this subaward which may include enforcement under 2 CFR 200.339 and the recovery of costs associated with subrecipient noncompliance. This contractual consideration and possibility of repayment supports that this relationship is one of pass-through and subrecipient, and not a transfer of a federal award to another component of an auditee. As such, subawards made by TEA are in fact second tier subawards for TWC and TWC has no obligation to report them as established in Appendix A 2 CFR Part 170. The Federal Funding Accountability and Transparency Act of 2006 (FFATA) was passed in the vein of openness and transparency to the public as it relates to Federal spending. Reporting on first-tier subawards took effect October 1, 2010. (See OMB Memorandum for Senior Accountable Officials, “Open Government Directive–Federal Spending Transparency and Subaward and Compensation Data Reporting,” August 27, 2010.) FFATA, § 2—Full Disclosure of Entities Receiving Federal Funding, directed the Office of Management and Budget to “ensure the existence and operation of a single searchable website, accessible by the public at no cost to access, that includes for each Federal award—(A) the name of the entity receiving the award” and other specified information. (See Public Law 109-282, §2(b).) That website is USASpending.gov. On that website, a search by “recipient” does not have an option to search for “State of Texas.” Rather, the search options individually list the Texas Workforce Commission and other Texas state agencies as separate recipients. When TWC makes an interagency pass-through contract to another state agency, TWC has always treated that other state agency as first-tier subrecipient for FFATA reporting purposes. That decision was based on guidance and interpretation of information available when the FFATA subaward reporting requirements took effect in 2010. TWC has continued in that manner with no audit finding on that approach until now. If TWC adheres to the recommendation made by this finding, the public will no longer have access to the interagency contract amounts through USASpending.gov. The USASpending.gov data presented to the public will instead indicate that the subrecipients of another state agency received subawards directly from TWC, which is inaccurate, will make the USASpending.gov data of the other state agency incomplete, and will cause the USASpending.gov data to be inconsistent with both state agencies’ presentation of those subawards in their respective systems and financial statements. In effect, the USASpending.gov data will represent the subawards of the other state agency as TWC’s subrecipients, while TWC’s systems and financial statements will have no record of those subawards beyond FFATA reporting. Similarly, the other state agency’s systems and financial statements will reflect those subawards as its own, but with no related reflection of that relationship in USASpending.gov. If the public were to submit an open records request about the subawards, the State’s response would be delayed by one state agency collecting data from the other, and inconsistent with the public’s expectation as to which state agency issued and managed those subawards. Those effects seem inconsistent with FFATA’s openness and transparency goals.

Period of Performance, Procurement, Suspension and Debarment, Reporting – Information Technology – Logical Security Federal Agency: U.S. Department of Education Federal Program Title: Rehabilitation Service – Vocational Rehabilitation Grants to States ALN: 84.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: H126A220092, H126A230092, H126A240092 October 1, 2021– September 30, 2023, October 1, 2022 – September 30, 2024, and October 1, 2023 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Workforce Commission (TWC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TWC is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: RehabWorks is TWC’s electronic case management system for the Vocational Rehabilitation program. Capabilities of the application include the ability to create service records (requisitions), generate service authorizations (purchase orders) and payment authorizations so that program expenditures are attributed to the casefile of the customer on whose behalf the goods or services were purchased in accordance with Federal regulations and the terms of the grant. During our testing of the information technology general controls of RehabWorks, we noted that TWC did not have proper segregation of duties to prevent developers of the application to promote their own changes into the production environment. Six of the 15 RehabWorks developers had access to production functions within the application. Access to migrate changes to the production environment should be restricted appropriately and based on job function to help ensure adequate internal controls are in place and appropriate segregation of duties exist. In general, developers should not have access to migrate changes to the production environment and should not have access privileges above read-only in the application. Questioned costs: None Context: See “Condition.” Cause: TWC’s information technology policies and procedures do not limit the number of developers who have access to production functions within the RehabWorks application. Effect: Failure to segregate user access may result in data loss, alteration or destruction of production data and/or disruption of operations. Repeat Finding: No Recommendation: We recommend that TWC ensure that logical access to promote code changes to production should be limited to mitigate the risk of unapproved changes being implemented in production which may result in data loss, alteration or destruction of production data and/or disruption of operations. Views of responsible officials: TWC’s IT leadership agrees with this observation.

Procurement, and Suspension and Debarment Federal Agency: U.S. Department of Education Federal Program Title: Rehabilitation Services – Vocational Rehabilitation Grants to States ALN: 84.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: H126A220092, H126A230092, H126A240092 October 1, 2021– September 30, 2023, October 1, 2022 – September 30, 2024, and October 1, 2023 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Workforce Commission (TWC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.214, recipients and subrecipients are subject to the nonprocurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, as well as 2 CFR part 180. The regulations in 2 CFR part 180 restrict making Federal awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from receiving or participating in Federal awards. Per 2 CFR 180.505 – Who uses SAM.gov Exclusions? (a) Federal agency officials use SAM.gov Exclusions to determine whether to enter into a transaction with a person, as required under § 180.430. (b) Participants also may, but are not required to, use SAM.gov Exclusions to determine if: (1) Principals of their transactions are excluded or disqualified, as required under § 180.320; or (2) Persons with whom they are entering into covered transactions at the next lower tier are excluded or disqualified. (c) The SAM.gov Exclusions are available to the general public. Condition: TWC’s Procurement and Contract Management Handbook (Revised April 2024) states that vendor compliance verifications include checking the Comptroller’s vendor performance tracking system, debarment, federal database checks and other verifications. A vendor that fails a verification may not move forward in the evaluation process and receive a contract award. Audit procedures included testing 34 procurements during the fiscal year to test whether vendor compliance verifications were completed prior to entering into a covered transaction. During our testing, we noted the following instances of noncompliance:  For one procurement, the vendor compliance verification was completed for the incorrect vendor. A search was completed for the director of the organization rather than the legal entity name.  For four of the procurements, a valid date stamp was not available to confirm the verification was completed prior to entering into a covered transaction. Questioned costs: None Context: See “Condition.” Cause: Individuals performing the vendor compliance checks were not adequately trained on the requirements and timeline that must be adhered to per TWC’s Procurement and Contract Management Handbook and federal guidelines. Effect: Failure to complete proper vendor compliance checks prior to entering into a covered transaction may lead to entering into contracts with suspended or disbarred vendors that could result in noncompliance and questioned costs. Repeat Finding: No Recommendation: We recommend that TWC provide additional training to individuals performing vendor compliance checks. We also recommend TWC establish internal controls to monitor that vendor compliance checks are being completed accurately and timely. Views of responsible officials: TWC’s Procurement and Contract Management (PCS) agrees with the recommendations.

Equipment and Real Property Management Federal Program Title: Research and Development Cluster Federal Agency: U.S. Department of Defense; National Science Foundation; and U.S. Department of Health and Human Services Assistance Listing Number: See below Pass-Through Agency: Texas A&M University Health Science Center; and Harvard University Award Number: See below Award Period: See below Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No A recipient’s property records for equipment acquired with federal funds must be maintained accurately and include all of the following: a description of the equipment; serial number or other identification number; the source of funding for the equipment, including the federal award identification number; indication of who holds the title; acquisition date; cost of the equipment; the percentage of federal participation in the cost of the equipment; the location, use, and condition of the equipment; and ultimate disposition data, including the date of disposal and sale price (Title 2, Code of Federal Regulations (CFR), Section 200.313(d)(1)). A control system must be developed to ensure that adequate safeguards are in place to prevent loss, damage, or theft of the equipment. Any loss, damage, or theft must be investigated (Title 2, CFR, Section 200.313(d)(3)). The Engineering Experiment Station did not maintain accurate and complete property records for 3 (5 percent) of 63 equipment items tested. Specifically:  For two items, the property records contained incorrect locations. The errors occurred because the Engineering Experiment Station either (1) did not enter property records accurately and completely into its asset management system or (2) did not always follow its policies and procedures to update property records as needed.  The Engineering Experiment Station was not able to locate one item selected for testing. As a result, the institution could not demonstrate that the item was properly safeguarded. After auditors brought the issue to the Engineering Experiment Station’s attention, the institution filed a missing or stolen property report. Not maintaining accurate and complete property records and not adequately safeguarding equipment increases the risk that equipment may be misused, lost, or stolen. The following awards were affected by the equipment issues discussed above: See chart or table in the Schedule of Findings and Questioned Costs. Recommendation: The Engineering Experiment Station should strengthen controls to ensure that it:  Maintains accurate and complete property records for all equipment acquired with federal funds.  Adequately safeguards its equipment to prevent loss or theft of equipment. Views of Responsible Officials: The Texas A&M Engineering Experiment Station (TEES) acknowledges and agrees with the finding. TEES will work to develop and implement corrective action to further improve processes.

Equipment and Real Property Management Federal Program Title: Research and Development Cluster Federal Agency: U.S. Department of Defense; National Aeronautics and Space Administration; National Science Foundation; U.S. Department of Energy; and U.S. Department of Health and Human Services Assistance Listing Number: See below Pass-Through Agency: Southern States Energy Board; and Universities Space Research Association Award Number: See below Award Period: See below Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: 2021-103, 2018-109, 2015-134, 2014-155, 2013-176, 13-161, and 12-170 A recipient’s property records for equipment acquired with federal funds must be maintained accurately and include all of the following: a description of the equipment; serial number or other identification number; the source of funding for the equipment, including the federal award identification number; indication of who holds the title; acquisition date; cost of the equipment; the percentage of federal participation in the cost of the equipment; the location, use, and condition of the equipment; and ultimate disposition data, including the date of disposal and sale price (Title 2, Code of Federal Regulations (CFR), Section 200.313(d)(1)). A control system must be developed to ensure that adequate safeguards are in place to prevent loss, damage, or theft of the equipment. Any loss, damage, or theft must be investigated (Title 2, CFR, Section 200.313(d)(3)). In addition, The University of Texas at Austin’s (University) Handbook of Business Procedures requires that a university inventory barcode (asset tag) be affixed to capitalized or controlled equipment items and the required information be submitted to Inventory Services for processing within 30 days of receipt of equipment. The University did not maintain accurate and complete property records for 12 (19 percent) of 63 equipment items tested. For one item discussed below, the property record contained multiple errors. Specifically:  For six items, the property records contained either no or incorrect serial numbers. Additionally, for two of those items the asset tag numbers located on the items did not match the asset tag numbers in the property records.  For four items, the property records contained incorrect locations. For three of those items, the locations in the property records did not match the current on-campus locations. For the other item, the location in the property record was not updated to indicate that the item had been relocated to Hawaii.  For two items, the property records contained generic default information because the University did not follow its policy to submit the required information to Inventory Services for processing within 30 days of receipt of items.  For one item, the property record indicated the item was in service. However, the item was transferred to the sponsor and the status was not updated in the property record. Those errors occurred because the University either (1) did not enter property records accurately and completely into its asset management system or (2) did not always follow its policies and procedures to update property records as needed. The University relies on unit administrators within each department to provide the required information in the equipment property records. In addition, the University did not follow its process to affix an asset tag for 6 (10 percent) of 61 equipment items tested. Specifically:  For three items, the asset tags were affixed by the University at the time of testing.  For two items, the asset tags could not be located.  For one item, the asset had been relocated to Hawaii and the University could not provide evidence to demonstrate that the asset was appropriately tagged and adequately safeguarded. Not maintaining accurate and complete property records and not adequately safeguarding equipment increases the risk that equipment may be misused, lost, or stolen. The following awards were affected by the equipment issues discussed above: See chart or table in the Schedule of Findings and Questioned Costs. Recommendation: The University should strengthen its controls to ensure that it:  Maintains accurate and complete property records for all equipment acquired with federal funds.  Adequately safeguards its equipment to prevent loss or theft of equipment.  Appropriately affixes asset tags to equipment in accordance with its policies and procedures. Views of Responsible Officials: The University acknowledges and agrees with the audit findings. The University will work with the individual departments to improve their understanding of inventory policies and procedures and stress the importance of maintaining accurate records.

Equipment and Real Property Management Federal Program Title: Research and Development Cluster Federal Agency: U.S. Department of Defense; and U.S. Department of Health and Human Services Assistance Listing Number: See below Pass-Through Agency: N/A Award Number: See below Award Period: See below Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: 2021-105 A recipient’s property records for equipment acquired with federal funds must be maintained accurately and include all of the following: a description of the equipment; serial number or other identification number; the source of funding for the equipment, including the federal award identification number; indication of who holds the title; acquisition date; cost of the equipment; the percentage of federal participation in the cost of the equipment; the location, use, and condition of the equipment; and ultimate disposition data, including the date of disposal and sale price (Title 2, Code of Federal Regulations (CFR), Section 200.313(d)(1)). The University of Texas Health Science Center at San Antonio (Health Science Center) did not maintain accurate property records for 4 (6 percent) of 62 equipment items tested. Specifically:  For three items, the property records contained incorrect locations. For the first item, the location was not updated when it was moved during a renovation. For the second item, the location was not updated when the department moved to a different floor in the building. For the third item, the property record did not reflect the item’s current location. These errors occurred because the Health Science Center staff responsible for the equipment did not update the property control department when the items were moved.  For one item, the property record contained an incorrect serial number due to a manual entry error. Not maintaining accurate and complete property records increases the risk that equipment may be misused, lost, or stolen. The following awards were affected by the equipment issues discussed above: See chart or table in the Schedule of Findings and Questioned Costs. Recommendation: The Health Science Center should strengthen controls to ensure that it maintains accurate property records for all equipment acquired with federal funds. Views of Responsible Officials: UT Health-San Antonio acknowledges and agrees with the finding.

General Controls. The following compliance areas were impacted: Activities Allowed or Unallowed Allowable Costs/Cost Principles Cash Management Equipment and Real Property Management Period of Performance Procurement and Suspension and Debarment Subrecipient Monitoring Special Tests and Provisions – Key Personnel Federal Program Title: Research and Development Cluster Federal Agency: Federal agencies that award Research and Development Cluster funds Assistance Listing Number: Multiple Pass-Through Agency: N/A Award Number: Multiple Award Period: Multiple Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas Medical Branch at Galveston (Medical Branch) did not appropriately maintain certain systems it uses to manage its federal research and development awards. The Medical Branch asserted that the maintenance was postponed as the institution was evaluating the most effective approach for implementing certain upgrades. Not ensuring that systems are updated and supported increases the risk of data loss or security breaches. After auditors brought the issue to the institution’s attention, the Medical Branch asserted that the appropriate maintenance was obtained. Recommendation: The Medical Branch should ensure that all systems used to manage federal awards are appropriately maintained and supported. Views of Responsible Officials: Management agrees with the auditor’s recommendation. Through analysis of the exceptions identified in the audit, the University implemented corrective action to reinstate maintenance and support.

Equipment and Real Property Management Federal Program Title: Research and Development Cluster Federal Agency: U.S. Department of Defense; and U.S. Department of Health and Human Services Assistance Listing Number: See below Pass-Through Agency: VaxDesign Award Number: See below Award Period: See below Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No A recipient’s property records for equipment acquired with federal funds must be maintained accurately and include all of the following: a description of the equipment; serial number or other identification number; the source of funding for the equipment, including the federal award identification number; indication of who holds the title; acquisition date; cost of the equipment; the percentage of federal participation in the cost of the equipment; the location, use, and condition of the equipment; and ultimate disposition data, including the date of disposal and sale price (Title 2, Code of Federal Regulations (CFR), Section 200.313(d)(1)). A control system must be developed to ensure that adequate safeguards are in place to prevent loss, damage, or theft of the equipment. Any loss, damage, or theft must be investigated (Title 2, CFR, Section 200.313(d)(3)). The Medical Branch did not maintain accurate property records for 3 (5 percent) of 61 equipment items tested. Specifically:  For two items, the property records contained incorrect locations. For one item, the location in the property record did not match the current location. For the second item, the location in the property record was not updated with the new room number after a renovation was completed.  For one item, the property record contained a serial number that was recorded incorrectly. In addition, the Medical Branch was unable to locate 8 (13 percent) of 61 equipment items selected for physical inspection. The Medical Branch asserted that the items were transferred to a surplus warehouse in preparation for disposal. However, the Medical Branch was not able to locate those items for testing because it did not have a process in place to track items in the warehouse. As a result, the Medical Branch was not able to demonstrate that those items were adequately safeguarded. Not maintaining accurate and complete property records and not adequately safeguarding equipment increases the risk that equipment may be misused, lost, or stolen. The following awards were affected by the issues discussed above: See chart or table in the Schedule of Findings and Questioned Costs. Two awards were affected by the issues discussed above; however, due to the age of the assets, the award information was no longer available. Recommendation: The Medical Branch should strengthen controls to ensure that it:  Maintains accurate and complete property records for all equipment acquired with federal funds.  Adequately safeguards and tracks all equipment sent to its surplus warehouse until appropriate disposition of that equipment. Views of Responsible Officials: Management agrees with the auditor’s recommendation.

Equipment and Real Property Management Federal Program Title: Research and Development Cluster Federal Agency: U.S. Department of Defense; National Aeronautics and Space Administration; National Science Foundation; and U.S. Department of Health and Human Services Assistance Listing Number: 12.000; 43.000; 47.000; and 93.000 Pass-Through Agency: University of Washington; Northwestern University; University of Toronto; The University of Texas at Arlington; Duke University Medical Center; Medical College of Wisconsin; Rogosin Institute Centers for Medical Research; University of Pittsburgh; Mayo Clinic; University of Pennsylvania; Yale University; University of California, San Diego; and University of Southern California Award Number: Multiple Award Period: Multiple Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No A recipient must conduct a physical inventory of equipment and reconcile the results with its property records at least once every two years (Title 2, Code of Federal Regulations (CFR), Section 200.313(d)(2)). A control system also must be developed to ensure that adequate safeguards are in place to prevent loss, damage, or theft of equipment. Any loss, damage, or theft of equipment must be investigated (Title 2, CFR, Section 200.313(d)(3)). Based on an analysis of a population of 1,330 federal assets, The University of Texas Southwestern Medical Center (Medical Center) did not perform a physical inventory for 257 (19 percent) of those items as required. Although the Medical Center had a process in place to monitor the most recent date each asset was inventoried, the process was not sufficient to ensure a complete physical inventory of all assets was conducted at least once during fiscal years 2023 and 2024. Not performing a biennial inventory of all assets increases the risk that equipment purchased with federal funds may be lost, stolen, or improperly disposed. Recommendation: The Medical Center should strengthen controls to ensure that a complete physical inventory of equipment is conducted at least once every two years. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2301TXTANF, 2301TXTAN3, 2201TXTANF, 2201TXTAN3, 2101TXTANF, 2101TXTAN3 October 1, 2022 – September 30, 2023, October 1, 2021 – September 30, 2022, and October 1, 2020 – September 30, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to United States Codes, Chapter 8 Aliens and Nationality, Chapter 14 – Restricting Welfare and Public Benefits of Aliens, §1611 Aliens who are not qualified aliens ineligible for Federal public benefits is as follows: (a) In general notwithstanding any other provision of law and except as provided in subsection (b), an alien who is not a qualified alien (as defined in section 1641 of this title) is not eligible for any Federal public benefit (as defined in subsection (c)). Condition: According to the DFPS’s Child Protective Services Handbook 2720 Responding to the Eligibility Statements CPS June 2020, IMPACT automatically makes the Emergency Assistance (EA) Eligibility Application/Determination section available when the caseworker completes the Risk Assessment tool and the risk level is ‘high’ or ‘very high.’ The caseworker completes this section, which contains three statements that each require a response of ‘YES’ in order for the child to be eligible for EA benefits. For one of 40 payments to program participants, we noted one of the three statements was answered ‘NO’ in IMPACT, which should have resulted in the determination that the child does not meet the emergency assistance eligibility criteria. However, the child and family were technically eligible for EA at closure of the investigation stage based on documentation. DFPS’s sandbox database reflects a conclusion that the child does meet the emergency assistance eligibility criteria indicating that the three statements had a response of ‘yes ‘at the time of stage closure. However, we were unable to verify a response of ‘yes’ for all three statements in IMPACT. Additionally, during our testing of 40 individual payments to program participants, we noted one participant being eligible based on the EA eligibility criteria in IMPACT. However, the child was not a U.S. citizen, qualified alien, or permanent resident and was ineligible to receive EA benefits. Questioned costs: $842.18. Context: See “Condition.” Cause: Exception related to statements in IMPACT was caused by system limitations. Exceptions related to eligibility determinations were due to management oversight. Effect: Failure to review and maintain accurate information may result in payments made to ineligible participants or overpayments to eligible participants. Repeat finding: 2022-002 Recommendation: DFPS should strengthen its internal controls and remedy system limitations to ensure accurate data is maintained in IMPACT. DFPS should also strengthen its internal controls over eligibility determinations. Views of responsible officials: DFPS acknowledges the incorrect EA Eligibility Determination was marked for question #2 in the EA Eligibility Application/Determination section in IMPACT. The caseworker marked no, but the answer should have been marked yes. Despite this system-generated discrepancy, interviews with family that were documented in the investigation report, did confirm the child was genuinely eligible for Emergency Assistance (EA). Notably, the child did not receive funding during the initial year but was later deemed eligible upon recertification a year later, without a clear understanding of the root cause for why the child was determined to be eligible at recertification. Citizenship: DFPS acknowledges the child was determined to be Emergency Assistance (EA) eligible based on (EA) eligibility criteria in IMPACT. DFPS also agrees the child was a not a US Citizen and therefore was not eligible to receive EA Benefits.

Special Tests and Provisions – Control, Accountability, and Safeguarding of Vaccines and Special Tests and Provisions – Record of Immunization – Information Technology – User Access Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Immunization Cooperative Agreements ALN: 93.268 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6 NH23IP922616 July 1, 2019 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: DSHS utilizes the Child Health Reporting System (CHRS) to track immunizations for childcare, daycares, and colleges. Providers that administer immunizations upload required information into the system for DSHS to meet reporting requirements. During our testing, we noted that the user provisioning process for CHRS does not require formal documentation for requesting and approving system access. Questioned costs: None. Context: See “Condition.” Cause: DSHS does not have established policies and procedures that require a formal request and approval for system access to CHRS. Effect: Failure to complete formal requests and approvals for system access increases the risk of unauthorized users and suspicious activities that may not be identified and investigated. Repeat finding: 2020-027 Recommendation: We recommend that DSHS implement enhanced procedures to ensure that new hire provisioning procedures are approved before access is granted. Views of responsible officials: The remaining portion of this prior year finding addresses only CHRS. CHRS is a system currently used by public and private schools to enter non-confidential, aggregate data eventually posted to the internet as part of the Annual Report of Immunizations Status. Within DSHS, internal CHRS users are from the Infectious Disease Prevention Division and the Vision, Hearing, Spinal Screening (VHSS) program within the Community Health Improvement Division. Access for these users is provisioned as part of the DSHS new hire process. Because CHRS does not contain confidential information, Immunization and VHSS staff want to make the process for schools to enter aggregate data as uncomplicated as possible.

Special Tests and Provisions – Control, Accountability, and Safeguarding of Vaccines Special Tests and Provisions – Record of Immunization Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Immunization Cooperative Agreements ALN: 93.268 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6 NH23IP922616 July 1, 2019 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Texas Vaccines for Children (TVFC) staff perform compliance visits to assess, support, and educate the site regarding TVFC policies and procedures. Compliance visits must be directly entered in PEAR while the review is being conducted. At the conclusion of a compliance visit, the DSHS Public Health Region (PHR) or Quality Assurance (QA) contractor reviewer must discuss the visit’s outcomes with the vaccine coordinator. The discussion must include a review of the site visit findings and a formal follow-up plan with a timeline addressing noncompliance issues or opportunities for improvement. Monthly reports are run from PEAR to ensure all provider audits are being conducted within a 24-month timeframe. When pulling the monthly report of issues/deficiencies, TVFC staff also review to see that follow-up activities have been completed on time. During fiscal year 2023, review and verification of follow up activities for site reviews conducted by TVFC staff were not formally documented. Thus, we were unable to verify that the reviews were being conducted. Questioned costs: Unknown. Context: See “Condition.” Cause: Internal controls surrounding the site visits conducted are not formally documented. Effect: Lack of formal documentation of reviews may result in missed follow-up actions and potential noncompliance. Repeat finding: No Recommendation: TVFC staff should formally document the review of site visit results, including any relevant follow-up actions, to retain documentation of compliance. Views of responsible officials: DSHS agrees formal documentation of TVFC site visits and site-visit reviews would improve the process.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Homeland Security Federal Program Title: Disaster Grants-Public Assistance (Presidentially Declared Disasters) ALN: 97.036 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: FEMA-4332-DR, FEMA-3540-DR, FEMA-4485-DR, FEMA-4586-DR 2017, 2020, 2020, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The Federal Emergency Management Agency (FEMA) evaluates the eligibility of all costs claimed by the applicant. Not all costs incurred as a result of the incident are eligible. Chapter 4 of the Public Assistance Program and Policy Guide states that to be eligible, costs must be:  Directly tied to the performance of eligible work.  Adequately documented.  Reduced by all applicable credits, such as insurance proceeds and salvage values. Authorized and not prohibited under federal, state, territorial, tribal, or local government laws or regulations.  Consistent with applicant’s internal policies, regulations, and procedures that apply uniformly to both federal awards and other activities of the applicant; and  Necessary and reasonable to accomplish the work properly and efficiently. Condition: Audit procedures included a sample of 60 expenditures, totaling $97,118,451, incurred during the fiscal year to validate allowability with the grant award. DSHS was unable to provide the project worksheets for seven out of the 60 samples, totaling $1,878,609. Thus, we were unable to verify that the costs were allowable per the project worksheets. For eight samples, totaling $561,562, the project worksheets associated with the transactions were not approved. Questioned costs: $2,440,171. Context: See “Condition.” Cause: FEMA project worksheets from the Texas COVID pandemic remain open. DSHS is continually adding and removing invoices from its claims with FEMA as final expenditures are deemed eligible and ineligible by FEMA and claims are reimbursed. Five of the invoices reported on the schedule of expenditures of federal awards and submitted for reimbursement were originally under a project worksheet but later withdrawn by DSHS as updated FEMA policies deemed certain costs ineligible. As a result, these transactions were no longer associated with a project worksheet at the time of audit fieldwork. Additionally, two invoices reported on the schedule of expenditures of federal awards had not been submitted to FEMA for reimbursement and do not have project worksheets associated with them at the time of audit fieldwork. Additionally, expenditures reported on the schedule of federal awards are not reconciled to allowable costs after ineligible expenditures are identified. Effect: Amounts reported on the schedule of expenditures of federal awards that are not reconciled to underlying allowable costs may result in disallowed costs. Repeat finding: No Recommendation: We recommend DSHS reconcile all program expenditures, whether they have been incurred, submitted for reimbursement, or reimbursed, to determine the amount to report on the schedule of expenditures of federal awards. Expenditures deemed to be ineligible subsequent to fiscal year end should be removed from the reported amount. Views of responsible officials: During the COVID-19 pandemic, DSHS’ primary focus was getting resources where they were needed most. The intensity of the pandemic resulted in significantly increased workloads and a need for rapid response. DSHS previously identified the need to review expenditures and ensure costs are allowable and align with required parameters. Because of the shifting of FEMA eligibility criteria over time, we agree that modifications are needed to ensure transactions comply with the most recent guidance.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Reporting – Information Technology – Password Configuration Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii ALN: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Various Various Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: MIP is GLO’s accounting application that serves as the agency’s system of record for budget, payroll, cash transactions, accounts receivable, and accounts payable. During our testing, we noted that Active Directory password configurations and the MIP lockout configurations do not adhere to the password policy defined in GLO’s Identification and Authentication policies or defined best practices. Questioned costs: None. Context: See “Condition.” Cause: GLO did not have processes in place to enforce password policies as outlined in the agency’s Identification and Authentication policies. Effect: Failure to follow GLO’s password policy increases the risk of inappropriate access. Repeat finding: No Recommendation: We recommend GLO update their password settings to align with the agency’s password policy. Views of responsible officials: We concur with the finding and the recommendation. Of note is that MIP is a standalone system and doesn’t provide the same password complexity and lockout capability that Active Directory offers, so we will address these individually. The risk associated with not having this same capability in the MIP system is somewhat mitigated by MIP being a system that is only available on-premises or via VPN with a valid Active Directory account.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Reporting – Information Technology – User Access Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii ALN: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Various Various Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Community Development and Revitalization (CDR) division of GLO uses TIGR as its primary grant management system of record. It is used to manage and process CDBG-DR and CDBG-MIT grant transactions. During our testing, we noted one of 13 terminations selected for testing did not have their Active Directory and TIGR access revoked upon termination in accordance with GLO’s Account Management policies, which state: 1.8 All access accounts established for contractors, consultants, vendors, and maintenance accounts must be disabled immediately upon termination or completion of the contract period. 1.9 In the event of involuntary termination of users, access must be removed or disabled prior to or at the same time the user is notified of the termination. The employee was terminated on July 5, 2023, however, their access was not removed. Subsequent to audit procedures, management terminated access to the Active Directory on September 25, 2023, and TIGR on September 28, 2023. Management was unable to provide evidence to support that neither system had been accessed between the date of the termination and the date that the system access was removed. We also noted that while management affirmed that a privileged user access review was completed for Active Directory accounts, there was no evidence maintained of the completion date, who the review was performed by, or frequency of review. Questioned costs: None. Context: See “Condition.” Cause: The exception related to the terminated employee was caused by a delay in communication between multiple departments within GLO. The exception related to user access reviews was caused by GLO not maintaining adequate documentation. Effect: Failure to disable and archive accounts for users that have been terminated increases the risk of inappropriate access and noncompliance. Failure to maintain adequate documentation of user access reviews may result in omission of steps in the review process. Repeat finding: No Recommendation: We recommend GLO enhance the existing process to allow for timely communication of terminated employees. Additionally, we recommend GLO develop a policy that outlines the documentation of user access reviews. Views of responsible officials: We concur with the finding and the recommendation and will take action to address the concerns.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii ALN: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: B-18-DP-48-0002 January 12, 2021 – January 12, 2033 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: GLO’s Contract Department determines subawards that are required to be reported in FSRS under FFATA reporting requirements. These subawards are subsequently provided to GLO’s Federal Finance and Grants Management to report in FSRS. During our testing, we noted the following exceptions: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None. Context: See “Condition.” Cause: Subawards were inadvertently omitted from the information provided to Federal Finance and Grants Management resulting in untimely submission. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Repeat finding: No Recommendation: We recommend that management establish standard operating procedures in order to guarantee accurate support and timely communication between departments to ensure timely submission of required reports. Views of responsible officials: We agree that two sub-awards were inadvertently omitted from the information provided to Federal Finance and Grants Management, resulting in an untimely submission.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Allowable Costs/Cost Principles – Cost Allocations, Matching, Level of Effort, Earmarking (CHIP Only) Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) Children’s Health Insurance Program (CHIP) Block Grants for Community Mental Health Services (MHBG) Block Grants for Prevention and Treatment of Substance Abuse (SABG) Medicaid Cluster Aging Cluster (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 10.557 93.558 93.667 93.767 93.958 93.959 93.775, 93.777, 93.778 93.044, 93.045, 93.053 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: WIC 6TX700527, 6TX700507 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2022 – September 30, 2024 TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 CHIP 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01 6B08TI083478- 01M002, 6B08TI083478-01M003, 6B08TI083478-01M004 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC’s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. HHSC experienced significant delays in updating factors. By the end of the fiscal year, cost allocations had been updated only through August 2022. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2023 when the costs for four of 40 sample allocations tested in the CHIP program were allocated using a rate other than the current one in effect resulting in noncompliance with matching requirements. Questioned costs: Unknown Context: See “Condition.” Cause: HHSC’s General Ledger Unit is responsible for cost allocations. At the start of fiscal year 2023, the Unit suffered a loss of more than half of its staff due to turnover. Additionally, the current Federal Medical Assistance Percentage (FMAP) rates were in a stepdown process whereby the rate changed quarterly as opposed to yearly which intensified the workload. In addition, since transformation, the number of Public Assistance Cost Allocation Plan (PACAP) methodologies (Project IDs) has increased by 243%. These methodologies have become increasingly more complex, now including over 80 dependent factors of which some comprise more than 100 fund sources each. This huge increase in both volume and complexity has greatly increased calculation labor and risk of error. Effect: Failure to update factor allocations timely can result in questioned costs. Repeat finding: 2022-010, 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should allocate adequate resources to ensure factor allocations are performed and reallocations are updated timely in order to present accurate information. Views of responsible officials: HHSC concurs with the finding.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.558 93.667 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM083999-01M001, 6B09SM083830-01M001 October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01M003 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat finding: 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC agrees with the finding but does not concur with the recommendation insofar as it makes a specific designation of CAPPS-Financials as the system to ensure compliance.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes:  Subrecipient’s unique entity identifier (UEI)  Federal award identification number (FAIN)  Federal award date of award to the recipient by the federal agency  Assistance listings number and title  Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include:  UEI (one sample)  FAIN (four samples)  Federal award date (four samples)  Assistance listings numbers and title (four samples)  Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.

Special Tests and Provisions – Penalty for Refusal to Work Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 261.14, if an individual refuses to engage in work required under section 407 of the Act, the State must reduce or terminate the amount of assistance payable to the family, subject to any good cause or other exceptions the State may establish. Such a reduction is governed by the provisions of § 261.16. The State must, at a minimum, reduce the amount of assistance otherwise payable to the family pro rata with respect to any period during the month in which the individual refuses to work. The State may impose a greater reduction, including terminating assistance. A State that fails to impose penalties on individuals in accordance with the provisions of section 407(e) of the Act may be subject to the State penalty specified at § 261.54. The State’s policy is to reduce benefits 100% for non_x0002_cooperation. Condition: HHSC works with the Texas Workforce Commission (TWC) to administer the CHOICES program at the Texas Local Workforce Development Boards (Workforce Boards). TWC sends sanctions initiated by the Workforce Boards to HHSC within seven calendar days of the date of non-cooperation. Subsequently, HHSC has five working days to process and apply the sanction as per policy. A sample of 40 beneficiaries who should have had their benefits reduced was selected for review, which resulted in the following:  For two cases, the benefits were not reduced timely by one month, resulting in an overpayments of $654.  For one case, the benefits were not reduced timely by three months, resulting in an overpayment of $1,179. Questioned costs: $1,833. Context: See “Condition.” Cause: Upon receipt of the sanctions from TWC, HHSC did not apply them within the timeline set by policy. Effect: Non-cooperating beneficiaries received TANF benefit payments they were not entitled to. Repeat finding: No Recommendation: Sanction requests should be applied timely per policy to ensure ineligible beneficiaries do not receive benefits. Views of responsible officials: HHSC concurs with the finding.

Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant ALN: 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass_x0002_through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. Title 42 USC 1397e requires states and territories to submit to the federal administering agency, the Office of Community Services, an annual Post Expenditure Report no later than six months following the close of the fiscal year. The report includes certain critical key line information including: 1. The number of eligible individuals who received services paid for in part or in whole with federal funds under the SSBG. 2. The amount of Social Services Block Grant funds spent in providing each service. Condition: During testing of key line items noted above in the FY2022 Annual Post Expenditure Report submitted in March 2023, we noted the following variances between the amounts reported and supporting documentation: Key Line Item 1 Children  Family Planning Services – variance of 1,796  Prevention and Intervention – variance of 9,866  Protective Services – Children – variance of 13,511 Adults Age 59 Years and Younger  Family Planning Services – variance of 107,476  Prevention and Intervention – variance of 19,398  Protective Services – Adults – variance of 21,973  Other Services – variance of 10,733 Adults Age 60 Years and Older  Family Planning Services – variance of 4,549  Prevention and Intervention – variance of 868  Protective Services – Adults – variance of 71,969  Other Services – variance of 14,408 Adults of Unknown Age  Prevention and Intervention – variance of 151 Key Line Item 2 SSBG Allocation  Foster Care Services – Children – variance of ($77,124)  Information & Referral – variance of $2,116  Protective Services – Adults – variance of ($59,467)  Protective Services – Children – variance of ($114,243) Funds Transferred into SSBG  Protective Services – Children – variance of ($6,948,063) Expenditures of All Other Federal, State, and Local Funds  Family Planning Services – variance of $172,504,171  Foster Care Services – Children – variance of $674,230,152  Information & Referral – variance of $35,508,405  Protective Services – Adults – variance of $67,694,139  Protective Services – Children – variance of $1,145,408,512  Other Services – $171,788,478 Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure the completeness and accuracy of the report. Additionally, HHSC did not follow current policies and procedures regarding record retention. More specifically, all variances listed for key line item 1 were due to lack of supporting documentation except for the Protective Services – Children variance of 13,511, which was the difference between amounts reported and supporting documentation provided. All variances for key line item 2 were due to lack of supporting documentation except the four amounts listed under SSBG Allocation, which are a result difference between amounts reported and supporting documentation provided. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. In addition, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend management revise its internal controls to reconcile expenditures reported on federal reports to federal expenditures in the general ledger. Additionally, HHSC should implement or revise policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Children’s Health Insurance Program (CHIP) ALN: 93.767 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control):  Ninety days for applicants who apply for Medicaid on the basis of disability; and  Forty-five days for all other applicants. Condition: Audit procedures included a review of 40 CHIP eligibility applications submitted by fiscal year 2023 for benefit recipients to determine whether the eligibility determination was made within 45 days. Of the 40 applications, we identified eight applications for which the eligibility determination was not made within 45 days. The eligibility determinations of these eight applications were made within 46-75 days of the submission date and did not have an administrative or other emergency circumstance. Questioned costs: None. Context: See “Condition.” Cause: Current policies and procedures surrounding the timely processing of benefit applications are not being properly implemented. Effect: Failure to process CHIP applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat finding: No Recommendation: HHSC should enforce existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timeline. Views of responsible officials: HHSC concurs with the finding.

Special Tests and Provisions – Provider Eligibility – Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Children’s Health Insurance Program ALN: 93.767 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance. Criteria or specific requirement: Per 2 CFR 200.303, a non-Federal entity must: Establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: § 455.104 – HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures:  The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address.  Date of birth and Social Security Number (in the case of an individual).  Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest.  Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling.  The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest.  The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). § 455.105 – HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request:  The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and  Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. § 455.106 – Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who:  Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and  Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. § 455.410 – HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. § 455.412 – HHSC must:  Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State.  Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. § 455.414 – HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. § 455.432 – HHSC must:  Conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program.  Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. § 455.434 – HHSC must:  Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.  Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. o Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. § 455.436 – HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. § 455.434 – HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 60 providers for CHIP, which resulted in one exception for the following:  A copy of the completed application was not included in the file.  Enrollment of the provider was not completed within the last 5 years.  Verification of the provider’s license was not included in the file.  Required information on ownership and control was not disclosed.  Supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk.  A copy of the provider agreement was not included in the files.  Supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk.  Supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: None. Context: See “Condition.” Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving CHIP funds. Repeat Finding: No Recommendation: HHSC should implement controls to ensure:  Documentation is maintained for at least the length of the providers’ current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334.  Provider licenses are verified during enrollment.  Providers are re-enrolled at least once every five years.  Provider agreements are obtained, and the proper disclosures are made.  Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk.  Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in CHIP. Views of responsible officials: HHSC concurs with the finding.

Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1B09SM087345, 6B09SM087345, 1B09SM087322-01 October 1, 2022 – September 30, 2024, October 17,2022 – October 16, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to § 200.308(e)(3). Condition: For projects with period of performance beginning dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the first month of the award. We noted the following instances of noncompliance:  For the two sampled transactions, totaling $56,997, one of the expenditures, totaling $31,254, was related to costs incurred prior to the period of performance begin date. Questioned costs: $31,254. Context: See “Condition.” Cause: Current controls are not at the correct precision level to detect costs charged outside of the period of performance. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. Repeat finding: No Recommendation: HHSC should enhance and/or modify existing controls to ensure that costs charged to a project have service dates within the period of performance stated in the federal award. Views of responsible officials: HHSC concurs with the finding.

Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster CFDA Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid, which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. HHSC did not perform risk assessments over the remaining 57 systems during the two-year period. Questioned costs: None. Context: See “Condition.” Cause: HHSC is not adhering to its’ current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: No Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.

Special Tests and Provisions – Provider Eligibility – Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, a non-Federal entity must: Establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: § 455.104 – HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures:  The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address.  Date of birth and Social Security Number (in the case of an individual)  Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest.  Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling.  The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest.  The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). § 455.105 – HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request:  The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and  Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. § 455.106 – Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who:  Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and  Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. § 455.410 – HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. § 455.412 – HHSC must:  Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State.  Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. § 455.414 – HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. § 455.432 – HHSC must:  Conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program.  Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. § 455.434 – HHSC must:  Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.  Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. o Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. § 455.436 – HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. § 455.434 – HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 60 providers each for Medicaid, which resulted in the following (sampled exceptions noted in parentheses):  A copy of the completed application was not included in the file. (9 providers)  Enrollment of the provider was not completed within the last 5 years. (7 providers)  Verification of the provider’s license was not included in the file. (7 providers)  Required information on ownership and control was not disclosed. (11 providers)  Supporting documentation was not included in the file indicating the provider consented to a criminal background check. (9 providers)  Supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. (13 providers)  A copy of the provider agreement was not included in the files. (13 providers)  Supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. (13 providers)  Supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. (9 providers) Questioned costs: None. Context: See “Condition.” Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat finding: 2022-014, 2021-008 Recommendation: HHSC should implement controls to ensure:  Documentation is maintained for at least the length of the providers’ current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334.  Provider licenses are verified during enrollment.  Providers are re-enrolled at least once every five years.  Provider agreements are obtained, and the proper disclosures are made.  Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk.  Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: HHSC concurs with this repeat finding.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Earmarking, Procurement, Suspension and Debarment, Reporting – Information Technology – Change Management Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: System changes that were applied to the production Texas Travel Industry Recovery Grant Program (TTIR) environment were not documented in accordance with appropriate change management procedures. We were unable to verify that changes were requested, approved, and segregation of duties existed within the process for five of the five samples selected for testing. Questioned costs: None. Context: See “Condition.” Cause: OOG currently utilizes emails and Microsoft Teams messages to transmit information during the change management process request and approval process. However, documentation from these methods was not retained. Effect: Failure to formally document system changes could result in undocumented or unauthorized changes to the application. Repeat finding: No Recommendation: We recommend formally documenting and retaining the request and approval of all changes related to the TTIR application. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the documented evidence of Change Management execution is insufficient. While the change management procedure is in practice cohesive and in continued use, the documentation of such and evidence of the repeatability thereof, is insufficient for the Texas Travel Industry Recovery Grant Program (TTIR) Portal.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Earmarking, Procurement, Suspension and Debarment, Reporting – Information Technology – Logical Access Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: OOG did not perform a documented periodic access review of users for the eGrants application, which would include a review of privileged users’ access during the fiscal year. Questioned costs: None. Context: See “Condition.” Cause: Management’s timeline to complete the user access review was delayed. Effect: Failure to perform user access reviews in a timely manner could result in undetected inappropriate access or inappropriate changes to the application. Repeat finding: No Recommendation: We recommend that OOG enforce current policies and procedures in relation to eGrants to complete timely user access reviews and document the results. The user access review should include a review of all privileged accounts on a periodic basis to verify that all active accounts are supported by a business purpose. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the OOG did not perform a documented periodic access review of users for the eGrants application, which would include a review of privileged users’ access during the fiscal year.

Reporting Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and NoncomplianceCriteria or specific requirement: Per 2 CFR section 200.303(a), the a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Compliance and Reporting Guidance Version 5.0, for purposes of reporting in the SLFRF portal, an obligation is an order placed for property and services, contracts and subawards made, and similar transactions that require payment. Condition: OOG is the prime recipient of SLFRF funds for the State of Texas. Per Senate Bill 8, funds are passed through to other state agencies to expend on programs established by the Senate Bill. On a quarterly basis, OOG receives ‘Agency Reconcilers’ from each state agency with reported amounts for each of their respective programs per Senate Bill 8 in order to prepare the state-wide Project and Expenditure Report. Audit procedures included testing of the December 31, 2022 and March 31, 2023 Project and Expenditure Reports, which combined Agency Reconcilers for 33 programs and 41 programs, respectively. We compared the amounts reported on the Project and Expenditure Reports as submitted to Treasury to the amounts noted on the ‘Agency Reconcilers’ submitted by the pass-through state agencies noting the following variances by key line item: December 31, 2022 Project and Expenditure Report  OOG was unable to provide the Agency Reconciler for five programs. As such, we were unable to validate all key line items reported for those agencies.  Current period obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for nine programs, resulting in a variance of ($61,450,208).  Cumulative obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 12 programs, resulting in a variance of $333,636,497.  Current period expenditures – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for five programs, resulting in a variance of ($85,590,747)  Cumulative expenditures - Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for one program, resulting in a variance of ($74,511). March 31, 2023 Project and Expenditure Report  Current period obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 15 programs, resulting in a variance of ($115,194,311).  Cumulative obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 22 programs, resulting in a variance of $572,738,964.  Current period expenditures – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for eight programs, resulting in a variance of ($20,661,270).  Cumulative expenditures - Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for one program, resulting in a variance of ($32,479). Questioned costs: None. Context: See “Condition.” Cause: Variances related to cumulative obligations were due to OOG reporting budgeted amounts rather than obligated amounts as defined by the SLFRF Compliance and Reporting Guidance Version 5.0. The remaining variances were due to discrepancies between the Agency Reconcilers and amounts reported in OOG’s eGrants system. OOG reported amounts reported in its eGrants system rather than the amounts reported by the state agencies. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported to the federal government. Repeat finding: No Recommendation: We recommend management enhance its internal controls to ensure obligations reported on federal reports meet the definition of an obligation per SLFRF Compliance and Reporting Guidance Version 5.0 and that amounts reported by the state agencies reconcile to the amounts reported in eGrants and the Project and Expenditures Reports. Management should reconcile discrepancies between eGrants and the amounts reported by the state agencies and obtain revised Agency Reconcilers, if appropriate. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the variances related to cumulative obligations are due to OOG reporting budgeted amounts rather than obligated amounts as defined by the SLFRF Compliance and Reporting Guidance Version 5.0. The remaining variances are due to discrepancies between the Agency Reconcilers and amounts reported in OOG’s eGrants system. When variances occurred, it was typically the result of data entry errors within the Agency Reconcilers. In these cases, the OOG deferred to the amounts reported in its eGrants system rather than the amounts reported by the state agencies in the Agency Reconcilers.

Reporting – PR28 Financial Summary Report Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii ALN: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: B-22-DC-48-004 September 1, 2022 – September 1, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per U.S. Department of Housing and Urban Development (HUD) notice CPD-21-11, when generating the PR28 PER Financial Summary in IDIS, states have the ability to enter various adjustment parameters to data summarized from within IDIS. These adjustments are specific to each individual PR28 PER Financial Summary and are displayed in the report output. For any PR28 PER Financial Summary where the grantee made adjustments, the grantee must attach an explanation to the report. Condition: Texas Department of Agriculture (TDA) is required to submit the PR28 Financial Summary report and record any necessary adjustments to the financial report. During our testing, we noted TDA did not make the necessary adjustments to match supporting documentation from TDA accounting systems. The following adjustments were not reported as follows:  Line B13: Adjustment to compute total set aside for State Administration - $421,994  Line B21: Adjustment to compute total redistributed – ($2,630,787)  Line B24: Adjustment to compute total not yet distributed - $2,181,312  Line D47: Adjustments to compute total subject to PS cap – ($5,756)  Line D56: Adjustments to compute total subject to P/A cap – ($5,756) Questioned costs: None. Context: See "Condition" Cause: While management maintained supporting documentation, they failed to make the appropriate adjustments to PR28 Financial Summary Report. Effect: Failure to report accurate data on the PR28 Financial Summary report could compromise HUD’s ability to monitor CDBG expenditures and compliance with statutory requirements. Repeat finding: No Recommendation: TDA should enhance internal controls surrounding reporting to ensure accurate data is being outputted in accordance with the requirements of the respective report. Views of responsible officials: TDA agrees with the finding. TDA acknowledges that the appropriate adjustments are not reflected in the PR-28 report originally submitted for Program Year 2022.

Reporting – FFATA Federal Agency: U.S. Department of Agriculture U.S. Department of Housing and Urban Development Federal Program Title: Child Nutrition Cluster (CNC) Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (CDBG) ALN: 10.553, 10.555, 10.556, 10.559, 10.582 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: CNC 236TX332N1099, 236TX332N1199, 236TX375L1603 October 1, 2022 – September 30, 2023 CDBG B-21-DC-48-0001, B-22-DC-48-0001 September 1, 2021 – September 1, 2028, September 1, 2021 – September 1, 2028, September 1, 2022 – September 1, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Texas Department of Agriculture (TDA) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). During our testing, we noted the following compliance exceptions: Child Nutrition Cluster- Fresh Fruit and Vegetable Program (ALN 10.582) See chart or table in the Schedule of Findings and Questioned Costs. Child Nutrition Cluster- National School Lunch Program (ALN 10.555) See chart or table in the Schedule of Findings and Questioned Costs. Community Development Block Grant (ALN 14.228) See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None. Context: See "Condition." Cause: As related to ALN 10.582 and 10.555, TDA reports expenditures at the end of the subaward period rather than reporting subawards over $30,000 by the last day of the month following the month in which the subaward/ subaward amendment obligation was made or the subcontract award/subcontract modification was made. This was due to the nature of the subaward agreements, where subaward amounts are not specified in the agreement and subrecipients are reimbursed based on actual expenditures incurred each month. As related to subawards not reported for ALN 10.555, TDA did not attempt to report subawards during the fiscal year due to significant technical difficulties encountered uploading subaward data into the FSRS in previous periods. As related to 14.228, reports were submitted late due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TDA should revise its current policies and procedures to ensure all subaward/ subaward amendment obligations over $30,000 are identified and submitted in FSRS by the last day of the month following the month in which the subaward/ subaward amendment obligation was made or the subcontract award/subcontract modification was made. Additionally, TDA should attempt to submit subaward information as required. If unsuccessful due to technical matters related to FSRS, TDA should retain documentation of the resolution efforts and submit subaward information immediately after the matter has been resolved. Views of responsible officials: CNC – TDA FND agrees with the CLA’s recommendation. CDBG – TDA agrees with the finding. TDA acknowledges the FFATA reports were not submitted timely.

Eligibility Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 – 2021, 1505-0270 – 2021. January 6, 2022 – December 29, 2022 and May 5, 2021 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: According to Treasury’s Emergency Rental Assistance (ERA) Frequently Asked Questions (FAQs) Revised August 25, 2021, in ERA1, grantees must make reasonable efforts to obtain the cooperation of landlords and utility providers to accept payments from the ERA program. Outreach will be considered complete if (i) a request for participation is sent in writing, by mail, to the landlord or utility provider, and the addressee does not respond to the request within seven calendar days after mailing; (ii) the grantee has made at least three attempts by phone, text, or e-mail over a five calendar-day period to request the landlord or utility provider’s participation; or (iii) a landlord confirms in writing that the landlord does not wish to participate. The final outreach attempt or notice to the landlord must be documented. According to Treasury’s ERA Frequently Asked Questions (FAQs) Revised August 25, 2021, Grantees must obtain, if available, a current lease, signed by the applicant and the landlord or sublessor, that identifies the unit where the applicant resides and establishes the rental payment amount. If a household does not have a signed lease, documentation of residence may include evidence of paying utilities for the residential unit, an attestation by a landlord who can be identified as the verified owner or management agent of the unit, or other reasonable documentation as determined by the grantee. In the absence of a signed lease, evidence of the amount of a rental payment may include bank statements, check stubs, or other documentation that reasonably establishes a pattern of paying rent, a written attestation by a landlord who can be verified as the legitimate owner or management agent of the unit, or other reasonable documentation as defined by the grantee in its policies and procedures. According to the Texas Rent Relief Program Policies effective June 21, 2021, a household can request and receive rent assistance up to the total amount of monthly contracted rent listed on the lease. In the rare cases in which a tenant is applying without landlord cooperation, AND a lease does not exist, the tenant will be required to provide receipts for their 3 most recent rent payments in order to establish a pattern. Condition: During our testing of 60 individual payments to program participants, we noted the following exceptions:  For one sampled payment totaling $1,950, only one outreach to the landlord was attempted by phone instead of the required minimum of three.  For one sampled payment totaling $3,277, the landlord confirmed they were not willing to participate, however, it was not obtained in writing.  For one sampled payment, the prorated calculation for monthly rent was incorrect, resulting in an overpayment of $203. Questioned costs: $5,430. Context: See "Condition" Cause: The reviewer did not adhere to procedures related to outreach and obtaining required documentation. Additionally, the processing vendor miscalculated the rental assistance. Effect: Failure to accurately calculate and perform outreach for rental assistance under the program may result in overpayments to tenants or payments to ineligible tenants. Repeat finding: 2022-022, 2021-012 Recommendation: We recommend management enhance current policies and procedures to ensure all program requirements are adhered to prior to making benefit payments. Views of responsible officials: Management agrees with the finding and recommendation

Subrecipient Monitoring Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 – 2021, 1505-0270 – 2021. January 6, 2022 – December 29, 2022 and May 5, 2021 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR sections 200.332 (d) through (f), all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Condition: TDHCA maintains a Master Planning Summary (MPS) to track all active subrecipient contracts that have expenditures in the planning phase, which are to be considered for sampling and potential selection for review. During our testing, we noted one subrecipient contract with expenditures during the fiscal year that was not included in the MPS for potential selection for a review. Questioned costs: None. Context: See “Condition.” Cause: Management is not adhering to the subrecipient monitoring procedures to ensure all active subrecipient contracts with expenditures incurred during the fiscal year are at least considered for review by being included in the MPS. Effect: Failure to complete proper monitoring over subrecipients may lead to noncompliance with grant terms and conditions. Repeat finding: No Recommendation: We recommend that TDHCA strengthen its internal controls to ensure that all subrecipients are included in the MPS and subject to review. Views of responsible officials: The Department’s Compliance Subrecipient Monitoring (CMSM) staff acknowledges that a subrecipient was erroneously not included in the Master Planning Summary. However, the Department’s procedures for risk assessment and monitoring activities for this review period remain compliant with 2 CFR section 200.303(a) as well as 2 CFR section 200.331(6)(b). Risk assessment for non-formula funded contracts is 100% risk based. Both risk assessment and subsequent monitoring functions represent a snapshot of the Department’s pass-through activities and 100% review is not required. It is the Department’s stance that this error does not materially impact the risk assessment process or the scope of this audit.

Special Tests and Provisions – ERA Funds Reallocation Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0270 – 2021 May 5, 2021 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.302, the non-Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. Per 2 CFR §200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per Treasury’s ERA2 Reallocation Guidance Updated November 15, 2022, the ERA2 statute requires Treasury to identify funds for reallocation from amounts allocated to eligible Grantees, but not yet paid out to them. Specifically, the statute provides that beginning on March 31, 2022, Treasury must “reallocate funds allocated to eligible grantees … but not yet paid,” according to a procedure established by Treasury. Condition: Audit procedures included a review of the ERA2 Quarter 3 2022 (July-September) and ERA2 Quarter 4 2022 (October-December) Compliance Reports. We noted that $6,777,186 was double counted on the ‘Cumulative Amount of Award Obligated as of the end of the Reporting Period’ amount in the ERA2 Quarter 4 2022 Compliance Report. Questioned costs: None. Context: See "Condition" Cause: Obligated amounts were duplicated when preparing the supporting worksheets due to management oversight. Effect: Inaccurate supporting data when calculating reallocation expenditure ratios may result in an incorrect amount of excess funds subject to recapture by Treasury. Repeat finding: 2022-025 Recommendation: We recommend management enhance its internal controls over the review of supporting reallocation expenditure ratio calculations. Views of responsible officials: Management agrees with the finding and recommendation

Eligibility Federal Agency: U.S. Department of the Treasury Federal Program Title: Homeowner Assistance Fund Program ALN: 21.026 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0269 – 2021 May 3, 2021 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of 60 individual payments to program participants, we noted the following exceptions for one sampled payment:  The servicer failed to provide an original loan amount. While the deed of trust was used to confirm conforming loan limits, it was not retained. The deed of trust was subsequently provided, however, we were unable to verify that the applicant provided a deed of trust prior to approval.  The applicant was enrolled in the Mortgage Reinstatement Program, which states that the debt to-income ratio must be between 31.01% and 55.0% and the applicant states they can afford to make the mortgage payments. We noted that the while the applicant had a 32.01% debt-to-income ratio, they stated they cannot afford to continue mortgage payments. As such, the applicant should have been enrolled in the Reinstatement plus Monthly payment assistance (R+U) program, which provides full monthly payment assistance to homeowners who are past due on their mortgage and unable to make full mortgage payments due to a continuing financial hardship associated with the Coronavirus pandemic. Questioned costs: None. Context: See "Condition" Cause: Management did not retain documentation to support eligibility determinations in the case file. With respect to program placement, the applicant was enrolled in the incorrect program due to changes in program types concurrently taking place. Effect: Ineffective controls over loan eligibility could result in payments on ineligible loans. Additionally, incorrectly placing participants in programs may result in ineligible payments or erroneously denying payments. Repeat finding: No Recommendation: We recommend enhancing current policies and procedures to ensure that the case auditors and supervisors are: (1) not approving applications with incomplete documentation and (2) properly placing participants in the correct program. Views of responsible officials: Management concurs with the control deficiency.

Reporting Federal Agency: U.S. Department of the Treasury Federal Program Title: Homeowner Assistance Fund Program ALN: 21.026 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0269 – 2021 May 3, 2021 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per the Department of Treasury’s Homeowner Assistance Fund (HAF) guidance on participant compliance and reporting responsibilities, HAF participants are required to submit quarterly reports (PRA 1505-0269) that include data regarding programs, expenditures, demographic distribution, civil rights compliance, equity indicators, community engagement efforts, and programmatic data. To provide public transparency on whether programs are using practices that promote on-time and on-budget delivery, Treasury will seek information from HAF participants on their workforce plans and practices related to HAF programs. The reports contain key line items with critical information as follows: 1. Administrative Expenses - Quantifiable Objective Criteria: Obligations and expenditures do not exceed 15% for admin expenses. 2. Services, Counseling & Education - Quantifiable Objective Criteria: Obligations and expenditures do not exceed 5% for legal services, counseling, and education. Condition: Audit procedures included a review of the key line items within the quarterly reports for the periods ending December 31, 2022 and March 31, 2023. While TDHCA did not exceed the percentage maximums for each key line item, we noted the following variances for Administrative Obligations and Expenses: December 31, 2022 Report  Obligations – Total cumulative obligations reported was $121,740,816, however the amount per supporting documentation provided was $95,675,808, resulting in a variance of $26,065,008.  Expenditures – Total cumulative expenditures reported was $32,309,867, however, the amount per supporting documentation was $31,498,881 resulting in a variance of $810,986.  Specific to contracts with CDCs, Housing Counselors, Affordable Housing Providers for Intake Centers and Outreach, review of the expenditure detail indicated that the $1,781,278 of cumulative expenditures reported included other costs not related to this category. March 31, 2023 Report  Obligations – Total cumulative obligations reported was $104,384,814, however, the amount per supporting documentation was $96,426,918, resulting in a variance of $7,957,896.  Expenditures – Total cumulative expenditures reported was $41,113,838, however, the amount per supporting documentation was $45,208,650, resulting in a variance of ($4,094,812).  Specific to contracts with expenditures for CDCs, Housing Counselors, Affordable Housing Providers for Intake Centers and Outreach, review of the expenditure detail indicated that the $0 of cumulative expenditures reported is incorrect. We noted cumulative expenditures for 100% intake of $2,324,512. These are at minimum expenditures as there are subrecipient contracts allocated between intake, counseling, and legal. which TDHCA did incur expenditures in Q1 2023 and previous quarters. Management was unable to provide an analysis of these expenditures to allocate the respective portion to intake. Questioned costs: None. Context: See "Condition" Cause: TDHCA reported budgeted amounts rather than obligated amounts as defined by the U.S. Treasury Homeowner Assistance Fund Guidance on Participant Compliance and Reporting Responsibilities. Additionally, TDHCA’s controls over the review of reports were not operating at a precision level that would identify reported amounts that do not agree to supporting documentation. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported to the federal government. Repeat finding: No Recommendation: We recommend management enhance its internal controls to ensure obligations reported on federal reports meet the definition of an obligation per Treasury and that amounts agree to supporting documentation. Views of responsible officials: Management concurs with the control deficiency.

Reporting – Financial and Special Reporting for FFATA Federal Agency: U.S. Department of Homeland Security Federal Program Title: Disaster Grants - Public Assistance (Presidentially Declared Disasters) ALN: 97.036 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: PA-06-TX-4485, PA-06-TX-4586 March 25, 2020 – March 25, 2028, February 19, 2021 – February 19, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The action is to be reported in FSRS no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: For one of the nine financial reports tested during the fiscal year, we noted the Texas Division of Emergency Management (TDEM) incorrectly reported total federal funds authorized amount of $14,451,281,005. TDEM should have reported total federal funds authorized amount of $14,450,861,018, resulting in a reported variance of $419,988. During our testing of special reporting for FFATA, we noted the following instances of noncompliance: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None. Context: See "Condition" Cause: Specific to financial reporting, the variance is due to a manual error in transferring data from the Smartlink report used to report the total federal funds authorized amount to the financial report. TDEM did not reduce the total federal funds authorized for the Hazard Mitigation projects included in the Smartlink report. The untimely submission of the FFATA report was due to the utilization of a new third-party application where gaps were later identified. Effect: Reporting inaccurate information on financial reports could impact the federal agency’s ability to accurately capture key information in order to assess the performance of the program. Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat finding: No Recommendation: TDEM should enhance its internal controls to ensure manual errors on financial reports are identified and FFATA reports are identified in a timely manner in order to be reported in FSRS within the required timeline. Views of responsible officials: Specific to the financial reporting, it appears there was a malfunction with the federal system adhoc legacy inquiry reporting tool when generating federal financial reports containing the total federal funds authorized. The federal system’s malfunction produced a comingled program report which caused an overage in total federal funds authorized. TDEM no longer generates reports from the unreliable federal system adhoc legacy inquiry module. As of October 2023, we began utilizing the federal system APEX reports. TDEM has followed up with the Federal Support Center for the Payment Management System multiple times to determine what is causing the federal system to report inaccuracies, however they have failed to address the issue at hand, have stated that “soon the legacy adhoc will no longer be available”, and are encouraging grantees to only use the APEX reports – seemingly due to the inaccuracies, such as the one noted here, that the federal system generates. Regarding the FFATA reporting, a new automated report developed by a third-party vendor to streamline the reporting timeline was being utilized after an internal testing phase had transpired. A gap was later identified which inadvertently created the timing delay.

Reporting – Special Reporting Federal Agency: U.S. Department of Education Federal Program Title: Education Stabilization Fund ALN: 84.425R Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: S425R210043 February 25, 2021 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per the Office of Elementary and Secondary Education, all grantees are required to report on ESSER funds received under the Coronavirus Aid, Relief, and Economic Security (CARES) Act; the Coronavirus Response and Relief Supplemental Appropriations (CRRSA) Act; and the American Rescue Plan (ARP) Act. Grantees must submit an annual report describing how the State and subrecipients used the awarded funds during the performance period. Condition: Audit procedures included a review of 40 subrecipients/ local education agencies (LEAs) whose data was reported on key line item 3.b10 - Number of specific positions supported with ESSER Fund. Of the 40 subrecipients, the number of paraprofessionals, the number of school counselors, school psychologists and/or social workers, and number of classroom educators, not covered by previous categories for one LEA was reported incorrectly in the Annual Report by TEA compared to the information the LEA submitted. Information was transposed with another LEA, causing that LEA’s information to be incorrect as well. Additionally, one LEA submitted corrected information, which was not subsequently corrected by TEA in the Annual Report. Questioned costs: None. Context: See “Condition.” Cause: Current controls are not at the correct precision level to detect variances in data reported in the Annual Report compared to information submitted by LEAs. Effect: Failure to report accurate information may result in noncompliance with terms of the grant award. Repeat finding: No Recommendation: TEA should enhance and/or modify existing controls to ensure information submitted by the LEAs is reported completely and accurately on the Annual Report. Views of responsible officials: TEA agrees an error was made during the upload of the LEA submitted corrected CROSSACT data. The corrective actions below will be implemented to prevent future occurrence.

Subrecipient Monitoring Federal Agency: U.S. Department of Education Federal Program Title: Adult Education- Basic Grants to States ALN: 84.002 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: V002A200044, V002A210044, V002A220044, V002A230044 July 1, 2020 – September 30, 2021, July 1, 2021 – September 30, 2022, July 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR sections 200.332 (d) through (f), TWC must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Condition: Per review of TWC's Subrecipient Monitoring Department's (SRM) Annual Monitoring Plan, the Adult Education and Literacy (AEL) program is designed to meet the education and training needs of adults. SRM will continue to work closely with the Workforce Development Division to identify the fiscal and program areas that present the highest risk to the Agency. SRM will also conduct data validation reviews of all AEL providers, once during each five-year grant period. During our testing, we noted seven AEL subrecipients were excluded from the SRM Plan and no reviews or data validations were performed within the previous five years. Questioned costs: None. Context: See “Condition.” Cause: Management is not adhering to the subrecipient monitoring procedures to ensure all Adult Education and Literacy subrecipients have a data validation review once during each five-year granting period. Effect: Failure to complete proper monitoring over subrecipients may lead to noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend that TWC strengthen its internal controls to ensure that monitoring over all subrecipients is completed. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding with one observation. Follow-up review indicates that only 6 of 7 AEL subrecipients tested were not included in the risk assessment. ‘Restore Education’ was, in fact, assessed. It was SRM’s understanding from prior guidance that the types of AEL subrecipients tested as part of this audit were not applicable to SRM’s risk assessment process. We have confirmed with TWC’s AEL program staff that they should have been in scope for SRM’s annual and mid-year risk assessments.

Eligibility Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; 84.379; and 93.264 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224051; Federal Work-Study Program, P033A224051; Federal Pell Grant Program, P063P222282; Federal Direct Student Loans, P268K232282; Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232282; and Nurse Faculty Loan Program (NFLP), 1 E01HP45821-01-00 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: $1,409 Repeat Finding: No Cost of Attendance: The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student’s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the “tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.” An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his or her family are expected to pay for educational expenses; it is computed by the federal central processor and included on the student’s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student’s financial aid exceeds the student’s need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student’s financial need (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). Direct Subsidized and Unsubsidized Loans have annual and aggregate limits that are the same for all students at a given grade level and dependency status. In general, a loan may not be more than the amount the borrower requests, the borrower’s unmet financial need, the borrower’s COA, or the borrower’s maximum borrowing limit. (U.S. Department of Education 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 5). Lamar University (University) uses algorithmic budgeting to build COA budgets for each term based on a student’s classification (undergraduate or graduate), dependency (dependent or independent), residency (in-state or out-of-state), living status (on-campus, off-campus, or at home with parents), and enrollment level (full-time, three-quarter-time, half-time, or less-than-half-time). Budgeting rules within the University’s student information system are established to assign various budget components based on the factors noted above. For 23 (38 percent) of 61 students tested, the University incorrectly calculated the COA. Specifically, the University did not adjust the students’ COA to reflect the students’ actual enrollment as of the census date. The University experienced turnover in the Student Financial Aid department during the 2022–2023 award year, and could not provide a cause for those errors. The University asserted that it implemented a process to recalculate students’ COAs based on their actual enrollment at census beginning with the Fall 2023 term; however, the errors discussed above occurred before that process was in place. As a result, the University overawarded two students. • One of those students was assigned an overstated COA for the Fall 2022 term based on three-quarter-time enrollment although the student’s actual enrollment was half-time. The student was awarded $5,294 in Subsidized Direct Loans, which exceeded the student’s financial need, resulting in $1,113 in questioned costs associated with ALN 84.268, Federal Direct Student Loans, award number P268K232282. • The other student was assigned an overstated COA for the Spring 2023 term based on full-time enrollment although the student did not attend during the term. The student was awarded $10,142 in Unsubsidized Direct Loans, which exceeded the student’s actual COA, resulting in $296 in questioned costs associated with ALN 84.268, Federal Direct Student Loans, award number P268K232282. The University did not have adequate controls in place to review budgets used in the calculation of COA and accurately assign those budgets to students. Incorrectly calculating COA increases the risk of overawarding or underawarding financial assistance to students. Recommendation: The University should strengthen its controls to ensure that it correctly calculates students’ COA budgets in accordance with its process and does not overaward financial assistance to students. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; and 84.063 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224051; and Federal Pell Grant Program, P063P222282 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Fiscal Operations Report and Application to Participate (FISAP): An institution participating in campus-based programs is required to annually submit the FISAP to the Secretary of the U.S. Department of Education to receive funds for the campus-based programs. The institution uses the Fiscal Operations Report portion to report its expenditures in the previous award year and the Application to Participate portion to apply for the following year (Title 34, Code of Federal Regulations (CFR), Section 674.19(d); and U.S. Department of Education, Fiscal Operations Report for 2022–23 and Application to Participate for 2024– 25 (FISAP) Instructions). The institution must ensure that the information is accurately reported on the form and at the time specified by the Secretary of the U.S. Department of Education (Title 34, CFR, Section 674.19(d)(2)). Lamar University (University) did not maintain adequate support for its FISAP. Specifically, the University did not have support for the total Federal Pell Grants expenditures for the 2022–2023 award year reported in Part II, Section E. Assessments and Expenditures, Line 23. In addition, the supporting documentation provided by the University for the total Federal Supplemental Educational Opportunity Grants (FSEOG) expenditures for undergraduate independent students with income from $0 to $1,999 for the 2022–2023 award year did not match the amount reported in Part IV, Section A. Distribution of Program Recipients and Expenditures by Type of Student, Line 12(d). The University asserted that those issues were due to human error. As a result, auditors were unable to determine whether the information on the FISAP for those line items was accurate and fairly presented in accordance with requirements. Recommendation: The University should maintain adequate support for information reported on its FISAP to ensure that information is accurate. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Disbursements To or On Behalf of Students Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; 84.379; and 93.264 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224051; Federal Work-Study Program, P033A224051; Federal Pell Grant Program, P063P222282; Federal Direct Student Loans, P268K232282; Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232282; and Nurse Faculty Loan Program (NFLP), 1 E01HP45821-01-00 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Award and Disbursement Notifications: Before an institution disburses Title IV, Higher Education Act of 1965 (HEA) program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each Title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans (Title 34, Code of Federal Regulations (CFR), Section 668.165(a)(1)). If an institution credits a student’s ledger account with Federal Direct Student Loan (Direct Loan) funds or Teacher Education Assistance for College and Higher Education (TEACH) Grant funds, the institution must notify the student or parent of (1) the anticipated date and amount of the disbursement, (2) the student’s or parent’s right to cancel all or a portion of that loan or grant and have the loan or grant proceeds returned to the U.S. Department of Education, and (3) the procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan or grant, or loan or grant disbursement (Title 34, CFR, Section 668.165(a)(2)). The institution must provide the notice in writing no earlier than 30 days before, and no later than 30 days after, crediting the student’s ledger account at the institution (Title 34, CFR, Section 668.165(a)(3)). For 21 (34 percent) of 62 disbursements tested, Lamar University (University) did not send an award or disbursement notification as required. Specifically: • For 20 students that received Direct Loan disbursements, the University did not send a disbursement notification. The University asserted those errors occurred because the University was utilizing a manual process to send out the disbursement notifications, and on those days when the employee charged with performing the manual process was not present, the notifications were not sent to students. • For one student who received Title IV funds, the University did not send an award notification. This error occurred because the University manually packaged the student’s awards after clearing a verification requirement, and the University did not have an adequate process in place to ensure that students who are manually awarded receive an award notification. Not receiving award and disbursement notifications impairs students’ and parents’ ability to budget for the cost of attending or exercise the option to cancel their loans or grants. Promissory Notes: Institutions must establish a process to make loans consistent with institutional policies and federal laws and regulations, including the completion of the following during disbursement: (1) signed promissory note, and (2) disclosure of terms and conditions (Nurse Faculty Loan Program (NFLP) Administrative Guidelines, 42 United States Code (U.S.C.) 297n-1 (Public Health Service Act Section 846A)). The University did not have a process in place to require a promissory note for NFLP loans prior to disbursement. NFLP loans were incorrectly identified in the student information system as a grant instead of a loan. As a result, the student information system did not place a required hold on disbursements until the promissory note requirement was completed. Not requiring a signed promissory note prior to disbursement of loan funds could limit the University’s ability to enforce repayment of the loan. Recommendations: The University should: • Strengthen its controls to ensure that it identifies all students that require an award or disbursement notification, and sends those notifications to the students. • Configure controls in the student information system to require promissory notes for applicable loans. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224051; Federal Pell Grant Program, P063P222282; Federal Direct Student Loans, P268K232282; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232282 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: $19,357 Repeat Finding: No Return of Title IV Calculations: When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs, and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The total number of calendar days in a payment period or period of enrollment includes all days within the payment period or period of enrollment that the student was scheduled to complete, excluding scheduled breaks of at least five consecutive days. Scheduled breaks of at least five consecutive days are also excluded from the number of calendar days the student completed in that period (Title 34, CFR, Section 668.22(f)(2)(i)). In determining the percentage of the payment period or period of enrollment completed for a student who withdraws from a program offered in modules, an institution must (1) include all days within the period that the student was scheduled to complete prior to ceasing attendance and (2) exclude any scheduled breaks of at least five consecutive days when the student was not scheduled to attend a module or other course offered during that period of time. Scheduled breaks include both those that take place within and between modules (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 5, Chapter 2). An institution must offer to disburse directly to a student, or parent in the case of a parent PLUS loan, any amount of a post-withdrawal disbursement of loan funds that is not credited to the student's account. The institution must make a direct disbursement of any loan funds that make up the post-withdrawal disbursement only after obtaining the student's, or parent's in the case of a parent PLUS loan, confirmation that the student or parent still wishes to have the loan funds disbursed (Title 34, CFR, Section 668.22(a)(6)(ii)(B)). Lamar University (University) made errors in Title IV return calculations for 25 (41 percent) of 61 students tested. Specifically, the University did not exclude any break days from the Spring 2023 term or days between modules as required. Those errors resulted in the University returning a total of $3,481 associated with ALN 84.268, Federal Direct Student Loans, award number P268K232282, and $1,802 associated with ALN 84.063, Federal Pell Grant Program, award number P063P222282, less Title IV funds than required. • For 2 of those 25 students, the University also used an inaccurate withdrawal date in the return calculation. • For 1 of those 25 students, the University also did not identify that the student was eligible to receive a post withdrawal disbursement of loan funds and therefore did not offer to disburse those loan funds to the student as required. In addition, for 8 (13 percent) of 61 students tested who did not have a return of Title IV funds made, the University did not perform a return calculation as required. The University asserted it did not consistently follow its procedures in identifying students who required a Title IV return calculation due to staff turnover and newer staff needing additional training. As a result, the University did not return a total of $13,707 associated with ALN 84.268, Federal Direct Student Loans, award number P268K232282, and $367 associated with ALN 84.063, Federal Pell Grant Program, award number P063P222282 as required. The errors discussed above occurred because the University did not configure its information system to accurately calculate returns and because of manual errors that the University made in performing the return calculations. In addition, the University did not have an adequate monitoring process to identify those errors. Not having a process that consistently calculates and returns the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. Timeliness of Returns: An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). For 5 (8 percent) of 59 students tested who withdrew and required a return of Title IV funds, the University did not return the funds within the required time frame. The University returned the funds for those students 47 to 143 days after it determined that the students withdrew. For 2 of those students, the University determined the withdrawal dates and performed the return calculations; however, it did not return the Title IV funds within the required 45-day time frame due to an oversight in processing the return of those funds. For three of those students, the University asserted that it determined that the return calculations required corrections, which resulted in the returns not being performed timely. Not making returns within required time frames reduces the funds available to the U.S. Department of Education for its program management. Recommendations: The University should: • Strengthen its controls to ensure that it accurately calculates returns of Title IV funds when required, including review of the variables it uses in those calculations. • Accurately determine the number of days in the payment period and exclude any scheduled breaks as required. • Strengthen its monitoring controls to ensure that it detects and corrects errors in return of Title IV calculations and returns Title IV funds in a timely manner. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222282; and Federal Direct Student Loans, P268K232282 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less_x0002_than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). Lamar University (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes to NSLDS when required. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 7 (12 percent) of 60 students tested, the University did not accurately report campus- and program level data elements or did not report enrollment status changes to NSLDS. Specifically: • For two students, the University incorrectly reported the students’ enrollment status as withdrawn, rather than graduated. The incorrect enrollment status was reported at both the campus and program levels to NSLDS. In addition, those statuses were not received by NSLDS until 130 and 134 days after the students graduated. • For two students, the University did not report the withdrawn status at the campus and program levels to NSLDS as required. • For two students, the University incorrectly reported the students’ graduated status effective date at the campus level. However, the graduated effective date for both students was correctly reported at the program level. The effective date reported at the campus level should be the same date reported at the program level because those dates reflect the same enrollment status change. • For one student, the University incorrectly reported the student’s enrollment status at the campus and program levels. The University initially reported the correct enrollment status; however, subsequent submissions to NSLDS overwrote that enrollment status with an incorrect enrollment status. The errors discussed above occurred because the University (1) did not ensure that all graduated students were included on the graduation transmission file to NSC, (2) did not fully address error reports provided by NSC, and (3) did not have a formally documented policy or review to ensure consistent and accurate enrollment reporting. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The University should strengthen its controls to ensure that all status changes are reported accurately and in a timely manner to NSLDS. Views of Responsible Officials: The University accepts and confirms the findings. Through assessing and identifying the exceptions in the audit the University will work to develop and enforce the beneficial measures needed to refine our procedures.

General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Sam Houston State University (University) did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate levels of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, 1 (14 percent) of 7 changes tested lacked documentation showing that the change was properly tested or validated before it was migrated to production. Not having sufficient controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate validation of changes prior to implementation. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.268 Pass-Through Agency: N/A Award Number: Federal Direct Student Loans, P268K232301 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal Direct Student Loans: Direct Unsubsidized Loans have higher annual limits for certain graduate and professional health professions students. Schools may award the increased unsubsidized amounts to students who are enrolled at least half-time in certain health professions programs. The increased unsubsidized amounts that an eligible health professions student may receive are in addition to the regular $20,500 Direct Unsubsidized Loan annual loan limit for graduate and professional students. For programs with an academic year covering 10 or 11 months, the annual additional unsubsidized loan limit must be prorated. The prorated annual loan limit is determined by dividing the applicable loan limit for a nine-month academic year by nine, and then multiplying the result by 10 or 11. (U.S. Department of Education 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 5). Based on a review of the full population of student financial assistance recipients, Sam Houston State University (University) overawarded a total of $239,932 in Unsubsidized Direct Loans to 133 students. Due to an incorrect proration methodology, the University awarded first- and second-year students in the Doctor of Osteopathic Medicine program in excess of their Unsubsidized Direct Loan annual limit. Specifically, the University prorated the sum of the annual and increased additional annual limits, instead of prorating only the increased additional annual limit. After auditors brought the errors to the University’s attention, it returned the excess Unsubsidized Direct Loan funds; therefore, there were no questioned costs. Recommendation: The University should use the appropriate methodology when prorating Unsubsidized Direct Loans for eligible health professions students to ensure that loans are disbursed within the student’s applicable annual limit. Views of Responsible Officials: The University acknowledges and agrees with the findings of this audit. Management recognizes that increased unsubsidized amounts for eligible health professions are to be calculated by prorating the additional months then dividing the applicable loan limit for a nine-month academic year by nine, and then multiplying the result by 10 or 11, depending on the months of the program.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224110; Federal Pell Grant Program, P063P222301; Federal Direct Student Loans, P268K232301; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232301 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). For distance education, documenting that a student has logged into an online class is not sufficient to demonstrate academic attendance by the student. An institution must demonstrate that a student participated in class or was otherwise engaged in an academically related activity. Only active participation by a student in an instructional activity related to the student's course of study that meets the definition of “academic engagement” in Title 34, CFR, Section 600.2 and takes place during a payment period or period of enrollment qualifies as attendance in an academically related activity (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 5, Chapter 2). For 1 (4 percent) of 24 students tested, Sam Houston State University (University) did not have evidence of academic engagement in the distance education course from which the student’s withdrawal date was determined. The University relies on the last dates of academic activity provided by instructors to determine the withdrawal date for Return of Title IV purposes for students who unofficially withdraw. The student’s record did not reflect evidence of academic activity for the distance education course, and the University asserted that the last day of attendance provided by the instructor was inaccurate. The University did not have a process in place to require instructors to provide or maintain evidence of academic engagement in distance education courses. As a result, the University did not perform a return calculation because it incorrectly determined that the student completed over 60 percent of the period. After auditors brought the issue to the University’s attention, the University performed a return calculation and returned Title IV funds as required; therefore, there were no questioned costs. Having a process that does not consistently calculate and return the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. Recommendation: The University should ensure that evidence of academic engagement is consistently documented for students in distance education courses. Views of Responsible Officials: The University acknowledges and agrees with the findings of this audit. Management acknowledges the responsibility to accurately verify the academic engagement and document it for students enrolled in distance education courses.

Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224131; Federal Work-Study Program, P033A224131; Federal Pell Grant Program, P063P222320; Federal Direct Student Loans, P268K232320; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232320 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Cost of Attendance: The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student’s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the “tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.” An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his or her family are expected to pay for educational expenses; it is computed by the federal central processor and included on the student’s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student’s financial aid exceeds the student’s need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student’s financial need (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). Tarleton State University (University) uses algorithmic budgeting to build COA budgets for each term based on a student’s tuition rate (guaranteed or variable), program, courses, classification (undergraduate or graduate), residency (in-state or out-of-state); living status (on-campus, off-campus, or with parent), and enrollment level (full-time, three-quarter-time, half-time, or less-than-half-time). Budgeting rules within the University’s student information system are established to assign various budget components based on the factors noted above. For 62 (100 percent) of 62 students tested, the University incorrectly calculated the COA. Specifically, the University used the 2021–2022 award year budgets instead of the 2022–2023 award budgets because it did not update the COA budget components in its student information system for the new award year. As a result, the COAs for those students were understated by a total of $148,781. This error would have affected the COA for all students in the Fall 2022 and Spring 2023 terms. However, because the students’ budgets were understated, this error did not result in overawards of financial assistance; therefore, there were no questioned costs. The University did not have adequate controls in place to review budgets used in the calculation of COA and accurately assign those budgets to students. Incorrectly calculating COA increases the risk of overawarding or underawarding financial assistance to students. Recommendation: The University should strengthen its controls to ensure that it correctly calculates students’ COA budgets in accordance with its process. Views of Responsible Officials: The University has carefully reviewed the findings outlined in the recent financial aid audit report, and we acknowledge and agree with the identified areas for improvement. Your thorough examination has provided valuable insights into our financial aid processes, and we appreciate the effort invested in ensuring transparency and accountability. In response to the findings, we are committed to taking immediate and comprehensive corrective actions to address the identified issues and enhance the overall effectiveness of our financial aid management. Our team is already in the process of developing a detailed Corrective Action Plan that will outline the specific steps we will take to rectify the noted deficiencies. We understand the importance of financial aid in supporting our students' academic endeavors, and we are dedicated to ensuring that our processes align with the highest standards of integrity and compliance.

Special Tests and Provisions – Disbursements To or On Behalf of Students Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.379 Pass-Through Agency: N/A Award Number: Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232320 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Award and Disbursement Notifications: Before an institution disburses Title IV, Higher Education Act of 1965 (HEA) program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each Title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans (Title 34, Code of Federal Regulations (CFR), Section 668.165(a)(1)). If an institution credits a student’s ledger account with Federal Direct Student Loan (Direct Loan) funds or Teacher Education Assistance for College and Higher Education (TEACH) Grant funds, the institution must notify the student or parent of (1) the anticipated date and amount of the disbursement, (2) the student’s or parent’s right to cancel all or a portion of that loan or grant and have the loan or grant proceeds returned to the U.S. Department of Education, and (3) the procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan or grant, or loan or grant disbursement (Title 34, CFR, Section 668.165(a)(2)). The institution must provide the notice in writing no earlier than 30 days before, and no later than 30 days after, crediting the student’s ledger account at the institution (Title 34, CFR, Section 668.165(a)(3)). Tarleton State University (University) did not send appropriate award and disbursement notifications to TEACH Grant recipients. Specifically, the University’s TEACH award notification did not describe how and when funds would be disbursed, while the TEACH disbursement notification did not include the date of disbursement, student’s right to cancel all or part of the loan, and guidance for the procedures and time for canceling the loan. Not providing sufficient award and disbursement notifications impairs students’ and parents’ ability to budget for the cost of attending or exercise the option to cancel their loans or grants. Recommendation: The University should ensure that award and disbursement notifications for TEACH recipients contain all required elements. Views of Responsible Officials: The University has carefully reviewed the findings outlined in the recent financial aid audit report, and we acknowledge and agree with the identified areas for improvement. Your thorough examination has provided valuable insights into our financial aid processes, and we appreciate the effort invested in ensuring transparency and accountability. In response to the findings, we are committed to taking immediate and comprehensive corrective actions to address the identified issues and enhance the overall effectiveness of our financial aid management. Our team is already in the process of developing a detailed Corrective Action Plan that will outline the specific steps we will take to rectify the noted deficiencies. We understand the importance of financial aid in supporting our students' academic endeavors, and we are dedicated to ensuring that our processes align with the highest standards of integrity and compliance.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224131; Federal Pell Grant Program, P063P222320; Federal Direct Student Loans, P268K232320; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232320 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: $12,259 Repeat Finding: No Return of Title IV Calculations: When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs, and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The total number of calendar days in a payment period or period of enrollment includes all days within the payment period or period of enrollment that the student was scheduled to complete, excluding scheduled breaks of at least five consecutive days. Scheduled breaks of at least five consecutive days are also excluded from the number of calendar days the student completed in that period (Title 34, CFR, Section 668.22(f)(2)(i)). In determining the percentage of the payment period or period of enrollment completed for a student who withdraws from a program offered in modules, an institution must (1) include all days within the period that the student was scheduled to complete prior to ceasing attendance and (2) exclude any scheduled breaks of at least five consecutive days when the student was not scheduled to attend a module or other course offered during that period of time. Scheduled breaks include both those that take place within and between modules (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 5, Chapter 2). For a program offered in modules, a student is not considered to have withdrawn if the student successfully completes any of the following: (1) a module that includes 49 percent or more of the number of days in the payment period, excluding scheduled breaks of five or more consecutive days and all days between modules; (2) a combination of modules that together contain 49 percent or more of the number of days in the payment period, excluding scheduled breaks of five or more consecutive days and all days between modules (Title 34, CFR, Section 668.22(a)(2)(ii)(A)(2)); or (3) coursework equal to or greater than the coursework required for the institution’s definition of a half-time student under 34 CFR 668.2(b) for the payment period (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 5, Chapter 1). An institution must disburse directly to a student any amount of a post-withdrawal disbursement of grant funds that is not credited to the student's account. The institution must make the disbursement as soon as possible, but no later than 45 days after the date of the institution's determination that the student withdrew. The institution must offer to disburse directly to a student, or parent in the case of a parent PLUS loan, any amount of a post withdrawal disbursement of loan funds that is not credited to the student's account. The institution must make a direct disbursement of any loan funds that make up the post-withdrawal disbursement only after obtaining the student's, or parent's in the case of a parent PLUS loan, confirmation that the student or parent still wishes to have the loan funds disbursed (Title 34, CFR, Section 668.22(a)(6)(ii)(B)). For 58 (97 percent) of 60 students tested, Tarleton State University (University) incorrectly calculated the amount of Title IV funds to be returned or returned the incorrect amount of funds. Specifically: • For 56 students, the University did not exclude any break days from the Fall 2022 term as required, and it incorrectly excluded 5 break days rather than 8 break days from the Spring 2023 term. Those errors occurred because the University did not load the correct break days into its student information system when setting up the payment period; therefore, this issue would have affected all students who withdrew from the Fall 2022 and Spring 2023 terms. Additionally: o For 2 of those 56 students, the University did not identify that the students were eligible to receive a post-withdrawal disbursement and therefore did not disburse those grant funds or offer to disburse those loan funds to the students as required. o For 4 of those 56 students, the University incorrectly determined the number of days in the payment period or used an incorrect withdrawal date for students enrolled in modules. • For 2 students enrolled in the Summer 2023 term, the University did not follow the return of Title IV requirements related to modular terms. For one student, the University incorrectly used the number of days in the full payment period rather than only the days within the period that the student was scheduled to complete prior to ceasing attendance. For the other student, the University failed to identify that the student successfully completed coursework equal to or greater than the coursework required for a half-time student and therefore should not have been considered withdrawn. The University asserted that this error occurred because staff misinterpreted the half-time withdrawal exemption requirements. As a result of the errors discussed above, the University returned a total of $1,992 associated with ALN 84.268, Federal Direct Student Loans, award number P268K232320, and $374 associated with ALN 84.063, Federal Pell Grant Program, award number P063P222320 less Title IV funds than required for the students tested in the sample. In addition, for 10 (17 percent) of 60 students tested who did not have a return of Title IV funds made, the University did not perform a return calculation as required. • For 6 students, the University did not exclude break days from its determination of whether the students completed 60 percent or more of the payment period as required. As a result, the University incorrectly determined that the students earned their aid and did not return a total of $7,679 associated with ALN 84.268, Federal Direct Student Loans, award number P268K232320, and $1,053 associated with ALN 84.063, Federal Pell Grant Program, award number P063P222320 as required. • For 4 students, the University incorrectly used the number of days in the full payment period in its determination of whether the students successfully completed 49 percent or more of the number of days in the payment period. As a result, the University incorrectly determined that the students earned their aid and did not return a total of $1,161 in questioned costs associated with ALN 84.268, Federal Direct Student Loans, award number P268K232320 as required. The errors discussed above occurred because the University did not configure its information system to accurately calculate returns and because of manual errors that the University made in performing return calculations. In addition, the University did not have an adequate monitoring process to identify those errors. Not having a process that consistently calculates and returns the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. Recommendations: The University should: • Strengthen its controls to ensure that it accurately calculates returns of Title IV funds when required, including review of the variables it uses in those calculations. • Accurately determine the number of days in the payment period and configure its student information system to exclude any scheduled breaks, as required. • Strengthen its monitoring controls to ensure that it detects and corrects errors in return of Title IV calculations and returns Title IV funds. Views of Responsible Officials: The University has carefully reviewed the findings outlined in the recent financial aid audit report, and we acknowledge and agree with the identified areas for improvement. Your thorough examination has provided valuable insights into our financial aid processes, and we appreciate the effort invested in ensuring transparency and accountability. In response to the findings, we are committed to taking immediate and comprehensive corrective actions to address the identified issues and enhance the overall effectiveness of our financial aid management. Our team is already in the process of developing a detailed Corrective Action Plan that will outline the specific steps we will take to rectify the noted deficiencies. We understand the importance of financial aid in supporting our students' academic endeavors, and we are dedicated to ensuring that our processes align with the highest standards of integrity and compliance.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222320; and Federal Direct Student Loans, P268K232320 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective, and the program begin date is the date the student began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). Enrollment is reported for a specific location of each campus; that is, the eight-digit Office of Postsecondary Education Identification (OPEID) number. Most students are enrolled in coursework at only one location. However, for students who are taking coursework at multiple locations of the same school, the school must determine which location is the student’s “primary location” and report the combined enrollment for the student using that location to NSLDS. A student’s “primary location” is the location where the student is taking more coursework than at any other location. Reporting a student’s enrollment at the main campus does not satisfy the enrollment reporting requirement if aid was disbursed or the student was physically attending school at a different location (NSLDS Enrollment Reporting Guide, November 2022, Chapters 4 and 6). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). Tarleton State University (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes to NSLDS when required. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 20 (33 percent) of 61 students tested, the University did not report or did not accurately report campus- or program-level data elements to NSLDS. Specifically: • For 19 students, the University incorrectly reported the OPEID number of the main campus instead of the OPEID number of the location where the students were taking the majority of their coursework. The University asserted that it reports the main campus OPEID number for all students to NSLDS, which would result in errors affecting all students who did not take the majority of their coursework at the main campus location. Additionally: o For 1 of those 19 students, the University did not report an enrollment status to NSLDS at the campus or program level. The University asserted that it reported the student’s enrollment and graduated statuses to NSC; however, those statuses were not reported to NSLDS. o For 1 of those 19 students, the program begin date was reported incorrectly. The University reported the program begin date for a program from which the student had withdrawn, instead of the first day of the term in which the student began attendance in a new program. • For one student, the University did not accurately report the student’s graduated status at the campus level to NSLDS. The student’s status was reported as graduated at the program level but was reported as withdrawn at the campus level. In addition, the withdrawn status was not received by NSLDS until 132 days after the student graduated. The University had a process to monitor enrollment information reported to NSC; however, that process was not sufficient to identify the errors discussed above. Not reporting student information accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in school status, deferments, grace periods, and repayment schedules. Recommendation: The University should strengthen its controls to ensure that campus- and program-level data elements are reported accurately and in a timely manner to NSLDS. Views of Responsible Officials: The Office of the Registrar has thoroughly reviewed the findings related to enrollment reporting, specifically concerning instances highlighted in the recent financial aid audit report. We acknowledge and agree with the identified discrepancies and are committed to addressing these issues promptly. For the student in question where the program begin date was reported incorrectly, we recognize the significance of accurately reporting program begin dates and maintaining accurate and consistent reporting across relevant systems. Regarding the case where the graduated status was inaccurately reported at the campus level, we understand the impact of such discrepancies and the delay in reporting. We recognize the importance of precise and timely enrollment reporting, and we are committed to enhancing our processes to prevent similar issues in the future. Our team is actively working on these corrective measures, and we aim to demonstrate significant improvements in the accuracy and timeliness of our reporting.

Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; 84.379; and 84.408 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A234136; Federal Work-Study Program, P033A224136; Federal Pell Grant Program, P063P225286; Federal Direct Student Loans, P268K235286; Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T235286; and Postsecondary Education Scholarships For Veteran's Dependents (Iraq and Afghanistan Service Grant (IASG)), P408A225286 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: Unknown Repeat Finding: No Satisfactory Academic Progress: A student is eligible to receive Title IV, Higher Education Act of 1965 (HEA) program assistance if the student maintains satisfactory academic progress in his or her course of study according to the institution’s published standards of satisfactory academic progress (SAP) that satisfy the provisions of Title 34, Code of Federal Regulations (CFR), Section 668.34 (Title 34, CFR, Section 668.32(f)). An institution’s SAP policy must include a qualitative component that consists of grades or comparable factors that are measurable against a norm and a quantitative component that consists of the pace at which students must progress through their program to ensure that they will graduate within the maximum time frame required to complete their education (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 1, Chapter 1). For an undergraduate program measured in credit hours, a period that is no longer than 150-percent of the published length of the educational program, as measured in credit hours, should be used to determine the maximum time frame for the quantitative component of SAP (Title 34, CFR, Section 668.34(b)(1)). For 1 (2 percent) of 45 students tested, Texas A&M University (University) did not calculate SAP in accordance with its policy. Specifically, the University did not update the program hours for the Bachelor of Science in Nursing program in its student information system when it changed the program length from 123 hours to 120 hours during the 2017–2018 award year. Therefore, this issue would have affected all students enrolled in the program. As a result, the maximum time frame calculation incorrectly allowed students to exceed the maximum hours without failing SAP. Incorrectly calculating the maximum time frame increases the risk that students could receive financial assistance for which they are not eligible. Recommendation: The University should ensure that the maximum time frame is configured in its student information system with the accurate number of credit hours for each degree program. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P225286; and Federal Direct Student Loans, P268K235286 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). To protect a student’s interest subsidy, institutions are required to report a graduated status for students who have completed their course of study (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4 and Appendix C). For instances in which a student completes one academic program and then enrolls in another academic program at the same school, the school must report two separate enrollment transactions: one showing the completion of the first program and its effective date and credential level, and the other showing the enrollment in the second program and its effective date (Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Texas A&M University (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University’s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University’s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 2 (3 percent) of 61 students tested, the University did not accurately report graduated status changes to NSLDS. Both students graduated from the Doctor of Veterinary Medicine program, but were reported to NSLDS as withdrawn. After auditors brought this to the University’s attention, the University determined that the issue was caused by the students being on two separate reports sent to NSC. NSC included the students on a warning file provided to the University to review and correct. However, the University did not complete a review of the warning file or make updates to those students’ enrollment status. As a result, NSC subsequently submitted a withdrawn status for those students. The University asserted the issue affected 158 additional Doctor of Veterinary Medicine program graduates, and indicated it was in the process of updating NSLDS with the correct enrollment status. Not reporting student status changes accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The University should strengthen its process of reporting graduated students and ensure that warning files related to graduated students are addressed and corrected. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Southern University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always ensure that (1) access to modify information and process transactions in the student information system and (2) administrative access at the network level was limited to only current employees and users who needed that access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made to those systems. Recommendation: The University should ensure that user access to its student information system and administrative access to its network is appropriately limited to employees based on current job responsibilities. Views of Responsible Officials: The Office of Technology acknowledges and agrees with the finding.

Eligibility Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; 84.379; and 93.925 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224145; Federal Work-Study Program, P033A224145; Federal Pell Grant Program, P063P222327; Federal Direct Student Loans, P268K232327; Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232327; and Scholarships for Health Professions Students from Disadvantaged Backgrounds – Scholarships for Disadvantaged Students (SDS), 5 T08HP39322-03-00, 5 T08HP39282-03-00 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 Cost of Attendance: The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student’s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the “tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.” An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his or her family are expected to pay for educational expenses; it is computed by the federal central processor and included on the student’s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student’s financial aid exceeds the student’s need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student’s financial need (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). Texas Southern University (University) uses algorithmic budgeting to build COA budgets for each term based on a student’s classification (undergraduate or graduate); residency (in-state or out-of-state); living status (on_x0002_campus, off-campus, or with parent); and enrollment level (full-time, three-quarter-time, half-time, or less-than_x0002_half-time). Budgeting rules within the University’s student information system are established to assign various budget components based on the factors noted above. For 7 (11 percent) of 65 students tested, the University incorrectly calculated the COA. Specifically, the University assigned an incorrect amount for books and supplies for these students. Those errors occurred because the University decreased the default amount for the books and supplies budget component but did not update the algorithmic budget table in its student information system to reflect that change. As a result, the COA was overstated by $40 for each of those students. The errors discussed above did not result in overawards of financial assistance; therefore, there were no questioned costs. However, by incorrectly calculating COA, the University increases the risk of overawarding or underawarding financial assistance to students. Federal Pell Grant: When awarding Federal Pell Grant assistance to students, institutions use the payment and disbursement schedules provided each year by the U.S. Department of Education for determining award amounts (Title 34, CFR, Section 690.62(a)). Those schedules provide the maximum annual amount a student would receive for a full academic year for a given enrollment status, EFC, and COA. There are separate schedules for three-quarter time, half-time, and less-than-half-time students (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 3; and Title 34, CFR, Section 690.63(b)). For 2 (3 percent) of 65 students tested who received Federal Pell Grants, the University did not award the correct amount of Federal Pell Grant assistance. Specifically, the University awarded those students less than they were eligible to receive. The University did not identify additional credit hours from late registration in the students’ Federal Pell Grant award determinations. As a result, the students were underawarded a total of $1,544 in Federal Pell Grant assistance. Federal Direct Student Loans: A borrower who has reached the aggregate borrowing limit for Direct Subsidized Loans and Direct Unsubsidized Loans may not receive additional loans. Once the loans are repaid, in full or in part, the borrower may apply for additional loans. The aggregate unpaid principal amount of all Direct Subsidized Loans made to a student may not exceed $23,000 for any student who has not successfully completed a program of study at the undergraduate level (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 5; and Title 34, CFR, Section 685.203(d)(1)). The University did not always disburse Federal Direct Student Loans in accordance with applicable limits. Specifically, the University exceeded the aggregate limit for Subsidized Direct Loans. Auditors determined that a student had been awarded $500 in excess of the aggregate limit of $23,000. The University manually cleared a hold to enforce the loan limit, without properly reviewing or adjusting the student’s loan. After auditors brought the overaward issue to the University’s attention, it returned the loan funds; therefore, there were no questioned costs. However, by not properly reviewing account holds, the University increases the risk of overawarding financial assistance to students. Satisfactory Academic Progress: A student is eligible to receive Title IV, Higher Education Act of 1965 (HEA) program assistance if the student maintains satisfactory academic progress in his or her course of study according to the institution’s published standards of satisfactory academic progress (SAP) that satisfy the provisions of Title 34, CFR, Section 668.34 (Title 34, CFR, Section 668.32(f)). An institution’s SAP policy must include a qualitative component that consists of grades or comparable factors that are measurable against a norm and a quantitative component that consists of the pace at which students must progress through their program to ensure that they will graduate within the maximum time frame required to complete their education. For a graduate program, a period defined by the institution that is based on the length of the educational program should be used to determine the maximum time frame for the quantitative component of SAP (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 1, Chapter 1; and Title 34, CFR, Section 668.34(b)). Additionally, an institution’s SAP policy should provide that, if at the time of evaluation, the student has not achieved the required grade point average, is not successfully completing his or her program of study at the required pace, or has not completed the program within the maximum time frame, the student is no longer eligible for Title IV aid. The policy should provide specific procedures for disbursements to students on financial aid warning or probation status and permit the student to appeal a determination; it should also provide specific procedures for re-establishing eligibility to receive Title IV aid and the basis on which a student may file an appeal (Title 34, CFR, Section 668.34(a)). For 1 (2 percent) of 65 students tested, the University did not calculate SAP in accordance with its policy. The student re-enrolled in the Fall 2022 term after a gap in attendance, and the University did not perform a manual SAP calculation, which would have shown that the student did not meet the minimum required pace as defined in the University’s SAP policy. The student would have been required to submit an appeal, and have that appeal approved, to receive financial assistance. The student was initially overawarded $6,184. Part of the funds were returned as a result of a Return of Title IV Funds calculation after the student withdrew, and the remaining funds were returned after auditors brought the issue to the University’s attention. Therefore, there were no questioned costs. Not calculating SAP compliance increases the risk that students could receive financial assistance for which they are not eligible. Institutional Student Information Records (ISIR): The U.S. Department of Education automatically distributes (or “pushes”) to institutions certain ISIR transactions processed by the Central Processing System (CPS); it then requires the institutions to take some sort of action. An example of a pushed ISIR would be a student-corrected ISIR that causes a change to the EFC. Institutions are required to review all pushed ISIRs and assess any potential effect on students’ eligibility for assistance (Technical Reference for Electronic Date Exchange (EDE) 2022-2023). The University did not have a process to address errors to ensure that all ISIR data was loaded accurately and completely into its student information system. Specifically, the University did not reconcile records received from CPS-pushed ISIRs to the University’s student information system records during the Fall 2022 term and part of the Spring 2023 term. As a result, some eligible students did not receive their financial assistance until making an inquiry of the University. Recommendations: The University should: • Ensure that it accurately configures COA budget components within its student information system. • Award students Federal Pell Grant assistance based on actual enrollment. • Disburse Subsidized Direct Loans within the student’s applicable aggregate limit. • Ensure that all students are evaluated for Satisfactory Academic Progress prior to disbursing financial assistance. • Properly reconcile all records received from CPS-pushed ISIRs. Views of Responsible Officials: Cost of Attendance (COA): The Office of Student Financial Success agrees with the auditor’s findings indicating that 7 of 65 students tested had an incorrect COA specifically related to the students’ books and supplies portion of the budget. Views of Responsible Officials: Federal Pell Grant: The Office of Student Financial Success agrees with the findings that 2 of 65 students tested were not awarded the correct amount of Federal Pell grant funds. Views of Responsible Officials: Federal Direct Student Loans: The Office of Student Financial Success agrees with the finding that 1 student did not receive federal student loans in accordance with applicable limits. Views of Responsible Officials: Satisfactory Academic Progress: The Office of Student Financial Success agrees with the finding that 1 of 65 students did not receive an SAP calculation in accordance with TSU policy. Views of Responsible Officials: Institutional Student Information Records (ISIR): The Office of Student Financial Success agrees with the finding related to Institutional Student Information Records.

Special Tests and Provisions – Disbursements To or On Behalf of Students Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224145; Federal Work-Study Program, P033A224145; Federal Pell Grant Program, P063P222327; Federal Direct Student Loans, P268K232327; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232327 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Award and Disbursement Notifications: Before an institution disburses Title IV, Higher Education Act of 1965 (HEA) program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each Title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans (Title 34, Code of Federal Regulations (CFR), Section 668.165(a)(1)). If an institution credits a student’s ledger account with Federal Direct Student Loan (Direct Loan) funds or Teacher Education Assistance for College and Higher Education (TEACH) Grant funds, the institution must notify the student or parent of (1) the anticipated date and amount of the disbursement, (2) the student’s or parent’s right to cancel all or a portion of that loan or grant and have the loan or grant proceeds returned to the U.S. Department of Education, and (3) the procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan or grant, or loan or grant disbursement (Title 34, CFR, Section 668.165(a)(2)). The institution must provide the notice in writing no earlier than 30 days before, and no later than 30 days after, crediting the student’s ledger account at the institution (Title 34, CFR, Section 668.165(a)(3)). For 61 (100 percent) of 61 disbursements tested, Texas Southern University (University) did not send an award or disbursement notification as required. The University asserted it did not send award notifications to students because it relied on the Common Origination and Disbursement (COD) Disclosure Statements sent by the Department of Education. However, the COD Disclosure Statements did not include all required elements of the award notification. In addition, the University did not consistently send disbursement notifications for the Fall 2022 term, and did not send any disbursement notifications for the Spring 2023 term. The issues with disbursement notifications were attributed to both manual error and disabling of the University’s automated processes. Further, the disbursement notifications that were sent for the Fall 2022 term did not include all required elements. Not receiving award and disbursement notifications impairs students’ and parents’ ability to budget for the cost of attending or exercise the option to cancel their loans or grants. Allowable Charges and Credit Balance Authorizations: An institution may credit a student's ledger account with Title IV, HEA program funds to pay for allowable charges associated with the current payment period. Allowable charges are: (1) the amount of tuition, fees, and institutionally provided room and board assessed the student for the payment period or the prorated amount of those charges if the institution debits the student's ledger account for more than the charges associated with the payment period; and (2) the amount incurred by the student for the payment period for purchasing books, supplies, and other educationally related goods and services provided by the institution for which the institution obtains the student's or parent's authorization under Section 668.165(b) (Title 34, CFR, Section 668.164(c)(1)). A Title IV, HEA credit balance occurs whenever the amount of Title IV, HEA program funds credited to a student's ledger account for a payment period exceeds the amount assessed the student for allowable charges associated with that payment period. A Title IV, HEA credit balance must be paid directly to the student or parent as soon as possible, but no later than (1) fourteen days after the balance occurred if the credit balance occurred after the first day of class within a payment period; or (2) fourteen days after the first day of class of a payment period if the credit balance occurred on or before the first day of class within that payment period (Title 34, CFR, Section 668.164(h)). If an institution obtains written authorization from a student or parent, as applicable, the institution may: (1) use the student’s or parent’s Title IV, HEA program funds to pay for charges that are included in that authorization, and (2) hold on behalf of the student or parent any Title IV, HEA program funds that would otherwise be paid directly to the student or parent as a credit balance, unless the Secretary provides funds to the institution under the reimbursement payment method or the heightened cash monitoring payment method (Title 34, CFR, Section 668.165(b)(1)). An institution may not use Title IV funds to pay finance charges or fees that are incurred because a student uses a financing method provided by the school to pay for educational expenses over time. Because students or families choose to incur these additional expenses rather than paying the balance due at registration, the additional charges are not considered educational expenses, and may not be included in a student’s cost of attendance. (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 2). For 8 (13 percent) of 61 students tested, the University used Title IV funds to pay unallowable charges. Specifically, the University credited the students’ ledger accounts during the payment period for installment handling charges and late installment charges. Although the University obtained authorization from the students to apply Title IV funds to charges other than tuition, fees, or institutionally provided room and board, that authorization did not extend to those unallowable charges. For 6 (11 percent) of 57 students tested, the University did not return credit balances to students or parents within 14 days of the disbursement date or first day of class. Specifically, the University returned credit balances to those students between 21 and 78 days. The University asserted those errors were caused by changes to the term allocations, and inadequate tracking of credit balances and associated refunds. Not receiving all Title IV funds a student is entitled to, or not receiving those funds in a timely manner, impairs students’ and parents’ ability to budget for the cost of attending. Recommendations: The University should strengthen its controls to ensure that: • It identifies all students that require an award or disbursement notification, and sends those notifications to the students. • Award and disbursement notifications include all required elements. • It does not credit student ledger accounts for unallowable charges. • Credit balances caused by the awarding of Title IV funds are returned to students in a timely manner. Views of Responsible Officials: Award and Disbursement Notifications: The Office of Student Financial Success agrees with the finding related to award and disbursement notifications. Views of Responsible Officials: Allowable Charges and Credit Balance Authorizations: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224145; Federal Pell Grant Program, P063P222327; Federal Direct Student Loans, P268K232327; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232327 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Return of Title IV Calculations: When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs, and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). For 8 (13 percent) of 61 students tested, Texas Southern University (University) incorrectly calculated the amount of Title IV funds to be returned for unofficially withdrawn students. Specifically, those 8 students were enrolled in the Fall 2022 term, and the University did not use the last date of attendance identified in the University’s automated report process. For return of Title IV funds, the University uses an automated report process to identify students who have unofficially withdrawn from a term; however, that process was inconsistently followed or not completed in determining the students’ withdrawal dates. The incorrect withdrawal dates used by the University were prior to the students’ actual withdrawal dates, which resulted in the University returning more Title IV funds than required for those students; therefore, there were no questioned costs. Those errors occurred because the University did not have an adequate process to determine the withdrawal dates of students who unofficially withdrew from the University. Timeliness of Returns: For an institution that is not required to take attendance, the institution must determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the earliest end date of (1) the payment period or period of enrollment, (2) the academic year in which the student withdrew, or (3) the educational program from which the student withdrew (Title 34, CFR, Section 668.22(j)(2)). An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). For 35 (57 percent) of 61 students tested who withdrew and required a return of Title IV funds, the University did not return the funds within the required time frame. Specifically: • For 23 students who unofficially withdrew in the Fall 2022 term, the University did not determine the withdrawal date within the required 30-day time frame, nor did it return the Title IV funds within the required 45-day time frame. The University determined the withdrawal date and returned the Title IV funds at the end of the Spring 2023 term. • For 9 students who unofficially withdrew in the Spring 2023 term, the University did not determine the students’ withdrawal date within the required 30-day time frame. The University determined the withdrawal date for those students between 31 and 52 days after the end of the period of enrollment. • For 3 students who withdrew in the Fall 2022 term, the University determined the withdrawal dates and performed the return calculations; however, it did not return the Title IV funds within the required 45-day time frame. The University asserted that for two students, this was due to an oversight in processing the return of those funds. The University returned the funds for those two students 71 and 115 days after it determined that the students withdrew. For the third student, the University completed a return calculation but did not return the funds as required. After auditors brought this error to the University’s attention, the University returned the funds to the U.S. Department of Education; therefore, there were no questioned costs. Those errors occurred because the University did not have an effective monitoring process to identify those errors and because of manual errors the University made in performing the return calculations. Not making returns within the required time frame reduces the funds available to the U.S. Department of Education for its program management. Recommendations: The University should: • Strengthen its process to ensure that it accurately determines the withdrawal date for students who unofficially withdraw from the University in a timely manner. • Strengthen its monitoring controls to ensure that it detects and corrects errors in return of Title IV calculations and returns Title IV funds in a timely manner. Views of Responsible Officials: Return of Title IV Calculations: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes. Views of Responsible Officials: Timeliness of Returns: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222327; and Federal Direct Student Loans, P268K232327 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: 2020-115 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective, and the program begin date is the date the student began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). Texas Southern University (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3). For 10 (17 percent) of 60 students tested, the University did not accurately report campus- or program level data elements to NSLDS. Specifically, the program length was reported incorrectly for the students’ master’s degree or doctoral degree programs. Additionally, for 1 of those 10 students, the University inaccurately reported the effective date of the student’s graduated status at the campus and program levels. The date reported was eight days before the actual date of graduation for the student. For 17 (45 percent) of 38 students tested who received a Direct Loan and ceased to be enrolled on at least a half-time basis or changed their permanent address, the students’ enrollment status was not reported to NSLDS in a timely manner. Specifically: • For 13 students, the University reported the students’ graduated status to NSLDS between 73 and 100 days after the students graduated. • For 2 students, the University reported the students’ enrollment level change to NSLDS 89 and 95 days after the effective date of the status change. • For 2 students, the University reported the students’ withdrawal status to NSLDS 68 and 70 days after the students’ withdrawal date. The errors discussed above occurred because the University (1) did not configure its information system to accurately report student enrollment information to NSLDS, (2) does not have a process to monitor student enrollment and program information reported to NSLDS, and (3) does not have a reporting process that allows it to make corrections to ensure that it certifies and submits graduated statuses in a timely manner. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayments schedules. Recommendation: The University should develop and implement controls to ensure that campus- and program-level data elements are reported to NSLDS accurately and in a timely manner. Views of Responsible Officials: Campus and Program Level Data: Texas Southern University agrees with the finding related to not accurately reporting campus or program level data elements to NSLDS. Views of Responsible Officials: Enrollment Status Updates: Texas Southern University agrees with the finding related to not accurately reporting enrollment status updates to NSLDS in a timely manner. Views of Responsible Officials: Accurate Attendance Reporting: Texas Southern University agrees with the finding related to not accurately reporting enrollment status updates to NSLDS in a timely manner.

Special Tests and Provisions – Gramm-Leach-Bliley Act - Student Information Security Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Gramm-Leach-Bliley Act: Institutions must protect sensitive data, including information obtained in support of the administration of federal student financial assistance programs, as required by the Gramm-Leach-Bliley Act (GLBA) (Public Law 106-102). Under their Program Participation Agreement (PPA) and the GLBA, postsecondary educational institutions must protect student financial aid information, with particular attention to information provided by the Department of Education or otherwise obtained in support of the administration of the Title IV Federal student financial aid programs (Dear Colleague Letter, July 1, 2016 (GEN-16-12)). Institutions are required to develop, implement, and maintain an information security program that includes the minimum elements in Title 16, Code of Federal Regulations (CFR), Section 314.4. In addition, the institution must designate a qualified individual responsible for overseeing, implementing, and enforcing the institution’s information security program (Title 16, CFR, Section 314.4(a)). Texas Southern University (University) did not implement an information security program as required by the GLBA. The University did not have a written information security program (and therefore did not address any of the minimum elements), and it did not designate a Qualified Individual responsible for implementing and monitoring its information security program. The University asserted that this was due to significant staffing issues in its Information Technology Department. Not implementing the required safeguards in an information security program and designating a Qualified Individual to implement and enforce those safeguards increases the University’s risk of data breach or loss. Recommendations: The University should: • Develop and implement an information security program that contains all elements required by the GLBA and the Code of Federal Regulations. • Designate a Qualified Individual responsible to implement and monitor its information security program. Views of Responsible Officials: Gramm-Leach-Bliley Act: The University acknowledges and agrees with the findings.

Eligibility Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; 84.379; 84.408; and 93.925 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224122; Federal Work-Study Program, P033A224122; Federal Pell Grant Program, P063P220387; Federal Direct Student Loans, P268K230387; Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T230387; Postsecondary Education Scholarships For Veteran's Dependents (Iraq and Afghanistan Service Grant (IASG)), P408A220387; and Scholarships for Health Professions Students from Disadvantaged Backgrounds - Scholarships for Disadvantaged Students (SDS), 5 T08HP39298-03-00 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Cost of Attendance: The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student’s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the “tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.” An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his or her family are expected to pay for educational expenses; it is computed by the federal central processor and included on the student’s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student’s financial aid exceeds the student’s need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student’s financial need (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, CFR, Sections 668.2, 673.5, and 685.301). Texas State University (University) uses algorithmic budgeting to build COA budgets for each term based on a student’s classification (undergraduate or graduate); residency (in-state or out-of-state); housing status (on_x0002_campus, off-campus, or living with parent); and enrollment status (full-time, three-quarter-time, half-time, or less_x0002_than-half-time). Budgeting rules within the University’s student financial assistance system are established to assign various budget components based on the factors noted above. For 1 (2 percent) of 44 students tested, the University incorrectly calculated the COA. Specifically, the University assigned a less-than-half-time COA when the student was enrolled full-time. As a result, the student’s COA was understated by $9,545. After auditors brought the issue to the University’s attention, it identified a total of 84 total students who were affected, including 56 students who received Title IV financial assistance. Those errors occurred because the University did not recalculate the COA for students in the Pathway program after enrollment was finalized for the Spring 2023 term. The errors discussed above did not result in overawards of financial assistance; therefore, there were no questioned costs. However, by incorrectly calculating COA, the University increases the risk of overawarding or underawarding financial assistance to students. Recommendation: The University should strengthen its controls to ensure that it correctly calculates students’ COA budgets for the Pathway program in accordance with its process. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Tech University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate level of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.

Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222328; and Federal Direct Student Loans, P268K232328 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: $562 Repeat Finding: No Cost of Attendance: The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student’s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the “tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.” An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his or her family are expected to pay for educational expenses; it is computed by the federal central processor and included on the student’s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student’s financial aid exceeds the student’s need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student’s financial need (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations, Sections 668.2, 673.5, and 685.301). Texas Tech University (University) uses algorithmic budgeting to build COA budgets based on student classification (undergraduate or graduate), academic program (for example, certain programs have increased tuition costs), enrollment level (full-time, three-quarter-time, half-time, or less-than-half-time), living status (on_x0002_campus, off-campus, or living with parents), and residency (in-state or out-of-state). Budgeting rules within the University’s student information system are established to assign various budget components based on the student’s reported expected enrollment. For 3 (5 percent) of 65 students tested, the University incorrectly calculated the COA. Specifically: • For one student, the University assigned an incorrect loan fee to the COA. The University manually canceled the student’s loan, but asserted that it did not remove the fee because the student was still eligible to receive the loan. As a result, the student’s COA was overstated by $60. • For one student, the University did not adjust the student’s COA budget to reflect the student’s actual enrollment. The University manually assigned a three-quarter-time budget to the student. Due to the manual update, the COA was not subject to an automated update process to adjust the COA to less-than-half-time status at census. In addition, the student was not included in the University’s process for reviewing manually updated budgets. As a result, the student’s COA was overstated by $4,157, and the student was overawarded $562 associated with ALN 84.063, Federal Pell Grant Program, award number P063P222328. • For one student, the University did not adjust the student’s tuition and fees budget component to reflect a change in the student’s academic program. The student’s major changed after the initial budget had been assigned. As a result, the student’s COA was overstated by $903; however, the University did not overaward financial assistance to that student. Incorrectly calculating COA increases the risk of overawarding or underawarding financial assistance to students. Recommendation: The University should strengthen its controls to ensure that it correctly calculates students’ COA budgets in accordance with its process and does not overaward financial assistance to students. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.

Special Tests and Provisions – Disbursements To or On Behalf of Students Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222328; and Federal Direct Student Loans, P268K232328 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Award Notifications: Before an institution disburses Title IV, Higher Education Act of 1965 (HEA) program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each Title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans (Title 34, Code of Federal Regulations (CFR), 668.165(a)(1)). For 7 (16 percent) of 43 disbursements tested, Texas Tech University (University) did not send an award notification or sent an award notification that did not include all required information. Specifically: • For four students who enrolled in the Fall 2022 term after August 1, 2022, the University did not send an award notification. The University sent award notifications to all students enrolled for the Fall 2022 term prior to that date. However, it did not have a process in place to identify and send award notifications to students who enrolled after that date. Therefore, this issue would have affected all students who enrolled in the Fall 2022 term after August 1, 2022. • For three students who enrolled in the Spring 2023 term, the award notifications did not contain the type or amount of funds that the student or his or her parent could expect to receive. The University notified students of expected financial assistance through email, and the award notification emails for the Fall 2022 term contained a hyperlink for students to access their account in the student information system to review the expected loan types and amounts. However, the award notification emails for the Spring 2023 term did not contain that hyperlink. This issue would have affected all students who enrolled after August 1, 2022, and only for the Spring 2023 term. The University did not have adequate controls in place to ensure that all students received award notifications and that the notifications contained all required elements. Not receiving award notifications, or receiving incomplete award notifications, impairs students’ and parents’ ability to budget for the cost of attending. Recommendations: The University should: • Strengthen its controls to ensure that it identifies all students that require an award notification, and sends those notifications to the students. • Ensure that award notifications contain all required elements. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; 84.379; and 84.408 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224151; Federal Pell Grant Program, P063P222328; Federal Direct Student Loans, P268K232328; Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232328; and Postsecondary Education Scholarships For Veteran's Dependents (Iraq and Afghanistan Service Grant (IASG)), P408A222328 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: Unknown Repeat Finding: No When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). For distance education, documenting that a student has logged into an online class is not sufficient to demonstrate academic attendance by the student. An institution must demonstrate that a student participated in class or was otherwise engaged in an academically related activity. Only active participation by a student in an instructional activity related to the student’s course of study that meets the definition of “academic engagement” in Title 34, CFR, Section 600.2 and takes place during a payment period or period of enrollment qualifies as attendance in an academically related activity (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 5, Chapter 2). For 1 (5 percent) of 20 students tested, Texas Tech University (University) did not have evidence of academic engagement in the distance education course from which the student’s withdrawal date was determined. The University asserted that when an instructor submits a failing grade for a student, the instructor is required to provide the date of last academic activity. That date is recorded in the University’s student information system and used by the University to determine the unofficial withdrawal date for Return of Title IV purposes. However, the University did not have a process in place to require instructors to provide or maintain evidence of academic engagement in distance education courses. As a result, the University could not demonstrate that the student participated or otherwise engaged in an academically related activity in that course to support the last date of attendance used by the University for Return of Title IV purposes. Having a process that does not consistently calculate and return the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. Recommendations: The University should: • Ensure that evidence of academic engagement is consistently documented for students in distance education courses. • Strengthen its controls to ensure that it accurately calculates returns of Title IV funds when required, including review of the variables it uses in those calculations. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222328; and Federal Direct Student Loans, P268K232328 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: 2020-117 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less_x0002_than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). For instances in which a student completes one academic program and then enrolls in another academic program at the same school, the school must report two separate enrollment transactions: one showing the completion of the first program and its effective date and credential level, and the other showing the enrollment in the second program and its effective date (Dear Colleague Letter, March 30, 2012 (GEN-12-06)). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). Texas Tech University (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 5 (8 percent) of 60 students tested, the University did not report campus- or program-level data elements accurately or in a timely manner to NSLDS. Specifically: • For three students, the enrollment effective date was correctly reported as the first day of the Summer 2023 term to NSLDS at the program level; however, the enrollment effective date was incorrectly reported as the day after the last day of the Spring 2023 term at the campus level because it did not align with the date reported at the program level. The effective date reported at the campus level should be the same date reported at the program level because those dates reflect the same enrollment status change. • For one student, the University incorrectly reported the student’s program-level enrollment status and the student’s program begin date as the day after the last day of the Spring 2023 term. The enrollment status should have been reported at the program level as full-time effective the first day of the Fall 2023 term. • For one student, the campus-level enrollment status change should have been reported as graduated, but it was incorrectly reported as withdrawn. Additionally, the student was pursuing dual majors, and the program level enrollment status was correctly reported as graduated for one program in a timely manner but incorrectly reported as withdrawn for the second program. The incorrect campus-level enrollment change and program level enrollment change were reported to NSLDS 135 days after the effective date of the graduation. The errors discussed above were caused by issues related to the configuration of the enrollment reporting processes in the University’s student information system. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayments schedules. Recommendations: The University should: • Strengthen its controls to ensure that campus-level and program-level data elements are reported to NSLDS accurately and in a timely manner. • Ensure that dual-major graduated statuses are reported to NSLDS accurately and timely for all programs. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.

Special Tests and Provisions – Additional Locations Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.268 Pass-Through Agency: N/A Award Number: Federal Direct Student Loans, P268K232328 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: $3,452,367 Repeat Finding: No Eligibility and Certification Approval Report: Each institution’s most recent Eligibility and Certification Approval Report (ECAR) lists the institution’s main campus and any additional approved locations. For any other locations at which an institution offers 50 percent or more of an eligible program, the institution must notify the U.S. Department of Education of that location if the institution plans to disburse Title IV funds to students enrolled at that location (Title 34, Code of Federal Regulations (CFR), Section 600.21(a)(3)). An institution may not disburse Title IV funds to students at that location before it reports to the U.S. Department of Education about that location (Title 34, CFR, Section 600.21(d)). Texas Tech University’s (University) most recent ECAR did not include all additional locations. Specifically, the University offered more than 50 percent of an eligible program at the School of Veterinary Medicine at Amarillo; however, the University did not include the location on its most recent ECAR nor did it submit notice or an application for approval of additional location as required. The University asserted that the error occurred due to turnover of the Primary Designee responsible for requesting approval of the new location, which resulted in the University failing to adequately review its ECAR to ensure that it reported all locations at which it offered more than 50 percent of an eligible program. The University disbursed $3,452,367 in federal student financial assistance to 108 students at the unreported location during the 2022–2023 award year. Those disbursements were associated with ALN 84.268, Federal Direct Student Loans, award number P268K232328, and were considered questioned costs. After auditors brought the issue to the University’s attention, the University added the location to its ECAR and the School of Veterinary Medicine at Amarillo was approved on July 26, 2023. Recommendation: The University should update its ECAR as required, and ensure that it does not disburse federal financial assistance to students at locations that are not approved by the U.S. Department of Education. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P223367; and Federal Direct Student Loans, P268K233367 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: 2016-122 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less_x0002_than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective, and the program begin date is the date the student began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate(NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). Texas Tech University Health Sciences Center (Health Sciences Center) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the Health Sciences Center reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes to NSLDS when required. Although the Health Sciences Center uses the services of NSC, the Health Sciences Center still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3.3). For 6 (10 percent) of 62 students tested, the Health Sciences Center did not accurately report campus level enrollment effective dates or did not report enrollment status changes to NSLDS. Specifically: • For one student, the enrollment status effective date was reported incorrectly at the campus-level. The student’s enrollment status for the Spring 2023 term decreased from full-time to less-than-half-time in April 2023; however, the effective date was reported as January 2023. • For five students, the Health Sciences Center did not report the students’ enrollment status changes to NSLDS. Two of those students withdrew, two students graduated, and one student received an approved leave of absence. The Health Sciences Center asserted that the errors discussed above were caused by issues related to the configuration of the enrollment reporting processes in the Health Sciences Center’s student information system, manual reporting errors, and not having adequate controls to ensure that student enrollment information reported to NSC was accurately reported to NSLDS. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The Health Sciences Center should strengthen its controls to ensure that campus-level enrollment statuses and effective dates are reported accurately and in a timely manner to NSLDS. Views of Responsible Officials: The University acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-142 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. Specifically, a user was granted administrative access in the student information system, which included the ability to modify information and process transactions, such as authorizing and disbursing aid. The University did not remove the administrative access after the user’s specific job responsibilities no longer required that level of access. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: To the point that The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. OIT and Financial Aid acknowledge that a user was given elevated access that was not removed when the assigned maintenance task was completed.

Cash Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 93.264; and 93.364 Pass-Through Agency: N/A Award Number: Nurse Faculty Loan Program (NFLP), 2 E01HP28792-04-00; and Nursing Student Loans (NSL), 1 E4CHP46343-01-00 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: $19,593 Repeat Finding: No Institutions must maintain advance payments of federal awards in interest-bearing accounts (Title 2, Code of Federal Regulations (CFR), Section 200.305(b)(8)). Interest earned amounts up to $500 per year may be retained by the non-federal entity for administrative expense. Any additional interest earned on federal advance payments deposited in interest-bearing accounts must be remitted annually to the Department of Health and Human Services Payment Management System (PMS) through an electronic medium using either the Automated Clearing House (ACH) network or a Fedwire Funds Service payment (Title 2, CFR, Section 200.305(b)(9)). The University of Texas at Arlington (University) did not remit interest to the Department of Health and Human Services’ PMS as required. Specifically, the University: • Maintained advance payments of Nurse Faculty Loan Program (NFLP) funds in an interest-bearing account, which earned $17,803 in interest in fiscal year 2023. • Maintained advance payments of Nursing Student Loan (NSL) funds in an interest-bearing account, which earned $2,290 in interest in fiscal year 2023. The University asserted it was not aware of the requirement to remit interest for NFLP and NLS, and believed the earnings on interest could be retained as a source of additional funds for lending to students. After the $500 allowance for administrative expenses, the University would be required to remit interest totaling $17,553 associated with ALN 93.264, Nurse Faculty Loan Program, award number 2 E01HP28792-04-00 and $2,040 associated with ALN 93.364, Nursing Student Loans, award number 1 E4CHP46343-01-00, which are considered questioned costs. Recommendation: The University should ensure that interest in excess of $500 per year earned on federal cash draws is remitted annually to the Department of Health and Human Services. Views of Responsible Officials: The University has been adhering to the guidance found in the Nursing Faculty and Student Loan award documentation as well as the guidance found in the HRSA EHB Guidance Document regarding interest earned on the advanced payments. The guidance found in these documents states that interest earned in these loan funds should be maintained in an interest-bearing account and deposited in the loan fund. It further states that the interest earned can be retained as an important source of additional funds for lending to students. However, as a result of the finding from this audit, the University acknowledges that interest in excess of $500 must be remitted annually to the Department of Health and Human Services. Corrective Action Plan: The University will remit annually any interest earned in excess of $500 to the Department of Health and Human Services. Implementation Date: 2/2024 Responsible Person: Andrea Wright, Executive Director of Accounting Service

Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224172; Federal Pell Grant Program, P063P222335; and Federal Direct Student Loans, P268K232335 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Cost of Attendance: The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student’s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the “tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.” An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his or her family are expected to pay for educational expenses; it is computed by the federal central processor and included on the student’s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student’s financial aid exceeds the student’s need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student’s financial need (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). The University of Texas at Arlington (University) uses algorithmic budgeting to build COA budgets for each term based on a student’s classification (undergraduate or graduate), dependency (dependent or independent), residency (in-state or out-of-state), living status (on-campus, off-campus, or with parents), and enrollment level (full-time, three-quarter-time, half-time, or less-than-half-time). Budgeting rules within the University’s student information system are established to assign various budget components based on the factors noted above. For 3 (5 percent) of 63 students tested, the University incorrectly calculated the COA. Specifically: • For two students, the University understated the COA by assigning a books component that did not reflect the students’ actual enrollment status. Those errors occurred because the University budgeted the students’ books at half-time enrollment instead of full-time enrollment. The University attributed the cause to human error associated with a manual budget rebuild in the student information system. As a result, the COA was understated by $200 for each of those students. • For one student, the University assigned an incorrect budget for the cost of tuition and fees component during the Summer 2022 term. The University attributed the cause to human error. As a result, the COA was understated by $198. The errors discussed above did not result in overawards of financial assistance; therefore, there were no questioned costs. However, by incorrectly calculating COA, the University increases the risk of overawarding or underawarding financial assistance to students. Federal Pell Grant: A student is eligible to receive a Federal Pell Grant for the period of time required to complete his or her first undergraduate baccalaureate course of study (Title 34, CFR, Section 690.6(a)). When awarding Federal Pell Grant assistance to students, institutions use the payment and disbursement schedules provided each year by the U.S. Department of Education for determining award amounts (Title 34, CFR, Section 690.62(a)). Based on a review of the full population of student financial assistance recipients, the University awarded a total of $1,593 in Federal Pell Grant assistance to 2 post-baccalaureate students who were not eligible for that assistance. The University asserted queries designed to identify these issues were not run timely due to staffing issues within the Financial Aid department. After auditors brought those errors to the University’s attention, the University returned the funds to the U.S. Department of Education; therefore, there were no questioned costs. For 1 (2 percent) of 63 students tested, the University did not award Federal Pell Grant assistance to an eligible student. Specifically, the student was eligible to receive $1,790 in Federal Pell Grant assistance, but did not receive an award from the University. The University asserted that the error occurred because the student made a late registration change and was missed on the University’s add report. As a result, the student was underawarded Federal Pell Grant assistance; therefore, there were no questioned costs. Federal Direct Student Loans: Direct Subsidized and Unsubsidized Loans have annual and aggregate limits that are the same for all students at a given grade level and dependency status. In general, a loan may not be more than the amount the borrower requests, the borrower’s unmet financial need, the borrower’s COA, or the borrower’s maximum borrowing limit. (U.S. Department of Education 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 5). For 1 (2 percent) of 63 students tested, the University did not disburse Direct Loans in accordance with applicable limits. Specifically, the University disbursed a Subsidized Direct Loan in excess of the student’s aggregate Subsidized Direct Loan and Total Direct Loan limits. After auditors brought the overaward issue to the University’s attention, it returned the loan funds; therefore, there were no questioned costs. The University asserted that error occurred because the University did not receive an updated history file in a timely manner due to issues with the National Student Loan Data System (NSLDS). Federal Supplemental Educational Opportunity Grants (FSEOG): The FSEOG program provides grants to eligible undergraduate students. Institutions are required to award FSEOG first to Federal Pell Grant recipients who have the lowest EFC. If an institution has FSEOG funds remaining after giving FSEOG awards to all Federal Pell Grant recipients, it can then award the remaining FSEOG funds to eligible students with the lowest EFCs who did not receive Federal Pell Grants (Title 34, CFR, Section 676.10). Based on a review of the full population of student financial assistance recipients, the University awarded a total of $750 in FSEOG assistance to a student who was working towards a second bachelor’s degree and thus was not eligible for that assistance. The student was awarded FSEOG in the Spring 2023 term after earning a first bachelor’s degree in the Fall 2022 term. The University asserted this was a manual error caused by a counselor canceling the student’s Federal Pell Grant, but failing to cancel the student’s FSEOG award. After auditors brought the issue to the University’s attention, it removed the grant funds from the student’s account; therefore, there were no questioned costs. Recommendations: The University should: • Strengthen its controls to ensure that it correctly calculates students’ COA budgets in accordance with its process. • Award Federal Pell Grant assistance only to eligible students. • Ensure that students are awarded Federal Pell Grants for which they are eligible. • Disburse Subsidized Direct Loans within the student’s applicable aggregate limit. • Award FSEOG assistance only to eligible students. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222335; Federal Direct Student Loans, P268K232335; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232335 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No COD Reporting: Institutions must submit Federal Pell Grant, Iraq and Afghanistan Service Grant, Direct Loan, and Teacher Education Assistance for College and Higher Education (TEACH) Grant disbursement records to the Common Origination and Disbursement (COD) system no later than 15 days after making the disbursement or becoming aware of the need to adjust a previously reported disbursement. Reporting this information helps ensure that institutions have the most accurate information available about students’ federal awards and helps prevent an institution from overawarding students (Title 34, Code of Federal Regulations (CFR), Section 690.83(b); U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 1; and Federal Register, Volume 88, Number 120). Certain data elements are required to be reported as part of a student’s origination and disbursement record, including the student’s Social Security number, Central Processing System (CPS) transaction number, enrollment date, cost of attendance, the start and end dates for the academic term, disbursement amount, and disbursement date (2022-2023 COD Technical Reference, Volume II). For 5 (8 percent) of 61 students tested, the University of Texas at Arlington (University) did not accurately report all origination record data elements to the COD system. Two of those students had both errors discussed below. Specifically, • For four students, the University reported an incorrect academic end date for one or more Direct Loan originations made on behalf of the students during the award year. • For three students, the University reported an incorrect cost of attendance for one or more Federal Pell Grant and/or Direct Loan originations made on behalf of the students during the award year. The University asserted that its developer was unable to identify the specific cause of these errors, but determined that the errors were related to an automated process rather than a manual change. In addition, the University did not have a sufficient monitoring process in place to identify those discrepancies. Not accurately reporting information to the COD system could result in the institution overawarding federal funds. Recommendation: The University should strengthen its controls to ensure that academic end dates and cost of attendance are reported to the COD system accurately. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222335; and Federal Direct Student Loans, P268K232335 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). For 5 (8 percent) of 61 students tested who withdrew and required a return of Title IV funds, the University of Texas at Arlington (University) did not return the funds within the required time frame. Specifically, the University returned the Title IV funds to the U.S. Department of Education between 101 to 390 days after the University determined the students withdrew. For four of those students, the updates to the students’ returns occurred after auditors selected those students for review. The error for the other student was identified by the University, but the funds were not returned in a timely manner. After the University became aware of the errors, it returned those funds to the U.S. Department of Education; therefore, there were no questioned costs. The University did not have an adequate monitoring process to ensure that Title IV funds were returned within the required time frame. Not making returns within the required time frames reduces the funds available to the U.S. Department of Education for its program management. Recommendation: The University should ensure that it returns Title IV funds within required time frames. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222335; and Federal Direct Student Loans, P268K232335 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: 2020-143 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). The University of Texas at Arlington (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes to NSLDS when required. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 18 (30 percent) of 61 students tested, the University did not accurately report campus- and program level data elements to NSLDS. One of those students was affected by two of the errors discussed below. Specifically: • For 13 students, the University incorrectly reported the students’ enrollment status at the program level to NSLDS. Six students were reported as less-than-half-time instead of half-time, and seven students were reported as half-time instead of full-time. Those errors occurred because the enrollment reporting processes in the University’s student information system were not configured appropriately for the Graduate Nursing program. • For four students, the enrollment effective date was reported correctly to NSLDS at the program level; however, the University incorrectly reported the first day of the Spring 2023 term as the enrollment effective date at the campus level. The effective date reported at the program level should have been the same date reported at the campus level because those dates reflect the same enrollment status change. As noted above, those errors were caused by issues with the configuration of the enrollment reporting processes for the Graduate Nursing Program. • For two students, the University did not report the students’ graduated status or did not accurately report the graduated status at the campus and program levels to NSLDS. One student’s graduated status was accurately reported at the campus level, but was reported as withdrawn at the program level. The other student was inaccurately reported as withdrawn at both the campus- and program-levels. Those errors occurred because the students’ statuses required manual reporting and were overlooked. Not reporting student enrollment and program information accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The University should strengthen its controls to ensure that all status changes are reported accurately to NSLDS. Views of Responsible Officials: The University acknowledges and agrees with the finding. The University will work to develop and implement corrective action to improve and update the processes.

General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Austin (University) did not appropriately restrict user access to its student information system. Specifically, an employee retained the ability to modify student financial aid awards after transitioning from the Office of Student Financial Aid to another department within the University. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, one of the University’s departments did not enable the control designed to prevent developers from migrating their own code changes into production. Not having sufficient segregation of duties controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate segregation of duties. Views of Responsible Officials: The University acknowledges and agrees with the finding. In this case, the employee transitioned from the Office of Scholarships and Financial Aid (OSFA) to the Student Financial Aid implementation project. It was intended for this employee to retain his prior access for a time so he could help provide backstop support while his duties were transitioned to other employees within OSFA. This access should have been removed once his duties were successfully transitioned. Views of Responsible Officials: The University acknowledges and agrees with the finding. However, technical limitations in the current financial aid management system require that a particular mainframe programming library be exempted from the change control mechanisms that are used in all other libraries that can update student financial aid information.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224173; Federal Pell Grant Program, P063P222336; and Federal Direct Student Loans, P268K232336 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Return of Title IV Calculations: When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs, and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). For 1 (2 percent) of 60 students tested, the University of Texas at Austin (University) incorrectly calculated the amount of Title IV funds to be returned. Specifically, the University initially determined that the student officially withdrew on March 10, 2023, and the University incorrectly determined that the student completed more than 60 percent of the term. The University subsequently incorrectly determined that the student unofficially withdrew on February 10, 2023, and processed a return of Title IV funds in the amount of $18,742. After auditors brought the error to the University’s attention, it re-performed the return calculation using the correct date of withdrawal and reinstated the appropriate amount of funds to the student. Not having a process that consistently calculates and returns the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. Coronavirus Aid, Relief, and Economic Security (CARES) Act: Section 3508 of the CARES Act directs the Secretary to waive the statutory requirement for institutions to return Title IV funds (R2T4) as the result of student withdrawals related to a qualifying emergency. For any student who begins attendance in a payment period or period of enrollment that includes March 13, 2020, or begins between March 13 and the later of December 31 or the last date that the national emergency is in effect, and subsequently withdraws from the period as a result of COVID-19-related circumstances, an institution is not required to return Title IV funds. The CARES Act requires an institution to report to the Department information specific to each student for whom it was not required to return Title IV funds under the waiver exception. An institution must determine the total amount of grant and loan assistance that otherwise would have been returned, identified in Step 5 of the R2T4 calculation, had the calculation been performed. Therefore, it will continue to be necessary for institutions to perform an R2T4 calculation for each student covered by the CARES Act R2T4 waiver (Electronic Announcement titled UPDATED Guidance for interruptions of study related to Coronavirus (COVID-19), June 16, 2020). For 1 (50 percent) of 2 students tested who were eligible for relief under the CARES Act, the University incorrectly processed a return of Title IV funds. The University determined that the student was eligible to receive an R2T4 waiver under Section 3508 of the CARES Act. However, the University subsequently processed a return of Title IV funds for the student. The University asserted that error occurred because the student was listed on a census report showing students who did not enroll in sufficient hours to receive aid, and the student’s Title IV funds were incorrectly returned because the student’s CARES Act R2T4 waiver was overlooked. After auditors brought the error to the University’s attention, it reinstated the student's aid and reported to the U.S. Department of Education that the student qualified for relief under the CARES Act waiver exemption and reported the amount of relief given. Not accurately identifying students who qualify for a waiver could result in those students not receiving aid to which they are entitled. Timeliness of Returns: An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). For 1 (2 percent) of 58 students tested who withdrew and required a return of Title IV funds, the University did not return the funds within the required time frame. The University performed the return calculation and executed a transaction to return the funds within its student information system; however, the University did not return the Title IV funds to the U.S. Department of Education within the required 45-day time frame due to an error in processing the return of those funds. After auditors selected the student for testing, the University returned Title IV funds as required; therefore, there were no questioned costs. Not returning funds within the required time frame reduces the information available to the U.S. Department of Education for its program management. The University had a process to review its calculations for returns of Title IV funds; however, it did not have adequate controls to ensure that it identified the errors discussed above. Recommendations: The University should strengthen its controls to ensure that it: • Accurately calculates returns of Title IV funds when required, including review of the variables it uses in those calculations. • Performs return of Title IV calculations and returns funds within the required time frame. Views of Responsible Officials: The University acknowledges and agrees with the finding. For 1 (2 percent) of 58 students tested who withdrew and required a return of Title IV funds, the University did not return the funds within the required time frame. For 1 (2 percent) of 60 students tested, the University incorrectly calculated the amount of Title IV funds to be returned. For 1 (50 percent) of 2 students tested eligible for relief under the CARES Act, the University incorrectly processed a return of Title IV funds. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to improve the processes further.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222336; and Federal Direct Student Loans, P268K232336 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). Institutions may not be immediately aware of a student’s enrollment status change when it happens. When the institution does become aware of such a change, it must report the status change using the actual enrollment status effective date, not the date when the institution became aware of the change (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4; and U.S. Department of Education Electronic Announcement, NSLDS Enrollment Reporting - Submission Dates, Effective Dates and Certification Dates, April 20, 2017). The University of Texas at Austin (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 4 (7 percent) of 61 students tested, the University did not accurately report program-level data elements to NSLDS. Specifically, the University incorrectly reported the program enrollment effective date as the first date of the term, rather than the actual effective date of the students’ enrollment status change. The University asserted those errors were caused by changes implemented in its automated enrollment reporting process to reflect the new 2023 academic calendar. Not reporting student status changes accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The University should strengthen its controls to ensure that program enrollment effective dates are reported to NSLDS accurately. Views of Responsible Officials: The University acknowledges and agrees with the Program Enrollment Effective Date finding. Program Enrollment Effective Date is defined as the date a student’s enrollment status changes during a semester of enrollment (i.e. student’s enrollment status changes from full-time to half-time status). For 4 (7 percent) of 61 students tested, the University did not accurately report program-level data elements to NSLDS. Specifically, the University incorrectly reported the program enrollment effective date as the first date of the term, rather than the date the students’ enrollment status actually changed. The University asserted those errors were caused by required changes to its automated enrollment reporting process to accommodate the newly implemented structure of its academic calendar. Through analysis of the exceptions identified in the audit, the University has developed and implemented corrective action to further improve the processes.

Special Tests and Provisions – Perkins Loan Recordkeeping and Record Retention Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.038 Pass-Through Agency: N/A Award Number: Federal Perkins Loan Program, award number N/A Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Institutions must retain promissory and master promissory notes (MPNs) and repayment records for each Perkins Loan program loan made. Institutions are required to keep original paper promissory notes or original paper MPNs and repayment schedules in a locked, fireproof container. The original promissory notes and repayment schedules must be kept until the loans are satisfied (Title 34, Code of Federal Regulations (CFR), Section 674.19(e)(4)). An institution shall retain disbursement and electronic authentication and signature records for each loan made using an MPN for at least three years from the date the loan is canceled, repaid, or otherwise satisfied. (Title 34, CFR, Section 674.19(e)(3)(i)). The University of Texas at Austin (University) did not consistently maintain paper Perkins Loan records in a locked, fire-proof container, as required. Paper records for open Perkins Loans were properly maintained; however, paper records for retired Perkins Loans were stored in paper boxes in the basement storage room of the Student Accounts Receivable Office. The University asserted that only staff in the Student Accounts Receivables Office have access to the storage room with electronic key cards, and that the records were stored in boxes because the University did not have sufficient filing cabinet storage available. Not appropriately storing paper records results in noncompliance with the Federal Perkins loan program record retention requirements and increases the risk of data loss or breach. Recommendation: The University should ensure that retired Perkins Loan original paper promissory notes or original paper MPNs and repayment schedules are stored in a locked, fireproof container for the prescribed period. Views of Responsible Officials: The University acknowledges and agrees with the finding. The University will work to develop and implement corrective action to further improve the processes.

Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224174; Federal Work-Study Program, P033A224174; Federal Pell Grant Program, P063P223234; Federal Direct Student Loans, P268K233234; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T233234 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Cost of Attendance: The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student’s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the “tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.” An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his or her family are expected to pay for educational expenses; it is computed by the federal central processor and included on the student’s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student’s financial aid exceeds the student’s need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student’s financial need (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, CFR, Sections 668.2, 673.5, and 685.301). The University of Texas at Dallas (University) established different COA budgets for each term based on a student’s tuition rate (guaranteed or variable); classification (undergraduate or graduate); residency (in-state and out-of-state); living status (on-campus, off-campus, or at home); and enrollment level (full-time, three-quarter-time, half-time, or less-than-half-time). Budgeting formulas within the University’s student information system are used to assign various budget components based on the factors noted above. The University did not always accurately configure COA budget components in its student information system. Specifically, the University incorrectly set the Summer transportation budget for a certain group of students—undergraduate students with a guaranteed tuition rate who were in-state residents living at home and enrolled half-time—to $640 instead of $928. After auditors brought the issue to the University’s attention, it identified 299 students who were affected. As a result, the COA for those students was understated by a total of $86,112 for the Summer 2023 term. The errors discussed above did not result in overawards of financial assistance; therefore, there were no questioned costs. However, by incorrectly calculating COA, the University increases the risk of overawarding or underawarding financial assistance to students. Recommendation: The University should ensure that it accurately configures COA budget components within its student information system. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes. While reviewing the population for submission to the auditors, the University determined that the above error had occurred. Since the timing was still within the summer semester, we corrected the COA component error and provided institutional grant funding for those students who had increased need due to the update in their summer transportation budget. There were only 2 students who needed to have their loans repackaged to avoid under awarding federal aid, which was done.

Special Tests and Provisions – Perkins Loan Recordkeeping and Record Retention Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.038 Pass-Through Agency: N/A Award Number: Federal Perkins Loan Program, award number N/A Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Institutions must retain promissory and master promissory notes (MPNs) and repayment records for each Perkins Loan program loan made. Institutions are required to keep original paper promissory notes or original paper MPNs and repayment schedules in a locked, fireproof container. The original promissory notes and repayment schedules must be kept until the loans are satisfied. If required to release original documents in order to enforce the loan, the institution must retain certified true copies of those documents. After the loan obligation is satisfied, the institution shall return the original or a true and exact copy of the note marked “paid in full” to the borrower, or otherwise notify the borrower in writing that the loan is paid in full and retain a copy for the prescribed period (Title 34, Code of Federal Regulations (CFR), Section 674.19(e)(4)). For 9 (100 percent) of 9 retired loans tested, the University of Texas at Dallas (University) did not send paid-in-full notifications to those borrowers, as required. As a result, the University did not maintain the required documentation of the paid-in-full notifications to those borrowers after their loan obligations were satisfied. Those errors occurred because the University’s third-party Perkins Loan servicer erroneously excluded the paid-in-full letter service from its contract renewal with the University, and the University failed to identify the discrepancy. The University provided auditors with correspondence from the servicer in which the servicer accepted responsibility for the oversight. The servicer stated that it would send the paid-in-full letters to borrowers retroactively. Not maintaining adequate documentation results in noncompliance with the Federal Perkins loan program record retention requirements. Additionally, not notifying borrowers of their loans’ paid-in-full status increases the risk of borrowers making overpayments on their loans. Recommendation: The University should ensure that paid-in-full notifications are sent to all borrowers who satisfy their Perkins Loan obligations, and retain a copy of each notification for the prescribed period. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes. For many years, the University's Perkins Loan portfolio was being serviced by Campus Partners. Shortly after Heartland ECSI acquired Campus Partners, the University made the decision to fully transfer their Perkins Loan services to ECSI. This transition was intended to not only continue receiving the services provided by our current servicer, but also to enhance services in other areas. During the early stages of this transition our team was very involved in determining which services would be included in the contract. It was determined that there were services considered standard with Campus Partners that were not included with ECSI; the paid-in-full letter was one of these services. The Bursar management team noticed this discrepancy and mentioned this to our ECSI Client Relationship Coordinator dated April 27, 2017. Based on the information provided, it was our understanding that the paid-in-full letter service would be an active service with ECSI. Since ECSI does not retain copies of these letters, we had no reason to question whether this service was being done. During this audit, it was brought to our attention that the most recent contract renewal with ECSI did not indicate that they were providing the paid- in-full letters on our behalf. As the Bursar Office began to research this process, we were told by an ECSI representative that they did not see this service being provided to our borrowers. After further communication with our Client Relationship Coordinator, it was determined that ECSI did not "turn on" this service after the order request was submitted to their implementation team, as determined via email on October 12, 2023. The University understands it's our responsibility to ensure processes are being completed by all servicing organizations. In response, ECSI has submitted an order for this service to be activated for all future accounts. They have also agreed to send paid in full notices to all borrowers dating back to the beginning of our contract, as well as revising the contract to ensure this service is included moving forward.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222338; and Federal Direct Student Loans, P268K232338 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less_x0002_than-half-time status, the institution must use the effective date that the student changed to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1 and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). To protect a student’s interest subsidy, institutions are required to report a graduated status for students who have completed their course of study (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4 and Appendix C). Institutions may not be immediately aware of a student’s enrollment status change when it happens. When the institution does become aware of such a change, it must report the status change using the actual enrollment status effective date, not the date when the institution became aware of the change (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4; and U.S. Department of Education Electronic Announcement, NSLDS Enrollment Reporting - Submission Dates, Effective Dates and Certification Dates, April 20, 2017). The University of Texas at El Paso (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 3 (5 percent) of 62 students tested, the University did not accurately report campus- and program level enrollment effective dates or did not report enrollment status changes to NSLDS. Specifically: • For two students, the effective date of the students’ withdrawn status was reported incorrectly at both the campus and program levels. The University reported one student’s withdrawal effective date as the end of the payment period, instead of the actual date of withdrawal. The University determined the second student never attended the Summer 2023 term and reported an incorrect withdrawal date instead of the student’s actual last date of attendance, which was the last day of the Fall 2022 term. • For one student, the University did not report an enrollment status change to NSLDS. The student’s enrollment status decreased from three-quarter-time to less-than-half-time after the University approved a medical withdrawal for certain courses after the term had ended, and the University did not report that change. For 2 (12 percent) of 17 students tested who received a Direct Loan and ceased to be enrolled on at least a half-time basis or changed their permanent address, the students’ enrollment status was not reported to NSLDS in a timely manner. Specifically, both students’ graduated status was received by NSLDS 73 days after the students graduated. The University had a process to monitor enrollment information reported to NSC and NSLDS; however, that process was not sufficient to identify the errors discussed above. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendations: The University should: • Strengthen its controls to ensure that campus- and program-level enrollment statuses and effective dates are reported to NSLDS accurately. • Ensure that all graduated statuses are reported to NSLDS in a timely manner. Views of Responsible Officials: The University acknowledges the findings and recommendations. Staff members have begun working on the corrective action plan to improve the processes and implement any necessary changes by the end of the spring 2024 semester.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224169; Federal Pell Grant Program, P063P223294; Federal Direct Student Loans, P268K233294; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T233294 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: $64,905 Repeat Finding: No Return of Title IV Calculations: When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The total number of calendar days in a payment period or period of enrollment includes all days within the payment period or period of enrollment that the student was scheduled to complete, excluding scheduled breaks of at least five consecutive days. Scheduled breaks of at least five consecutive days are also excluded from the number of calendar days the student completed in that period (Title 34, CFR, Section 668.22(f)(2)(i)). The University of Texas at San Antonio (University) made errors in Title IV return calculations for 14 (56 percent) of 25 students tested. Those errors occurred because the University did not exclude break days from its calculations of returns of Title IV funds for the Spring 2023 term as required; therefore, that issue would have affected all students who withdrew from the Spring 2023 term and had a return calculation performed. Although the amount of unearned Title IV assistance calculated for those students was incorrect, there were no questioned costs because the University returned more funds than required. In addition, for 3 (12 percent) of 25 students tested who did not have a return of Title IV funds made, the University did not perform a return calculation as required. Those errors occurred because the University incorrectly used 7 break days instead of 8 break days when determining whether students who withdrew from the Spring 2023 term had completed 60 percent or more of the term. As a result, the University did not perform return calculations and return funds as required for students who withdrew between March 26 and March 28, 2023, which resulted in total questioned costs of $50,146 associated with ALN 84.268, Federal Direct Student Loans, award number P268K233294, and $14,759 associated with ALN 84.063, Federal Pell Grant Program, award number P063P223294. The University did not have an adequate monitoring process to identify those errors. Not having a process that consistently calculates and returns the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. Recommendations: The University should: • Accurately determine the number of days in the payment period and exclude any scheduled breaks as required. • Strengthen its controls to ensure that it detects and corrects errors in return of Title IV calculations and returns Title IV funds. Views of Responsible Officials: The University acknowledges and agrees with the finding that were the result of staff turnover. Through analysis of the exceptions identified in the audit, the University has worked to develop and implement corrective action.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P223294; and Federal Direct Student Loans, P268K233294 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Enrollment is reported for a specific location of each campus; that is, the eight-digit Office of Postsecondary Education Identification (OPEID) number. Most students are enrolled in coursework at only one location. However, for students who are taking coursework at multiple locations of the same school, the school must determine which location is the student’s “primary location” and report the combined enrollment for the student using that location to NSLDS. A student’s “primary location” is the location where the student is taking more coursework than at any other location. Reporting a student’s enrollment at the main campus does not satisfy the enrollment reporting requirement if aid was disbursed or the student was physically attending school at a different location (NSLDS Enrollment Reporting Guide, November 2022, Chapters 4 and 6). The University of Texas at San Antonio (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes to NSLDS when required. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 2 (8 percent) of 26 students tested, the University inaccurately reported the OPEID number to NSLDS. Specifically for those students, the University incorrectly reported the OPEID number of the main campus, instead of the OPEID number of the location where the students were taking the majority of their coursework. The University asserted that it reports the main campus OPEID number for all students to NSLDS; therefore, the errors discussed above would have affected all students who did not take the majority of their coursework at the main campus location. Not reporting student information accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The University should implement a process to ensure that it accurately reports the OPEID number to NSLDS for students who take the majority of their coursework at a location other than the main campus. Views of Responsible Officials: The University acknowledges and agrees with the finding, which has had no impact on accurately reporting the enrollment levels of our students to NSLDS.

Special Tests and Provisions – Perkins Loan Recordkeeping and Record Retention Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.038 Pass-Through Agency: N/A Award Number: Federal Perkins Loan Program, award number N/A Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Institutions must retain promissory and master promissory notes (MPNs) and repayment records for each Perkins Loan program loan made. Institutions are required to keep original paper promissory notes or original paper MPNs and repayment schedules in a locked, fireproof container. The original promissory notes and repayment schedules must be kept until the loans are satisfied. If required to release original documents in order to enforce the loan, the institution must retain certified true copies of those documents. After the loan obligation is satisfied, the institution shall return the original or a true and exact copy of the note marked “paid in full” to the borrower, or otherwise notify the borrower in writing that the loan is paid in full and retain a copy for the prescribed period (Title 34, Code of Federal Regulations (CFR), Section 674.19(e)(4)). For 25 (100 percent) of 25 retired loans tested, the University of Texas at San Antonio (University) did not send paid-in-full notifications to those borrowers, as required. As a result, the University did not maintain the required documentation of the paid-in-full notifications being sent to those borrowers after their loan obligations were satisfied. Not maintaining adequate documentation results in noncompliance with the Federal Perkins loan program record retention requirements. Additionally, not notifying borrowers of their loans’ paid-in-full status increases the risk of borrowers making overpayments on their loans. The University asserted the errors discussed above occurred because it believed the University’s third-party Perkins Loan servicer was responsible for sending the paid-in-full notifications. The University was unable to provide its contract with the third-party Perkins Loan servicer. However, the University obtained a list of services rendered from the servicer, which showed the paid-in-full letter service was not a service included in the contract. Recommendation: The University should ensure that paid-in-full notifications are sent to all borrowers who satisfy their Perkins Loan obligations, and retain a copy of each notification for the prescribed period. Views of Responsible Officials: UTSA acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, UTSA will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222337; and Federal Direct Student Loans, P268K232337 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). To protect a student’s interest subsidy, institutions are required to report a graduated status for students who have completed their course of study (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4 and Appendix C). Institutions may not be immediately aware of a student’s enrollment status change when it happens. When the institution does become aware of such a change, it must report the status change using the actual enrollment status effective date, not the date when the institution became aware of the change (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4; and U.S. Department of Education Electronic Announcement, NSLDS Enrollment Reporting - Submission Dates, Effective Dates and Certification Dates, April 20, 2017). For 6 (10 percent) of 61 students tested, the University of Texas Health Science Center at San Antonio (Health Science Center) did not accurately report the program begin date to NSLDS. Specifically, those students began attendance in the program on July 29, 2019; however, the Health Science Center reported a program begin date of either January 6, 2020, or May 18, 2020. The Health Science Center asserted those errors were caused by the CIP code year conversion from 2010 to 2020 within the Health Science Center Registrar’s Office. After auditors brought those errors to the Health Science Center’s attention, the Health Science Center corrected the program begin date for all six students. Not reporting student program information accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The Health Science Center should strengthen its controls to ensure that program begin dates are reported to NSLDS accurately. Views of Responsible Officials: The University acknowledges noncompliance of validating program start dates aligned to Classification of Instructional Program (CIP codes) and graduated student status. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to improve processes.

Special Tests and Provisions – Perkins Loan Recordkeeping and Record Retention Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.038 Pass-Through Agency: N/A Award Number: Federal Perkins Loan Program, award number N/A Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Institutions must retain promissory and master promissory notes (MPNs) and repayment records for each Perkins Loan program loan made. Institutions are required to keep original paper promissory notes or original paper MPNs and repayment schedules in a locked, fireproof container. The original promissory notes and repayment schedules must be kept until the loans are satisfied. If required to release original documents in order to enforce the loan, the institution must retain certified true copies of those documents. After the loan obligation is satisfied, the institution shall return the original or a true and exact copy of the note marked “paid in full” to the borrower, or otherwise notify the borrower in writing that the loan is paid in full and retain a copy for the prescribed period (Title 34, Code of Federal Regulations (CFR), Section 674.19(e)(4)). For 17 (100 percent) of 17 retired loans tested, the University of Texas Health Science Center at San Antonio (Health Science Center) did not send paid-in-full notifications to those borrowers, as required. As a result, the Health Science Center did not maintain the required documentation of the paid-in-full notifications to those borrowers after their loan obligations were satisfied. The Health Science Center asserted that it was unaware of this requirement and that it only provided paid-in-full confirmations when requested by the borrower. Not maintaining adequate documentation results in noncompliance with the Federal Perkins loan program record retention requirements. Additionally, not notifying borrowers of their loans’ paid-in-full status increases the risk of borrowers making overpayments on their loans. Recommendation: The Health Science Center should ensure that paid-in-full notifications are sent to all borrowers who satisfy their Perkins Loan obligations and retain a copy of each notification for the prescribed period. Views of Responsible Officials: The University acknowledges non-compliance with Perkins loan recordkeeping and will implement corrective action to improve processes.

General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas Permian Basin (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to implement further access limitations and enhanced its periodic review of access.

Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224178; Federal Work-Study Program, P033A224178; Federal Pell Grant Program, P063P223265; Federal Direct Student Loans, P268K233265; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T233265 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Cost of Attendance: The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student’s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the “tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.” An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his or her family are expected to pay for educational expenses; it is computed by the federal central processor and included on the student’s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student’s financial aid exceeds the student’s need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student’s financial need (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). The University of Texas Permian Basin (University) uses algorithmic budgeting to build COA budgets for each term based on a student’s classification (undergraduate or graduate), program (in-person or online), residency (in_x0002_state or out-of-state), living status (on-campus, off-campus, or at home with parents), and enrollment level (full_x0002_time, three-quarter-time, half-time, or less-than-half-time). Budgeting rules within the University’s student information system are established to assign various budget components based on the factors noted above. For 60 (98 percent) of 61 students tested, the University incorrectly calculated the COA. For some of the students discussed below, there were multiple errors in the COA calculation. Specifically: • For 38 students, the University assigned an incorrect amount for the fees, loan fees, and/or transportation budget components. Those errors occurred because the amounts were incorrectly loaded into the budget tables in the University’s student information system. The University asserted that it discovered these issues in April 2023, and attempted to manually update individual student accounts that were affected. As a result, the COA for those students was overstated, and three students were overawarded a total of $2,871. After auditors brought the overawards to the University’s attention, it returned funds to the U.S. Department of Education; therefore, there were no questioned costs. • For 15 students, the University assigned an in-person budget instead of an online advanced budget. Those errors occurred because the University failed to consistently communicate which programs were offered online to the financial aid office, which would have helped ensure that the student information system was updated appropriately. As a result, the COA for those students was overstated, and one of those students was overawarded a Subsidized Direct Loan in the amount of $919. After auditors brought the overaward to the University’s attention, it returned funds to the U.S. Department of Education; therefore, there were no questioned costs. • For 12 students, the University incorrectly assigned an additional room and board fee. As a result, the COA was overstated by $50 per term for each of those students; however, the University did not overaward financial assistance to those students. • For eight students, the University did not adjust the students’ COA to reflect the students’ actual enrollment. The University did not have a process to freeze student enrollment levels in order to recalculate COA after census. As a result, the COA for those students was overstated; however, the University did not overaward financial assistance to those students. The University did not have adequate controls in place to review budgets used in the calculation of COA and accurately assign those budgets to students. Incorrectly calculating COA increases the risk of overawarding or underawarding financial assistance to students. Recommendation: The University should strengthen its controls to ensure that it correctly calculates students’ COA budgets in accordance with its process and does not overaward financial assistance to students. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to implement additional controls as it relates to calculation of the Cost of Attendance.

Special Tests and Provisions – Disbursements To or On Behalf of Students Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Direct Student Loans, P268K233265; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T233265 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Award and Disbursement Notifications: Before an institution disburses Title IV, Higher Education Act of 1965 (HEA) program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each Title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans (Title 34, Code of Federal Regulations (CFR), Section 668.165(a)(1)). If an institution credits a student’s ledger account with Federal Direct Student Loan (Direct Loan) funds or Teacher Education Assistance for College and Higher Education (TEACH) Grant funds, the institution must notify the student or parent of (1) the anticipated date and amount of the disbursement, (2) the student’s or parent’s right to cancel all or a portion of that loan or grant and have the loan or grant proceeds returned to the U.S. Department of Education, and (3) the procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan or grant, or loan or grant disbursement (Title 34, CFR, Section 668.165(a)(2)). The institution must provide the notice in writing no earlier than 30 days before, and no later than 30 days after, crediting the student’s ledger account at the institution (Title 34, CFR, Section 668.165(a)(3)). For 9 (15 percent) of 61 disbursements tested, the University of Texas Permian Basin (University) did not send a disbursement notification as required. Specifically, those nine students received Direct Loan disbursements, and the University did not send disbursement notifications because the University’s automated process used to identify and send disbursement notifications to students was not configured to include students whose disbursements were made manually within the student information system. The University asserted that it identified this issue in May 2023 and corrected the process in its student information system, but did not retroactively send the missing disbursement notifications for the Fall 2022 or Spring 2023 term. In addition, the University did not have a process in place to send award or disbursement notifications to TEACH Grant recipients. This error occurred because the University’s automated processes used to identify and send award and disbursement notifications to students was not configured to include TEACH Grants. The University asserted that it identified this issue in May 2023 and corrected the processes in its student information system, but it did not retroactively send missing disbursement notifications for the Fall 2022 or Spring 2023 term. Not receiving award and disbursement notifications impairs students’ and parents’ ability to budget for the cost of attending or exercise the option to cancel their loans or grants. Recommendation: The University should strengthen its controls to ensure that it identifies all students that require an award or disbursement notification, and sends those notifications to the students. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to ensure that disbursement notifications for Federal Direct Loans and TEACH grants go out to all applicable students.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224178; Federal Pell Grant Program, P063P223265; Federal Direct Student Loans, P268K233265; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T233265 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Return of Title IV Calculations: When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs, and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The total number of calendar days in a payment period or period of enrollment includes all days within the payment period or period of enrollment that the student was scheduled to complete, excluding scheduled breaks of at least five consecutive days. Scheduled breaks of at least five consecutive days are also excluded from the number of calendar days the student completed in that period (Title 34, CFR, Section 668.22(f)(2)(i)). For a program offered in modules, a student is not considered to have withdrawn if the student successfully completes either (1) a module that includes 49 percent or more of the number of days in the payment period, excluding scheduled breaks of five or more consecutive days and all days between modules; or (2) a combination of modules that together contain 49 percent or more of the number of days in the payment period, excluding scheduled breaks of five or more consecutive days and all days between modules (Title 34, CFR, Section 668.22(a)(2)(ii)(A)(2)). For 3 (6 percent) of 48 students tested who did not have a return of Title IV funds made, the University of Texas Permian Basin (University) did not perform a return calculation as required. Specifically: • For two students who were enrolled in module courses, the University did not perform a return calculation because it incorrectly determined that the students completed 49 percent or more of the number of days in the payment period. The University asserted that staff misinterpreted the 49 percent withdrawal exemption requirements. • For one student, the University did not perform a return calculation and return funds as required due to staff oversight. After auditors brought those errors to the University’s attention, the University performed the return calculations and returned the funds to the U.S. Department of Education; therefore, there were no questioned costs. In addition, the University made errors in Title IV return calculations for 11 (48 percent) of 23 students tested. Specifically, the University did not exclude any break days from the students’ return calculations as required. Those errors occurred because the University did not load the break days into its student information system when setting up the payment periods for the standard Fall 2022 and Spring 2023 terms; therefore, this issue would have affected all students who withdrew from those terms. As a result, the University returned a total of $284 less than it should have for 2 of those 11 students. After auditors brought the issue to the University’s attention, the University returned those funds to the U.S. Department of Education; therefore, there were no questioned costs. • For 3 of those 11 students, the University also incorrectly adjusted the students’ Direct Loans disbursements prior to performing the return calculation. As a result of those errors, the University returned more funds than required; therefore, there were no questioned costs. The University did not have an adequate monitoring process to identify the errors discussed above. Not having a process that consistently calculates and returns the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. Timeliness of Returns: An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). For 3 (13 percent) of 23 students tested who withdrew and required a return of Title IV funds, the University did not return the funds within the required time frame. The University returned the Title IV funds to the U.S. Department of Education 46 and 203 days after the University determined that the students withdrew. The University did not have adequate controls in place to ensure that Title IV funds were returned within the required 45-day time frame. Not making returns within required time frames reduces the funds available to the U.S. Department of Education for its program management. Recommendations: The University should: • Configure its student information system to exclude any scheduled breaks as required. • Strengthen its monitoring controls to ensure that it detects and corrects errors in return of Title IV calculations and returns Title IV funds in a timely manner. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to ensure procedures and interpretation of the regulations for the Return to Title IV have been updated to result in correct and timely return of Title IV funds.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P223265; and Federal Direct Student Loans, P268K233265 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective, and the program begin date is the date the student began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). Institutions may not be immediately aware of a student’s enrollment status change when it happens. When the institution does become aware of such a change, it must report the status change using the actual enrollment status effective date, not the date when the institution became aware of the change (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4; and U.S. Department of Education Electronic Announcement, NSLDS Enrollment Reporting - Submission Dates, Effective Dates and Certification Dates, April 20, 2017). For instances in which a student completes one academic program and then enrolls in another academic program at the same school, the school must report two separate enrollment transactions: one showing the completion of the first program and its effective date and credential level, and the other showing the enrollment in the second program and its effective date (Dear Colleague Letter, March 30, 2012 (GEN-12-06)). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). The University of Texas Permian Basin (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes to NSLDS when required. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 8 (13 percent) of 61 students tested, the University did not report enrollment status changes or did not accurately report campus- and program-level data elements to NSLDS. Specifically: • For three students, the effective date for the students’ withdrawn status was reported incorrectly. Those students were determined to have never attended the Spring 2023 term. The University incorrectly reported the last day of the Spring 2023 term as the effective date at the campus and program level, rather than the students’ actual last date of attendance. • For two students, enrollment status changes were inaccurately reported at the campus and program levels. Both students were enrolled full-time in the Spring 2023 term and had enrollment changes to half-time; however, the University incorrectly reported to NSLDS a less-than-half-time status for one student and a withdrawn status for the other student. • For two students, the University incorrectly reported the effective date of enrollment status changes at the campus and program levels. • For one student, the enrollment status for the Spring 2023 term was reported incorrectly at the campus and program levels because the University used graduate-level enrollment rather than undergraduate-level enrollment. The University asserted that the student was enrolled as an undergraduate in the Spring 2023 term and as an undergraduate and graduate in the Summer 2023 term. This error was caused by the University not submitting the student’s undergraduate program information to NSLDS. For 3 (9 percent) of 33 students tested who received a Direct Loan and ceased to be enrolled on at least a half-time basis or changed their permanent address, the students’ enrollment status was not reported to NSLDS in a timely manner. Specifically, the University reported the 3 students’ withdrawn status 118 days after it became aware that the students either never attended or unofficially withdrew from the Spring 2023 term. The issues discussed above occurred because the University (1) did not configure its student information system to accurately report student enrollment and program information to NSLDS, (2) did not establish formal and documented policies over student enrollment reporting until policies were requested by auditors, and (3) did not have an adequate process to monitor student enrollment and program information reported to NSLDS. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayments schedules. Recommendation: The University should strengthen its controls to ensure that campus- and program-level data elements are reported accurately and in a timely manner to NSLDS. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University is working to ensure that procedures and queries used for exporting enrollment information to the National Student Clearinghouse are updated so that reporting is accurate and timely.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222296; and Federal Direct Student Loans, P268K232296 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less_x0002_than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). The University of Texas Rio Grande Valley (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes to NSLDS when required. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 2 (3 percent) of 62 students tested, the University inaccurately reported the students’ program-level graduated status effective date to NSLDS. For those students, the graduated status effective date was reported correctly to NSLDS at the campus level; however, a different effective date was incorrectly reported at the program level for the students’ graduated status. The effective date reported at the program level should be the same date reported at the campus level because those dates reflect the same graduated status change. The University identified and corrected the program-level effective date for one of those students after auditors selected the student for testing. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The University should strengthen its controls to ensure that program-level data elements are reported to NSLDS accurately. Views of Responsible Officials: UTRGV acknowledges and concurs with the audit finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the process.

Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; and 84.063 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224166; and Federal Pell Grant Program, P063P222333 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal Supplemental Educational Opportunity Grants (FSEOG): The FSEOG program provides grants to eligible undergraduate students. Institutions are required to award FSEOG first to Federal Pell Grant recipients who have the lowest expected family contribution (EFC). If an institution has FSEOG funds remaining after giving FSEOG awards to all Federal Pell Grant recipients, it can then award the remaining FSEOG funds to eligible students with the lowest EFCs who did not receive Federal Pell Grants (Title 34, Code of Federal Regulations (CFR), Section 676.10). If the total amount of calculated Title IV grant or loan assistance, or both, that a student earned is greater than the total amount of Title IV grant or loan assistance, or both, that was disbursed to the student, as of the date that the institution determines that the student has withdrawn, the difference between those amounts must be treated as a post-withdrawal disbursement in accordance with Title 34, CFR, Section 668.22(a)(6) and Section 668.164(i) (Title 34, CFR, Section 668.22(a)(5)). The institution must disburse directly to a student any amount of a post-withdrawal disbursement of grant funds that is not credited to the student’s account. The institution must make the disbursement as soon as possible, but no later than 45 days after the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(a)(6)(ii)(B)(1)). Based on a review of the full population of student financial assistance recipients, the University of Houston (University) awarded a total of $6,500 in FSEOG assistance to 5 students who did not also receive a Federal Pell Grant. Specifically: • For three students, the University did not award Federal Pell Grants to those students because the students reported on their Free Application for Federal Student Aid (FAFSA) that they had earned a bachelor’s degree or were working on a degree beyond a bachelor's degree. After auditors brought these errors to the University’s attention, the University canceled the FSEOG awards to those students; therefore there were no questioned costs. • For one student, the University did not award a Federal Pell Grant to the student for the term in which the student received FSEOG funds. Due to a manual error, the University applied the student’s Federal Pell Grant to the wrong term. After auditors brought the error to the University’s attention, the University corrected the Federal Pell Grant award to the correct term; therefore there were no questioned costs. • For one student, the University did not award a Federal Pell Grant to the student due to a hold that was placed on the student’s account for an incomplete task. After auditors brought the error to the University’s attention, the University reviewed the student’s account and determined the hold should be removed. The University processed a post-withdrawal disbursement of Federal Pell Grant funds 324 days after the date of the University’s determination that the student withdrew. There were no questioned costs as a result of this error. Although the University had monitoring controls in place to ensure accurate awarding of federal funds, it did not have an adequate process to identify the errors discussed above. Recommendations: The University should: • Award FSEOG funds only to eligible students. • Complete post-withdrawal disbursements within a timely manner. Views of Responsible Officials: The University acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Disbursement To or On Behalf of Students Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222333; Federal Direct Student Loans, P268K232333; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232333 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Allowable Charges: An institution may credit a student's ledger account with Title IV, Higher Education Act of 1965 (HEA) program funds to pay for allowable charges associated with the current payment period. Allowable charges are: (1) the amount of tuition, fees, and institutionally provided room and board assessed the student for the payment period or the prorated amount of those charges if the institution debits the student's ledger account for more than the charges associated with the payment period; and (2) the amount incurred by the student for the payment period for purchasing books, supplies, and other educationally related goods and services provided by the institution for which the institution obtains the student’s or parent’s authorization under Section 668.165(b) (Title 34, Code of Federal Regulations (CFR), Section 668.164(c)(1)). If an institution obtains written authorization from a student or parent, as applicable, the institution may: (1) use the student’s or parent’s Title IV, HEA program funds to pay for charges that are included in that authorization, and (2) hold on behalf of the student or parent any Title IV, HEA program funds that would otherwise be paid directly to the student or parent as a credit balance, unless the Secretary provides funds to the institution under the reimbursement payment method or the heightened cash monitoring payment method (Title 34, CFR, Section 668.165(b)(1)). An institution may not use Title IV funds to pay finance charges or fees that are incurred because a student uses a financing method provided by the school to pay for educational expenses over time. Because students or families choose to incur these additional expenses rather than paying the balance due at registration, the additional charges are not considered educational expenses, and may not be included in a student’s cost of attendance. (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 2). For 13 (21 percent) of 62 students tested, the University of Houston (University) used Title IV funds to pay unallowable charges. Some of those students were affected by both errors discussed below. Specifically: • For eight students, the University credited student ledger accounts during the payment period for unallowable charges unrelated to tuition, fees, or institutionally provided room and board. The unallowable finance charges paid with Title IV funds included various fees (credit card processing, severance of service, installment origination, and late fees), and various loan charges. Those charges are unallowable whether the University obtains student or parent authorization or not. The University asserted it is conducting a comprehensive review of all charges to determine allowability for Title IV funds. • For eight students, the University credited student ledger accounts during the payment period for charges other than tuition, fees, or institutionally provided room and board without obtaining the authorization of the student or parent. The unallowable charges paid with Title IV funds included various parking and garage related fees, meal plan tax charges, and book loan university fund charges. Those errors occurred because the University did not have a process to obtain written authorization from a student or parent to apply Title IV funds to charges other than tuition, fees, and institutionally provided room and board. Not receiving all Title IV funds a student is entitled to impairs students’ and parents’ ability to budget for the cost of attending. Recommendations: The University should strengthen its controls to ensure that: • It does not credit student ledger accounts for unallowable charges. • It obtains written authorization from students or parents prior to crediting student ledger accounts for certain charges. Views of Responsible Officials: The University acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224166; Federal Pell Grant Program, P063P222333; Federal Direct Student Loans, P268K232333; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232333 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Return of Title IV Calculations: When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The institution must return the lesser of the total amount of unearned Title IV assistance calculated above or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance not earned by the student. For purposes of this calculation, “institutional charges” are tuition, fees, room and board (if the student contracts with the institution for the room and board), and other educationally related expenses assessed by the institution (Title 34, CFR, Section 668.22(g)). The institutional charges used in the calculation are usually the charges that were initially assessed to the student for the entire payment period or period of enrollment, as applicable. Initial charges may be adjusted only by those changes the institution made prior to the student’s withdrawal, such as a change in enrollment status unrelated to the withdrawal (U.S. Department of Education, 2022- 2023 Federal Student Aid Handbook, Volume 5, Chapter 1, Section: Institutional Charges). The University of Houston (University) made errors in Title IV return calculations for 18 (30 percent) of 60 students tested. Specifically: • For 15 students, the University made errors in determining the amount of institutional charges to be used in the return calculation by including unallowable charges in its calculation for those students. • For two students, the University returned the incorrect amount of Title IV funds due to manual entry errors. For one of those students, the University also incorrectly included unallowable charges in the student’s return calculation as discussed above. • For one student, the University incorrectly canceled the student’s Federal Pell Grant award before its calculation. The University asserted that was due to a processing error in its student information system. There were no questioned costs as a result of those errors because for each student the University returned more than the required amount or the error did not affect the amount of Title IV grant or loan assistance to be returned. Distance Education: For distance education, documenting that a student has logged into an online class is not sufficient to demonstrate academic attendance by the student. An institution must demonstrate that a student participated in class or was otherwise engaged in an academically related activity. Only active participation by a student in an instructional activity related to the student’s course of study that meets the definition of “academic engagement” in Title 34, CFR, Section 600.2 and takes place during a payment period or period of enrollment qualifies as attendance in an academically related activity (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 5, Chapter 2). For 1 (7 percent) of 14 students tested, the University did not have evidence of academic engagement in the distance education course from which the student’s withdrawal date was determined. The University relies on the last dates of academic activity provided by instructors to determine the withdrawal date for return of Title IV purposes for students who unofficially withdraw. However, the University did not have an adequate review process in place to ensure that it maintained documentation supporting attendance in distance education courses. As a result, the University could not demonstrate that the student participated or otherwise engaged in an academically related activity in that course to support the last date of attendance used by the University for return of Title IV purposes. The University did not have an adequate monitoring process to identify the errors discussed above. Not having a process that consistently calculates and returns the correct amount of Title IV funds increases the risk that the University could return the incorrect amount of Title IV funds. Recommendations: The University should: • Calculate institutional charges in accordance with U.S. Department of Education requirements. • Ensure that evidence of academic engagement is consistently documented for students in distance education courses. • Strengthen its monitoring controls to ensure that it detects and corrects errors in its calculation of Title IV funds to return. Views of Responsible Officials: The University acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222333; and Federal Direct Student Loans, P268K232333 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). The University of Houston (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes to NSLDS when required. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 3 (5 percent) of 61 students tested, the University did not report graduated status changes or did not accurately report graduated status changes at the campus and program levels to NSLDS. Specifically: • For two students, the University did not report a graduated status at the program level. However, the graduated status for both students was correctly reported at the campus level. The University asserted that it reported the graduated statuses to NSC; however, NSLDS had no record found reported for the program level. • For one student, a graduated status was not reported at the campus level, and the effective date of the graduated status was incorrectly reported at the program level. The University asserted that it reported the graduated status accurately to NSC. For 24 (75 percent) of 32 students tested who received a Direct Loan and ceased to be enrolled on at least a half-time basis or changed their permanent address, the student’s enrollment status was not reported to NSLDS in a timely manner. Specifically: • For 23 students, the students’ graduated status for the Spring 2023 term was not received by NSLDS until 85 days after that status became effective on May 11, 2023. The University certified and submitted the graduation file to NSC on June 22, 2023; however, the statuses were not received by NSLDS until August 4, 2023. • For one student, the University reported the status change 146 days after the student’s graduated status became effective. The errors discussed above occurred because the University did not have a process to ensure that student enrollment and program information reported to NSC was accurately reported to NSLDS in a timely manner. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The University should develop and implement controls to ensure that campus-level and program-level data elements are reported to NSLDS accurately and in a timely manner. Views of Responsible Officials: The University acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions - Gramm-Leach-Bliley Act - Student Information Security Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Gramm-Leach-Bliley Act: Institutions must protect sensitive data, including information obtained in support of the administration of federal student financial assistance programs, as required by the Gramm-Leach-Bliley Act (GLBA) (Public Law 106-102). Under their Program Participation Agreement (PPA) and the GLBA, postsecondary educational institutions must protect student financial aid information, with particular attention to information provided by the Department of Education or otherwise obtained in support of the administration of the Title IV Federal student financial aid programs (Dear Colleague Letter, July 1, 2016 (GEN-16-12)). Institutions are required to develop, implement, and maintain an information security program that includes the minimum elements in Title 16, Code of Federal Regulations (CFR), Section 314.4. Those minimum requirements include conducting a periodic inventory of data, noting where it is collected, stored, or transmitted (Title 16, CFR, Section 314.4(c)(1)). In addition, the institution must designate a qualified individual responsible for overseeing, implementing, and enforcing the institution’s information security program (Title 16, CFR, Section 314.4(a)). The University of Houston’s (University) information security program did not address the implementation of all minimum safeguards as required by the GLBA. Specifically, while the University had designated a Qualified Individual to coordinate its information security program and had a written information security program in place, that program did not meet the requirements for conducting a periodic inventory of data. Not implementing all required safeguards in its information security program increases the University’s risk of data breach or loss. Recommendation: The University should ensure that all elements required by the GLBA are documented and implemented in its information security program. Views of Responsible Officials: The University acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.379 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222293; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232293 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No COD Reporting: Institutions must submit Federal Pell Grant, Iraq and Afghanistan Service Grant, Direct Loan, and Teacher Education Assistance for College and Higher Education (TEACH) Grant disbursement records to the Common Origination and Disbursement (COD) system no later than 15 days after making the disbursement or becoming aware of the need to adjust a previously reported disbursement. Reporting this information helps ensure that institutions have the most accurate information available about students’ federal awards and helps prevent an institution from overawarding students (Title 34, Code of Federal Regulations (CFR), Section 690.83(b); U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 1; and Federal Register, Volume 88, Number 120). Certain data elements are required to be reported as part of a student’s origination and disbursement record, including the student’s Social Security number, Central Processing System (CPS) transaction number, enrollment date, disbursement amount, and disbursement date (2022-2023 COD Technical Reference, Volume II). For 2 (3 percent) of 63 students tested, the University North Texas (University) did not accurately report all disbursement record data elements to the COD system. Specifically: • For one student, the University reported an incorrect disbursement date for two TEACH disbursements made to the student during the award year. The University’s process is to manually report TEACH Grant awards on COD’s website; the incorrect disbursement dates reported were a result of manual entry errors made during that process. • For one student, the University reported an incorrect disbursement date for one Federal Pell Grant disbursement made to the student during the award year. The University asserted that error occurred because the student’s record had to be manually updated after being rejected by the COD system for a missing value. The incorrect disbursement dates ranged from 78 days prior to 74 days after the actual funds were disbursed to the students. The University did not have a sufficient process to review the manual data entries for accuracy. Not accurately reporting information to the COD system could result in the institution overawarding federal funds. Recommendation: The University should strengthen its controls to ensure that disbursement dates are reported to the COD system accurately. Views of Responsible Officials: The University acknowledges and agrees with the findings regarding the accuracy of reporting disbursements in the Common Origination and Disbursement (COD) system. The University recognizes the importance of accurately reporting disbursements in the COD system and will work accordingly to ensure manual entries are entered with accurate information.

Special Tests and Provisions – Disbursements To or On Behalf of Students Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222293; and Federal Direct Student Loans, P268K232293 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Allowable Charges and Credit Balance Authorizations: An institution may credit a student’s ledger account with Title IV, Higher Education Act of 1965 (HEA) program funds to pay for allowable charges associated with the current payment period. Allowable charges are: (1) the amount of tuition, fees, and institutionally provided room and board assessed the student for the payment period or the prorated amount of those charges if the institution debits the student’s ledger account for more than the charges associated with the payment period; and (2) the amount incurred by the student for the payment period for purchasing books, supplies, and other educationally related goods and services provided by the institution for which the institution obtains the student’s or parent’s authorization under Section 668.165(b) (Title 34, Code of Federal Regulations (CFR), Section 668.164(c)(1)). A Title IV, HEA credit balance occurs whenever the amount of Title IV, HEA program funds credited to a student’s ledger account for a payment period exceeds the amount assessed the student for allowable charges associated with that payment period. A Title IV, HEA credit balance must be paid directly to the student or parent as soon as possible, but no later than (1) fourteen days after the balance occurred if the credit balance occurred after the first day of class within a payment period; or (2) fourteen days after the first day of class within a payment period if the credit balance occurred on or before the first day of class within that payment period (Title 34, CFR, Section 668.164(h)). If an institution obtains written authorization from a student or parent, as applicable, the institution may: (1) use the student’s or parent’s Title IV, HEA program funds to pay for charges that are included in that authorization, and (2) hold on behalf of the student or parent any Title IV, HEA program funds that would otherwise be paid directly to the student or parent as a credit balance, unless the Secretary provides funds to the institution under the reimbursement payment method or the heightened cash monitoring payment method (Title 34, CFR, Section 668.165(b)(1)). For 5 (8 percent) of 62 students tested, the University of North Texas (University) used Title IV funds to pay unallowable charges. Specifically, the University credited student ledger accounts during the payment period for charges other than tuition, fees, or institutionally provided room and board without obtaining the authorization of the student or parent. The unallowable charges paid with Title IV funds included various fees (late registration, replacement identification card, and parking), as well as the balance of institutional loans. Those errors occurred because a statement designed to obtain the student’s authorization to apply the Title IV funds to those types of charges was not included in the student self-service portal in the student information system as intended. For 1 (3 percent) of 36 students tested, the University did not obtain written authorization from the student or parent to hold Title IV funds as a credit balance. Specifically, the University held $1,861 of Direct Loans in excess of the student’s institutional charges, which should have been paid directly to the student or parent. Not receiving all Title IV funds a student is entitled to impairs students’ and parents’ ability to budget for the cost of attending. Recommendation: The University should strengthen its controls to ensure that it obtains written authorization from students or parents prior to crediting student ledger accounts for certain charges, or holding credit balances. Views of Responsible Officials: The University acknowledges and agrees with the findings regarding the payment of unallowable charges using Title IV funds for 5 students and the lack of written authorization to hold a Title IV fund as a credit balance for 1 student. The University recognizes the importance of ensuring Title IV funds are used only toward allowable charges and are not held as a credit balance without written authorization from the student or parent.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224085; Federal Pell Grant Program, P063P222293; Federal Direct Student Loans, P268K232293; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232293 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Return of Title IV Calculations: When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The total number of calendar days in a payment period or period of enrollment includes all days within the payment period or period of enrollment that the student was scheduled to complete, excluding scheduled breaks of at least five consecutive days. Scheduled breaks of at least five consecutive days are also excluded from the number of calendar days the student completed in that period (Title 34, CFR, Section 668.22(f)(2)(i)). The University of North Texas (University) made errors in Title IV return calculations for 32 (52 percent) of 61 students tested. Those errors occurred because the University did not exclude any break days from its Title IV return calculations for the Fall 2022 term as required; therefore, that issue would have affected all students who withdrew from the Fall 2022 term and had an automated return calculation performed. Although the amount of unearned Title IV assistance calculated for those students was incorrect, there were no questioned costs as a result of those errors because the University returned more funds than required. • For 1 of those 32 students, the University also did not accurately determine the withdrawal date for the student who was enrolled in modules. After auditors brought the issue to the University’s attention, the University re-performed the return calculation and returned the additional Title IV funds as required; therefore, there were no questioned costs. • In addition, for 1 of those 32 students, the University incorrectly returned Title IV funds for a student who completed more than 60 percent of the term and did not require a return. Distance Education: For distance education, documenting that a student has logged into an online class is not sufficient to demonstrate academic attendance by the student. An institution must demonstrate that a student participated in class or was otherwise engaged in an academically related activity. Only active participation by a student in an instructional activity related to the student’s course of study that meets the definition of “academic engagement” in Title 34, CFR, Section 600.2, and takes place during a payment period or period of enrollment qualifies as attendance in an academically related activity (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 5, Chapter 2). For 1 (14 percent) of 7 students tested, the University did not have evidence of academic engagement for the student who attended all distance education courses. The University relies on the last dates of attendance (LDA) provided by instructors to determine the withdrawal date for Return of Title IV purposes for students who unofficially withdraw. If no LDAs are provided by the instructors, the University uses the midpoint of the term as the withdrawal date. The student was enrolled in all distance education courses, and the University used the midpoint as the withdrawal for the student. However, the University could not provide evidence that the student participated or otherwise engaged in an academically related activity in any of the distance education courses. After auditors brought the issue to the University’s attention, the University performed a return calculation and returned Title IV funds as required; therefore, there were no questioned costs. Timeliness of Returns: An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). For 12 (20 percent) of 61 students tested who withdrew and required a return of Title IV funds, the University did not return the funds within the required time frame. Specifically, the University returned the Title IV funds to the U.S. Department of Education between 47 to 183 days after the University determined that the students withdrew. The University asserted those errors occurred due to staffing issues and problems with the transmission of the adjustments to the U.S. Department of Education’s Common Origination and Disbursement (COD) system. The University did not have an adequate monitoring process to identify those errors or document the review process. Having a process that does not consistently calculate and return the correct amount of Title IV funds increases the risk that the University could return incorrect amounts of Title IV funds. In addition, not making returns within the required time frames reduces the funds available to the U.S. Department of Education for its program management. Recommendations: The University should: • Accurately determine the number of days in the payment period and exclude any scheduled breaks as required. • Ensure that evidence of academic engagement is consistently documented for students in distance education courses. • Strengthen its monitoring controls to ensure that it detects and corrects errors in Title IV return calculations and returns Title IV funds in a timely manner. Views of Responsible Officials: The University acknowledges and agrees with the findings regarding the Return of Title IV funds in cases where a student officially or unofficial withdraws from the institution after the student begins attendance in a given payment period or period of enrollment. The University acknowledges the importance of accurately calculating the Title IV funds to be returned and the timely return of those funds.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222293; and Federal Direct Student Loans, P268K232293 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: 2020-136 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective, and the program begin date is the date the student began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). For instances in which a student completes one academic program and then enrolls in another academic program at the same institution, the institution must report two separate enrollment transactions: one showing the completion of the first program and its effective date and credential level, and the other showing the enrollment in the second program and its effective date (Dear Colleague Letter, March 30, 2012 (GEN-12-06)). The University of North Texas (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3). For 9 (36 percent) of 25 students tested, the University did not accurately report the program begin date to NSLDS. Specifically, the University reported the program begin date as the first day of the term after the students declared their major or were otherwise approved to enroll in the program, instead of the first day of the term in which the students actually began attendance in the program. The University asserted that the errors were caused by issues related to the configuration of the enrollment reporting processes in the University’s student information system. Not reporting student program information accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayments schedules. Recommendation: The University should strengthen its controls to ensure that program begin dates are reported to NSLDS accurately. Views of Responsible Officials: The University acknowledges and agrees with the findings regarding the accuracy of the program begin dates reported for some students identified in the testing. The University acknowledges the importance of accurately reporting program information for students receiving Title IV aid to ensure that guarantors, lenders, and servicers of student loans are able to make accurate determinations related to in-school status, deferments, grace periods, and repayment schedules.

Special Tests and Provisions – Perkins Loan Recordkeeping and Record Retention Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.038 Pass-Through Agency: N/A Award Number: Federal Perkins Loan Program, award number N/A Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Institutions must retain promissory and master promissory notes (MPNs) and repayment records for each Perkins Loan program loan made. Institutions are required to keep original paper promissory notes or original paper MPNs and repayment schedules in a locked, fireproof container. The original promissory notes and repayment schedules must be kept until the loans are satisfied. If required to release original documents in order to enforce the loan, the institution must retain certified true copies of those documents. After the loan obligation is satisfied, the institution shall return the original or a true and exact copy of the note marked “paid in full” to the borrower, or otherwise notify the borrower in writing that the loan is paid in full and retain a copy for the prescribed period (Title 34, Code of Federal Regulations (CFR), Section 674.19(e)(4)). For 4 (100 percent) of 4 retired loans tested, the University of North Texas (University) did not send paid in-full notifications to those borrowers, as required. As a result, the University did not maintain the required documentation of the paid-in-full notifications to those borrowers after their loan obligations were satisfied. The University asserted that the notifications were not sent due to staff turnover and the assumption that the University’s third-party Perkins Loan servicer was responsible for sending the notifications. Not maintaining adequate documentation results in noncompliance with the Federal Perkins loan program record retention requirements. Additionally, not notifying borrowers of their loans’ paid-in-full status increases the risk of borrowers making overpayments on their loans. Recommendation: The University should ensure that paid-in-full notifications are sent to all borrowers who satisfy their Perkins Loan obligations, and retain a copy of each notification for the prescribed period. Views of Responsible Officials: The University acknowledges and agrees with the finding related to sending paid-in-full notifications to all borrowers who satisfy their Perkins Loan obligations.

2022-001 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Indirect Costs Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3 October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: DFPS utilizes four basic methods to develop allocated project IDs that are used to allocate indirect costs: Paid-Full Time Equivalents (PFTE), random moment time study, case counts by client eligibility, and service unit counts. To ensure allocated project IDs are complete and accurate, project allocation percentage forms are signed and dated by the preparer, 1st Proofer, 2nd Proofer, Entered By, and Enter Proofed By individuals. During our testing of 40 indirect costs, 12 transactions did not have full approval for the project allocation. The project allocation documentation was missing the approval for Entry Proofed By. This approval is to ensure the allocation entered into the system agrees to the project allocation documentation. All 12 transactions were allocated to the same project ID. Questioned costs: None Context: See ?Condition.? Cause: The exception was caused by management oversight. Effect: Failure to complete adequate reviews over project IDs may result in incorrect allocation of costs and questioned costs. Repeat Finding: No Recommendation: We recommend DFPS strengthen its existing internal controls over the review of project IDs to ensure all approvals are obtained on the project allocation percentage forms. Views of responsible officials: Management agrees with the finding.

2022-002 Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, 2101TXTAN3, 2001TXTANF, 2001TXTAN3 October 1, 2021 ? September 30, 2022, October 1, 2020 ? September 30, 2021 and October 1, 2019 ? September 30, 2020 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 263.2(b), An ?eligible family? as defined by the State, must: (1) Be comprised of citizens or non-citizens who: (i) Are eligible for TANF assistance; (ii) Would be eligible for TANF assistance, but for the time limit on the receipt of federally funded assistance; or (iii) Are lawfully present in the United States and would be eligible for assistance, but for the application of title IV of PRWORA; (2) Include a child living with a custodial parent or other adult caretaker relative (or consist of a pregnant individual); and (3) Be financially eligible according to the appropriate income and resource (when applicable) standards established by the State and contained in its TANF plan. Condition: According to the DFPS?s Child Protective Services Handbook 2720 Responding to the Eligibility Statements CPS June 2020, IMPACT automatically makes the EA Eligibility Application/Determination section available when the caseworker completes the Risk Assessment tool and the risk level is `high? or `very high.? The caseworker completes this section, which contains three statements that each require a response of `yes? or `no?. For one of 40 payments to program participants, we noted two of the three statements were not answered in IMPACT, resulting in a determination that the child does not meet the emergency assistance eligibility criteria. The DFPS?s sandbox database reflects a conclusion that the child does meet the emergency assistance eligibility criteria indicating that the three statements had a response of `yes `at the time of stage closure. However, we were unable to verify a response of `yes? for the three statements in IMPACT. According to the DFPS?s Child Protective Services Handbook 2714 Documentation CPS June 2020, the caseworker documents the following information in the contact narrative in IMPACT: ? The names of the people whose income the caseworker counted in the family?s total annual income. ? The information that the caseworker gathered to determine the family?s total annual income. ? The sources of information that the caseworker used (including the FCAA, if DFPS has removed a child). ? The family?s total annual income (before taxes and other similar deductions). For two of 40 payments to program participants, we noted the following exceptions in the documentation of the family's income: ? One participant had an annual family income range selected of $0 - $10,000. However, the investigation report had $20,640 as annual family income. ? One participant had an annual family income range selected of $10,000 - $20,000. No income information was documented in the investigation report. According to the DFPS?s TANF School Allowance Kinship Program, the Pandemic Emergency Assistance Fund (PEAF) awards are disbursed through two payments ? (1) a spring allocation of $250 and (2) a fall allocation of $250 to be used cover the cost of clothing and school supplies for the school year. The maximum number of disbursements to be made for each participant is two disbursements. For three of seven payments to program participants under the TANF PEAF, three payments were made rather than two, resulting in total overpayments of $750. Questioned costs: $9,119 Context: See ?Condition.? Cause: Exceptions related to missing statements in IMPACT were caused by system limitations. Exceptions related to documentation of family income were due to management oversight. Exceptions related to PEAF are a result of DFPS not having an existing process to disburse payments under the new grant. The individuals were mistakenly captured twice for the 2nd payment. Effect: Failure to review and maintain accurate information may result in payments made to ineligible participants or overpayments to eligible participants. Repeat Finding: No Recommendation: DFPS should strengthen its internal controls and remedy system limitations to ensure accurate data is maintained in IMPACT. EA Application/Determination Views of responsible officials: Although these questions can currently be answered by reviewing the Investigation Report for the participant to show that the participant was eligible. DFPS acknowledges and agrees with the finding two of the three EA questions regarding a participant do not show currently answered. DFPS acknowledges and agrees with the finding regarding the incorrect documentation of income for two of the participants. PEAF Views of responsible officials: This is not a regular DFPS payment, therefore there is not an existing automatic process to disburse payments. As a result, a process was developed by which qualifying children were captured and paid through a batch process. It appears that the subject children were mistakenly captured twice for the 75U payment. DFPS?s TANF School Allowance was a one-time allocation of COVID funding for the school allowance effort. The allocation allowed for two (2) disbursements of $250 per child in a kinship home. Because it is a one-time allocation, there currently is no future plan of a second TANF School Allowance allocation.

2022-003 Reporting ? ACF-196R Expenditure Misclassifications Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, 2101TXTAN3, 2001TXTANF, 2001TXTAN3 October 1, 2021 ? September 30, 2022, October 1, 2020 ? September 30, 2021 and October 1, 2019 ? September 30, 2020 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. Condition: Audit procedures included testing of three quarterly ACF-196R reports. Three of the three reports reported Relative and Other Designated Caretaker (RODC) program costs incorrectly on line 19 as follows: ? Grant Year 2020 ACF-196R for the quarter-ended 9/30/2021 - $2,909 ? Grant Year 2021 ACF-196R for the quarter-ended 12/31/2021 - $175,862 ? Grant Year 2022 ACF-196R for the quarter-ended 3/31/2022 - $803,324 The purpose of the DFPS?s RODC program is promoting stability for children in the conservatorship of DFPS. It additionally provides financial assistance through a monthly payment to eligible kinship caregivers. Monthly reimbursement payments are time-limited and may be paid for up to twelve (12) months. However, if DFPS determines there is good cause for an exception, payments may be made for up to an additional six (6) months. As these benefits are short-term by nature, these costs should have been reported on line 15, Non-recurrent Short -Term Benefits. Questioned costs: None Context: See ?Condition.? Cause: Management misinterpreted the guidance provided for reporting specific activities on certain line items of the ACF-196R report. Effect: Failure to collect the accurate data could compromise the Office of Family Assistance (OFA) and the ACF?s ability to monitor TANF expenditures and compliance with statutory requirements. These data are also needed to estimate outlays and to prepare reports and budget submissions for Congress. Repeat Finding: No Recommendation: DFPS should revise its policies and procedures related to the ACF-196R report review process to ensure all expenditure amounts are being properly classified. Views of responsible officials: Management agrees with the finding.

2022-004 Period of Performance Federal Agency: U.S. Department of Homeland Security Federal Program Title: Homeland Security Grant Program (HSGP) ALN: 97.067 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3708603, 3902402, 4164001 3/1/2020 ? 630/2022, 4/1/2020 ? 5/31/2022, 9/1/2020 ? 2/28/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to ? 200.308(e)(3). Condition: The Office of the Texas Governor (OOG) is the prime recipient of federal awards for the Homeland Security Grant Program. The Department of Public Safety (DPS) receives allocations of these funds for individual projects. A Statement of Grant Award (SOGA) is issued by OOG to DPS for each project with start, end, and liquidation dates. For projects with period of performance ending dates during the fiscal year, as stipulated by OOG, audit procedures included testing transactions posted to the general ledger during the last month and after the period of performance end date. We noted the following instances of noncompliance: ? For the twelve sampled transactions, totaling $1,240,691, five of the expenditures, totaling $78,749, were related to costs incurred after the period of performance end date or liquidated after the liquidation period end date. Questioned costs: $78,749 Context: See ?Condition.? Cause: Current controls are not at the correct precision level to detect costs charged outside of the period of performance or paid after the liquidation date as specified in the project grant agreement. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. Repeat Finding: No Recommendation: DPS should enhance and/or modify existing controls (both manual and automated) to ensure that costs are not charged to a project unless (1) the service dates fall within the period of performance stated in the SOGA, and (2) the costs have been paid prior to the liquidation period end date. Views of responsible officials: The Department of Public Safety acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the Department of Public Safety will work to develop and implement corrective action to further improve the processes.

2022-005 Reporting ? SF-425 Federal Financial Reports Federal Agency: U.S. Department of Homeland Security Federal Program Title: Homeland Security Grant Program (HSGP) ALN: 97.067 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3834802, 3834803, 3865603, 3902402, 3912003, 3920803 1/1/2020 ? 2/28/2022, 3/1/2021 ? 5/31/2023, 3/1/2021 ? 5/31/2023, 4/1/2020 ? 5/31/2022, 3/1/2021 ? 5/31/2023, 3/1/2021 ? 5/31/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included a sample of three SF-425 reports submitted during fiscal year 2022. For two of the three reports tested, DPS expenditures reported on the SF-425 did not agree to the general ledger. The following variances were identified: See Schedule of Findings and Questioned Costs for chart/table We noted that amounts reported on the SF-425 were accurate, however, the corresponding expenditures were not recorded on the general ledger. Management subsequently made corrections to its general ledger and schedule of expenditures of federal awards. Questioned costs: None Context: See ?Condition.? Cause: Expenditures not recorded in the general ledger were in-kind expenditures related to blade hours incurred and thus did not follow the normal accounts payable process. Management reconciled amounts reported on the SF-425 to federal revenues rather than federal expenditures. The discrepancies were not identified as internal controls were not designed properly. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on the schedule of expenditures of federal awards or federal reports. Repeat Finding: No Recommendation: We recommend management revise its internal controls to reconcile expenditures reported on federal reports to federal expenditures in the general ledger rather than federal revenue to account for in-kind expenditures. Views of responsible officials: The Department of Public Safety acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the Department of Public Safety will work to develop and implement corrective action to further improve the processes.

2022-006 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2021-CS-21027 3/3/2021 ? 1/1/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In section 4 of the 2021 Texas Senate Bill 8, the Department of State Health Services (DSHS) was appropriated money received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning March 3, 2021 and ending January 1, 2023, due to the coronavirus pandemic: (1) Providing funding for surge staffing at state and local hospitals, long-term care facilities, psychiatric hospitals, and nursing facilities; (2) Purchasing therapeutic drugs, including drugs for monoclonal antibody treatments; and (3) Providing funding for the operation of regional infusion centers Condition: During our testing, we selected 60 expenditures, totaling $31,017,511, incurred during the fiscal year to validate allowability with the grant award. We noted that ten out of the 60 samples, totaling $648,086 were not for goods or services allowed by the grant award. Questioned costs: $648,086 Context: See ?Condition.? Cause: While unallowable expenditures may have been initially charged to the grant, DSHS planned to complete a final reconciliation at the close of the grant and return any unallowable costs. Effect: Unallowable costs charged to the grant may result in material noncompliance. Additionally, not maintaining accurate records throughout the year prohibits the federal granting agency to monitor the progress of the grant. Repeat Finding: No Recommendation: DSHS should enhance controls related to review of expenditures for compliance with allowable costs and activities unallowed requirements to ensure unallowed costs are not charged to the grant. Views of responsible officials: During the COVID-19 pandemic, there was a surge of COVID-19 cases in hospitals throughout the State of Texas and an immediate and emergent need to serve Texans. DSHS previously identified the need to ensure costs are allowable and align with required parameters. To strengthen requirements, DSHS will address through policy revision.

2022-007 Period of Performance Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2021-CS-21027 3/3/2021 ? 1/1/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonFederal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per section 602(g)(1) of the Social Security Act as added by section 9901 of the American Rescue Plan Act of 2021, Pub. L. No. 117-2 and Treasury?s Interim Final Rule and Final Rule at 31 CFR section 35.5(a), State and Local Fiscal Recovery Funds (SLFRF) may only be used for costs incurred within a specific time period, beginning March 3, 2021, with all funds obligated by December 31, 2024 and all funds spent by December 31, 2026. Condition: The Department of State Health Service received a grant award for SLFRF funds on February 28, 2022. Audit procedures performed included a sample of ten transactions totaling $817,008 posted to the general ledger with service dates prior to April 2, 2021. For three samples, we noted expenditures totaling $348,874 that were incurred prior to March 3, 2021. Questioned costs: $348,874 Context: See ?Condition.? Cause: As the grant was awarded subsequent to the beginning of the period of performance, DSHS transferred expenditures previously paid for with state funds to the federal award based on the invoice date. However, the underlying services were partially incurred prior to March 3, 2021. Effect: Failure to review expenditures at a detail level could result in unallowable costs or expenditures claimed outside of the award?s period of performance. Repeat Finding: No Recommendation: We recommend DSHS add an additional process to review the underlying service dates for invoices near the beginning and end dates of the period of performance to ensure costs incurred outside of this period are not charged to the federal award. Views of responsible officials: During the COVID-19 pandemic, there was a surge of COVID-19 cases in hospitals throughout the State of Texas and an immediate and emergent need to serve Texans. DSHS previously identified the need to ensure costs are allowable and align with required parameters. To strengthen requirements, DSHS will address through policy revision.

2022-008 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis Response ALN: 93.354 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: NU90TP922165, NU90TP922067 7/1/2021 ? 6/30/2023, 3/5/2020 ? 3/15/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: In conjunction with the Finance Team within the Contract Management Section (CMS), the FFATA Coordinator coordinates the FFATA reporting process for all required submissions at the Department of State Health Services (DSHS). On a monthly basis, the DSHS FFATA Coordinator identifies FFATA subawards of $30,000 or more. Information for all relevant data elements is documented on the Data Validation Checklist and reviewed and approved by the FFATA Coordinator prior to being submitted to the CMS Finance Team to enter into FSRS by the end of the subsequent month. During our testing, we noted that there was no evidence of review on the Data Validation Checklist by the FFATA Coordinator for three of the four monthly submissions selected for testing during the fiscal year. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table Questioned costs: None Context: See ?Condition.? Cause: Program personnel lack established internal controls and procedures over FFATA reporting to ensure the relevant subawards are submitted accurately and timely. Effect: Failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Repeat Finding: No Recommendation: DSHS should enhance FFATA policies and procedures including the current controls in place to formally document the verification FFATA reports for completeness and accuracy prior to submission. DSHS should also maintain all relevant documentation which supports the key data elements reported. Views of responsible officials: DSHS implemented a new procedure and a FFATA checklist to include controls and to formally document verification of FFATA reports for completeness and accuracy on March 1, 2022. The records reviewed under this audit were submitted prior to the implementation of the procedure and checklist. The Contract Management Section has fully implemented this recommendation and agree that this is a finding for FY22 based on the overlap in fiscal years and is based solely on timing.

2022-009 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Matching, Level of Effort, and Earmarking, Reporting, Subrecipient Monitoring, Special Tests ? Information Technology ? Password Configuration Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Coronavirus Relief Fund (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 21.019 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) 97.050 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? TIERS: The password minimum age was set to 0 days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to 1 day. Questioned costs: None Context: ?See Condition? Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to following HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020-012, 2021-003 Recommendation: We recommend that HHSC update password configurations for TIERS to be compliant with its internal policies. Views of responsible officials: Agree

2022-010 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster Supplemental Nutrition Assistance Program (SNAP) Cluster Temporary Assistance for Needy Families (TANF) Aging Cluster (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.775, 93.777, 93.778 10.551, 10.561 93.558 93.044, 93.045, 93.053 (nonmajor) 93.958 (nonmajor) 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT, 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022 SNAP Cluster 6TX400105, 6TX400106, 6TX400108, 6TX430165, 6TX430176, 6TX460001, 6TX460002 October 1, 2020 ? September 30, 2021, March 11, 2021 ? September 2021, October 1, 2020 ? September 30, 2022, October 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2023 TANF 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated by voucher, either monthly, quarterly, semi-annually, or annually, depending on the Project ID. For 29 of 60 samples tested for proper reallocation of estimates, the project ID percentages as calculated by HHSC did not match the percentages in the reallocation entries that were posted in CAPPS, HHSC?s financial system. Questioned costs: Unknown Context: See ?Condition.? Cause: During the fiscal year, a formula error occurred that altered several links within multiple workbooks that changed reallocation percentages covering several months. Due to time and resource constraints, an outdated reallocation journal tool was utilized during the interim and verification reports were not being run after changes were made to the calculation spreadsheet to ensure reallocation percentages match. Effect: Failure to accurately calculate indirect costs may result in incorrect amounts being charged to the grant and noncompliance with grant terms and conditions. Repeat Finding: 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should enhance existing reallocation procedures to include an additional review to ensure that the percentages in the entry made in CAPPS match the percentages in the calculation spreadsheet. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. The issues are primarily associated with a non-automated process to compare entered calculations into Centralized Accounting and Payroll/Personnel System (CAPPS) Financials. These issues are the result of manual errors and formula errors.

2022-011 Earmarking Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 264.1(a), (b), and (c): (a) (1) Subject to the exceptions in this section, no State may use any of its Federal TANF funds to provide assistance (as defined in ? 260.31 of this chapter) to a family that includes an adult head-of-household or a spouse of the head-of-household who has received Federal assistance for a total of five years (i.e., 60 cumulative months, whether or not consecutive). (2) The provision in paragraph (a)(1) of this section also applies to a family that includes a pregnant minor head-of-household, minor parent head-of-household, or spouse of such a head-of-household who has received Federal assistance for a total of five years. (3) Notwithstanding the provisions of paragraphs (a)(1) and (a)(2) of this section, a State may provide assistance under WtW, pursuant to section 403(a)(5) of the Act, to a family that is ineligible for TANF solely because it has reached the five-year time limit. (b) (1) States must not count toward the five-year limit: (i) Any month of receipt of assistance by an individual who is not the head-of-household or married to the head-of-household; (ii) Any month of receipt of assistance by an adult while living in Indian country (as defined in section 1151 of title 18, United States Code) or a Native Alaskan Village where at least 50 percent of the adults were not employed; and (iii) Any month for which an individual receives only noncash assistance provided under WtW, pursuant to section 403(a)(5) of the Act. (2) Only months of assistance that are paid for with Federal TANF funds (in whole or in part) count towards the five-year time limit. (c) States have the option to extend assistance paid for by Federal TANF funds beyond the five-year limit for up to 20 percent of the average monthly number of families receiving assistance during the fiscal year or the immediately preceding fiscal year, whichever the State elects. States are permitted to extend assistance to families only on the basis of: (1) Hardship, as defined by the State; or (2) The fact that the family includes someone who has been battered, or subject to extreme cruelty based on the fact that the individual has been subjected to: (i) Physical acts that resulted in, or threatened to result in, physical injury to the individual; (ii) Sexual abuse; (iii) Sexual activity involving a dependent child; (iv) Being forced as the caretaker relative of a dependent child to engage in nonconsensual sexual acts or activities; (v) Threats of, or attempts at, physical or sexual abuse; (vi) Mental abuse; or (vii) Neglect or deprivation of medical care. Condition: In order to monitor the earmarking requirement, the Health and Human Service Commission?s (HHSC) Data Analytics and Performance (DAP) Department maintains a tracking worksheet that is updated monthly, which contains relevant data derived from the TIERS benefit payment query and other source files. Key data used in the calculation include the following: ? Report month ? Number of clients who received their 60th monthly benefit payment in the report month ? Number of clients who received a hardship exemption in the report month ? Total number of clients receiving benefit payments as of the report month ? Total number of clients with a hardship exemption as of the report month The final monthly calculation takes the total number of clients with a hardship exemption as of the report month (i.e. those families that have received more than 60 months of benefit payments) divided by the total number of clients receiving benefit payments as of the report month. Audit procedures included a sample of five clients who received their 60th monthly benefit payment and a hardship exemption in a given month during the fiscal year. Individual monthly benefit payments noted per the results of the TIERS benefit payments query were compared to the TANF Time Limit screens which show each monthly benefit payment made. For all five sampled clients, there were discrepancies noted between the two data sets as to which months were counted as payments. Questioned costs: None Context: See ?Condition.? Cause: The TIERS benefit payment query is not configured to pull accurate data for purposes of monitoring the earmarking requirement. Effect: Inaccurate inputs used for monitoring earmarking requirements could result in noncompliance with federal requirements. Repeat Finding: No Recommendation: We recommend that HHSC update the parameters used in the TIERS benefit payment query to ensure it is pulling the accurate benefit payment fields in TIERS in order to assess compliance with earmarking requirements. Views of responsible officials: We agree with this finding and appreciate the audit team bringing this issue to our attention. This issue was discovered and communicated to us late in the audit process. As such, we have not had enough time to ensure we understand the root cause of the errors and have no assurance the cause lies in the query being used.

2022-012 Reporting ? ACF-196R Expenditure Misclassifications Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. Condition: Audit procedures included testing of three quarterly ACF-196R reports. Two of the three reports reported Early Childhood Intervention (ECI) expenditures incorrectly on line 22a as follows: ? Grant Year 2021 ACF-196R for the quarter-ended 12/31/2021 - $2,485,091 ? Grant Year 2022 ACF-196R for the quarter-ended 3/31/2022 - $1,625,367 The purpose of the HHSC?s ECI services program is to ensure that all eligible children under the age of three and their families receive quality early intervention services, resources and support needed to reach their developmental goals. Thus, these expenditures should have been reported on line 16, Supportive Services as they are supportive services and not administrative costs. Additionally, as the designated state agency of the TANF award, HHSC is responsible for verifying the accuracy of data submitted by other state agencies administering TANF funds. We noted HHSC included misclassified data as reported by other state agencies on three of the three quarterly ACF 196R reports submitted to the Administration for Children and Families (ACF). Questioned costs: None Context: See ?Condition.? Cause: Management misinterpreted the guidance provided for reporting specific activities on certain line items of the ACF-196R report. Additionally, management did not provide adequate training or guidance to ensure data submitted by other state agencies was accurate. Effect: Failure to collect the accurate data could compromise the Office of Family Assistance (OFA) and the ACF?s ability to monitor TANF expenditures and compliance with statutory requirements. These data are also needed to estimate outlays and to prepare reports and budget submissions for Congress. Repeat Finding: No Recommendation: HHSC should revise its policies and procedures related to the ACF-196R report review process to ensure all expenditure amounts are being properly classified. Additionally, we recommend HHSC provide adequate training and oversight and establish formal processes on preparing the ACF-196R report to other state agencies in order to ensure the information submitted to the ACF is accurate. Views of responsible officials: The Texas Health and Human Services Commission (HHSC) acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, HHSC has developed and implemented corrective action to further improve the processes.

2022-013 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXTANF, 2201TXTAN3, 2101TXTANF, and 2101TXTAN3 October 1, 2021 ? September 30, 2022 and October 1, 2020 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of HHSC?s FFATA Reporting Policy, program departments must submit the FFATA Reporting Template to the Federal Funds Office (FFO) team by the 15th of the month to be included in that month?s agency submission. Program departments review the submission, as evidenced by the reviewer?s signature on the FFATA Reporting Template. The FFO team will collect FFATA Reporting Templates and submit the data to the FFATA Subaward Reporting System (FSRS) by the end of every month. During our testing, we noted that The FFATA Reporting Template was not completed for 14 of the 16 subawards selected. The remaining two templates were completed and signed by the reviewer but contained errors. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table Questioned costs: None Context: See ?Condition.? Cause: HHSC experienced resource challenges during the fiscal year as well as challenges related to the transition of the FFATA reporting process to the FFO at the beginning of the fiscal year 2022, which caused subawards to not be identified and/ or reported in the FSRS. Additionally, controls related to the review of each subaward?s key elements are not at the precision level to detect inaccurate data. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Additionally, failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Repeat Finding: No Recommendation: HHSC should establish processes to ensure that all subawards are identified and submitted in FSRS as required. Additionally, HHSC should enhance existing controls related to the verification of key elements prior to submission. Views of responsible officials: Accepted.

2022-014 Special Tests and Provisions ? Provider Eligibility ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: ? 455.104 ? HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: ? The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address. ? Date of birth and Social Security Number (in the case of an individual) ? Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. ? Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. ? The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. ? The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). ? 455.105 ? HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request: ? The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and ? Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. ? 455.106 ? Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who: ? Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and ? Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. ? 455.410 ? HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. ? 455.412 ? HHSC must: ? Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State ? Confirm that the provider's license has not expired and that there are no current limitations on the provider's license ? 455.414 ? HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. ? 455.432 ? HHSC must: ? Conduct pre-enrollment and post-enrollment site visits of providers who are designated as ?moderate? or ?high? categorical risks to the Medicaid program. ? Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. ? 455.434 ? HHSC must: ? Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.? Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. ? Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a ?high? risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. ? 455.436 ? HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. ? 455.434 ? HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of ?limited,? ?moderate,? or ?high.? If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 40 long-term care providers, which resulted in the following: ? For 11 samples, a copy of the completed Medicaid application was not included in the file. ? For 12 samples, enrollment of the provider was not completed within the last 5 years. ? For 20 samples, verification of the provider?s license was not included in the file. ? For 15 samples, required information on ownership and control was not disclosed. ? For 20 samples, supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. ? For 16 samples, supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. ? For 11 samples, supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. ? For 14 samples, supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. ? For 20 samples, supporting documentation was not included in the file indicating the LEIE and EPLS databases were checked at least monthly during the enrollment period. ? For 20 samples, supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. ? For 19 samples, a copy of the provider agreement was not included in the files. ? For 20 samples, supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. ? For 11 samples, supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: NoneContext: See ?Condition.? Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat Finding: 2021-008 Recommendation: HHSC should implement controls to ensure: ? Documentation is maintained for at least the length of the providers? current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334. ? Provider licenses are verified during enrollment. ? Providers are re-enrolled at least once every five years. ? Provider agreements are obtained, and the proper disclosures are made. ? Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk. ? Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: Agree.

2022-015 Special Tests and Provisions ? Medical Loss Ratio (MLR) ? Missing Data Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT; 2205TX5ADM, 2205TX5MAP, 2205TXIMPL, 2205TXINCT October 1, 2020 ? September 30, 2021, October 1, 2021 ? September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: For all contracts, the state must ensure that each MCO, PIHP, and PAHP submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 42 CFR section 438.8(k) - The State, through its contracts, must require each MCO, PIHP, or PAHP to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC receives and reviews the MLR reports to verify the reports contain the required data elements. The MLR report template that is used by MCOs for this requirement is created and maintained by FRAC. Audit procedures included a review of six MLR reports submitted to FRAC during the fiscal year. Six of six (6) reports did not contain three of the thirteen required elements as follows: ? Methodology(ies) for allocation of expenditures ? A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). ? A description of the aggregation method used under paragraph (i) of this section Questioned costs: None Context: See ?Condition.? Cause: The current MLR report template provided to MCOs does not contain all thirteen (13) of the required data elements. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: 2021-010 Recommendation: The FRAC should update the MLR report template to reflect all required elements as per 42 CFR 438.8(k). Views of responsible officials: HHSC agrees with the finding. It should be noted that the missing elements describe how the report was developed and do not impact the accuracy of the report or the Medical Loss Ratio (MLR) percentage.

2022-016 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Justice U.S. Department of Homeland Security Federal Program Title: Crime Victim Assistance Homeland Security Grant Program ALN: 16.575 97.067 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Crime Victim Assistance 15POVC-21-GG-00600-ASSI, 2020-V2-GX-0004, 2019-V2-GX-0011, 2018-V2- GX-0040 10/1/2020 ? 9/30/2024, 10/1/2019 ? 9/30/2023, 10/1/2018 ? 9/30/2022, 10/1/2017 ? 9/30/2022 Homeland Security Grant Program EMW-2020-SS-00054, EMW-2021-SS-00062 9/1/2020 ? 8/31/2023, 9/1/2021 ? 8/31/2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The Office of the Governor (OOG) uploads subaward information on a monthly basis via a batch upload to FSRS due to the volume of subawards in certain months. We noted the following instances of noncompliance for the Crime Victim Assistance Program, all of which were part of the May 2022 batch upload: See Schedule of Findings and Questioned Costs for chart/table We noted the following instances of noncompliance for the Homeland Security Grant Program, all of which were part of the May 2022 batch upload: See Schedule of Findings and Questioned Costs for chart/table The May 2022 batch included subawards granted in April 2022, however, were reported in FSRS on June 7, 2022. Questioned costs: None Context: See ?Condition.? Cause: The reports were not submitted timely due to staff turnover in OOG?s Public Safety Office. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Repeat Finding: No Recommendation: We recommend that management establish standard operating procedures in order to transition responsibilities in the event of staff turnover to ensure timely submission of required reports. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the May 2022 Federal Funding Accountability and Transparency Act (FFATA) report was submitted on June 7, 2022, which is 7 days after the May 31, 2022 due date.

2022-017 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Period of Performance, Suspension and Debarment ? Information Technology ? User Access Federal Agency: Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund (DWSRF) Cluster ALN: 66.468, 66.483 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 582-22-30745 9/1/2021 ? 8/31/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Texas Commission on Environmental Quality (TCEQ) utilizes the Budget Accounting and Monitoring System (BAMS) as its financial application for vendor disbursements and procurement. During our testing, we noted the following: ? We sampled seven terminated users to verify whether their access was removed in accordance with the TCEQ Access Control Policy (Policy). Four of the seven terminated users did not have their access to BAMS revoked in accordance with the Policy. Questioned Costs: None Context: ?See Condition? Cause: TCEQ did not follow the account management process as outlined in the TCEQ Access Control Policy. Effect: Failure to disable user accounts timely could increase the risk of inappropriate access. Repeat Finding: No Recommendation: We recommend TCEQ strengthen its internal controls to ensure terminated BAMS users? access is disabled and archived in accordance with its Access Control Policy. Views of responsible officials: The four IDs referenced in this finding did not have access to the BAMS application; the BAMS application is only accessible to agency staff with Oracle database user accounts. The report listing these IDs was from the application?s record of roles. Access to BAMS was terminated when the users? database accounts were removed.

2022-018 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles - Payroll Federal Agency: Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund (DWSRF) Cluster ALN: 66.468, 66.483 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 582-22-30745 9/1/2021 ? 8/31/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.430 (i-vii), the Texas Commission on Environmental Quality must ensure that charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) be incorporated into the official records of the non-Federal entity; (iii) reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) encompass federally assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) comply with the established accounting policies and practices of the non-Federal entity; and (vii) support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Condition: During our testing, we selected 40 payroll-related expenditures incurred during the fiscal year totaling $134,012 to validate allowability and proper documentation of time and effort. We noted that for three out of the 40 samples, wages charged to the federal program were overstated by $27. Questioned costs: $27 Context: See ?Condition.? Cause: Hours incorrectly charged to the grant are a result of system and manual errors when allocating time to federal grants. Effect: Unallowable costs charged to the grant will result in noncompliance with the grant terms and questioned costs. Repeat Finding: No Recommendation: TCEQ should strengthen its controls related to review of payroll expenditures for compliance with federal time and effort requirements to ensure unallowed costs are not charged to the grant. Views of responsible officials: Federally funded and site-specific employees are required to record their time accurately and to charge to grants correctly. Supervisors are required to implement the quality control measures necessary to ensure that salaries and wages are based on records that accurately reflect the work performed.

2022-019 Period of Performance Federal Agency: Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund (DWSRF) Cluster ALN: 66.468, 66.483 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 582-22-30745 9/1/2021 ? 8/31/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of the Texas Commission on Environmental Quality?s (TCEQ) controls over the period of performance, we noted that the fiscal year 2022 grant ended on August 31, 2022. The closeout period for this grant ended on December 31, 2022, at which time all PCAs associated with that grant should have been closed in USAS in order to prevent costs being charged outside of the period of performance in accordance with TCEQ?s policies and procedures. However, we noted that PCAs were still open subsequent December 31, 2022. Questioned Costs: None Context: ?See Condition? Cause: TCEQ personnel misinterpreted policies and procedures in place over period of performance requirements. Effect: Failure to enforce internal controls over period of performance requirements may result in expenditures charged to the grant outside of the period of performance resulting in noncompliance and questioned costs. Repeat Finding: No Recommendation: We recommend TCEQ document its internal controls over period of performance requirements and clearly define roles and responsibilities within those policies. Additionally, we recommend TCEQ perform periodic reviews to verify that those controls are operating effectively. Views of responsible officials: The Federal Funds Section of the Budget and Planning Division maintains a Federal Funds Instruction Guide which outlines Close Out Items in Chapter 14. Those items are required when closing out a grant. This chapter does not specifically reference when Program Cost Accounts (PCAs) should be inactivated.

2022-020 Cash Management, Eligibility, Special Tests and Provisions- Accountability for USDA Foods ? Information Technology ? Vendor Management Federal Agency: U.S. Department of Agriculture Federal Program Title: Food Distribution Cluster ALN: 10.565, 10.568, 10.569 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6TX10877, 6TX810816, 6TX810817, 6TX810830, 6TX810821 October 1, 2020 ? September 30, 2021 and October 1, 2021 ? September 30, 2022. Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: TDA utilizes TXUNPS, a web application that allows TDA personnel and subrecipients to submit and approve documents. TXUNPS manages information regarding subrecipient contracts, entitlement, inventory, orders and other Food Distribution Cluster (?FDC?) functions. Specific functions of TXUNPS include submitting and tracking commodity orders, viewing or declining commodity allocations, viewing invoices, and submitting and maintaining annual commodity contract packets and contract entitlements. TDA currently outsources the hosting, maintenance and enhancement over TXUNPS to a third-party service organization. TDA did not obtain assurance over the operating effectiveness of internal controls of these functions performed by the service organization for the fiscal period. Questioned costs: None Context: See "Condition" Cause: While management requested that the third-party vendor provide a Service Organization Controls 1 (?SOC 1?) Type 2 report that would validate the suitability of design and operating effectiveness of the vendor?s controls, a report had not been provided to TDA. Effect: Validating the internal controls over functions outsourced to a third-party vendor is critical to ensure that the service organization has the required controls infrastructure in place to process and secure TDA?s data. Repeat Finding: No Recommendation: TDA should obtain assurance over the operating effectiveness of internal controls of its third party service organizations for the fiscal period. This may be achieved by obtaining and reviewing SOC reports for each third-party vendor that provide services over critical applications within a timeline to allow TDA to evaluate whether they can rely on the third party?s overall control structure. In addition, TDA should review and test the complementary user entity controls included in each SOC report and document the results of those procedures. Views of responsible officials: TDA agrees with the finding.

2022-021 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Earmarking, Period of Performance, Reporting, Subrecipient Monitoring, and Special Tests and Provisions ? Information Technology ? User Access Federal Agency: U.S. Department of Treasury U.S. Department of Health and Human Services Federal Program Title: Emergency Rental Assistance Program Low-Income Home Energy Assistance ALN: 21.023 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 ? 2021, 1505-0270 ? 2021 January 6, 2022?December 29, 2022 and May 5, 2021? September 30, 2025 2201TXLIEA ? 2022, 2101TXE5C6 ? 2021, 2101TXLWC5 2021 October 1, 2021 ?September 30, 2023, March 11, 2021 ?September 30, 2022, and May 5, 2021 ? September 30 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of the Active Directory (Network) and CAPPS Financial, we noted the following: ? TDHCA did not perform a user access review service accounts for the Network. ? User access reviews for CAPPS Financials were not performed during the fiscal year. However, the review was completed subsequent to fiscal year end. Questioned Costs: None Cause: There were no policies established to address a periodic review of Network service accounts. Additionally, management planned to complete user access reviews of CAPPS Financial users, however, it was not until after the fiscal year end. Effect: Failure to perform user access reviews of service accounts could result in inappropriate access or inappropriate changes to the application. Additionally, failure to complete user access reviews on an annual basis may result in undetected inappropriate access to systems. Repeat Finding: 2021-013 Recommendation: We recommend management implement policies and procedures to complete user access reviews of Network service accounts and establish a policy to complete user access reviews of CAPPS Financial, at a minimum, on an annual basis each fiscal year. Views of responsible officials: Management acknowledges the recommendation and will update its current policies to better define terms and processes which will clarify its intent to document compliance.

2022-022 Eligibility Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 ? 2021, 1505-0270 ? 2021. January 6, 2022 ? December 29, 2022 and May 5, 2021 ? September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: According to Treasury?s Emergency Rental Assistance (ERA) Frequently Asked Questions (FAQs) Revised August 25, 2021, in ERA1, grantees must make reasonable efforts to obtain the cooperation of landlords and utility providers to accept payments from the ERA program. Outreach will be considered complete if (i) a request for participation is sent in writing, by mail, to the landlord or utility provider, and the addressee does not respond to the request within seven calendar days after mailing; (ii) the grantee has made at least three attempts by phone, text, or e-mail over a five calendar-day period to request the landlord or utility provider?s participation; or (iii) a landlord confirms in writing that the landlord does not wish to participate. The final outreach attempt or notice to the landlord must be documented. According to Treasury?s ERA Frequently Asked Questions (FAQs) Revised August 25, 2021, Grantees must obtain, if available, a current lease, signed by the applicant and the landlord or sublessor, that identifies the unit where the applicant resides and establishes the rental payment amount. If a household does not have a signed lease, documentation of residence may include evidence of paying utilities for the residential unit, an attestation by a landlord who can be identified as the verified owner or management agent of the unit, or other reasonable documentation as determined by the grantee. In the absence of a signed lease, evidence of the amount of a rental payment may include bank statements, check stubs, or other documentation that reasonably establishes a pattern of paying rent, a written attestation by a landlord who can be verified as the legitimate owner or management agent of the unit, or other reasonable documentation as defined by the grantee in its policies and procedures. According to the Texas Rent Relief Program Policies effective June 21, 2021, a household can request and receive rent assistance up to the total amount of monthly contracted rent listed on the lease. In the rare cases in which a tenant is applying without landlord cooperation, AND a lease does not exist, the tenant will be required to provide receipts for their 3 most recent rent payments in order to establish a pattern. According to Treasury?s ERA Frequently Asked Questions (FAQs) Revised August 25, 2021, all payments for utilities and home energy costs should be supported by a bill, invoice, or evidence of payment to the provider of the utility or home energy service. According to the Texas Rent Relief Program Policies Version I, Assistance payments for arrears and current month utilities will be based on actual bills. Condition: During our testing of 60 individual payments to program participants, we noted the following the following instances of noncompliance: ? The landlord outreach was not completed for two ERA 1 tenant payments, totaling $7,116. ? The monthly rent paid did not agree to the monthly rent on the lease for two tenant payments resulting in a total overpayment of $3,390. ? The monthly rent paid did not agree to the payment receipt for one tenant payment resulting in an overpayment of $900. ? The monthly rent paid did not agree to the tenant ledger for one tenant payment resulting in an overpayment of $6,739. ? The date and amount on the electricity bill for one tenant was not supported by adequate documentation as the bill was illegible. Total payment for electricity was $510. Questioned costs: $11,916 Context: See "Condition" Cause: Exceptions were due to management oversight. The processing vendor miscalculated the rental assistance. The reviewer neglected to complete and electronically sign the Landlord Application Review. Effect: Failure to accurately calculate and review rental assistance under the program may result in overpayments to tenants or payments to ineligible tenants. Repeat Finding: 2021-012 Recommendation: We recommend management to perform a thorough review of the documentation submitted to the Texas Rent Relief Program and pay according to the current lease or other verification of rental expense. Additionally, we recommend management ensure that appropriate documentation related to review of applications is maintained in the files. Views of responsible officials: Management agrees with the finding and recommendation

2022-023 Reporting ? Monthly Compliance Reports Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 ? 2021, 1505-0270 ? 2021 January 6, 2022?December 29, 2022 and May 5, 2021? September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: According to ?200.302 Financial management of 2 CFR Part 200, the nonFederal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. Condition: The Texas Department of Housing and Community Affairs (TDHCA) is required to submit ERA 1 and ERA 2 Monthly Compliance Reports, which include the total number of participating households that receive ERA assistance of any kind, and the total amount of ERA funds expended by TDHCA to or for participating households on behalf of eligible households. During our testing of three ERA 1 and three ERA 2 Monthly Compliance Reports, we noted the following: ? TDHCA was unable to provide source data for the October 2021 ERA 1 Monthly Compliance Report. The reported total number of participating households that receive ERA assistance was 42,607 and total amount of ERA funds expended was $197,113,340. ? For the December 2021 ERA 1 Monthly Compliance Report, the number of unique households reported to the Treasury was 1,175. However, the number of unique households was 1,170 based on the supporting documentation provided. ? For the November 2021 ERA 2 Monthly Compliance Report, the number of unique households reported to the Treasury was 78,378. However, the number of unique households was 78,332 based on the supporting documentation provided. TDHCA is also required to submit quarterly reports with reporting periods of one calendar quarter and several cumulative fields covering all activity from the date of award through the quarter close. These reports provide financial and performance data regarding TDHCA?s administration of their ERA projects and capture program design in addition to program status data elements. Key line items include the cumulative amount obligated and the cumulative amount expended by TDHCA. During our testing of three quarterly ERA 1 reports and two quarterly ERA 2 reports, we noted that no support was provided to validate the cumulative obligations and expenditures to date. Questioned costs: None Context: See "Condition" Cause: While management maintained dashboards to support reported information, they did not maintain the underlying supporting documentation. Effect: Failure to accurately report information on federal reports inhibits Treasury?s ability to accurately calculate reallocations and capture other key information in order to assess the performance of the program. Repeat Finding: No Recommendation: We recommend management adopt policies and procedures to ensure supporting documentation for federal reports is maintained, including any reconciling calculations or adjustments to support information reported on the federal reports. Views of responsible officials: Management agrees with the finding and recommendation.

2022-024 Reporting ? FFATA and Annual Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXLIEA ? 2022, 2101TXE5C6 ? 2021, 2101TXLWC5 2021 October 1, 2021 ?September 30, 2023, March 11, 2021 ?September 30, 2022, and May 5, 2021 ? September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the ?Transparency Act? that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The action is to be reported in FSRS no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Pursuant to 45 CFR 96.82(a) each grantee which is a State or an insular area which receives an annual allotment of at least $200,000 shall submit to the Department, as part of its LIHEAP grant application, the data required by section 2605(c)(1)(G) of Public Law 97-35 (42 U.S.C. 8624(c)(1)(G)) for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance. Condition: During our testing of special reporting for FFATA, we noted there is no review and approval process in place over the submitted reports to ensure accuracy and completeness. Additionally, we noted the following instances of noncompliance: See Schedule of Findings and Questioned Costs for chart/table TDHCA submits the Annual Report on Households Assisted by LIHEAP (Annual Report), which includes key lines items in Section 1 and 2 of the report. During our testing of Annual Report submitted for Federal Fiscal Year 2021, we noted several variances between the Annual Report and supporting detail provided. The following variances were noted during our testing: ? Section I - Line 2 - Heating (CARES Act funding only) - Variance of 8,937 ? Section I - Line 4 - Cooling - Variance of 48 ? Section I - Line 7a - Year Round - Variance of 17 ? Section I - Line 11 - Any type of LIHEAP assistance - Variance of 574 ? Section I - Line 12 - Any type of LIHEAP assistance (CARES Act funding only) - Variance of 22,858 ? Section I - Line 14 - Bill Payment Assistance - Variance of 48 ? Section I - Line 15 - Bill Payment Assistance (CARES Act funding only) - Variance of 22,267 ? Section IV - Line 7j - Emergency Furnace Repair & Assistance - Variance of (1,752) ? Section IV - Line 7k - Emergency Furnace Repair & Assistance (CARES Act funding only) - Variance of (457) ? Section IV - Line 8 - Weatherization - Variance of (715) ? Section IV - Line 9 - Weatherization (CARES Act funding only) - Variance of (56,821) Questioned costs: None Context: See "Condition" Cause: FFATA reporting exceptions were primarily due to management oversight. Specifically, to the subawards not reported, incorrect subawards were linked to the FAIN. As such FFATA reports for subaward obligations for those months were not submitted in FSRS. Variances in the Annual Report were due to manual errors in transferring data from TDHCA?s system reports to the Annual Report. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Additionally, reporting inaccurate information on other federal reports inhibits the federal agency?s ability to accurately capture key information in order to assess the performance of the program. Repeat Finding: No Recommendation: We recommend management implement a review and approval process to ensure accurate and complete information is submitted in FSRS and subaward information is reported timely. Additionally, we recommend management establish a review process to ensure information submitted on the Annual Report is complete and accurate. Views of responsible officials: Management concurs with the control deficiency.

2022-025 Special Tests and Provisions Testing ? ERA Funds Reallocation Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 ? 2021 January 6, 2022 ? December 29, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to Treasury?s ERA 1 Reallocation Guidance Updated March 30, 2022, Treasury will begin accepting requests from Grantees for reallocated funds, on a form to be published by Treasury, on October 15, 2021. As the ERA 1 statute requires, reallocated funds will only be available to Grantees that have obligated at least 65% of their own initial ERA 1 allocations. Each funding request will be required to indicate the amount requested and confirm the need for such funds in the Grantee?s jurisdiction. Condition: TDHCA submitted two allocation requests during fiscal year 2022. For 2 of 2 reallocation requests tested, the Department was unable to provide supporting documentation to validate the information that informed Treasury of the obligation amounts for the reallocation requests submitted on January 13, 2022, and June 10, 2022. Questioned costs: None Context: See "Condition" Cause: Failure to maintain adequate documentation was caused by management oversight. Effect: Failure to maintain adequate documentation to support submissions to the federal agency may result in inaccurate information being submitted inhibiting the federal agency from making make key decisions. Repeat Finding: Yes Recommendation: We recommend management adopt policies and procedures to ensure supporting documentation for federal submissions are maintained, including any reconciling calculations or adjustments to support information. Views of responsible officials: Management agrees with the finding and recommendation.

2022-026 Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Reporting, Special Tests and Provisions ? Information Technology ? User Access Federal Agency: U.S. Department of Labor Federal Program Title: Unemployment Insurance ALN: 17.225 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Unemployment Insurance UI-38249-22-55-A-48, UI-38008-22-60-A-48, UI-35972-21-60-A-48, UI-37309-22- 55-A-48, UI-37093-21-55-A-48, UI-37252-22-55-A-48, UI-35733-21-55-A-48, UI 34523-20-60-A-48, UI-34885-20-55-A-48, UI-35677-21-55-A-48, UI-34087-20- 55-A-48, UI-32628-19-55-A-48, UI-34744-20-55-A-48 January 1, 2022 ? March 31, 2024, January 1, 2022 ? September 30, 2023, January 1, 2021 ? September 30, 2022, October 1, 2021 ? September 30, 2022, September 1, 2021 ? August 31, 2023, October 1, 2021 ? December 31, 2024, October 1, 2020 ? September 30, 2021, January 1, 2020 ? September 30, 2021, April 1, 2020 ? June30, 2022, 2021 October 1, 2020 ? December 31, 2023, October 1, 2019 ? December 31, 2022, October 1, 2018 ? December 31, 2021, and October 1, 2018 ? June 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: TWC is not consistently adhering to the guidelines for issuing and managing accounts to ensure security controls are in place, effective, and are not bypassed as stated in section 3.2.15 Account Management of the TWC Information Security Manual (ISM) dated September 24, 2021. During our testing we noted the following deviations: ? UI Benefits: An annual review of user access was not completed during the fiscal year. Additionally, we noted that two developers had the ability to promote code change into production. Questioned Costs: None Context: ?See Condition? Cause: TWC did not follow the account management process as outlined in the TWC Information Security Manual. Effect: Failure to perform an annual user access review could increase the risk of inappropriate access. Repeat Finding: No Recommendation: We recommend that TWC should perform annual review of user access to be compliant with its internal policies. Views of responsible officials: For the annual UI access review, TWC agrees we need to perform annual reviews of user access. In 2022, TWC shifted our annual access reviews from what was then a manual process, usually documented on paper, to an improved process embedded in our Peoplesoft HR system called Centralized Accounting and Payroll/Personnel System (CAPPS). The new CAPPS Systems Access Privileges Certification provides a centralized place to track pending and completed access reviews to TWC systems. Since this was the first year the new process was used, there was some confusion by reviewers, which we believe led to some incomplete reviews and lack of monitoring this effort to completion. TWC acknowledges that two IT staff inappropriately had system access to both make code changes and promote changes to production. Although business processes, assigned job duties and staffs? skill sets limited them to using only one role or the other, they did have both accesses assigned in the system. Both named employees are no longer with the agency.

2022-027 Reporting ? ACF-196R and ACF-204 Reports ? Inaccurate Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2001TXTANF, 2101TXTANF and 2201TXTANF October 1, 2019 ? September 30, 2022, October 1, 2020 ? September 30, 2023, October 1, 2021 ? September 30, 2024, Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR 265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. Per 2 CFR 200.329(b) Reporting program performance, the Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. As appropriate and in accordance with above mentioned information collections, the Federal awarding agency must require the recipient to relate financial data and accomplishments to performance goals and objectives of the Federal award. Condition: Audit procedures over financial reports included testing of three quarterly ACF-196R reports. All three reports had expenditures incorrectly reported as follows: ? Grant Year 2020 ACF-196R for the quarter-ended 9/30/2021 Line 9b, Education and Training was understated by $987,108 Line 9c, Additional Work Activities was overstated by $5,079,845 Line 17, Services for Children and Youth was understated by $4,092,737 ? Grant Year 2021 ACF-196R for the quarter-ended 3/31/2022 Line 9b, Education and Training was understated by $716,670 Line 9c, Additional Work Activities was overstated by $4,555,850 Line 17, Services for Children and Youth was understated by $3,839,180 ? Grant Year 2022 ACF-196R for the quarter-ended 3/31/2022 Line 9b, Education and Training was overstated by $137,683 Line 9c, Additional Work Activities was overstated by $950,355 Line 17, Services for Children and Youth was understated by $1,088,038 Audit procedures over special reports included testing of the ACF-204, Annual Report including the Annual Report on State Maintenance-of-Effort Programs (OMB No. 0970-0248) for federal fiscal year 2021, which requires TWC to file an annual report containing information on the TANF program and the state?s MOE programs for that year, including strategies to implement the Family Violence Option, state diversion programs, and other program characteristics. Key line items include line 8 for the total number of families served under the program with MOE funds. We noted that this line was overstated by 9,784 families. Questioned costs: None Context: See ?Condition.? Cause: The ACF-196R and ACF-204 are populated from data retrieved through preset queries from CAPP and TWIST, respectively. Queries were written incorrectly and thus did not output accurate information. Effect: Failure to report accurate data on the ACF-196R could compromise the Office of Family Assistance (OFA) and the ACF?s ability to monitor TANF expenditures and compliance with statutory requirements. These data are also needed to estimate outlays and to prepare reports and budget submissions for Congress. Additionally, failure to report accurate data on the ACF-204 inhibits ACF?s ability to monitor the nature of State and Territory expenditures used to meet States and Territories MOE requirements. Repeat Finding: No Recommendation: TWC should perform a review of all queries used to retrieve data when populating the ACF 196R and ACF-204 reports to ensure accurate data is being outputted in accordance with the requirements of the respective reports. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the findings. Through analysis of report criteria, the Texas Workforce Commission has developed and implemented corrective action to address this finding.

2022-028 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Fund (CCDF) Cluster ALN: 93.489,93.575 and 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCCDF and 2201TXCCDF October 1, 2020 ? September 30, 2023 and October 1, 2021 ? September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Per review of TWC?s FFATA reporting procedures, the FFATA reports are derived from a set of queries that captures all the subaward information during the respective month. The Financial Reporting supervisor periodically reviews queries to ensure continued accuracy of the data. The Financial Reporting Accountant runs the set of queries after the 25th of each month and creates a batch file to be uploaded to FSRS. We noted the following instances of noncompliance, all of which were part of the December 2021 batch upload: See Schedule of Findings and Questioned Costs for chart/table The December 2021 batch included subawards granted in September and October 2021, however, were reported in FSRS on December 28, 2021. Questioned costs: None Context: See ?Condition.? Cause: TWC failed to submit monthly FFATA reports timely due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS timely will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TWC should establish processes to ensure that all subawards are identified and submitted in FSRS in a timely manner. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding.

2022-029 Special Tests and Provisions ? Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care Development Fund (CCDF) Cluster ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2201TXCCDF, 2201TXCCDD, 2101TXCCC5, 2101TXCSC6, 2101TXCDC6, 2101TXCCDF, 2001TXCCC3, 2001TXCCDF, 2001TXCCDM, 2001TXCCDD, 1901TXCCDD, 1901TXCCDM, 1901CCDF October 1, 2021 ? September 2024, December 27, 202 ? September 30, 2023, October 1, 2020 ? September 30, 2023, March 27, 2020 ? September 30, 2023, October 1, 2019 ? September 30, 2022, and October 1, 2018 ? September 30, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. Additionally, pursuant to TWC?s Childcare Services Guide (April 2022), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. The Texas Workforce Commission (TWC) must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: When an improper payment is identified by a Board, the Board must issue a notice of determination (RID-58) that notifies the participant that they were found to be ineligible to receive assistance for the time period and amount in question as well as the reason for ineligibility. If the improper payment is caused by fraud, the Board issues a 1st collection letter (RID-64) to attempt to recoup the ineligible amount. If amounts are not collected or on an active payment plan, the Board issues a final collection letter (RID-65) and refers the participant to TWC for warrant hold, which will bar future services to the individual until the recoupment is collected. Letters issued by the Board are maintained in the Program Integrity Reporting Tracking System (PIRTS), the tool for Board use in reporting and tracking childcare fact-finding, fraud determinations, and recoupments. TWC monitors the Boards? compliance with the recovery of improper payments through its subrecipient monitoring procedures. However, we noted that TWC is not consistently adhering to the guidelines for monitoring the policies and procedures issued to the Boards. We noted the following exceptions in the 40 cases selected for testing: ? Determination letters were not maintained in PIRTS for nine of the 40 cases tested. ? 1st collection letters were not maintained in PIRTS for 12 of the 40 cases tested. ? Final collection letters were not maintained in PIRTS for 11 of the 40 cases tested. Improper payments for which the determination letter, 1st collection letter and/ or final collection letter were not retained totaled $79,339 of the total improper payments of $188,299 tested. Recoupment efforts were still in process for the cases noted above. Questioned costs: None Context: ?See Condition? Cause: Management is not adhering to the subrecipient monitoring procedures to ensure determination letters, 1st collection letters and final collection letters are obtained by the Boards and maintained in PIRTS. Effect: Failure to obtain documentation of collection efforts may result in improper payments not being recouped. Repeat Finding: No Recommendation: We recommend management implement a process to ensure subrecipient reviews follow its subrecipient monitoring policies to verify that Boards are maintaining the appropriate documentation in PIRTS as required by TWC?s Childcare Services Guide (April 2022). Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. The TWC?s Division of Fraud Deterrence and Compliance Monitoring?s Office of Investigation (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs the TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. However, during the COVID-19 pandemic, FDCM/OI was inundated with unprecedented ID fraud claims investigations associated to the CARES Act unemployment compensation (UC) programs. During the scope of this audit, the majority of FDCM/OI?s investigator resources were deployed to address UC ID fraud matters. FDCM/OI relied on the TWC?s Subrecipient Monitoring Department (SRM) to test Board compliance with respect to childcare improper payment reporting and recoupment. Historically, this is an area in which SRM monitors are not subject-matter experts. FDCM/OI is now in a position to devote more investigator resources to this area.

2022-101 Activities Allowed or Unallowed Allowable Costs/Cost Principles Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution, Cross-cutting Assistance Listing Number: 93.498, Cross-cutting Pass-Through Agency: N/A Pass-Through Number: N/A Award Number: Unavailable, Cross-cutting Award Period: July 1, 2020 to December 31, 2020, Cross-cutting Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas M.D. Anderson Cancer Center (Cancer Center) did not appropriately restrict user access to certain information resources that it uses to manage federal awards. Specifically, the Cancer Center did not always promptly remove user accounts when an employee transferred to a new position or otherwise did not require access. The Cancer Center also did not consistently ensure that administrative access was limited to appropriate account types. The Cancer Center has policies in place to periodically review and modify user access to information resources, including upon an employee?s role change. However, the Cancer Center did not conduct effective user access reviews for all system levels to verify that access was appropriately restricted. After auditors brought these issues to the Cancer Center?s attention, it removed the inappropriate access. Allowing users inappropriate access to information resources increases the risk of unauthorized changes to those systems. In addition, the Cancer Center did not ensure that user access settings for all administrative accounts complied with policy requirements. The Cancer Center?s policies require certain settings to help restrict access for administrative accounts. However, auditors identified certain accounts that did not meet those requirements. Not ensuring that all settings meet minimum requirements increases the risk of data loss or tampering. Recommendations: The Cancer Center should: ? Appropriately limit user access to information resources and strengthen its user access review process for all system levels. ? Ensure that user access settings for administrative accounts align with policy requirements. Views of Responsible Officials: The Cancer Center acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the Cancer Center will work to develop and implement corrective action to mitigate further issues.

2021 ? 001 Allowable Costs/Cost Principles ? Indirect Cost Reimbursements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Epidemiology and Laboratory Capacity for Infectious Diseases ALN: 93.323 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: NU50CK000501 8/1/2019 ? 7/31/2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Federal Funds Reporting Manager performs calculations throughout the fiscal year for indirect cost reimbursements based on approved federal rates. Once complete, a memo is sent to the Cash Management Branch Manager detailing the project codes, funding sources, and amounts to be processed and drawn for reimbursement. Audit procedures included a sample of seven indirect cost calculations. For one calculation, the supporting documentation contained a formula error that resulted in double counting certain costs. As a result, the agency had overdrawn $64,669 in indirect cost reimbursements as of the date of the calculation. For two samples, the agency was unable to provide supporting documentation of the calculation. Questioned costs: None. Cause: DSHS does not currently have a process in place to review the calculations for completeness and accuracy. Effect: The agency was reimbursed for $64,669 of costs in excess of what was allowed at the time of the calculation. Repeat Finding: No Recommendation: DSHS should implement a formally documented review process over the completeness and accuracy of the indirect cost reimbursement calculations. Views of responsible officials: DSHS acknowledges and agrees with the recommendation on the indirect cost drawn for ELC ALN 93.323. Through analysis of the exception identified in the audit, DSHS will work to develop and implement corrective action to further improve the process for review of the indirect cost calculations.

2021 ? 002 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Epidemiology and Laboratory Capacity for Infectious Diseases ALN: 93.323 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: NU50CK000501 8/1/2019 ? 7/31/2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: In conjunction with the Finance Team within the Contract Management Section (CMS), the FFATA Coordinator coordinates the FFATA reporting process for all required submissions at the Department of State Health Services (DSHS). On a monthly basis, the DSHS FFATA Coordinator identifies FFATA subawards of $30,000 or more. Information for all relevant data elements is populated in an Excel template and submitted to the CMS Finance Team to enter into FSRS by the end of the subsequent month. Under the current process and for quality assurance purposes, the DSHS FFATA Coordinator must verify each FFATA report against each Excel spreadsheet and corrections are made if necessary. Audit procedures included a sample of two monthly FFATA submissions. For one of the two submissions, there was no evidence of verification of the data submitted in FSRS. Questioned costs: None. Cause: DSHS failed to maintain evidence of the verification of the data submitted in September 2020 in the FSRS. Effect: Failure to verify FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Repeat Finding: No Recommendation: DSHS should enhance FFATA policies and procedures including the current controls in place to formally document the verification of FFATA reports for completeness and accuracy prior to submission. Views of responsible officials: DSHS agrees with this recommendation. Existing FFATA reporting procedures should be formalized and enhanced.

2021 ? 003 Allowable Costs/ Cost Principles ? Information Technology ? Password Configuration Health and Human Services Commission / Department of Family and Protective Services/ Department of State Health Services Federal Agency: U.S. Department of Health and Human Services U.S. Department of Treasury U.S. Department of Homeland Security U.S. Department of Agriculture Social Security Administration Federal Program Title: Medicaid Cluster Coronavirus Relief Fund Block Grants for Community Mental Health Services Aging Cluster Presidential Declared Disaster Assistance to Individuals and Households - Other Needs Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Foster Care-Title IV-E (nonmajor) Adoption Assistance (nonmajor) Immunization Cooperative Agreements (nonmajor) ALN: 93.775, 93.777, 93.778 21.019 93.958 93.044, 93.045, 93.053 97.050 10.557 (nonmajor) 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.658 (nonmajor) 93.659 (nonmajor) 93.268 (nonmajor) Pass-Through Agency: Office of the Governor (Coronavirus Relief Fund only) Pass-Through Number(s): N/A Award Numbers and Periods: Medicaid Cluster 2005TXINCT, 2005TX5MAP, 2005TX5ADM, 2005TXIMPL, 2105TX5021, 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT 10/1/2019 ? 9/30/2020, 10/1/2020 ? 9/30/2021 Coronavirus Relief Fund 2020-CF-21019 4/15/2019-12/31/2021 Block Grants for Community Mental Health Services B09SM083830, B09SM083999, B09SM082632, B09SM010051 10/01/2020 ? 09/30/2022, 03/15/2021 ? 03/14/2023, 10/01/2019 ? 09/30/2021, 10/01/2018 ? 09/30/2020 Aging Cluster 1901TXOASS, 2001TXOASS, 2101TXOASS, 1901TXOACM, 2001TXOACM, 2101TXOACM, 1901TXOAHD, 2001TXOAHD, 2101TXOAHD, 1901TXOANS, 2001TXOANS, 2101TXOANS 10/01/2018-09/30/2021, 10/01/2019-09/30/2022, 10/01/2020-09/30/2022 Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs FEMA-4586-DR-TX, FEMA-4454-DR-TX, FEMA-4466-DR-TX 02/19/2021-08/19/2022, 07/17/2019-01/17/2021, 10/4/2019-2/4/2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at HHSC is not consistently adhering to the password parameters as stated in the HHSC Information Security Policy. During our testing we noted the following deviations: ? CAPPS FIN: The minimum password length was set to eight characters and the password history was set to five days. Since CAPPS FIN is defined as a high-risk system, per the HHSC Information Security Policy IA-05(01) Password Based Authentication, the minimum password length needs to meet or exceed 15 characters and password history of 12 days. Additionally, the password age is set to zero days. Per section 3.2.20 the minimum password age should be one day. The CAPPS FIN password length and history was updated on August 9, 2021 to be compliant with the HHSC Information Security Policy. ? RMS: The password minimum age was set to zero days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to one day. ? TIERS: The password minimum age was set to zero days. Per the HHSC Information Security Policy - Password Based Authentication, the minimum password age should be set to one day. Questioned Costs: None. Cause: HHSC did not have processes in place to enforce password policies as outlined in the HHSC Information Security Policy. Effect: Failure to follow HHSC?s password policies increases the risk of inappropriate access. Repeat Finding: 2020 ? 012 Recommendation: We recommend that HHSC update password configurations for TIERS and RMS to be compliant with its internal policies. CAPPS FIN was updated on August 9, 2021. Views of responsible officials: Agree

2021 ? 004 Allowable Costs/Cost Principles ? Cost Allocation Plan Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Aging Cluster Medicaid Cluster Block Grants for Community Mental Health Services Social Services Block Grant (nonmajor) Children?s Health Insurance Program (CHIP) (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) TANF (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 93.044, 93.045, 93.053 93.775, 93.777, 93.778 93.958 93.667 (nonmajor) 93.767 (nonmajor) 93.959 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.558 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 10.557 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Aging Cluster 1901TXOASS, 2001TXOASS, 2101TXOASS, 1901TXOACM, 2001TXOACM, 2101TXOACM, 1901TXOAHD, 2001TXOAHD, 2101TXOAHD, 1901TXOANS, 2001TXOANS, 2101TXOANS 10/01/2018-09/30/2021, 10/01/2019-09/30/2022, 10/01/2020-09/30/2022 Medicaid Cluster 2005TXINCT, 2005TX5MAP, 2005TX5ADM, 2005TXIMPL, 2105TX5021, 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT 10/1/2019 ? 9/30/2020, 10/1/2020 ? 9/30/2021 Block Grants for Community Mental Health Services B09SM083830, B09SM083999, B09SM082632, B09SM010051 10/01/2020 ? 09/30/2022, 03/15/2021 ? 03/14/2023, 10/01/2019 ? 09/30/2021, 10/01/2018 ? 09/30/2020 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: with Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR ?95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR ?95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. Condition: During testing over the application of the 2021 PACAP, the following items were noted: ? The PACAP does not include all department codes that HHSC is using to charge items. For two of 60 samples tested, the departments were not included in the PACAP and could not be tied to an allocation method. ? For one of 60 samples tested for proper reallocation of estimates, the incorrect percentages were applied in the reallocation journal entry when adjusting costs to actual. Questioned costs: None. Cause: (1) Department IDs ? HHSC is not reviewing and updating its PACAP plan on a regular basis. (2) Reallocation entry ? Between the time the supporting calculations were prepared and the time the entries were made in the system, the percentages were altered and subsequently entered improperly. Effect: Failure to accurately record indirect costs may result in noncompliance with grant terms and conditions. Repeat Finding: 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: (1) HHSC should review and update the cost allocation plan to ensure that the PACAP accurately describes how costs will be allocated between the federal programs and the state. (2) HHSC should minimize the time between preparing the supporting calculations and entering into the system to ensure proper recording. Views of responsible officials: Bullet point one: HHSC acknowledges the findings. New Dept IDs are added to the PACAP based on whether a Dept ID is in use in the system of record (CAPPS-Fin) on the PACAP submission effective date. The ?missing? Dept IDs used service dates before the PACAP effective date. However, these Dept IDs were setup and had transactions processed after the PACAP effective date, and therefore showed up in the audit samples as missing from the PACAP. This is expected as a normal part of HHSC?s operations, since new Dept IDs may be setup and transactions may be processed against the new Dept IDs well after a cost has been accrued for a variety of reasons. HHSC will further improve communication about HHSC?s business operations to address this finding. Bullet point two: The Texas Health and Human Services Commission (HHSC) acknowledges and agree with the findings. Through analysis of the exceptions identified in the audit, HHSC will work to develop and implement corrective action to further improve the processes.

2021 ? 005 Reporting ? FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster ALN: 93.044, 93.045, 93.053 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 1901TXOASS, 2001TXOASS, 2101TXOASS, 1901TXOACM, 2001TXOACM, 2101TXOACM, 1901TXOAHD, 2001TXOAHD, 2101TXOAHD, 1901TXOANS, 2001TXOANS, 2101TXOANS 10/01/2018-09/30/2021, 10/01/2019-09/30/2022, 10/01/2020-09/30/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: In conjunction with the Federal Funds Office (FFO), the Access and Eligibility Services (AES) Section coordinates the FFATA reporting process for the Aging Cluster at the Health and Human Services Commission (HHSC). Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: AES maintains a FFATA Reporting Template which includes all data elements required to be submitted in the FSRS. This template is to be sent to the FFO team for all applicable subawards by the 15th of every month. Prior to sending to FFO, the AES group reviews the information for completeness and accuracy. Audit procedures included a sample of four monthly FFATA submissions. For three of the four submissions, there was no evidence of review of the data provided to the FFO for input into the FSRS. Questioned costs: None. Cause: AES had experienced turnover at the management level during the fiscal year who had overseen the FFATA submissions. Additionally, HHSC was in the process of transitioning the FFATA responsibilities to new departments during the fiscal year. Effect: Failure to review FFATA submissions for completeness and accuracy may lead to inaccurate information being reported in FSRS. Repeat Finding: No Recommendation: HHSC should enforce controls in place to formally review FFATA reports for completeness and accuracy prior to submission. This review and approval should be documented on the FFATA Reporting Template. Views of responsible officials: AES agrees with the finding. However, AES does not have ownership of the FFATA Report Template. The FFATA Report Template is maintained by the Health and Human Services Commission?s (HHSC?s) Chief Financial Officer?s (CFO?s) Federal Funds Office Policy team. The FFATA Report Template was updated in October 2021, and the new form does not capture the management review and approval on the template. The FFATA Report Template will need to be updated to include the fields to record the management level review and approval.

2021 ? 006 Subrecipient Monitoring ? Subaward Agreements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services Social Services Block Grant (nonmajor) Block Grants for Prevention and Treatment of Substance Abuse (nonmajor) TANF (nonmajor) ALN: 93.958 93.667 (nonmajor) 93.959 (nonmajor) 93.558 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Block Grants for Community Mental Health Services B09SM083830, B09SM083999, B09SM082632, B09SM010051 10/01/2020 ? 09/30/2022, 03/15/2021 ? 03/14/2023, 10/01/2019 ? 09/30/2021, 10/01/2018 ? 09/30/2020 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: The Behavioral Health Services Section coordinates the subrecipient monitoring process for the Mental Health Block Grant (MHBG) at the Health and Human Services Commission (HHSC). Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR ?200.331, all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the certain information at the time of the subaward and if any of these data elements change, include the changes in the subsequent award modification. Required information includes the indirect cost rate for the federal award (including if the de minimis rate is charged). In addition, the approved federally recognized indirect cost rate negotiated between the subrecipient and the federal government should be used, or, if no such rate exists, either a rate negotiated between the pass-through entity and the subrecipient (in compliance with this part), or a de minimis indirect cost rate. Condition: HHSC is not applying the correct indirect cost rates for federal awards per the regulations when the subrecipient has an existing federally recognized indirect cost rate. When the subrecipient does not have a federally recognized indirect cost rate, HHSC is negotiating methodologies for applying indirect costs rather than rates. These methodologies are only being validated through periodic onsite reviews. For nine of the nine contracts selected for testing for the Mental Health Block Grant, federally negotiated indirect cost rates had not been incorporated into the contracts. Questioned costs: None. Cause: HHSC continues to incorporate indirect cost rates into current contract, which is a multi-year process. Effect: Failure to incorporate indirect cost rates into executed contracts may lead to noncompliance with grant terms and conditions. Repeat Finding: 2020-021, 2018-012, 2017-021 Recommendation: HHSC should continue to apply federally negotiated indirect cost rates to subrecipient contracts who have a federally negotiated rate. For subrecipients who do not have a federally negotiated indirect cost rate, HHSC should work with the subrecipient to obtain an indirect cost rate or determine if the subrecipient is eligible for the de minimis 10% rate. Views of responsible officials: Accepted.

2021 ? 007 Reporting ? Submission of FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Block Grants for Community Mental Health Services B09SM083830, B09SM083999, B09SM082632, B09SM010051 10/01/2020 ? 09/30/2022, 03/15/2021 ? 03/14/2023, 10/01/2019 ? 09/30/2021, 10/01/2018 ? 09/30/2020 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: In conjunction with responsible program personnel, the Federal Funds Office (FFO) coordinates FFATA Reporting at the Health and Human Services Commission (HHSC). Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: During the fiscal year, a total of $139,476,688 was awarded and obligated to HHSC for the program. Additionally, $56,980,096 or 97% of total program expenditures were passed through to 61 subrecipients during the fiscal year. However, the agency did not submit any subawards of $30,000 or more in the FSRS throughout the year. Questioned costs: None. Cause: Program personnel lack established internal controls and procedures over FFATA reporting to ensure the relevant subawards are submitted accurately and timely. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: Program personnel should implement policies and procedures related to FFATA Reporting to ensure the required subawards are being provided the Federal Funds Office when required in order to be submitted accurately and timely in FSRS. Views of responsible officials: Accepted.

2021 ? 008 Special Tests and Provisions ? Provider Eligibility ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2005TXINCT, 2005TX5MAP, 2005TX5ADM, 2005TXIMPL, 2105TX5021, 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT 10/1/2019 ? 9/30/2020, 10/1/2020 ? 9/30/2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR ?200.334, financial records, supporting documents, statistical records, and all other non- Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and passthrough entities must not impose any other record retention requirements upon non-Federal entities. Per 42 CFR ?455.436, HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 40 providers, which resulted in the following: ? For 14 samples, supporting documentation was not included in the file indicating the LEIE and EPLS databases were checked at the time of the most recent enrollment, ? For 15 samples, supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment, ? For 19 samples, supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment, ? For 7 samples, supporting documentation was not included in the file indicating the date of the most recent enrollment, and ? For 16 samples, the LEIE and EPLS were not being checked at least monthly. Questioned costs: None. Cause: Procedures for ensuring required documentation is maintained and proper ongoing monitoring of the databases are not in place and/or not at the correct precision level. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Additionally, unallowable payments could be made to providers if the required databases are not checked on an ongoing basis. Repeat Finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for at least the length of the providers? current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334. HHSC should also refine procedures to ensure the LEIE and EPLS databases are checked at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: HHSC agrees with the finding. Access and Eligibility Services (AES) Long Term Care (LTC) provider screening protocol did not require contract staff to verify and print the provider?s NPI by checking the NPPES database, printing the required database screening results, and uploading all screening results to the electronic contract file.

2021 ? 009 Special Tests and Provisions ? Provider Health and Safety Standards ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2005TXINCT, 2005TX5MAP, 2005TX5ADM, 2005TXIMPL, 2105TX5021, 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT 10/1/2019 ? 9/30/2020, 10/1/2020 ? 9/30/2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR ?200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. Condition: The Health Care Regulation Unit of the Regulatory Services Division (RSD) at HHSC conducts surveys for hospitals in the state of Texas to verify whether they meet prescribed health and safety standards. Audit procedures included a review of 40 samples which resulted in the following: ? For one sampled hospital, the survey file did not include a completed form CMS-1539 Medicare/Medicaid Certification and Transmittal. ? For two sampled hospitals, the form CMS-1539 Medicare/Medicaid Certification and Transmittal was not signed by the Surveyor Team Lead. ? Three sampled hospitals had their accreditation expire during the fiscal year and the required form CMS- 1539 Medicare/Medicaid Certification and Transmittal and form CMS-2567 Statement of Deficiencies and Plan of Correction were not completed. Questioned costs: None. Cause: Exceptions noted were due to oversight and inability to locate the relevant documentation. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR ?200.334. HHSC should also implement procedures to ensure all hospitals with upcoming expirations on their accreditation are flagged to have a survey file completed with all required forms. Views of responsible officials: Health Care Regulation (HCR) acknowledges the finding and will work internally to ensure the recommendations are implemented.

2021 ? 010 Special Tests and Provisions ? Medical Loss Ratio (MLR) ? Missing Data Elements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2005TXINCT, 2005TX5MAP, 2005TX5ADM, 2005TXIMPL, 2105TX5021, 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT 10/1/2019 ? 9/30/2020, 10/1/2020 ? 9/30/2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: For all contracts, the state must ensure that each MCO, PIHP, and PAHP submits a report with the data elements specified in 42 CFR ?438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR ?438.8(k) - The State, through its contracts, must require each MCO, PIHP, or PAHP to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC receives and reviews the MLR reports to verify the reports contain the required data elements. The MLR report template that is used by MCOs for this requirement is created and maintained by FRAC. Audit procedures included a review of six MLR reports submitted to FRAC during the fiscal year. Six of six (6) reports did not contain three of the thirteen required elements as follows: ? Methodology(ies) for allocation of expenditures ? A comparison of the information reported in this paragraph with the audited financial report required under ? 438.3(m). ? A description of the aggregation method used under paragraph (i) of this section Questioned costs: None. Cause: The current MLR report template provided to MCOs does not contain all thirteen (13) of the required data elements. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: The FRAC should update the MLR report template to reflect all required elements as per 42 CFR 438.8(k). Views of responsible officials: HHSC agrees with the finding.

2021 ? 011 Special Tests and Provisions ? Managed Care Financial Audit ? Periodic Audits Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2005TXINCT, 2005TX5MAP, 2005TX5ADM, 2005TXIMPL, 2105TX5021, 2105TX5ADM, 2105TX5MAP, 2105TXIMPL, 2105TXINCT 10/1/2019 ? 9/30/2020, 10/1/2020 ? 9/30/2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR ?438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920). Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR ?438.602(g), the State must post on its website, as required in ?438.10(c)(3), the following documents and reports: (1) The MCO, PIHP, PAHP, or PCCM entity contract. (2) The data at ?438.604(a)(5). (3) The name and title of individuals included in ?438.604(a)(6). (4) The results of any audits under paragraph (e) of this section. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC contracts with independent audit firms to perform agreed upon procedures (AUP) audits to verify the accuracy, truthfulness, and completeness of the financial data submitted by each MCO. Audit procedures included a review of seven AUP audits submitted to FRAC during the fiscal year. None of the documents and reports required per 42 CFR ?438.602(g) were posted to HHSC?s website. Questioned costs: None. Cause: The FRAC group does not currently have a process in place for posting the required documents and reports to the HHSC website. Effect: Failure to post the required documents and reports results in noncompliance with federal requirements. Repeat Finding: No Recommendation: The FRAC group should implement a process to post the required documents and reports to HHSC's website. The FRAC group maintains a tracker to ensure all audit reports are received. We recommend adding the status of posting to the website to this tracking tool. Views of responsible officials: HHSC agrees with the finding.

2021 ? 012 Eligibility Federal Agency: U.S. Department of Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505 ? 0266 01/06/2021 ? 12/31/2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Under the ERA1 program, payment shall be used to provide financial assistance to eligible households, including the payment of (i) rent; (ii) rental arrears; (iii) utilities and home energy costs; (iv) utilities and home energy costs arrears; and (v) other expenses related to housing incurred due, directly or indirectly, to the novel corona virus disease (COVID-19) outbreak, as defined by the Secretary. According to the U.S. Department of the Treasury Emergency Rental Assistance Frequently Asked Questions Revised August 25, 2021, for ERA funds used for rent and rental arrears, grantees must obtain, if available, a current lease, signed by the applicant and the landlord or sublessor, that identifies the unit where the applicant resides and establishes the rental payment amount. According to the Texas Rent Relief Program Policies (Effective 04/21/21), eligible rent expenses can be verified through any of the following: ? Current lease, signed by both applicant and landlord/sublessor, ? Lease dates, monthly rent amount, and past due rent provided by the landlord in the landlord application, or ? Evidence of the three most recent payments of rent: bank statements or check stubs, or rent receipt from landlord. According to the Texas Rent Relief Program Policies Version I (03/29/21), an application for assistance is initiated by either a landlord or a tenant. Payment will not be made on behalf of an applicant until an applicant certification, landlord certification (if participating) and utility certification (if participating) have been received. A tenant Reviewer Checklist and Landlord Application Review, as applicable, are completed based on information in the Tenant Application, Landlord Application, as applicable, and documentation submitted to the Texas Rent Relief Program. Each checklist is electronically signed by the reviewer. During our testing of payments to participants, we noted the following: ? For one of the 60 payments (Tenant Case ID 527731), TDHCA made an overpayment of $144 to the landlord for rent assistance and rental arrears. The total payment was $4,356 for four months at $1,089 per month. However, the lease calls for a monthly amount of $1,053, resulting in an overpayment for each month of $36. ? For one of the 60 payments (Tenant Case ID 512404), the Landlord Application Review was not completed nor electronically signed. However, TDHCA made a payment to the landlord for rental assistance in the amount of $4,200. Questioned Costs: $144 Cause: Management oversight. The processing vendor miscalculated the rental assistance. The reviewer neglected to complete and electronically sign the Landlord Application Review. Effect: Failure to accurately calculate and review rental assistance under the program may result in overpayments to tenants or payments to ineligible tenants. Repeat Finding: No Recommendation: We recommend management to perform a thorough review of the documentation submitted to the Texas Rent Relief Program and pay according to the current lease or other verification of rental expense. We recommend management ensure that appropriate documentation related to review of applications is maintained in the files. Views of responsible officials: Management agrees with the finding and recommendation.

2021 ? 013 Eligibility, Reporting ? Information Technology ? User Access, Change Management, and Vendor Management Federal Agency: U.S. Department of Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505 ? 0266 01/06/2021 ? 12/31/2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Texas Department of Housing and Community Affairs (TDHCA) utilizes the following information technology (IT) applications for the administration of the Emergency Rental Assistance program: ? Active Directory (Network) ? This application is used to grant network access to TDHCA personnel. ? Neighborly ? This application is used host and process the agency?s program data. It is used to determine eligibility of program participants, verify that the payments to program participants fall within the program?s period of performance and extract data used to prepare reports necessary meet reporting requirements to the federal agency. THDCA utilizes a third-party consultant to manage its use of Neighborly and make eligibility and period of performance determinations. Users of this application include both TDHCA users and the third-party consultant. ? Bill.com ? This application is used to make payments to program participants that are deemed eligible. TDHCA utilizes the same third-party consultant as it does for Neighborly to make payments via Bill.com to eligible program participants. Users of this application include both TDHCA users and the third-party consultant. During our testing of the Network, Neighborly and Bill.com, we noted the following: ? User Access Reviews: TDHCA did not perform a periodic access review of users for the Network, which would include a review of privileged users? access. In addition, while the third-party consultant completed user access reviews of its users of Neighborly and Bill.com, TDHCA did not perform a periodic access review of the agency?s users of the two applications. We noted that management completed a user access review of TDHCA users of Neighborly and Bill.com subsequent to fiscal year end. ? Change Management: Requests for changes to Neighborly and Bill.com are processed through change management tickets that are submitted by the agency to the third-party consultant. The third-party consultant subsequently submits the change requests to Neighborly or Bill.com. Change tickets may include configuration changes, enhancements, etc. TDHCA did not maintain a centralized tracking of all change requests submitted during the fiscal year. As a result, we were unable to perform testing over change management. ? Vendor Management: TDHCA did not obtain assurance over the internal controls of Neighborly during the fiscal year. Questioned Costs: None. Cause: There were no policies established to address a periodic review of user accounts. Additionally, while management had a process in place to request and submit change tickets, there was no process in place to maintain a log of those requests. Furthermore, as Neighborly was a new system used in fiscal year 2021, management did not have processes in place to obtain assurance over its internal controls. Effect: Failure to perform user access reviews, track change management requests and obtain assurance over the internal controls of vendors hosting the agency?s data could result in inappropriate access or inappropriate changes to the application. Repeat Finding: No Recommendation: User Access: We recommend management implement policies and procedures to complete user access reviews of the Network, Neighborly and Bill.com periodically, but not less than once a fiscal year to ensure all user accounts are appropriate. Change Management: We recommend management maintain a log of change management requests for Neighborly and Bill.com and periodically review the log to verify that all requests were appropriate. Vendor Management: We recommend that management obtain assurance over Neighborly?s internal controls as it relates to hosting and processing the agency?s data. This can be completed through an internal review of their internal controls, periodic audits of its processes or obtaining a SOC 1 Type 2 or SOC 2 Type 2 report and reviewing any complementary user controls and applicable findings. Views of responsible officials: Management agrees with the finding and recommendation

2021 ? 014 Reporting- Internal Control Finding Federal Agency: U.S. Department of Education Federal Program Title: Education Stabilization Fund ALN: 84.425 Pass-Through Agency: Office of the Governor (OOG) Pass-Through Number(s): N/A Award Number and Periods: 2020-GE-84425C 07/01/2020 ? 08/31/2021, 09/01/2020 ? 06/30/2022, 06/01/2021 ? 06/30/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR ?200.334 Retention requirements for records, Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. Condition: THECB is required to submit quarterly Progress Reports to its pass-through entity for each of its Governor?s Emergency Education Relief Fund (GEER) awards. Information is compiled from THECB?s Business Management System (BMS), and submission is completed through the pass-through entity?s eGrants system wherein THECB enters the data and submits directly via eGrants. Of the 12 Progress Reports submitted in fiscal year 2021, management was unable to provide supporting documentation from BMS for nine of the reports. Additionally, we noted that all 12 reports were prepared, reviewed and submitted in eGrants by the same individual. Questioned Costs: None. Cause: Management was unable provide copies of the data from BMS used to prepare the Progress Reports from the inception of the grant through June 2021. Information could not be recreated from BMS and management did not maintain copies of the supporting documentation for that time period. Additionally, due to the restrictions on the number of users allowed in eGrants only certain management personnel had access to submit reports during the fiscal year. Furthermore, due to the complexity of the new reporting requirements, management did not delegate the responsibilities over the preparation of the reports to accounting and finance staff. That responsibility remained with management, which significantly decreased the number of individuals that had the knowledge to prepare and review the report and access to submit the report. Effect: Lack of supporting documentation or appropriate segregation of duties in the preparation, review and submission of Progress Reports could result in inaccurate information to the pass-through entity. Repeat Finding: No Recommendation: We recommend that management retain information used to prepare the Progress Reports until the retention period for records has expired. Furthermore, we recommend that management separate the duties of preparing, and reviewing/submitting the Progress Reports to reduce the risk of inaccurate information submitted to the pass-through entity. Views of responsible officials: Management agrees with the auditor?s recommendation to develop (and strengthen existing) procedures for all federal performance measures, including retention of documentation of reports submitted.

2021 ? 015 Subrecipient Monitoring Federal Agency: U.S. Department of Education Federal Program Title: Education Stabilization Fund ALN: 84.425 Pass-Through Agency: Office of the Governor (OOG) Pass-Through Number(s): N/A Award Number and Periods: 2020-GE-84425C 07/01/2020 ? 08/31/2021, 09/01/2020 ? 06/30/2022, 06/01/2021 ? 06/30/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: All pass-through entities must communicate each of the required elements in 2 CFR ?200.332 within their subaward agreements. Required information includes 1) Federal award identification which includes the Federal Award Date of award to the recipient by the Federal agency and Federal Award Identification Number (FAIN). Condition: THECB obtains signed subaward agreements from all subrecipients to communicate and acknowledge the subrecipient?s understanding of the terms and conditions of the grant. For 17 of the subrecipients tested, seven subaward agreements between THECB and the subrecipient did not include the federal award dates or identification numbers. In fiscal year 2021, THECB passed through approximately 93% of GEER funds to subrecipients. Questioned Costs: None. Cause: Management did not have internal controls in place to ensure a review of subaward agreements was taking place to verify that all required elements per 2 CFR 200 ?200.332 were included. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by THECB. Repeat Finding: No Recommendation: We recommend management establish policies to require a review of all subaward agreements to ensure that all pass-through agreements from THECB include each of the required elements by 2 CFR ?200.332. Views of responsible officials: Management agrees with the auditor?s recommendation to develop (and strengthen existing) policies to require a review of all subaward agreements to ensure that all pass-through agreements from THECB include each of the required elements by 2 CFR ?200.332.

2021 ? 016 Allowable Costs/ Cost Principles ? Information Technology ? Password Management Federal Agency: U.S. Department of Labor U.S. Department of Homeland Security U.S. Department of Education Federal Program Title: Unemployment Insurance Workforce Innovation and Opportunity Act Cluster (WIOA Cluster) Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs Rehabilitation Services - Vocational Rehabilitation Grants to States ALN: 17.225 17.258, 17.259, 17.278 97.050 84.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Unemployment Insurance Various Various WIOA Cluster 4485DRTXSPLW 07/25/2020 ? 03/27/2022 Presidential Declared Disaster Assistance to Individuals and Households H126A210092 10/01/2020 ? 09/30/2021 Rehabilitation Services - Vocational Rehabilitation Grants to States AA-32205-18-A-48, AA-32258-19-A-48, AA-34797-20-55-A-48 04/01/2018 ? 06/30/2021, 04/01/2019 ? 06/30/2022, 04/01/2020 ? 06/30/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The password management at TWC is not consistently adhering to the password parameters as stated in section 3.2.20 Identification and Authentication of the TWC Information Security Manual (ISM) dated August 30, 2021. During our testing we noted the following deviations: ? Network: The Network password configuration for TWC minimum password age does not align with the TWC password policy. ? Rehab Works, UI Benefits, UI Tax, and the Cash Draw and Monthly Expenditure Report (CDER): The password settings do not align with the TWC password policy. ? TWIST: The password settings do not align with the TWC password policy. A security exception was granted for TWIST for the period August 5, 2021, through December 31, 2021, regarding not being in compliance with TWC?s password management policy. Questioned Costs: None. Cause: TWC did not have processes in place to enforce password policies as outlined in the TWC Information Security Manual. Effect: Failure to follow TWC?s password policies could increase the risk of inappropriate access. Repeat Finding: 2020 ? 034 Recommendation: We recommend that TWC should update password configurations for their Network, Rehab Works, UI Benefits, UI Tax, CDER, and TWIST to be compliant with its internal policies. Views of responsible officials: The Agency acknowledges and agrees with the finding. The Agency has determined that the network and these systems (Rehab Works, TWIST and RACF (including UI Benefits, UI Tax, and CDER), will need a password policy exception following the process outlined in the TWC ISM for exceptions. These systems are in the process of being replaced.

2021 ? 017 Allowable Costs/ Cost Principles ? MEUC Program Implementation Federal Agency: U.S. Department of Labor Federal Program Title: Unemployment Insurance ALN: 17.225 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: UI-34744-20-55-A-48 01/01/2021 ? 09/06/2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Section 2104 of the CARES Act and the Continued Assistance Act allows for unemployment compensation to be paid to claimants under the Self-Employment Assistance Program and MEUC, respectively. Condition: In January 2021, the Texas Workforce Commission (TWC) signed an addendum with the Department of Labor to administer the Mixed Earners Unemployment Compensation (MEUC) program. Under this agreement, each state is required to operate the program as required by any statutory amendments and the Department of Labor?s guidance. MEUC provides an additional $100 per week in supplemental benefits through weeks of unemployment ending on or before September 6, 2021, to individuals receiving certain unemployment insurance benefits who received at least $5,000 of self-employment income in the most recent taxable year ending prior to the individual?s application for regular unemployment compensation. Individuals who receive Pandemic Unemployment Assistance were ineligible for MEUC benefits. We noted that TWC did not implement the MEUC program during fiscal year 2021. TWC gave notice to the Department of Labor on June 26, 2021, to terminate the MEUC program, however, the Department of Labor has not issued a waiver. Questioned Costs: None. Cause: TWC did not implement the MEUC program because it lacked sufficient programming resources to configure its system for the MEUC program. Effect: A delay in implementing federal unemployment programs may diminish the number of claimants that will apply for MEUC and prevent the payment of benefits to eligible claimants contemporaneous to their weeks that claimants experienced a lack of income due to their unemployment. Repeat Finding: No Recommendation: We recommend that TWC should implement the required programs retroactively and/or obtain a waiver from the Department of Labor. Views of responsible officials: The Texas Workforce Commission acknowledges that it has not implemented the Mixed Earners Unemployment Compensation (MEUC) program. Texas exited the pandemic unemployment programs effective benefit week ending June 26, 2021, and the expiration of the programs became effective on September 6, 2021.

2021 ? 018 Eligibility, Special Tests and Provisions ? UI Program Integrity ? Overpayments ? Improper Payment of Benefits Federal Agency: U.S. Department of Labor Federal Program Title: Unemployment Insurance ALN: 17.225 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: UI-34193-20-55-A-48, UI-35733-21-55-A-48 10/01/2019 ? 9/30/2020, 10/01/2020 ? 09/30/2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: 20 CFR ?618.720 Qualifying requirements for Basic Trade Readjustment Allowances (TRA). To qualify for Basic TRA for a week of unemployment, an AAW must meet each of the requirements in paragraphs (a) through (g) of this section: (g) Participation in approved training. (1) As a condition for receiving Basic TRA, except as provided for in ?618.730, the AAW, after a total or partial separation from the adversely affected employment within the certification period, and by the applicable deadlines in ?618.725 must: (i) Be enrolled in training, as defined in subpart A of this part; (ii) Be participating in approved training (as defined in ?618.705); or (iii) Have a waiver granted under ?618.735 in effect. (2) An AAW who has not met the requirements in paragraph (g)(1) of this section may, if otherwise eligible, receive Basic TRA before expiration of the applicable training enrollment deadline in ?618.725. Once the training enrollment deadline is reached, the training requirements in paragraph (g)(1) of this section must be met. Basic TRA payments must cease beginning the first week for which the requirements in paragraph (g)(1) of this section were required but not met. (3) The requirements in paragraph (g)(1) of this section do not apply to an AAW with respect to claims for Basic TRA for weeks of unemployment beginning before the filing of an initial claim for TRA after publication of the certification of the appropriate worker group as provided in ?618.715(a), nor for any week that begins before the AAW is notified that he or she is covered by a certification and is fully informed of the requirements of this section. (4) An AAW who meets the participation in approved training requirement in paragraph (g)(1) of this section by the applicable deadlines in ?618.725 may continue to receive Basic TRA after the AAW has completed training, even if such participation in training was on a part-time basis, provided that the worker meets all other eligibility requirements for Basic TRA. Condition: During our testing, we noted that one out of 60 claimants tested for UI eligibility requirements was not enrolled in an approved training to be eligible to receive TRA benefits. The claimant had a denial of payment decision placed on their record in the UI system, based on the fact that the claimant graduated from an approved training program. A TWC analyst removed the denial in error, allowing the system to process two weeks of TRA benefit payments of $378 per week to the individual. Additionally, as this amount was not identified as an overpayment by TWC, it was not included in the overpayments listing as of August 31, 2021. Questioned Costs: $756 Cause: A denial of payment decision is manually entered when a claimant is no longer eligible for TRA benefits. A TWC employee, unfamiliar with the TRA eligibility requirements, erroneously removed the payment decision in the UI system as all weeks of TRA benefits had not been paid to the claimant. This allowed the payment to be processed by the UI system in error. Effect: Due to the volume of claims, a lack of familiarity with eligibility requirements by employees making eligibility determinations could lead to payment of ineligible claims and material noncompliance. Repeat Finding: No Recommendation: We recommend that TWC provide additional training over eligibility requirements to individuals with access to make eligibility determinations in the UI system. Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the cause noted. TWC did take action and provided additional training as recommended.

2021 ? 019 Eligibility, Special Tests and Provisions ? UI Program Integrity ? Overpayments ? Improper Payment of Benefits Federal Agency: U.S. Department of Labor U.S. Department of Homeland Security Federal Program Title: Unemployment Insurance Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs ALN: 17.225 97.050 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Unemployment Insurance Various Various Presidential Declared Disaster Assistance to Individuals and Households 4485DRTXSPLW 07/25/2020 ? 03/27/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR ?200 Appendix XI, State responsibilities include: (1) establishing specific, detailed policies and operating procedures which comply with the requirements of federal laws and regulations; (2) determining the state UI tax structure; (3) collecting state UI contributions from employers (commonly called ?unemployment taxes?); (4) determining claimant eligibility and disqualification provisions; (5) making payment of UI benefits to claimants; (6) managing the program?s revenue and benefit administrative functions; (7) administering the programs in accordance with established policies and procedures; and (8) enacting state UC law that conforms with federal UC law and that state law and operations substantially comply with federal law. UIPL 16-21 - When a state obtains information through automated systems or other sources that question whether the name and/or SSN used to file a claim belong to the individual who is filing the claim, the state must act quickly to: i) provide the individual with proper notice and an opportunity to provide information to resolve the issue; ii) decide whether or not sufficient information has been provided to verify the individual?s ID; and iii) issue a written determination. When such issues arise, states must act promptly to verify an individual?s ID in order to meet the requirement of section 301(a)(1), SSA, that the state have methods of administration reasonably calculated to ensure full payment of UI when due. For new claims, payment ?when due? means that qualified and eligible individuals receive their first benefit payments as soon as administratively feasible. UIPL No. 04-01 interprets the ?when due? requirement to also require states to ensure that payment of benefits is not made when payment is not due. Investigations of fraudulent imposter claims involving claimants, employers, and/or state staff are necessary for the proper administration of the UI program. States must have processes in place to ensure benefits are only paid to the individual whose identity has been verified. However, once a claim has been established and payments have been issued, there is a presumption of eligibility (refer to UIPL 04-01). Therefore, there must be evidence on the record that substantiates a reasonable basis for stopping payments once a determination of eligibility has been made and payments have been issued. Internal Control ? Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: On March 27, 2020, the President signed the CARES Act that authorized additional funding under the unemployment insurance program. This pandemic-related funding was significant and expanded the eligible individuals to support changes in employment status caused by COVID-19. These benefits extended into 2021. Additionally, on August 21, 2020, the Federal Emergency Management Agency (FEMA) provided supplemental payments for lost wages funds to enable TWC to provide $300 weekly supplemental payments to individuals unemployed due to COVID-19 pursuant to FEMA-DR-4485-TX. There was a priority on distributing funds under self-attestation strategy with limited verification to expedite disbursement of funds and support individuals in greatest need. However, several states experienced significant fraudulent claims. The U.S. Department of Labor and TWC have partnered to investigate the extent and methods used to perpetrate the fraud. For TWC, given the extent and circumstances, eligibility determinations made by the management were following the existing policies and procedures for this pandemic funding; however, to meet Federal and State expectations regarding the quick payment of federal pandemic benefits, the policies and procedures were not adequate to completely prevent fraudulent claims related to stolen identities (e.g., identity theft). Condition (Continued): TWC?s detective control did identify abnormal claim activity, however, not before payments were made. During our testing of 60 claims for supplemental payments for lost wages, we identified five claims that were considered potential identity theft as the claimants had not identified themselves through the identity verification process. The claims included benefit payments under UI, Disaster Unemployment Assistance (DUA), Pandemic Unemployment Assistance (PUA), Federal Pandemic Unemployment Compensation - ARPA and CARES (FPUC), and/ or Lost Wage Assistance (LWA). While these claims have been placed in an open period ineligibility status through a contact request to stop any future payments until TWC can speak with the claimant and resolve the potential ID theft issue, benefits in the amount of $55,224 were paid to these five claimants without appropriate identity verification. Per United States Department of Labor (USDOL) guidance through Unemployment Insurance Program Letter 16- 21, ?While an individual?s failure to respond is sufficient to prevent additional benefits from being paid until the individual responds, failure to respond in and of itself is not sufficient to establish an overpayment. The state must consider the evidence supporting suspicious activity, in addition to the individual?s failure to respond to the state?s attempt to verify identity, and determine if, under state law, the evidence in the record is sufficient to establish an overpayment.? TWC has stopped claims that it deems suspicious and potential ID theft, however, did not establish an overpayment as there was no corroboration from the claimant or an employer that actual ID theft occurred. Questioned Costs: Undetermined and under investigation by both federal and local authorities Cause: TWC experienced unprecedented claims volume with increased funding and additional program requirements with a priority for efficient distribution from both the U.S. Department of Labor and State officials. TWC?s existing identity verification protocols and vendor services were not adequate to timely identify and stop the onslaught of imposter claims caused by identity theft. Effect: A lack of internal controls over eligibility determinations may make the programs more vulnerable to fraudulent claims. Repeat Finding: No Recommendation: We recommend that TWC continue to review, monitor, and enhance eligibility procedures to detect and/or prevent fraudulent claimants from receiving benefits. Also, TWC should continue to enhance its assessment of risk related to the eligibility process and implement internal controls to help mitigate future identify theft frauds. Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. TWC has historically maintained strong internal controls to address fraud and identity theft in the Regular program as well as the long-established Federal programs (Unemployment Compensation for Ex-Service Members; Unemployment Compensation for Federal Employees; DUA, etc.). TWC has implemented all required and recommended data crossmatches from the U.S. Department of Labor and was an early adopter of the fraud-fighting services, protocols, and best practices of the National Association of State Workforce Agencies? UI Integrity Center. TWC was inundated with unprecedented claims volumes associated to the CARES Act programs. In addition to the sheer volume, the Pandemic Unemployment Assistance (PUA) program exacerbated the scourge of fraudulent imposter claims. Unlike true unemployment insurance programs such as Regular State benefits and Pandemic Emergency Unemployment Compensation, PUA was designed primarily to provide for payments to individuals who were not eligible for traditional unemployment compensation, e.g., individuals who were selfemployed or who had very limited work history. Congress mirrored the PUA program on the existing Disaster Unemployment Assistance (DUA) program. Like DUA, the PUA program was an emergency program activated in response to a crisis and designed to provide benefits to certain individuals who were ineligible for regular unemployment compensation or extended benefits. By its very nature, the PUA program bypassed core internal controls in the Regular program designed to ensure integrity in the system. Because PUA addressed the selfemployed or recently employed, it did not generally rely on past wages that exist in states? unemployment insurance systems as employer-reported quarterly employee wage records. Likewise, PUA eligibility was predicated on criteria related to the COVID-19 pandemic (UIPL 16-20 ?4(a)) rather than a traditional jobseparation analysis based on a claim response from an employer. The employer claim notice and response control is vital to a bona fide unemployment insurance system because it serves, in part, as verification of the worker?s identity and past employment with the employer. It is not unexpected, then, that of the 60 claims tested as part of this audit, the 5 which were identified as potentially ID theft imposter claims were each PUA claims. While acknowledging that some amount of fraudulent ID theft claims were paid, TWC in general was successful in identifying and stopping the large majority of these claims prior to payment. Since the beginning of the pandemic in March 2020, approximately 5 million total unemployment benefit claims were filed and $54 billion in total net benefits were paid. Of that population, more than 159,000 claims have been confirmed as ID theft. Of that, a little over 10,000 claimants were paid benefits in the amount of approximately $56 million, or 0.1 percent of all benefit payouts. TWC protocols prevented an estimated $827 million in payouts to confirmed ID theft claims. Additionally, TWC claim-verification processes identified roughly 627,000 potential ID theft claims that had no benefits paid at all. Regarding these claims, TWC estimates that approximately $3.5 billion in potentially fraudulent benefits were prevented from paying out. All told, TWC stopped nearly $4.3 billion in potential ID theft payments. In summary, TWC is committed to the integrity of the unemployment compensation program and continues to commit significant resources to the on-going effort to eliminate fraud, waste, and abuse in the program.

2021 ? 020 Special Tests and Provisions ? UI Program Integrity ? Overpayments ? Lack of Data Collection Federal Agency: U.S. Department of Labor U.S. Department of Homeland Security Federal Program Title: Unemployment Insurance Presidential Declared Disaster Assistance to Individuals and Households ? Other Needs ALN: 17.225 97.050 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Unemployment Insurance Various Various Presidential Declared Disaster Assistance to Individuals and Households 4485DRTXSPLW 07/25/2020 ? 03/27/2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Sections UIPL 15-20 and UIPL 16-20, Recovery Provisions, require a State agency to properly identify, handle and recover amounts overpaid to claimants. State agencies must have systems in place to capture overpayment data in order for recovery procedures to be conducted. SEC. 262. Lost Wages Assistance Recoupment Fairness. (b) Waiver Authority For State Liability. In the case of any individual who has received amounts of covered assistance to which the individual is not entitled, the State shall require the individual to repay the amounts of such assistance to the State agency, except that the State agency may waive such repayment if the State agency determines that (1) the payment of such covered assistance was without fault on the part of the individual; and (2) such repayment would be contrary to equity and good conscience. Condition: Under the CARES Act and amidst the COVID-19 pandemic, TWC administered a number of unemployment insurance programs to provide unemployment benefits for persons impacted by COVID-19. Among these programs were the PUA, FPUC, and LWA programs that provided the following benefits: See Schedule of Findings and Questioned Costs for chart/table During these weeks, TWC processed an unprecedented number of claims in order to provide benefits to claimants impacted by COVID-19 in a timely manner. During these weeks, we noted that TWC did not implement overpayment data collection procedures in its UI system for these programs. As a result, potential overpayments were not being calculated during this time period. Overpayments were retroactively calculated for the PUA and FPUC programs in May 2021 and December 2021, respectively. However, overpayments have not been calculated for the LWA program as of the fiscal year end. Questioned Costs: Undetermined Cause: TWC experienced unprecedented claims volume with increased funding and additional program requirements with a priority for efficient distribution from both the U.S. Department of Labor and State officials. Due to the volume of claims and the expectation to meet demand, TWC did not implement adequate program changes to its system to calculate potential overpayments for the new program. Effect: The passage of time diminishes TWC's ability to recover overpaid amounts. Additionally, overpaid balances for the Lost Wages Assistance are not properly accounted for as they are not captured in TWC's financial statements. Repeat Finding: No Recommendation: We recommend that TWC develop a plan to capture and collect overpayment data. Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding of not programming overpayments associated with the Lost Wage Assistance (LWA) program. TWC has implemented overpayment tracking to capture and collect Pandemic Unemployment Assistance (PUA) and Federal Pandemic Unemployment Compensation (FPUC) overpayments, however programming for Lost Wage Assistance (LWA) is still pending.

2021 ? 021 Period of Performance ? Application of Program Income Federal Agency: U.S. Department of Education Federal Program Title: Rehabilitation Services - Vocational Rehabilitation Grants to States ALN: 84.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: H126A210092 10/01/2020 ? 09/30/2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: TWC applies expenditures to program income on a weekly basis in order to spend program income prior to drawing down additional federal funds. Management queries a report from WRAPS (Workforce, Reporting, Accounting and Purchasing System) to retrieve all program expenditures by accounting period. Program expenditures for the current accounting period, up to the amount of program income is applied to program income. We noted that the accounting period per the WRAPS report used by management does not coincide with the underlying service date of the expenditures. We tested 25 out of 17,218 expenditures that were expended during the first month of the grant award period, or September 24, 2020 through October 31, 2020. Six out of 25 samples tested were entries to apply expenditures to program income based on the process described above. Upon review of the underlying expenditures, we noted that $1,481,904 out of $6,141,146 in expenditures had services dates in September 2020, prior to the grant period of performance and were incorrectly charged to the grant. Management corrected the error and reclassified the expenditures. Questioned Costs: None. Cause: The systematic approach in which management applied program income was incorrect as it used the accounting date rather than the service date of the expenditures. Effect: Reliance on internal controls that are not designed properly may result in errors and questioned costs. Repeat Finding: No Recommendation: We recommend TWC update its process to apply expenditures to program income to use the service date of the expenditure rather than the WRAPS accounting date. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the Texas Workforce Commission has developed and implemented corrective action to address this finding.

2021 ? 022 Allowable Costs/ Cost Principles ? Indirect Cost Lab Rate Allocation Federal Agency: U.S. Department of Transportation - Federal Highway Administration Federal Program Title: Highway Planning and Construction Cluster ALN: 20.205, 20.219, 20.224, 23.003 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Various Various Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: TXDOT applies a 0.0025721626% indirect cost rate for its laboratory operations, as approved by the Federal Highway Administration in its Administrative Indirect Cost annual update effective September 1, 2020. This rate is used in project costing to allocate lab costs for construction and maintenance projects for fiscal year 2021. Allocable lab costs include participating direct expenditures, or federally funded expenditures. Applicable rates are applied automatically in Peoplesoft to participating direct expenditures for each invoice. For 25 of the indirect cost charges tested, four of the samples were indirect cost charges related to the lab rate allocation. For one of the four samples, we noted that the indirect cost rate was incorrectly being applied to both participating and non-participating direct expenditures. The program reported a total of $65,023,060 of indirect costs in fiscal year 2021. Of that amount, we tested $22,701 within our sample of 25 indirect costs charged to the program. We identified a known error of $160 as the indirect cost rate for laboratory operations was incorrectly applied to the non-participating direct expenditure noted above. As the error was a systemic, management quantified the total dollar amount of the systemic error for fiscal year 2021 as $122,180, or 0.0024% of total expenditures for the program for the year. Management corrected the systemic error subsequent to August 31, 2021. Questioned Costs: $160 Cause: The error was due to a system error in the way in which the indirect cost rate was being applied within Peoplesoft. The indirect cost rate for laboratory operations was incorrectly being applied to both participating and non-participating direct expenditures. Effect: Undetected failures in internal controls with an information technology component could result in material noncompliance due to the volume of transactions the controls are applied to. Repeat Finding: No Recommendation: We recommend management continue to test internal controls with an information technology component to ensure systemic errors do not exist. Views of responsible officials: Management routinely performs reviews of our internal controls. The process of allocating participating, and non-participation construction costs was updated a few years ago and has prevented material errors in TxDOT billings to the Federal government. The controls are/were working properly to prevent material misallocation and/or inaccurate billing to the Federal government for general Construction charges and Construction Engineering costs (no material issues were identified by the auditor). The final questioned costs of $160.44 represent 0.00025% of the total $65MM population. TxDOT was proactive and vigilant in this situation and immediately worked to identify the issue and adopt resolutions.

2021 ? 023 Cash Management, Subrecipient Monitoring, Special Tests and Provisions ? Quality Assurance ? Information Technology ? User Access and Password Management Federal Agency: U.S. Department of Transportation Federal Program Title: Highway Planning and Construction Cluster Formula Grants for Rural Areas ALN: 20.205, 20.219, 20.224, 23.003 20.509 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Various Various Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR ?200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: SiteManager (SMGR) automates the contract administration functions for construction and maintenance projects and the materials and tests administration functions, which include aspects of project administration from the time a contract is awarded through finalization of the project. eGrants is a TxDOT-wide enterprise system managed by the Information Technology Division (ITD) and used by the Aviation (AVN) and Public Transportation (PTN) Divisions to manage grants to subgrantees across Texas for federal and State funded grants. During our testing of SGMR and EGrants, we noted the following: ? Password Management: During our testing, we noted that there is no set password expiration or lockout configurations set for SGMR, which is not in accordance with the password standards in the Texas Department of Transportation (TXDOT) Information Security Policy (Policy). The policy states that passwords must be changed periodically and that lockout attempts should be configured in accordance with the Information Security and Privacy Controls Catalog. ? User Access Reviews: During our testing, we noted that TXDOT did not perform a documented periodic access review of users for SGMR, which would include a review of privileged users? access. In addition, during our testing we noted that TXDOT did not perform a documented periodic access review of users for the EGrants application, which would include a review of privileged users? access. We tested thirtythree (33) users with privilege access in EGrants to verify whether access was restricted to those who have business needs. Of the 33 users, TXDOT was unable to provide the business purpose for 19 of the privilege access users. The 19 accounts were noted as vendor accounts. Management corrected the password configuration matter subsequent to August 31, 2021 by adding the Active Directory login function to SGMR. As of December 17, 2021, the Active Directory credentials are used for all users? login into SMGR. Questioned Costs: None. Cause: Password configurations were not in accordance with the TXDOT Information Security Policy and Information Security and Privacy Controls Catalog due to management oversight. Additionally, TxDOT does not have established policies and procedures that require user access reviews over user accounts for all applications. Effect: Failure to set password configurations and password lockout configurations increases the risk of inappropriate access. Failure to perform user access reviews increases the risk that suspicious activities may not be identified and investigated. Repeat Finding: 2018 ? 038 Recommendation: We recommend TXDOT configure SGMR password configurations to be in accordance with the established TXDOT Information Security Policy and Information Security and Privacy Controls Catalog. In addition, we recommend that TXDOT implement policies and procedures in relation to SGMR and EGrants to complete documented user access reviews, including a review of all privileged accounts on a periodic basis to verify that all active accounts supported by a business purpose. Views of responsible officials: The Department concurs with the recommendations. The Department implemented corrective action in December 2021 to resolve the password configuration finding. ITD is responsible for reviewing user access for its Division and vendors supporting those ITD functions within eGrants. AVN and PTN are responsible for reviewing user access for their respective divisions? employees and subgrantee staffs.

2021 ? 101 Equipment and Real Property Management Federal Program Title: Research and Development Cluster Federal Agencies: U.S. Department of Defense, U.S. Department of Health and Human Services, National Science Foundation Award years: See below Award numbers: See below Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Non-Compliance Questioned Costs: $0 Repeat Finding: No A recipient?s property records for equipment acquired with federal funds must be maintained accurately and include all of the following: a description of the equipment; serial number or other identification number; the source of funding for the equipment, including the federal award identification number; who holds the title; acquisition date and cost of the equipment; the percentage of federal participation in the cost of the equipment; the location, use, and condition of the equipment; and ultimate disposition data, including the date of disposal and sale price (Title 2, Code of Federal Regulations (CFR), Section 200.313(d)(1)). A control system must be developed to ensure that adequate safeguards are in place to prevent loss, damage, or theft of the equipment. Any loss, damage, or theft must be investigated (Title 2, CFR, Section 200.313(d)(3)). Texas A&M University (University) did not maintain accurate and complete property records for 4 (6 percent) of 65 equipment items tested. Specifically: ? For three items, the property record contained an incorrect location. For one item, the location was not updated before it was deployed to an off-campus location. For the second item, the location in the property record did not match the location where the item was currently in use. That item is mobile; however, the location was not updated in the property record when the item was moved. For the third item, the property record did not reflect the location where the item was stored until it could be installed. ? For one other item, the University did not follow its policy to affix an inventory tag before the item was transferred to an off-campus location. That item also did not have a serial number noted in the property record. While there was not a specific serial number located on the item, there was another number that could have been entered into the property record to help identify the item. In addition, the University was unable to locate 1 (2 percent) of 62 equipment items selected for physical inspection. The University did not identify that the item was missing and file a missing property report until auditors selected that item for testing. Not maintaining accurate and complete property records and not adequately safeguarding equipment increases the risk that equipment may be misused, lost, or stolen. The following awards were affected by the equipment issues discussed above: See Schedule of Findings and Questioned Costs for chart/table Recommendations: The University should strengthen controls to ensure that it: ? Maintains accurate and complete property records for all equipment acquired with federal funds. ? Adequately safeguards its equipment to prevent loss or theft of equipment. Views of Responsible Officials: The University acknowledges and agrees with the finding. Texas A&M University will work to develop and implement corrective action.

2021 ? 102 Subrecipient Monitoring Federal Program Title: Research and Development Cluster Federal Agencies: U.S. Department of Education, National Science Foundation Award year: See below Award number: See below Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Non-Compliance Questioned Costs: $0 Repeat Finding: No Award Identification At the time of the subaward, the pass-through entity must communicate to the subrecipient: (1) federal award identification information, including the assistance listing number and title, federal award number, subrecipient?s unique entity identifier, and whether the award is research and development; (2) all requirements imposed by the pass-through entity on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the federal award; (3) any additional requirements that the passthrough entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the federal awarding agency; (4) an approved federally recognized indirect cost rate negotiated between the subrecipient and the federal government; (5) a requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient?s records and financial statements; and (6) appropriate terms and conditions concerning closeout of the subaward (Title 2, Code of Federal Regulations (CFR), Section 200.332(a)). For 2 (7 percent) of 30 subawards tested, Texas A&M University (University) did not provide all required information to the subrecipient. Specifically, the University did not communicate one or more of the following required elements: assistance listing number and title, the subrecipient?s unique identifier, or whether the award is research and development. For one of those subawards, the pass-through entity did not communicate all of the required information to the University and the University relied on that information when creating its own subaward. In addition, for that same award, the University used an old subaward template that had not been updated to include all of the required information. For the other subaward, the University created the subaward using a generic assistance listing number. Not providing all required award information increases the risk that subrecipients will not comply with all applicable statutes, regulations, and terms and conditions of the federal award. Risk Assessment Pass-through entities are required to evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The pass-through entity may consider such factors as (1) the subrecipient?s prior experience with the same or similar subawards, (2) the results of previous audits, (3) whether the subrecipient has new personnel or new or substantially changed systems, and (4) the extent and results of federal awarding agency monitoring (Title 2, CFR, Section 200.332 (b)). When establishing a new subaward, the University uses a subrecipient risk assessment template that allows it to assess risk based on criteria such as the amount of a subaward, scope of work, place of performance, and previous audit findings. Based on the results of the risk assessment, the University determines for the subrecipient an overall risk level of acceptable risk or high risk. For 1 (3 percent) of 30 subawards tested, the University could not provide evidence that it had performed a risk assessment for the subrecipient. As a result, auditors were unable to determine whether the University would have needed to perform additional monitoring activities in accordance with its policies. When auditors brought the issue to the University?s attention, it was unable to determine whether the risk assessment had not been performed or if the risk assessment was performed but not documented in the subrecipient?s file. The following awards were affected by the issues discussed above. See Schedule of Findings and Questioned Costs for chart/table Recommendations: The University should: ? Ensure that it communicates all required information to subrecipients. ? Follow its policies for assessing subrecipient risk and document that assessment in the subrecipient?s file. Views of Responsible Officials: The University acknowledges and agrees with the finding. Texas A&M University will work to develop and implement corrective action.

2021 ? 103 Equipment and Real Property Management Federal Program Title: Research and Development Cluster Federal Agencies: U.S. Department of Defense, National Science Foundation, U.S. Department of Energy, U.S. Department of Education, U.S. Department of Health and Human Services Award years: See below Award numbers: See below Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Non-Compliance Questioned Costs: $0 Repeat Finding: 2018-109, 2015-134, 2014-155, 2013-176, 13-161, and 12-170 Equipment Property Records A recipient?s property records for equipment acquired with federal funds must be maintained accurately and include all of the following: a description of the equipment; serial number or other identification number; the source of funding for the equipment, including the federal award identification number; who holds the title; acquisition date and cost of the equipment; the percentage of federal participation in the cost of the equipment; the location, use, and condition of the equipment; and ultimate disposition data, including the date of disposal and sale price (Title 2, Code of Federal Regulations (CFR), Section 200.313(d)(1)). The University of Texas at Austin (University) did not maintain accurate and complete property records for 6 (9 percent) of 64 equipment items tested. Specifically, for each of those items, the property record was inaccurate or did not contain one of the following elements: serial number or other identification number, cost of equipment, item location, or disposition information. The University relies on unit administrators within each University department to provide the required information in the equipment property records. Those errors occurred because the University either (1) did not enter property records accurately and completely into its asset management system or (2) did not always follow its policies and procedures to update property records as needed. Not maintaining accurate and complete property records increases the risk that equipment may be misused, lost, or stolen. The following awards were affected by the equipment issues discussed above: See Schedule of Findings and Questioned Costs for chart/table Physical Inventory A recipient must conduct a physical inventory of equipment and reconcile the results with its property records at least once every two years. A control system also must be developed to ensure that adequate safeguards are in place to prevent loss, damage, or theft of equipment. Any loss, damage, or theft of equipment must be investigated (Title 2, CFR, Section 200.313(d)(2) and (3)). The University?s Handbook of Business Procedures (Handbook) states that an annual physical inventory will be conducted and that when a unit administrator becomes aware that an item of equipment is missing, a diligent search must be performed until the equipment is found or until it is established that it has been lost or stolen. The University conducted a physical inventory of equipment during fiscal year 2021; however, 28 (8 percent) of 332 departments did not complete the physical inventory as required. Specifically: ? For 25 departments, documentation was provided to explain why the physical inventory was not completed, which was generally attributable to the COVID-19 pandemic. ? For three departments, no documentation was provided to explain why the physical inventory was not completed. Not requiring all departments to complete an annual inventory increases the risk that equipment purchased with federal funds may be lost, stolen, or improperly disposed. Recommendations: The University should strengthen controls to ensure that it: ? Maintains accurate and complete property records for all equipment acquired with federal funds. ? Requires departments to conduct an annual physical inventory of equipment. Views of Responsible Officials: The University concurs with the findings.

2021 ? 104 Equipment and Real Property Management Federal Program Title: Research and Development Cluster Federal Agency: U.S. Department of Health and Human Services Award years: See below Award numbers: See below Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Non-Compliance Questioned Costs: $0 Repeat Finding: No A recipient?s property records for equipment acquired with federal funds must be maintained accurately and include all of the following: a description of the equipment; serial number or other identification number; the source of funding for the equipment, including the federal award identification number; who holds the title; acquisition date and cost of the equipment; the percentage of federal participation in the cost of the equipment; the location, use, and condition of the equipment; and ultimate disposition data, including the date of disposal and sale price (Title 2, Code of Federal Regulations (CFR), Section 200.313(d)(1)). The University of Texas Health Science Center at Houston (Health Science Center) did not maintain accurate property records for 4 (7 percent) of 61 equipment items tested. Specifically: ? For two items, the property record contained an incorrect location. For those items, the department responsible for the equipment did not update the asset management department when the items were moved. ? For one item, the Health Science Center was not able to locate the item when auditors selected it for testing. As a result, the Health Science Center filed a missing property report; however, that item was subsequently found in a different location. ? For one item, the property record contained an incorrect serial number. That item was replaced under the manufacturer?s warranty, and the Health Science Center did not update the property record to reflect the replacement item?s serial number. Not maintaining accurate property records increases the risk that equipment may be misused, lost, or stolen. The following awards were affected by the equipment issues discussed above: See Schedule of Findings and Questioned Costs for chart/table One additional award was affected by the issues discussed above; however, due to the age of the asset, the award information was no longer available. Recommendation: The Health Science Center should strengthen controls to ensure that it maintains accurate property records for all equipment acquired with federal funds. Views of Responsible Officials: The University of Texas Health Science Center at Houston agrees there is an opportunity for improvement in the strengthening controls of assets. Assets that were found in an incorrect location were found in close proximity to the listed room number, within the same department. Each department within the University is responsible for reporting timely changes or discrepancies regarding location or replacement of assets. Capital Assets Management will work with each department to ensure the most accurate and UpToDate asset information is reflected in our asset tracking system.

2021 ? 105 Equipment and Real Property Management Federal Program Title: Research and Development Cluster Federal Agency: U.S. Department of Health and Human Services Award years: See below Award numbers: See below Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Non-Compliance Questioned Costs: $0 Repeat Finding: No Equipment A recipient?s property records for equipment acquired with federal funds must be maintained accurately and include all of the following: a description of the equipment; serial number or other identification number; the source of funding for the equipment, including the federal award identification number; who holds the title; acquisition date and cost of the equipment; the percentage of federal participation in the cost of the equipment; the location, use, and condition of the equipment; and ultimate disposition data, including the date of disposal and sale price (Title 2, Code of Federal Regulations (CFR), Section 200.313(d)(1)). A control system must be developed to ensure that adequate safeguards are in place to prevent loss, damage, or theft of the equipment. Any loss, damage, or theft must be investigated (Title 2, CFR, Section 200.313(d)(3)). The University of Texas Health Science Center at San Antonio (Health Science Center) did not maintain accurate property records for 8 (13 percent) of 62 equipment items tested. Specifically, for each of those eight equipment items, the property record contained an incorrect location, serial number, or both. Those errors occurred because the Health Science Center did not enter information into its property record accurately or the asset management department was not notified when there were changes to the equipment items, such as relocation. In addition, the Health Science Center did not adequately safeguard 2 (3 percent) of 58 equipment items selected for physical inspection. The property record for each of those items indicated they were in-service; however, the Health Science Center was unable to locate the items when auditors selected them for testing. Not maintaining accurate property records and not adequately safeguarding equipment increases the risk that equipment may be misused, lost, or stolen. Equipment Disposition The Health Science Center?s Handbook of Operating Procedures requires its departments to submit a Property Deletion Request form to the Health Science Center?s property control office when disposing of obsolete, unserviceable, worn out, or surplus equipment. For 5 (63 percent) of 8 equipment disposals tested, the Health Science Center did not dispose of equipment in accordance with its policy. Specifically, the Health Science Center did not complete a Property Deletion Request form for those five equipment items. Those items were left in a building that the Health Science Center was planning to sell. Items left in the building were inventoried and auctioned off; however, the Health Science Center could not provide evidence of the auction proceeds for two of the five items tested. Not disposing of equipment in accordance with its policy increases the risk that the Health Science Center could improperly dispose of equipment purchased with federal funds. The following awards were affected by the equipment issues discussed above: See Schedule of Findings and Questioned Costs for chart/table Recommendations: The Health Science Center should strengthen controls to ensure that it: ? Maintains accurate property records for all equipment acquired with federal funds. ? Adequately safeguards its equipment to prevent loss or theft of equipment. ? Disposes of equipment items in accordance with its policy. Views of Responsible Officials: UT Health-San Antonio acknowledges and agrees with the finding.

2021 ? 106 Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Special Tests and Provisions ? Key Personnel Federal Program Title: Research and Development Cluster Federal Agencies: Federal agencies that award Research and Development Cluster funds Award years: Multiple Award numbers: Multiple Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency Questioned Costs: $0 Repeat Finding: No General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303). The University of Texas M.D. Anderson Cancer Center (Cancer Center) did not appropriately update certain systems it uses to manage its federal research and development awards. The Cancer Center asserted that the updates were not made due to other competing priorities. Not ensuring that systems are updated and supported increases the risk of data loss or breach. After auditors brought the issue to the Cancer Center?s attention, it updated those systems. Recommendation: The Cancer Center should update and support all systems it uses to manage federal awards. Views of Responsible Officials: MD Anderson Cancer Center (MDACC) acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, MDACC will work to develop and implement a corrective action to further improve the processes.

2021 ? 107 Equipment and Real Property Management Federal Program Title: Research and Development Cluster Federal Agencies: U.S. Department of Defense, U.S. Department of Veterans Affairs, U.S. Department of Health and Human Services Award years: See below Award numbers: See below Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Non-Compliance Questioned Costs: $0 Repeat Finding: 2018-119 A recipient?s property records for equipment acquired with federal funds must be maintained accurately and include all of the following: a description of the equipment; serial number or other identification number; the source of funding for the equipment, including the federal award identification number; who holds the title; acquisition date and cost of the equipment; the percentage of federal participation in the cost of the equipment; the location, use, and condition of the equipment; and ultimate disposition data, including the date of disposal and sale price (Title 2, Code of Federal Regulations (CFR), Section 200.313(d)(1)). A control system must be developed to ensure that adequate safeguards are in place to prevent loss, damage, or theft of the equipment. Any loss, damage, or theft must be investigated (Title 2, CFR, Section 200.313(d)(3)). The University of Texas M.D. Anderson Cancer Center (Cancer Center) did not maintain accurate and complete property records for 22 (36 percent) of 61 equipment items tested. Specifically: ? For 17 items, the property record contained an incorrect location. The Cancer Center relies on its annual inventory process to verify that the property record accurately reflects the location of equipment items. Due to the COVID-19 pandemic, the Cancer Center did not complete the fiscal year 2020 inventory and was in the process of performing the fiscal year 2021 inventory at the time of the audit. As a result, the property records were not updated to reflect the items? current locations. ? For two items, the property record indicated that the items were in-service; however, those items were no longer in use. After auditors selected those items for testing, the Cancer Center submitted a request for disposal. ? For two items, the property record did not contain the item?s serial number or the serial number was recorded incorrectly. ? For one item, the property record did not contain the item?s serial number and the location of the item was also incorrect. In addition, the Cancer Center was unable to locate 1 (2 percent) of 61 equipment items selected for inspection. The Cancer Center did not file a missing property report until auditors selected that item for testing. The errors discussed above occurred because the Cancer Center (1) did not enter information accurately or completely when creating the property records or (2) did not update the property records when changes to the items were made. Not maintaining accurate and complete property records and not adequately safeguarding equipment increases the risk that equipment may be misused, lost, or stolen. The following awards were affected by the equipment issues discussed above: See Schedule of Findings and Questioned Costs for chart/table Recommendations: The Cancer Center should strengthen controls to ensure that it: ? Maintains accurate and complete property records for all equipment acquired with federal funds. ? Adequately safeguards its equipment to prevent loss, or theft of equipment. Views of Responsible Officials: MD Anderson Cancer Center (MDACC) acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, MDACC will work to develop and implement a corrective action to further improve the processes.

2021 ? 108 Equipment and Real Property Management Federal Program Title: Research and Development Cluster Federal Agency: U.S. Department of Health and Human Services Award years: See below Award numbers: See below Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Non-Compliance Questioned Costs: $0 Repeat Finding: 2018-123 A recipient?s property records for equipment acquired with federal funds must be maintained accurately and include all of the following: a description of the equipment; serial number or other identification number; the source of funding for the equipment, including the federal award identification number; who holds the title; acquisition date and cost of the equipment; the percentage of federal participation in the cost of the equipment; the location, use, and condition of the equipment; and ultimate disposition data, including the date of disposal and sale price (Title 2, Code of Federal Regulations (CFR), Section 200.313(d)(1)). A control system must be developed to ensure that adequate safeguards are in place to prevent loss, damage, or theft of the equipment. Any loss, damage, or theft must be investigated (Title 2, CFR, Section 200.313(d)(3)). The University of Texas Medical Branch at Galveston (Medical Branch) did not maintain accurate and complete property records for 2 (3 percent) of 60 equipment items tested. Specifically, the property record for each item either did not contain the item?s serial number or the serial number was incorrect. Those errors occurred because the Medical Branch did not enter property records accurately and completely into its asset management system. In addition, the Medical Branch did not adequately safeguard 4 (7 percent) of 60 equipment items selected for physical inspection. Specifically: ? For three items, the Medical Branch asserted that the items were transferred to a warehouse in preparation for disposal; however, it was not able to locate those items or provide documentation supporting those relocations. ? For one item, the property record indicated the item was in-service; however, the Medical Branch was not able to locate that item when auditors selected it for testing. Not maintaining accurate and complete property records and not adequately safeguarding equipment increases the risk that equipment may be misused, lost, or stolen. The following award was affected by the issues discussed above: See Schedule of Findings and Questioned Costs for chart/table Other awards were affected by the issues discussed above; however, due to the age of the assets, the award information was no longer available. Recommendations: The Medical Branch should strengthen controls to ensure that it: ? Maintains accurate and complete property records for all equipment acquired with federal funds. ? Adequately safeguards its equipment to prevent loss or theft of equipment. Views of Responsible Officials: Management agrees with the auditor?s recommendation.

2020 ? 001 Reporting ? Information Technology ? Change Management Federal Agency: U.S. Department of Agriculture Federal Program Title: Community Development Block Grant CFDA Number: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Various Various Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303, the Texas Department of Agriculture (TDA) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Per the TDA Software Configuration Management Policy, Change Control is required to ensure that all change requests go through the proper approval process and are tracked through completion. Measures must be taken to ensure the code that is being moved to production is functioning accurately and will not cause disruptions in processing. It is vital to keep track of code changes in each release. If problems with a new release occur, the previous version of the software can be restored. Condition: TDA uses the Community Development Block Grant (CDBG) Contract Tracking System (CDBG-CTS) to manage grants and grantee performance as well as for reporting to the Department of Housing and Urban Development (HUD). During our testing we noted the CDBG - CTS System Application was moved to a cloud environment (Azure) in March 2020. However, there was no change record noted for this move to the cloud environment in March. In addition, the CDBG database change logs showed nine database system changes/recompiles that occurred during fiscal year 2020. However, TDA did not maintain sufficient documentation to support eight (8) of the nine (9) changes/recompiles. Questioned costs: None. Context: See ?Condition.? Cause: TDA's software configuration policies and procedures do not have change types identified (i.e. standard, emergency, normal, enhancements); therefore appropriate documentation for CDBG-CTS changes were not reviewed and retained. Effect: Failure to monitor changes in TDA?s information technology systems increases the risk that suspicious activities may not be identified and investigated. Repeat Finding: No Recommendation: We recommend that TDA implement policies and procedures to ensure management reviews of all changes and recompiles are completed and documentation of those reviews are maintained. Additionally, if the reviews result in follow up action items, we recommend the policies and procedures outline the guidance for the follow up and documentation of the resolution. Views of responsible officials: The CDBG system was inherited by TDA several years ago. The system was not written by TDA and has not been modified to any large degree. The CIO understands that the I.T. organization must assure appropriate internal controls over software changes. The CIO was hired on February 1, and he looks forward to working with the I.T. organization on systemic improvements to issues such as this one.

2020 ? 002 Reporting ? Information Technology ? User Access Federal Agency: U.S. Department of Agriculture Federal Program Title: Community Development Block Grant CFDA Number: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Various Various Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303, the Texas Department of Agriculture (TDA) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Condition: TDA uses the Community Development Block Grant (CDBG) Contract Tracking System (CDBG-CTS) to manage grants and grantee performance as well as for reporting to the Department of Housing and Urban Development (HUD). We noted that TDA?s periodic access reviews of the CDBG-CTS application do not include a review of privileged users? access. We tested twenty-eight (28) users with privilege access in CDBG-CTS to verify whether access was restricted to those who have business needs. Of the twenty-eight users, TDA was unable to provide the business purpose for twenty-six (26) of the privilege access users. Additionally, we noted one CDBG-CTS developer that had access to production functions within the CDBG-CTS application. Access to migrate changes to the production environment should be restricted appropriately and based on job function to help ensure adequate internal controls are in place and appropriate segregation of duties exist. In general, developers should not have access to migrate changes to the production environment and should not have access privileges above read-only in the application. Questioned costs: None. Context: See ?Condition.? Cause: TDA?s information technology policies and procedures over user access reviews do not require a review of privilege accounts on a periodic basis. Effect: Failure to terminate privilege access accounts that do not have a business need in TDA?s information technology systems increases the risk that suspicious activities may occur and not be identified and investigated. Repeat Finding: No Recommendation: We recommend that TDA implement policies and procedures to ensure user access reviews include a review of all privilege accounts on a periodic basis. Additionally, we recommend that TDA terminate all privilege user accounts that are not supported by a business purpose. Views of responsible officials: The CDBG system was inherited by TDA several years ago. The system was not written by TDA and has not been modified to any large degree. The CIO understands that the I.T. organization must assure appropriate internal controls over access control. The CIO was hired on February 1, and he looks forward to working with the I.T. organization on systemic improvements to issues such as this one.

2020 ? 003 Cash Management, Eligibility, Subrecipient Monitoring, Special Tests and Provision ? Verification of Free and Reduced Price Applications (NSLP) ? Information Technology ? Vendor Management Federal Agency: U.S. Department of Education U.S. Department of Agriculture Federal Program Title: Child Nutrition Cluster Child and Adult Care Food Program Food Distribution Cluster (nonmajor) CFDA Number: 10.553, 10.555, 10.556, 10.559 10.558 10.565, 10.568, 10.569 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Various Various Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303, the Texas Department of Agriculture (TDA) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Condition: TDA utilizes Texas Unified Nutrition Program System (TX-UNPS), a web application that allows TDA personnel and subrecipients to submit and approve documents. TX-UNPS manages information regarding subrecipient contracts, entitlement, inventory, orders, and other food distribution functions. Specific functions of TX-UNPS include submitting and tracking commodity orders, viewing or declining commodity allocations, viewing invoices, and submitting and maintaining annual commodity contract packets and contract entitlements. During our testing we noted that TDA outsources the hosting, maintenance, and enhancement over TX-UNPS to a third-party service organization. The third-party service organization does not currently provide a Service Organization Controls 1 (SOC 1) Type 2 report. A SOC 1 Type 2 report validates the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process TDA?s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. Questioned costs: None. Context: See ?Condition.? Cause: While TDA requested a SOC 1 Type 2 report from the TX-UNPS vendor, TDA was unable to apply established IT policies and procedures to review the SOC 1 Type 2 report for this third-party vendor because the vendor provided a SOC 1 Type 1 report. Effect: Failure to obtain and review findings and complementary user entity controls within each third-party vendor?s SOC 1 Type 2 report may result in inappropriate reliance on the third-party vendor?s internal controls, which could result in noncompliance. Repeat Finding: 2019-002 Recommendation: We recommend that TDA obtain and review the SOC 1 Type 2 report for the TX-UNPS vendor that provide services over critical applications in order to evaluate whether they can rely on the third party?s overall control structure. In addition, TDA should review and test the complementary user entity controls included in the SOC 1 Type 2 report and document the results of those procedures. Views of responsible officials: TDA made significant efforts during the audit period to strengthen internal controls related to TXUNPS. TDA developed procedures and a standard template to document the review of the SOC reports and completed the review and assessment of the TXUNPS SOC 1, Type 1 report.

2020 ? 004 Special Tests and Provisions ? Verification of Free and Reduced Price Applications (NSLP) ? Failure to obtain eligibility verifications by the established deadline Federal Agency: U.S. Department of Education Federal Program Title: Child Nutrition Cluster CFDA Number: 10.553, 10.555, 10.556, 10.559 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6TX300332 10/1/2019-9/30/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 7 CFR 245.6a(h) Verification reporting and recordkeeping requirements, by February 1, each local educational agency must report information related to its annual statutorily required verification activity, which excludes verification conducted in accordance with paragraph (c)(7) of this section, to the State agency in accordance with guidelines provided by the Food and Nutrition Service (FNS). Per the Texas Department of Agriculture?s (TDA) Administrator's Reference Manual (ARM), TDA will review documentation submitted through the Texas Unified Nutrition Program System (TX-UNPS) and determine if the Contracting Entity (CE) is compliant with the regulations related to verification. TDA may require a corrective action plan if the CE does not comply with the verification requirements, including, but not limited to, submitting all required forms by due dates and complete and approvable implementation of verification processes. Noncompliance in these areas may require fiscal action. A CE is required to submit a corrective action plan in the event that the CE fails to complete the eligibility verification by the established deadline and fails to request an extension. Condition: During our testing, we noted that TDA did not follow up with CE?s that failed to complete the eligibility verification by the established deadline and failed to request an extension. For five (5) out of the forty (40) CE?s sampled, we noted that TDA did not request corrective action plans from CE?s that submitted their FNS-742 School Food Authority (SFA) Verification Collection Report (FNS-742) after the February 1, 2020 deadline. Corrective action plans were requested subsequent to the auditor?s request on December 10, 2020. Questioned costs: None. Context: See ?Condition.? Cause: Due to the COVID outbreak, TDA experienced challenges of contacting the CE?s regarding the late FNS 742 reports. TDA requested corrective action plans from the five (5) CE's on December 11, 2020, with a due date of December 17, 2020. Effect: Failure to follow up and obtain corrective action plans over late FNS-742 reports may result in TDA being out of compliance with corrective action requirements for untimely report submissions. Repeat Finding: No Recommendation: We recommend that TDA implement controls to ensure an adequate process is in place to follow up and obtain corrective action plans for those CE?s that fail to complete the eligibility verification by the established deadline and fail to request an extension. Views of responsible officials: TDA management agrees with the concept that system controls are necessary. We have process and procedures in place, and we will refine those procedures to incorporate formal timelines for processing of corrective action plans.

2020 ? 005 Allowable Costs/ Cost Principles ? Timeliness of Cost Allocation Plan Reallocations Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Foster Care-Title IV-E Adoption Assistance Medicaid Cluster Temporary Assistance for Needy Families (TANF) (nonmajor) Child Care and Development Fund Cluster (CCDF Cluster) (nonmajor) CFDA Number: 93.658 93.659 93.775, 93.777, 93.778 93.558 (nonmajor) 93.489, 93.575, 93.596 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Foster Care-Title IV-E 2001TXFOST 10/1/2019-12/31/019, 1/1/2020-9/30/2020 Adoption Assistance 2019TXADPT, 2001TXADPT 10/1/2019-12/31/2019, 1/1/2020-9/30/2020 Medicaid Cluster 1905TX5000,1905TXINCT, 1905TX5MAP, 1905TX5ADM, 1905TXIMPL, 2005TX5000, 2005TXINCT, 2005TX5MAP, 2005TX5ADM, 2005TXIMPL 10/1/2018-9/30/2019, 10/1/2019-9/30/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, Department of Family and Protective Services (DFPS) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: DFPS?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments result in costs claimed for each period being allocated based on actual base statistics for the same period. Per DFPS?s internal schedule, 4th quarter reallocations should be completed by December 14 of each year; however were not completed until the end of January for fiscal year 2019 and 2020. During fiscal year 2019, reallocations were completed through December 2018 for recording in the general ledger. Monthly reconciliations were completed through March 2019 and posted through a top-side entry. However, reallocations required for projects for the months of April through August 2019 were not completed in a timely manner in order to post the top-side entry. DFPS recorded the reallocations in the amount of $2,217,064 for the Foster Care program and ($106,828) for the Adoption Assistance program for the months of April ? August 2019 in fiscal year 2020. During fiscal year 2020, reallocations were completed through March 2020. Monthly reconciliations were completed through May 2020 and posted through a top-side entry. However, reallocations required for projects for the months of June through August 2019 were not completed in a timely manner in order to post the top-side entry. DFPS did not record the reallocations in the amount of $3,690,285 for the Foster Care program and $1,045,684 for the Adoption Assistance program for the months of April ? August 2019. Based on the matters noted above, we noted a net misstatement of $1,473,221 for Foster Care and $1,152,512 for Adoption Assistance in fiscal year 2020. Questioned costs: $1,473,221 (Foster Care) $1,152,512 (Adoption Assistance). Context: See ?Condition.? Cause: DFPS?s certified Schedule of Expenditures of Federal Awards (SEFA) is due to the Comptroller of Public Accounts in November each year. The timing between when allocations are completed and available to be posted is currently around five and a half (5.5) months, which does not allow sufficient time for inclusion in the SEFA. Effect: DFPS should continue to improve the timeliness of reallocations to ensure the amounts included in the Schedule of Expenditures of Federal Awards meet 2 CFR 200.303. Repeat Finding: 2019-003, 2018-002, 2017-005, 2016-008 Recommendation: DFPS should continue to improve the timeliness of reallocations to ensure the amounts included in the Schedule of Expenditures of Federal Awards meet 2 CFR 200.303. Views of responsible officials: DFPS agrees with the finding and will take steps to improve the timeliness of reallocations to ensure amounts included in the Schedule of Expenditures comply with 2 CFR 200.303.

2020 ? 006 Eligibility ? Information Technology - User Access Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Foster Care-Title IV-E Adoption Assistance Social Services Block Grant CFDA Number: 93.658 93.659 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Foster Care-Title IV-E 2001TXFOST 10/1/2019-12/31/019, 1/1/2020-9/30/2020 Adoption Assistance 2019TXADPT, 2001TXADPT 10/1/2019-12/31/2019, 1/1/2020-9/30/2020 Social Services Block Grant 1801TXSOSR, 1901TXSOSR, 2001TXSOSR 10/1/2017-9/30/2019, 10/1/2018-9/30/2020, 10/1/2019-9/30/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303, Department of Family and Protective Services (DFPS) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Condition: DFPS utilizes the Information Management Protecting Adults and Children in Texas (IMPACT) system to record case information about the children and adults the agency protects. DFPS uses IMPACT to document all stages of service of a case, including when someone reports abuse, neglect, or exploitation and when those cases are investigated. During fiscal year 2020, there were 319 terminated IMPACT users. We sampled twenty-six (26) terminated users to verify whether their access was removed in accordance with the DFPS Account Management Policy (Policy), which states that a user?s account should be disabled and archived within one day of termination. Ten of the twenty-six (26) terminated users did not have their access to IMPACT revoked in accordance with the Policy. Furthermore, one of the ten (10) users? last login date was after their termination date. Questioned costs: None. Context: See ?Condition.? Cause: DFPS did not enforce its policies and procedures to terminate IMPACT user accounts in accordance with its Account Management Policy. Effect: Failure to disable and archive accounts for users that have been terminated increases the risk of inappropriate access and noncompliance. Repeat Finding: No Recommendation: We recommend DFPS strengthen its internal controls to ensure terminated IMPACT users? access is disabled and archived in accordance with its Account Management Policy. Views of responsible officials: The agency acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the agency will develop and implement corrective actions to improve internal controls over account access.

2020 ? 007 Allowable Costs/Cost Principles, Reporting ? Information Technology -Vendor Management Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grant CFDA Number: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Various Various Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303, the General Land Office (GLO) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Condition: GLO utilizes the Homeowner Reimbursement Program (HRP)/ Quickbase application, a cloud-based platform application to manage expenditures related to the homeowner reimbursement program. GLO also relies on Work Force Group for data entry processes for this application. During our testing, we noted that GLO outsources the development platform used to customize and streamline the workflow related to vendors and their related claims to a third-party service organization. We noted that while GLO did obtain the SOC 1 Type II report from the third-party vendor, they did not perform a review of the findings and complementary user entity controls within the report in order to place reliance on it. A SOC 1 Type 2 report validates the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process GLO?s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. Questioned costs: None. Context: See ?Condition.? Cause: GLO does not have established policies and procedures that requires the information technology department to obtain and review SOC1 Type 2 reports for third party vendors. Effect: Failure to obtain and review findings and complementary user entity controls within each third-party vendor?s SOC 1 Type 2 report may result in inappropriate reliance on the third-party vendor?s internal controls, which could result in noncompliance. Repeat Finding: No Recommendation: We recommend that GLO should establish policies and procedures to obtain and review SOC 1 Type 2 reports for each of their third party vendors that provide services over critical applications in order to evaluate whether they can rely on the third party?s overall control structure. In addition, GLO should review and test the complementary user entity controls included in each SOC 1 Type 2 report and document the results of those procedures. Views of responsible officials: Management agrees with the recommendation.

2020 ? 008 Allowable Costs/ Cost Principles, Period of Performance, Reporting ? Information Technology ? Password Management Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grant CFDA Number: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Various Various Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303, the General Land Office (GLO) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Per the Texas GLO Policy Book ? Information Security policy, passwords must be changed on a periodic basis as outlined in the policies. Condition: During our testing we noted the existing configuration for GLO?s identity management tool had been intentionally changed by management and was no longer compliant with the GLO's information security policy. Questioned costs: None. Context: See ?Condition.? Cause: A password setting was intentionally changed by management during the pandemic to help assist end users in the transition to working remotely. As a compensating control, multi-factor authentication (MFA) was implemented for access to the Network remotely. However, the password policies and procedures were not updated to reflect this change. Effect: Changes to password settings may increase the risk of inappropriate access and loss or compromised data if compensating controls are not implemented. Repeat Finding: No Recommendation: We recommend that GLO issue an addendum or memorandum to its existing policies in order to memorialize the changes being made, the reasons for the change and how the change will continue to reduce the risk of inappropriate access. Views of responsible officials: Management agrees with the recommendation.

2020 ? 009 Reporting ? Inaccurate Reporting on the HUD 60002 Summary Report Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grant CFDA Number: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Various Various Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 24 CFR 91.520 Performance reports. (a) General. Each jurisdiction that has an approved consolidated plan shall annually review and report, in a form prescribed by HUD, on the progress it has made in carrying out its strategic plan and its action plan. The performance report must include a description of the resources made available, the investment of available resources, the geographic distribution and location of investments, the families and persons assisted (including the racial and ethnic status of persons assisted), actions taken to affirmatively further fair housing, and other actions indicated in the strategic plan and the action plan. This performance report shall be submitted to HUD within 90 days after the close of the jurisdiction's program year. (d) CDBG. For CDBG recipients, the report shall include a description of the use of CDBG funds during the program year and an assessment by the jurisdiction of the relationship of that use to the priorities and specific objectives identified in the plan, giving special attention to the highest priority activities that were identified. This element of the report must specify the nature of and reasons for any changes in its program objectives and indications of how the jurisdiction would change its programs as a result of its experiences. This element of the report also must include the number of extremely low-income, low-income, and moderate-income persons served by each activity where information on income by family size is required to determine the eligibility of the activity. Condition: During our testing of GLO's HUD 60002, Section 3 Summary Report, Economic Opportunities for Low-and Very Low-Income Persons report (HUD 60002 Summary Report), we noted calculation errors that resulted in inaccurate reporting. We recalculated the Total Dollar Amount of Non-Construction Contracts Awarded in Part II of the HUD 60002 Report, which is comprised of the Total Non-Construction Contract Dollars from the Section 3 Housing 60002 Summary, the Section 3 Non-Housing 60002 Summary, and the Section 3 MultiFamily 60002 Summary. During our testing, we noted that the Section 3 Multifamily 60002 Summary was not included in the Total Dollar Amount of Non-Construction Contracts Awarded, resulting in an understatement of $834,337.23. GLO reported $18,270,312.81 for the Total Dollar Amount of Non-Construction Contracts Awarded, however should have reported $19,104,650.04. Furthermore, the Percentage of the Total Dollar Amount that was Awarded to Section 3 Businesses for Non Construction Contracts is calculated as the Total Dollar Amount of Non-Construction Contracts Awarded to Section 3 Business divided by the Total Dollar Amount of Non-Construction Contracts Awarded. As a result of the calculation error noted above, the Percentage of the Total Dollar Amount that was Awarded to Section 3 Businesses for Non-Construction Contracts was understated 0.01%. GLO reported 0.22% for the Percentage of the Total Dollar Amount that was Awarded to Section 3 Businesses for Non-Construction Contracts, however, should have reported 0.21%. Questioned costs: None. Context: See ?Condition.? Cause: Errors in the HUD 60002 Summary Report occurred because of manual calculation errors GLO made when preparing the performance reports. Effect: Inaccurate information in performance reports increases the risk that federal agencies and pass-through entities could rely on inaccurate information to manage and monitor their awards. Repeat Finding: No Recommendation: We recommend that GLO should strengthen controls to ensure that the performance reports it submits are complete and accurate. Views of responsible officials: Management agrees with the recommendation.

2020 ? 010 Reporting ? Lack of Documentation of Reviews on the Quarterly Performance Report Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grant CFDA Number: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Various Various Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303, the General Land Office (GLO) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Quarterly Performance Report (QPR) (OMB No. 2506-0165): This report is due each quarter from state CDBG DR grantees after the first full quarter following execution of a grant agreement with HUD. Condition: Quarterly Performance Reports are reviewed and approved by GLO directors and managers in a quarterly meeting. The approvals are evidenced by signatures on the meeting memorandums. We selected seven (7) of the twenty-eight (28) QPRs submitted in fiscal year 2020 and verified whether the reports were reviewed and approved in accordance with GLO?s policies and procedures. Of the seven (7) QPRs selected for testing, GLO was unable to provide evidence of the review and approval for one (1) QPR. Questioned costs: None. Context: See ?Condition.? Cause: Due to the COVID outbreak, GLO?s employees were working remotely during the audit. Evidence of approval of the QPR was located at the GLO office in paper copy, which management was unable to retrieve due to the remote working environment. Effect: Lack of documentation of GLO?s internal controls could lead to inaccurate reporting and noncompliance. Repeat Finding: No Recommendation: We recommend management implement a process to retain electronic copies of reviews and approvals of quarterly performance reports. Views of responsible officials: Management agrees with the recommendation.

2020 ? 011 Special Tests and Provisions ? Wage Rate Requirements ? Lack of Certified Payrolls Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grant CFDA Number: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Various Various Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: All laborers and mechanics employed by contractors or subcontractors to work on construction contracts in excess of $2,000 financed by federal assistance funds must be paid wages not less than those established for the locality of the project (prevailing wage rates) by the Department of Labor (DOL) (40 USC 3141-3144, 3146, and 3147. Non-federal entities shall include in their construction contracts subject to the Wage Rate Requirements (which still may be referenced as the Davis-Bacon Act) a provision that the contractor or subcontractor comply with those requirements and the DOL regulations (29 CFR part 5, Labor Standards Provisions Applicable to Contacts Governing Federally Financed and Assisted Construction). This includes a requirement for the contractor or subcontractor to submit to the non-federal entity weekly, for each week in which any contract work is performed, a copy of the payroll and a statement of compliance (certified payrolls) (29 CFR sections 5.5 and 5.6; the A-102 Common Rule (section 36(i)(5)); OMB Circular A-110 (2 CFR part 215, Appendix A, Contract Provisions); 2 CFR part 176, subpart C; and 2 CFR section 200.326). Condition: GLO contracts with developers for their Affordable Rental Projects (ARP) and Infrastructure construction projects. Developers hire general contractors who in turn hire subcontractors to complete construction work. GLO?s Community Development and Revitalization Office conduct field labor reviews of its developers to verify whether the developer obtained certified payrolls general contractor and subcontractors in accordance with wage rate requirements. We selected twenty-six (26) monthly payments for Affordable Rental Projects (ARP) and Infrastructure construction projects, which was comprised of thirteen (13) projects: ? For twelve (12) out of the twenty-six (26) monthly payments, GLO did not verify that the developer obtained certified payrolls or a statement of non-performance to certify there was no labor from the general contractor for the period under review. ? For one (1) out of the thirteen (13) projects, we identified two (2) missing subcontractor certified payrolls. Follow up was not completed to obtain the missing certified payrolls. ? For one (1) of the thirteen (13) projects selected, we noted that the general contractor did not sign (certify) one of the certified payrolls submitted for that month. Questioned costs: Unknown. Context: See ?Condition.? Cause: Field reports completed by the Community Development and Revitalization Office is a manual process and lacks policies and procedures on follow-up actions and retention of documentation. Effect: Lack of obtaining certified payrolls from prime contractors and subcontractors could result in the payment of inappropriate wages and noncompliance with the requirements of the grant agreement. Repeat Finding: No Recommendation: We recommend GLO establish policies and procedures to ensure certified payrolls are received on a weekly basis from all general contractors and subcontractors. For weeks in which the general contractor or subcontractor did not have payroll costs, we recommend that GLO obtain a statement of non performance. Additionally, we recommend that GLO consider purchasing an automated software application to assist them in collecting, verifying, and managing compliance data as well as certified payroll report data from general contractors and subcontractors. Views of responsible officials: Management agrees with the recommendation

2020 ? 012 Allowable Costs/Cost Principles ? Information Technology ? CAPPS Password Configuration Health and Human Services Commission / Department of Family and Protective Services/ Department of State Health Services Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services U.S. Department of Treasury Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Medicaid Cluster Social Services Block Grant Children?s Health Insurance Program (CHIP) Block Grants for Prevention and Treatment of Substance Abuse Disability Insurance/SSI Cluster Foster Care-Title IV-E Adoption Assistance Immunization Cooperative Agreements Coronavirus Relief Fund CFDA Number: 10.557 93.775, 93.777, 93.778 93.667 93.767 93.959 96.001, 96.006 93.658 93.659 93.268 21.019 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: WIC 6TX700507, 6TX700527 10/1/2017-9/30/2019, 10/1/2018-9/30/2019, 10/1/2019-9/30/2020, 10/1/2018- 9/30/2020 Medicaid Cluster 1905TX5000,1905TXINCT, 1905TX5MAP, 1905TX5ADM, 1905TXIMPL, 2005TX5000, 2005TXINCT, 2005TX5MAP, 2005TX5ADM, 2005TXIMPL 10/1/2018-9/30/2019, 10/1/2019-9/30/2020 Social Services Block Grant 1801TXSOSR, 1901TXSOSR, 2001TXSOSR 10/1/2017-9/30/2019, 10/1/2018-9/30/2020, 10/1/2019-9/30/2020 CHIP 1805TX501, 1905TX5021, 2005TX5021 10/1/2017-9/30/2019, 10/1/2018-9/30/2020, 10/1/2019-9/30/2021 Block Grants for Prevention and Treatment of Substance Abuse 2B08TI010051, 3B08TI010051, 1B08TI083054, 6B08TI083054 10/1/2017-9/30/2019, 10/1/2018-9/30/2020, 10/1/2019-9/30/2021 Disability Insurance/SSI Cluster 1904TXDI00, 2004TXDI00 10/1/2018-9/30/2019, 10/1/2019-9/30/2020 Foster Care-Title IV-E 2001TXFOST 10/1/2019-12/31/019, 1/1/2020-9/3/2020 Adoption Assistance 2019TXADPT, 2001TXADPT 10/1/2019-12/31/2019, 1/1/2020-9/30/2020 Immunization Cooperative Agreements 6 NH23IP922616 7/1/2019-6/30/2024 Coronavirus Relief Fund 2020-CF-21019 4/15/2019-12/31/2021 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303, the Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Condition: HHSC has their own instance of the Centralized Accounting and Payroll/Personnel System ? Financials (CAPPS Financials). CAPPS Financials is the HHSC accounting system of record. This system is responsible for financial-related transaction processing that occurs for the entire Enterprise, encompassing the Accounts Payables, General Ledger, Asset Management and Purchasing functions for administrative and client services related to provider payments. In addition, HHSC utilizes PeopleSoft?s Human Capital Management (HCM) system (CAPPS HCM) a Human Resources/ Payroll application. CAPPS Financials is an Oracle PeopleSoft application. During our testing we noted the existing configuration for CAPPS Financials and CAPPS HCM have a password reuse set to five (5) passwords generations. The HHSC information security policy indicates a password reuse of twelve (12) generations for high or six (6) generations for moderate, low plus or low systems. Questioned costs: None. Context: See ?Condition.? Cause: Password configurations were not in accordance with the HHS Information Security Policy due to management oversight. Effect: Failure to set password configurations and password lockout configurations increases the risk of inappropriate access Repeat Finding: No Recommendation: We recommend HHSC should update password configurations for CAPPS Financials and CAPPS HRM to be compliant with its policies. Additionally, we recommend that HHSC perform a periodic review to ensure password configurations continue to be compliant with its policies. Views of responsible officials: Agree

2020 ? 013 Allowable Costs/Cost Principles - Information Technology ? CAPPS User Access Health and Human Services Commission / Department of Family and Protective Services/ Department of State Health Services Federal Agency: U.S. Department of Agriculture U.S. Department of Education U.S. Department of Health and Human Services U.S. Department of Homeland Security U.S. Department of Treasury Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Medicaid Cluster Social Services Block Grant Children?s Health Insurance Program (CHIP) Block Grants for Prevention and Treatment of Substance Abuse Disability Insurance/SSI Cluster Foster Care-Title IV-E Adoption Assistance Immunization Cooperative Agreements Coronavirus Relief Fund SNAP Cluster (nonmajor) TANF (nonmajor) Special Education-Grants for Infants and Families (nonmajor) HIV Care Formula Grants (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Presidential Declared Disaster Assistance to Individuals and Households ? other Needs (nonmajor) Aging Cluster (nonmajor) CFDA Number: 10.557 93.775, 93.777, 93.778 93.667 93.767 93.959 96.001, 96.006 93.658 93.659 93.268 21.019 10.551, 10.561 (nonmajor) 93.558 (nonmajor) 84.181(nonmajor) 93.917 (nonmajor) 93.958 (nonmajor) 97.050 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: WIC 6TX700507, 6TX700527 10/1/2017-9/30/2019, 10/1/2018-9/30/2019, 10/1/2019-9/30/2020, 10/1/2018- 9/30/2020 Medicaid Cluster 1905TX5000,1905TXINCT, 1905TX5MAP, 1905TX5ADM, 1905TXIMPL, 2005TX5000, 2005TXINCT, 2005TX5MAP, 2005TX5ADM, 2005TXIMPL 10/1/2018-9/30/2019, 10/1/2019-9/30/2020 Social Services Block Grant 1801TXSOSR, 1901TXSOSR, 2001TXSOSR 10/1/2017-9/30/2019, 10/1/2018-9/30/2020, 10/1/2019-9/30/2020 CHIP 1805TX501, 1905TX5021, 2005TX5021 10/1/2017-9/30/2019, 10/1/2018-9/30/2020, 10/1/2019-9/30/2021 Block Grants for Prevention and Treatment of Substance Abuse 2B08TI010051, 3B08TI010051, 1B08TI083054, 6B08TI083054 10/1/2017-9/30/2019, 10/1/2018-9/30/2020, 10/1/2019-9/30/2021 Disability Insurance/SSI Cluster 1904TXDI00, 2004TXDI00 10/1/2018-9/30/2019, 10/1/2019-9/30/2020 Foster Care-Title IV-E 2001TXFOST 10/1/2019-12/31/2019, 1/1/2020-9/30/2020 Adoption Assistance 2019TXADPT, 2001TXADPT 10/1/2019-12/31/2019, 1/1/2020-9/30/2020 Immunization Cooperative Agreements 6 NH23IP922616 7/1/2019-6/30/2024 Coronavirus Relief Fund 2020-CF-21019 4/15/2019-12/31/2021 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Condition: HHSC has their own instance of the Centralized Accounting and Payroll/Personnel System ? Financials (CAPPS Financials). CAPPS Financials is the HHSC accounting system of record. This system is responsible for financial-related transaction processing that occurs for the entire Enterprise, encompassing the Accounts Payables, General Ledger, Asset Management and Purchasing functions for administrative and client services related to provider payments. In addition, HHSC utilizes PeopleSoft?s Human Capital Management (HCM) system (CAPPS HCM) a Human Resources/ Payroll application. CAPPS Financials and HCM personnel provide system support, including development changes. Based on our review, we noted that HHSC did not complete appropriate user access reviews over CAPPS Financials or CAPPS HCM privileged accounts to determine appropriateness based on user roles and employment status. Additionally, we obtained the administrative account listing for all administrative roles related to CAPPS Financials to validate that privileged access is only limited to authorized personnel based on their job function. During our testing, we noted one (1) instance out of the twenty-five (25) administrative accounts where a business analyst had inappropriate access to the following roles: ? Process_Scheduler_Admin_Role ? Report_Dist_Admin_Role Privileged access was granted to the business analyst, which was outside of the job description and functions. Context: See ?Condition.? Cause: HHSC does not have established policies and procedures that requires user access reviews over user accounts. Effect: Failure to perform user access reviews increases the risk that suspicious activities may not be identified and investigated. Repeat finding: 2019-005, 2018-026 and 2017-025 Recommendation: We recommend that HHSC strengthen its policies and procedures over user access reviews over privileged accounts to include whether those accounts are appropriate based on the user?s job description and function. Additionally, we recommend that HHSC terminate all privileged user accounts that are not supported by a business purpose. Views of responsible officials: Agree

2020 ? 014 Allowable Costs/Cost Principles ? Time and Effort Certification Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Prevention and Treatment of Substance Abuse CFDA Number: 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2B08TI010051, 3B08TI010051, 1B08TI083054, 6B08TI083054 10/1/2017-9/30/2019, 10/1/2018-9/30/2020, 10/1/2019-9/30/2021 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.430(i-vii), the Department of Health and Human Services Commission must ensure that charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) be incorporated into the official records of the non-federal entity; (iii) reasonably reflect the total activity for which the employee is compensated by the non-federal entity, not exceeding 100% of compensated activities (for IHE, this per the IHE?s definition of IBS); (iv) encompass both federally assisted and all other activities compensated by the non-federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non federal entity?s written policy; (v) comply with established accounting policies and practices of the non-federal entity; and (vii) support the distribution of the employee?s salary or wages among specific activities or cost objectives if the employee works on more than one federal award, a federal award and non-federal award, an indirect cost activity and a direct cost activity, two or more indirect activities which are allocated using different allocation bases, or an unallowable activity and a direct or indirect cost activity. Condition: The process in place for verification of the employee pay towards a federal grant includes the use of CAPPS HCM to certify employee time. During testing of Block Grants for Prevention and Treatment of Substance Abuse, the time and effort was not certified for one (1) employee out of forty (40) selections. Questioned costs: None. Context: See ?Condition.? Cause: Time and effort certification was not completed due to employee oversight. Effect: HHSC does not have procedures in place over the review of time and effort certifications to ensure all time and effort reports are signed. Repeat finding: No Recommendation: HHSC should implement procedures to ensure certification of time and effort. These procedures should include a monthly or quarterly review of time and effort reports to ensure all are signed. Views of responsible officials: Agree

2020 ? 015 Allowable Costs/ Cost Principles, Matching, Level of Effort, Earmarking ?Information Technology ? CMBHS User Access Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Prevention and Treatment of Substance Abuse CFDA Number: 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 2B08TI010051, 3B08TI010051, 1B08TI083054, 6B08TI083054 10/1/2017-9/30/2019, 10/1/2018-9/30/2020, 10/1/2019-9/30/2021 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Condition: HHS utilizes the Clinical Management for Behavioral Health Services (CMBHS) system to maintain electronic health records to track care, treatment plans, etc. Based on our review, we noted that HHSC did not complete a formal user access review over CMBHS accounts, including privileged accounts to determine appropriateness based on user roles and employment status. Additionally, we obtained the administrative account listing for all administrators related to CMBHS to validate that privileged access is only limited to authorized personnel based on their job function. During our testing we noted three (3) instances out of the twenty-eight (28) administrative accounts where inappropriate privileged access was granted. Of the three (3) accounts that were identified, two (2) were developers and one (1) was a Database Administrator. Questioned costs: None Context: See ?Condition.? Cause: HHSC does not have established policies and procedures that requires user access reviews over user accounts. Effect: Failure to perform user access reviews increases the risk that suspicious activities may not be identified and investigated. Repeat finding: No Recommendation: We recommend that HHSC implement policies and procedures to complete user access reviews, including a review of all privileged accounts on a periodic basis. Additionally, we recommend that HHSC terminate all privileged user accounts that are not supported by a business purpose. Views of responsible officials: Agree

2020 ? 016 Allowable Costs/Cost Principles Matching, Level of Effort, Earmarking ? Cost Allocation Plan Federal Agency: U.S. Department of Agriculture U.S. Department of Education U.S. Department of Health and Human Services Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Medicaid Cluster Social Services Block Grant Children?s Health Insurance Program (CHIP) Block Grants for Prevention and Treatment of Substance Abuse Disability Insurance/SSI Cluster Money Follows the Person Rebalancing Demonstration (nonmajor) SNAP Cluster (nonmajor) TANF (nonmajor) CCDF Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) Block Grants for Community Mental Health Services (nonmajor) Aging Cluster (nonmajor) CFDA Number: 10.557 93.775, 93.777, 93.778 93.667 93.767 93.959 96.001, 96.006 93.791(nonmajor) 10.551, 10.561 (nonmajor) 93.558 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 84.181 (nonmajor) 93.958 (nonmajor) 93.044, 93.045, 93.053 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: WIC 6TX700507, 6TX700527 10/1/2017-9/30/2019, 10/1/2018-9/30/2019, 10/1/2019-9/30/2020, 10/1/2018- 9/30/2020 Medicaid Cluster 1905TX5000,1905TXINCT, 1905TX5MAP, 1905TX5ADM, 1905TXIMPL, 2005TX5000, 2005TXINCT, 2005TX5MAP, 2005TX5ADM, 2005TXIMPL 10/1/2018-9/30/2019, 10/1/2019-9/30/2020 Social Services Block Grant 1801TXSOSR, 1901TXSOSR, 2001TXSOSR 10/1/2017- 9/30/2019, 10/1/2018-9/30/2020, 10/1/2019-9/30/2020 CHIP 1805TX501, 1905TX5021, 2005TX5021 10/1/2017-9/30/2019, 10/1/2018-9/30/2020, 10/1/2019-9/30/2021 Block Grants for Prevention and Treatment of Substance Abuse 2B08TI010051, 3B08TI010051, 1B08TI083054, 6B08TI083054 10/1/2017-9/30/2019, 10/1/2018-9/30/2020, 10/1/2019-9/30/2021 Disability Insurance/SSI Cluster 1904TXDI00, 2004TXDI00 10/1/2018-9/30/2019, 10/1/2019-9/30/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. Condition: During testing over the application of the 2020 PACAP, the following items were noted: ? The PACAP does not include all department codes that HHSC is using to charge items. For six of 68 samples tested, the departments were not included in the PACAP and could not be tied to an allocation method. ? The PACAP includes allocation methods that are dependent on other allocation methods. One of the allocations tested was based on a factor that was not included in the 2020 PACAP plan. ? The PACAP summarizes the funding sources, including state general revenue and federal programs, which will be used by each allocation method. The mix of fund source for any given factor can change over time. During our testing, there were a total of eight (8) different factors where the funding sources per the PACAP did not match the funding sources used in the allocation calculation performed. ? The fund source allocations used to reallocate transactions for each project ID are not currently reviewed to ensure that the current CHIP FMAP rate in effect is used and that adjustments for non-entitlement grant funding are made for grant year or use of GR in lieu. HHSC is required to pay part of the costs of providing health care to the poor and part of the costs of administering the program. Different State participation rates apply to medical assistance payments. The Federal Medical Assistance Percentage (FMAP) is updated in each allocation method in CAPPS FIN, the book of record, annually based on the Federal Register Circular. The FMAP is effective on October 1 of each year. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2020 when the costs for 1 of 40 sample reallocations tested were allocated using the federal fiscal year 2019 FMAP rates, when they were reallocated during federal fiscal year 2020. Questioned costs: Unknown Context: See ?Condition.? Cause: HHSC is not reviewing and updating its PACAP plan on a regular basis including how the current FMAP rates are being applied. Effect: Failure to accurately record indirect costs may result in noncompliance with grant terms and conditions. Repeat finding: 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should review and update the cost allocation plan to ensure that the PACAP accurately describes how costs will be allocated between the federal programs and the state. HHSC should also document how the PACAP will be applied, including how the FMAP will be applied to transactions and reallocations. Views of responsible officials: Agree

2020 ? 017 Eligibility ? Timeliness of Eligibility Determinations Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Children?s Health Insurance Program (CHIP) CFDA Number: 93.767 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 1805TX501, 1905TX5021, 2005TX5021 10/1/2017-9/30/2019, 10/1/2018-9/30/2020, 10/1/2019-9/30/2021 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 42 CFR 457.340(d) Application for and enrollment in CHIP (d) Timely determination of eligibility. (1) The terms in ?435.912 of this chapter apply equally to CHIP, except that standards for transferring electronic accounts to other insurance affordability programs are pursuant to ?457.350 and the standards for receiving applications from other insurance affordability programs are pursuant to ?457.348 of this part. (2) In applying timeliness standards, the State must define ?date of application? and must count each calendar day from the date of application to the day the agency provides notice of its eligibility decision. Per the 2020 Compliance Supplement, States are directed, at 42 CFR 457.340(d), to determine eligibility promptly and without undue delay. The determination of eligibility may not exceed 45 days. Condition: We reviewed sixty (60) CHIP eligibility applications submitted in fiscal year 2020 to determine whether the eligibility determination was made within 45 days. Of the sixty (60) applications, we identified one application for which the eligibility determination was not made within 45 days. We noted that the applicant submitted the application on 12/9/2019 via the Health Insurance Marketplace, however the eligibility determination was not made until 2/1/2020, 54 days after the application was submitted. Questioned costs: None. Context: See ?Condition.? Cause: Due to the high volume of applications submitted directly to the State during this time frame, those were being processed first. Applications submitted via the Health Insurance Marketplace were processed after the applications submitted directly to the State, which caused a delay in the determination. Effect: Failure to process CHIP applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: HHSC should implement a process wherein CHIP applications are processed on a first in ? first out basis in order to ensure the timely processing of applications. Views of responsible officials: Agree

2020 ? 018 Equipment/Real Property Management ? Equipment Disposals Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Program Title: WIC Special Supplemental Nutrition Program for Women, Infants, and Children Money Follows the Person Rebalancing Demonstration (nonmajor) CFDA Number: 10.557 93.791 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 6TX700507, 6TX700527 10/1/2017-9/30/2019, 10/1/2018-9/30/2019, 10/1/2019-9/30/2020, 10/1/2018- 9/30/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per Texas Government Code Title 4. Subchapter L, Sec. 403.273. (g), ?At all times, the property records of a state agency must accurately reflect the property possessed by the agency. Property may be deleted from the agency's records only in accordance with rules adopted by the comptroller.? According to SPA Process User?s Guide ? Chapter 2 ? General Policies ? Records Retention, ?The Texas State Records Retention Schedule requires agencies to maintain property records for the life of the asset and for a period not less than three fiscal years after the disposal of property. Property records should include any payment-related source documentation (i.e., invoices, payment vouchers, receipts, etc.) necessary to substantiate the value of the asset. When applicable, agencies must adhere to the federal rules and regulations for retention of records for property purchased with federal grants or funds. Where federal guidelines and state guidelines apply, the greater required time period for records retention applies. If a state agency fails to keep the records, the Comptroller?s office may refuse to draw warrants or initiate electronic funds transfers on behalf of the agency.? Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per SPA Process User's Guide ? Chapter 2 ? General Policies ? Policy and Contacts, ?Per Government Code, Section 403.271, each state agency (and university choosing to report to SPA) is responsible for ensuring that its fiscal year-end capitalized asset balance(s) reflected in SPA are accurate and materially correct.? According to SPA Process User?s Guide ? Chapter 6 ? Deleting Property and Funds ? Disposal method 15, ?Property must be in a disposal method 5c before it can be updated to disposal method 15.? Condition: During our testing, we noted the following: ? Two (2) out of ten (10) samples did not maintain disposal records. ? Four (4) out of ten (10) samples were not disposed timely. ? Two (2) out of ten (10) samples did not utilize disposal method 5c before utilizing disposal method 15 per the SPA Manual. Questioned costs: None. Context: See ?Condition.? Cause: Improper disposal methods and lack of documentation occurred due to organizational changes in the State of Texas state agencies. Additionally, timeliness of disposals occurred due to information being reported to the appropriate department late. Effect: Failure to follow the SPA Process User?s Guide may lead to noncompliance with grant terms and conditions. Repeat finding: 2019-011 Recommendation: We recommend that HHSC continue to provide training to employees, including supervisory level employees, to ensure compliance with State policy and federal regulations. Views of responsible officials: Agree

2020 ? 019 Matching, Level of Effort, Earmarking ?Internal Controls over Earmarking Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Children?s Health Insurance Program (CHIP) CFDA Number: 93.767 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 1805TX501, 1905TX5021, 2005TX5021 10/1/2017-9/30/2019, 10/1/2018-9/30/2020, 10/1/2019-9/30/2021 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per the 2020 Compliance Supplement, expenditures not directly related to providing child health insurance assistance under the plan are limited to 10% of the state?s total expenditures through CHIP. The 10 percent limit is applied on an annual fiscal-year basis and is calculated based on (a) the total amounts of expenditures, and (b) the quarter in which such expenditures are claimed by the state for the fiscal year. Condition: In fiscal year 2020, the earmarking calculation was not being performed to review compliance. No compliance issues were noted during the recalculation of the requirements. Questioned costs: None. Context: See ?Condition.? Cause: In prior years, HHSC Budget staff were monitoring compliance with this requirement through a series of calculations. Due to management turnover, monitoring was not being completed and was not reinstated for fiscal year 2020. Effect: Failure to perform periodic monitoring over earmarking requirements may result in noncompliance with earmarking requirements at the end of the fiscal year. Repeat finding: 2019-016 Recommendation: HHSC should ensure that the controls over earmarking requirements are being followed to ensure that any future changes to the program funding will not result in noncompliance. Views of responsible officials: Agree

2020 ? 020 Procurement and Suspension and Debarment ? HHSC PCS Federal Agency: U.S. Department of Agriculture Federal Program Title: WIC Special Supplemental Nutrition Program for Women, Infants, and Children CFDA Number: 10.557 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 6TX700507, 6TX700527 10/1/2017-9/30/2019, 10/1/2018-9/30/2019, 10/1/2019-9/30/2020, 10/1/2018- 9/30/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency on Internal Control over Compliance Criteria: Per 2 CFR Section 200.317, States and governmental subrecipients of States, will use the same State policies and procedures used for procurements from non-federal funds. They also must ensure that every purchase order or other contract includes any clauses required by federal statutes and executive orders and their implementing regulations. Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. An open market solicitation is used to purchase a good or service by soliciting from any available source. The open market solicitation procedure is authorized by Texas Government Code ?2155.062(a) (3) and 2156.061. Open market informal solicitations can be used for procurements of commodities or services greater than $5,000 but not greater than $25,000. Open Market Formal Solicitation is used for agency-administered open market purchases of services greater than $25,000 and for commodities if delegated by Texas Comptroller or through statutory authority specific to an agency. Per the HHSC Procurement Manual, for small purchases ($5,000 or less excluding IT purchases) competition is not required; however, HHSC?s PCS Division does require contact with at least one Historically Underutilized Business (HUB) vendor to provide them with an opportunity to quote. HHSC PCS conducts procurement activities for all HHSC agencies, resulting in a purchase order, contract, or other agreement for the requesting agency. Following the procurement process, HHSC agency staff are responsible for subsequent contract management and monitoring activities. Per Texas Government Code 531.0055, for each health and human services system agency or division, the operational authority and responsibility for the contracting, purchasing, and related policies rests with HHSC?s Procurement and Contracting Services (PCS). In addition, all procurement functions are performed by HHSC PCS on behalf of the Department of State Health Services. Condition: Audit procedures included a review of procurement files related to sixteen (16) WIC procurements. For one of 16 procurement files, HHSC did not maintain the PCS 150 checklists which is used to ensure the file is complete and accurate with all required documentation. Questioned costs: None. Context: See ?Condition.? Cause: The checklist was misplaced by the responsible procurement buyer who is no longer with the agency. Effect: Failure to follow the State procurement policies and procedures may lead to noncompliance with grant terms and conditions. Repeat finding: 2019-009, 2018-007, 2017-023, 2016-026, and 2015-024 Recommendation: We recommend that HHSC PCS continue to provide training to employees, including supervisors and management, to ensure compliance of internal procedures. These procedures should include a process for ensuring all required documentation is maintained in each procurement file including steps to take in the event of an employee termination. Views of responsible officials: Agree

2020 ? 021 Subrecipient Monitoring ? Subaward Agreements Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant Block Grants for Prevention and Treatment of Substance Abuse TANF (nonmajor) CFDA Number: 93.667 93.959 93.558 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Social Services Block Grant 1801TXSOSR, 1901TXSOSR, 2001TXSOSR 10/1/2017-9/30/2019, 10/1/2018-9/30/2020, 10/1/2019-9/30/2020 Block Grants for Prevention and Treatment of Substance Abuse 2B08TI010051, 3B08TI010051, 1B08TI083054, 6B08TI083054 10/1/2017-9/30/2019, 10/1/2018-9/30/2020, 10/1/2019-9/30/2021 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: The Behavioral Health Services Section coordinates the subrecipient monitoring process for the Block Grants for Prevention and Treatment of Substance Abuse (SABG) and the Social Services Block Grant (SSBG) at the Health and Human Services Commission (HHSC). Per 2 CFR 200.303, HHSC must establish and maintain effective internal controls over federal awards that provides reasonable assurance that they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR Section 200.331, all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the certain information at the time of the subaward and if any of these data elements change, include the changes in the subsequent award modification. Required information includes the indirect cost rate for the federal award (including if the de minimis rate is charged). In addition, the approved federally recognized indirect cost rate negotiated between the subrecipient and the federal government should be used, or, if no such rate exists, either a rate negotiated between the pass-through entity and the subrecipient (in compliance with this part), or a de minimis indirect cost rate. Condition: HHSC is not applying the correct indirect cost rates for federal awards per the regulations when the subrecipient has an existing federally recognized indirect cost rate. When the subrecipient does not have a federally recognized indirect cost rate, HHSC is negotiating methodologies for applying indirect costs rather than rates. These methodologies are only being validated through periodic onsite reviews. For 18 (eighteen) of the 19 (nineteen) contracts selected for testing for the Social Services Block Grant and twenty-five (25) of the twenty-five (25) contracts tested for the Block Grants for Prevention and Treatment of Substance Abuse, federally negotiated indirect cost rates had not been incorporated into the contracts. Questioned costs: None. Context: See ?Condition.? Cause: HHSC continues to incorporate indirect cost rates into current contract, which is a multi-year process. Effect: Failure to follow the SPA Process User?s Guide may lead to noncompliance with grant terms and conditions. Repeat finding: 2017-021 Recommendation: HHSC should continue to apply federally negotiated indirect cost rates to subrecipient contracts who have a federally negotiated rate. For subrecipients who do not have a federally negotiated indirect cost rate, HHSC should work with the subrecipient to obtain an indirect cost rate or determine if the subrecipient is eligible for the de minimis 10% rate. Views of responsible officials: Agree

2020 ? 022 Special Tests and Provisions ? Provider Health and Safety Standards ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster CFDA Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 1905TX5000,1905TXINCT, 1905TX5MAP, 1905TX5ADM, 1905TXIMPL, 2005TX5000, 2005TXINCT, 2005TX5MAP, 2005TX5ADM, 2005TXIMPL 10/1/2018-9/30/2019, 10/1/2019-9/30/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. Per 42 CFR part 442.430 - Agreement as evidence of certification. (a) FFP is available in expenditures for NF and ICF/IID services only if the facility has been certified as meeting the requirements for Medicaid participation, as evidenced by a provider agreement executed under this part. An agreement is not valid evidence that a facility has met those requirements if CMS determines that? (5) The survey agency failed to adhere to the following principles in determining compliance: (i) The survey process is the means to assess compliance with Federal health, safety, and quality standards Condition: The Long-Term Care Regulatory (LTCR) Survey Operations unit of the RSD at HHSC conducts surveys for Intermediate Care Facilities for Individuals with an Intellectual Disability (ICF/IID) and Nursing Facilities (NF) to verify whether they meet prescribed health and safety standards. HHSC was unable to provide a completed survey for two (2) of the forty (40) ICF/ IID and Nursing Facilities selected for testing, which contained the completed form CMS-2567 Statement of Deficiencies and Plan of Correction and the approved Plan of Correction Form by the surveyor. Questioned costs: None. Context: See ?Condition.? Cause: HHSC was unable to locate the documentation for the exceptions noted above. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: Agree

2020 ? 023 Special Tests and Provisions ? Provider Eligibility (Screening and Enrollment) ? Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster CFDA Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 1905TX5000,1905TXINCT, 1905TX5MAP, 1905TX5ADM, 1905TXIMPL, 2005TX5000, 2005TXINCT, 2005TX5MAP, 2005TX5ADM, 2005TXIMPL 10/1/2018-9/30/2019, 10/1/2019-9/30/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 42 CFR 455.410 - 416, Enrollment and screening of providers. (a) The State Medicaid agency must require all enrolled providers to be screened under to this subpart. (b) The State Medicaid agency must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. (c) The State Medicaid agency may rely on the results of the provider screening performed by any of the following: (1) Medicare contractors. (2) Medicaid agencies or Children's Health Insurance Programs of other States. Revalidation of enrollment - The State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years. Termination or denial of enrollment - The State Medicaid agency? (a) Must terminate the enrollment of any provider where any person with a 5 percent or greater direct or indirect ownership interest in the provider did not submit timely and accurate information and cooperate with any screening methods required under this subpart. Per HHSC?s Provider Licensure and Certification Department?s Licensing and Credentialing Policy and Procedure Manual, quality check reviews are completed through quarterly reviews. Each quarter of the year (each 3-month period beginning at the start of the fiscal year 9/1/YYYY - 8/31/YYYY), 10% of licensing applications that have status of LICENSE ISSUED must be audited. Condition: HHSC?s LTCR Licensing and Credentialing Department utilizes licensing specialists to complete screening of licensing applications and renewals. The licensing specialists use standard checklists, based on the type of provider, developed by HHSC to perform the screening. The LTCR Licensing and Credentialing Department performs quarterly reviews of 10% of licensing applications that have been issued by licensing specialists to verify that screening is completed in accordance with 42 CFR 455. During our testing, we noted that for the Home and Community Support Services Agencies (HCSSA), there were two quarters in which the 10% audit requirement was not met. During the second quarter, there were a total of 81 audits required based on 812 licensing applications with a status of ?License Issued.? The Provider Licensure and Certification Department completed 79 audits (9.7%). Similarly, for the fourth quarter of the year, there were a total of 103 audits required based on 1,033 applications. The department completed 102 audits (9.9%). Additionally, we selected a sample of forty (40) quality check reviews completed by the LTCR Licensing and Credentialing Department completed during fiscal year 2020. During our testing, we noted the following: ? For one (1) of the forty (40) quarterly reviews selected, HHSC was unable to provide the taxpayer identification verification information as required by the standard reviewer checklist. This deficiency was identified as part of the Provider Licensure and Certification Department?s quality check review over Day Activity and Health Services Facilities however, documentation was not subsequently obtained from the provider. ? For one (1) of the forty (40) quarterly reviews selected, HHSC was unable to provide the fire marshal report, as required by the standard reviewer checklist. This deficiency was identified as part of the Provider Licensure and Certification Department?s quality check review over Nursing Facilities however, documentation was not subsequently obtained from the provider. Questioned costs: None. Context: See ?Condition.? Cause: HHSC failed to meet the 10% audit requirement due to management oversight as related to the number of audits completed. Additionally, HHSC does not have policies and procedures in place to obtain missing documentation identified as part of their quality check reviews from providers. Effect: Failure to complete screenings and maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: HHSC should continue to monitor the number of quality check reviews to ensure it meets its 10% requirement by the end of the fiscal year. Additionally, HHSC should implement policies and procedures to require licensing specialists to obtain missing documentation as identified through the LTCR Licensing and Credentialing Department?s quality check reviews to ensure HHSC is in compliance with 42 CFR 455. Views of responsible officials: Agree

2020 ? 024 Special Tests and Provisions ? ADP Risk Analysis and System Security Review ? Information Technology ? Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster CFDA Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 1905TX5000,1905TXINCT, 1905TX5MAP, 1905TX5ADM, 1905TXIMPL, 2005TX5000, 2005TXINCT, 2005TX5MAP, 2005TX5ADM, 2005TXIMPL 10/1/2018-9/30/2019, 10/1/2019-9/30/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria: State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Condition: SysCat, HHSC?s enterprise-wide repository for approved HHS systems, is HHSC?s book of record of all information technology (IT) systems, including both in-house and third-party systems. During FY20, HHSC worked to consolidate the list by linking subsystems to the parent system, resulting in sixty (60) Medicaid related systems. HHSC refreshed the Information Security Controls Guide and completed standardizing security assessment templates for both in-house and third-party systems. Additional templates were developed to track potential deficiencies and resolution. The deficiencies and resolutions are tracked in a centralized database and a review is conducted to close any open recommendations. During fiscal year 2020, forty (40) risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over all sixty (60) systems in a two-year period. Questioned costs: None Context: See ?Condition.? Cause: HHSC is continuing to remediate this finding, however, the corrective action spans multiple years. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2019-014, 2018-023, 2017-015, 2016-020, and 2015-021 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: Agree

2020 ? 025 Special Tests and Provisions ? Control, Accountability, and Safeguarding of Vaccines and Special Tests and Provisions ? Record of Immunization ? Information Technology ? Password Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Immunization Cooperative Agreements CFDA Number: 93.268 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6 NH23IP922616 7/1/2019-6/30/2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303, the Department of State Health Services (DSHS) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Condition: The Child Health Reporting System (CHRS) is an application utilized to track immunizations for childcare, daycares, and colleges. Providers that administer immunizations upload required information into CHRS in order for DSHS to meet reporting requirements. During our testing we noted the existing password configuration for CHRS has a password minimum length of three characters, however, the Health and Human Services (HHS) Information Security Policy indicates that the minimum password length should be set to fifteen characters for high or eight characters for moderate, low-plus and low systems. Questioned costs: None. Context: See ?Condition.? Cause: Password configurations were not in accordance with the HHS Information Security Policy due to management oversight. Effect: Failure to set password configurations and password lockout configurations increases the risk of inappropriate access. Repeat Finding: No Recommendation: We recommend DSHS should update password configurations for CHRS to be compliant with its policies. Additionally, we recommend that DSHS perform a periodic review to ensure password configurations continue to be compliant with its policies. Views of responsible officials: Agree

2020 ? 026 Special Tests and Provisions ? Control, Accountability, and Safeguarding of Vaccines and Special Tests and Provisions ? Record of Immunization ? Information Technology ? User Access Reviews Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Immunization Cooperative Agreements CFDA Number: 93.268 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6 NH23IP922616 7/1/2019-6/30/2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303, the Department of State Health Services (DSHS) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Condition: DSHS utilizes the Child Health Reporting System (CHRS) to track immunizations for childcare, daycares, and colleges. Providers that administer immunizations upload required information into the system in order for DSHS to meet reporting requirements. DSHS utilizes IPRM to onboard and track data exchange. During our testing, we noted the following: ? DSHS had not completed a formal user access review over IPRM accounts to determine appropriateness based on user roles and employment status. ? DSHS had not completed a formal user access review over CHRS accounts to determine appropriateness based on user roles and employment status. Questioned costs: None. Context: See ?Condition.? Cause: DSHS does not have established policies and procedures that requires user access reviews over IPRM and CHRS accounts. Effect: Failure to perform user access reviews increases the risk that suspicious activities may not be identified and investigated. Repeat Finding: No Recommendation: We recommend that DSHS periodically perform user access reviews and maintain formal documentation of those reviews for tracking purposes. Views of responsible officials: DSHS agrees that periodic user access reviews should be performed and documented. DSHS will work with HHSC IT to initiate new periodic user access reviews for these systems after the next close of data reporting periods.

2020 ? 027 Special Tests and Provisions ? Control, Accountability, and Safeguarding of Vaccines and Special Tests and Provisions ? Record of Immunization ? Information Technology ? User Access Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Immunization Cooperative Agreements CFDA Number: 93.268 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6 NH23IP922616 7/1/2019-6/30/2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303, the Department of State Health Services (DSHS) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Condition: DSHS utilizes the Immunization Tracking (ImmTrac) system to track immunizations and the Child Health Reporting System (CHRS) to track immunizations for childcare, daycares, and colleges. Providers that administer immunizations upload required information into the respective system in order for DSHS to meet reporting requirements. DSHS utilizes IPRM to onboard and track data exchange. During our testing, we noted the following: ? From a population of eleven (11) new hires for the ImmTrac system in fiscal year 2020, we selected a sample of five (5) new hires for testing. During our testing we identified all 5 samples did not have formal documentation for requesting and approving system access. ? From a population of eight (8) new hires for the CHRS application in fiscal year 2020, we selected a sample of five (5) new hires for testing. During our testing we identified four (4) of the five (5) samples did not have formal documentation for requesting and approving system access. ? From a population of eleven (11) new hires for the IPRM application in fiscal year 2020, we selected a sample of five (5) new hires for testing. During our testing we identified all five (5) samples did not have formal documentation for requesting and approving system access. Questioned costs: None. Context: See ?Condition.? Cause: DSHS does not have established policies and procedures that require a formal request and approval for system access to ImmTrac, CHRS and IPRM accounts. Effect: Failure to complete formal request and approvals for system access increases the risk of unauthorized users and suspicious activities that may not be identified and investigated. Repeat Finding: No Recommendation: We recommend that DSHS should implement enhanced procedures to ensure that new hire provisioning procedures are approved before access is granted. Views of responsible officials: DSHS agrees that procedures for approving access to these systems could be strengthened.

2020 ? 028 Allowable Costs/ Cost Principles ? Time and Effort Reporting Federal Agency: Federal Emergency Management Agency U.S. Department of Treasury Federal Program Title: Disaster Assistance ? Public Assistance (Presidentially Declared Disasters) Coronavirus Relief Fund CFDA Number: 97.036 21.019 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Disaster Assistance ? Public Assistance (Presidentially Declared Disasters) 1780DRTXP00000001, 1791DRTXP00000001, 4029DRTXP00000001, 4269DRTXP00000001, 4272DRTXP00000001, 4332DRTXP00000001 7/24//2008-8/27/2020, 9/13/2008-3/13/2021, 9/9/2011-3/17/2020, 4/25/2016- 4/22/2021, 6/11/2016-6/8/2021, 8/25/2019-8/25/2021 Coronavirus Relief Fund 4181401 3/1/2020-12/31/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.430(i-vii), the Texas Division of Emergency Management must ensure that charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) be incorporated into the official records of the non-federal entity; (iii) reasonably reflect the total activity for which the employee is compensated by the non-federal entity, not exceeding 100% of compensated activities (for IHE, this per the IHE?s definition of IBS); (iv) encompass both federally assisted and all other activities compensated by the non-federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-federal entity?s written policy; (v) comply with established accounting policies and practices of the non-federal entity; and (vii) support the distribution of the employee?s salary or wages among specific activities or cost objectives if the employee works on more than one federal award, a federal award and non-federal award, an indirect cost activity and a direct cost activity, two or more indirect activities which are allocated using different allocation bases, or an unallowable activity and a direct or indirect cost activity. Condition: We noted that the pay rate for one (1) of the two (2) employees selected for the Disaster Assistance grant did not match the pay rate of the employee?s personnel file that was in effect at the time of the activity. The rate charged to the federal grant was $38.51 per hour, however, we noted that the employee?s pay rate in effect was $31.25 per hour, resulting in $779 of costs inappropriately charged to the grant. In accordance with the Federal Register Notice Volume 86, Number 10 for the Coronavirus Relief Fund (CRF), TDEM utilized payments from CRF to meet the non-federal matching requirements for the Disaster Assistance ? Public Assistance (Presidentially Declared Disasters). CRF funds were used to meet the cost share for the employee above, resulting in $195 of costs inappropriately charged to the grant. Questioned costs: None. Context: See ?Condition.? Cause: The incorrect pay rate was used for the employee as a result management error. Effect: Failure to use appropriate pay rates to calculate costs charged to federal grants may lead to noncompliance with grant terms and conditions. Repeat Finding: No. Recommendation: We recommend that TDEM strengthen its internal controls over the review and approval of employee time charged to federal grants in order to ensure the pay rates in effect at the time of the activity are utilized. Views of responsible officials: TDEM acknowledges and agrees with the known findings of $778.64 for Disaster Assistance and $194.66 for Coronavirus Relief Funds. TDEM has implemented corrective action to further improve the process and strengthen internal controls.

2020 ? 029 Subrecipient Monitoring ? Lack of Documentation Federal Agency: Federal Emergency Management Agency Federal Program Title: Disaster Assistance ? Public Assistance (Presidentially Declared Disasters) CFDA Number: 97.036 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: 1780DRTXP00000001, 1791DRTXP00000001, 4029DRTXP00000001, 4269DRTXP00000001, 4272DRTXP00000001, 4332DRTXP00000001 7/24//2008-8/27/2020, 9/13/2008-3/13/2021, 9/9/2011-3/17/2020, 4/25/2016- 4/22/2021, 6/11/2016-6/8/2021, 8/25/2019-8/25/2021 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: The Texas Division of Emergency Management is required to monitor subrecipients to ensure compliance with Federal rules and regulations, as well as the provisions of the contracts or grant agreements under the following federal guidelines: ? OMB Circular A-133 Section .400(d) ? Applicable to disasters prior to December 26, 2014 - Award Identification ? At the time of the subaward, identifying to the subrecipient the Federal award information (i.e., CFDA title and number; award name and number; if the award is research and development; and name of Federal awarding agency) and applicable compliance requirements. 2 CFR Part 200.332 - Applicable to disasters after December 26, 2014 - Requirements for pass-through entities. All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; (3) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports; (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section Condition: Prior to December 26, 2014, TDEM obtained signed subrecipient agreements to communicate Federal award information and applicable compliance requirements in accordance with OMB Circular A-133 Section .400(d). For disasters subsequent to December 26, 2014, TDEM obtained signed subaward agreements and Grant Terms and Conditions to communicate award information in accordance with 2 CFR 200.332. We tested 60 project worksheets issued to subrecipients that had payments to subrecipients during fiscal year 2020. We noted the following: Disasters prior to December 26, 2014 ? Six (6) of the sixty (60) project worksheets were for disasters prior to December 26, 2014, which was comprised of (3) subrecipients. o TDEM was unable to provide signed subrecipient agreements that communicated federal award information and applicable compliance requirements at the time of the subaward for two (2) of the four (4) subrecipients. o TDEM provided a subrecipient agreement with Federal Award Information and applicable compliance requirements at the time of the subaward for (1) of the four (4) subrecipients, however the agreement was not signed by the subrecipient. Accordingly, we were unable to conclude whether this information was communicated to the subrecipient at the time of the subaward. Disasters after December 26, 2014 ? Fifty-four (54) of the sixty (60) project worksheets were for disasters after December 26, 2014, which was comprised of thirty-seven (37) subrecipients. During our testing, we noted the following: o For one (1) of the thirty-seven (37) subrecipients, TDEM provided the Grant Terms and Conditions, however the agreement was not signed by the subrecipient. Accordingly, we were unable to conclude whether this information was communicated to the subrecipient at the time of the subaward. o One (1) of the thirty-seven (37) subrecipients did not have a Subrecipient Risk Assessment completed that documented the subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward. o For one (1) of the thirty-seven (37) subrecipients, TDEM had not completed the Subrecipient Assessment for Monitoring Plan that documented the appropriate subrecipient monitoring based on the risk assessment prior to the audit request. However, we noted that the Subrecipient Assessment for Monitoring Plan was subsequently completed. The subaward agreement was signed on October 18, 2019, however, the Subrecipient Assessment for Monitoring Plan was not completed until July 26, 2020. Questioned costs: None. Context: See ?Condition.? Cause: TDEM did not utilize its Grants Management System (GMS) at the time of the old disasters that occurred between 2008 ? 2011. As documents were maintained in hardcopy prior to the implementation of GMS, TDEM was unable to locate some documents. Exceptions noted in newer disasters subsequent to the implementation of GMS are due to recovery officers not including documentation within GMS per TDEM policies and procedures or the timeliness of when risk assessments and monitoring plans are completed. Effect: Failure to maintain adequate documentation or complete risk assessments and monitoring plans in a timely manner may lead to noncompliance with grant terms and conditions. Repeat Finding: No. Recommendation: We recommend that TDEM locate or obtain subrecipient agreements from subrecipients that continue to have project worksheets open for old disasters (2008-2011) and maintain the documents in GMS. Additionally, we recommend that TDEM strengthen its policies and procedures in place to require documentation to be maintained within GMS and subrecipient risk assessments and monitoring plans to be completed in a timely manner. Views of responsible officials: TDEM will continue to obtain documentation in a timely and complete manner from its subrecipients and work with its contracted support affiliates. This finding has not appeared in prior Single Audits, despite the introduction of the Grants Management System in 2015 which is used to monitor subrecipient awards to ensure proper documentation is tracked from account activation to award closure.

2020 ? 030 Subrecipient Monitoring ? Subrecipient Single Audit Submissions Federal Agency: U.S. Department of Treasury Federal Program Title: Coronavirus Relief Fund CFDA Number: 21.019 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 4181401 3/1/2020-12/31/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Texas Division of Emergency Management is required to monitor subrecipients to ensure compliance with Federal rules and regulations, as well as the provisions of the contracts or grant agreements under 2 CFR Part 200.332 - Requirements for pass-through entities as follows: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. Condition: We selected 61 subawards made during fiscal year 2020 in order to verify that TDEM requested and obtained the subrecipient?s Single Audit. We noted that TDEM did not request Single Audits for eight (8) of the sixty-one subrecipients. Questioned costs: None. Context: See ?Condition.? Cause: While TDEM has historically had the same subrecipients for which Single Audits are obtained, there were several new subrecipients under the CRF. Due to other priorities during the pandemic, TDEM was unable to send requests to new subrecipients. Effect: Failure to complete proper monitoring over subrecipients may lead to noncompliance with grant terms and conditions. Repeat Finding: No. Recommendation: We recommend that TDEM strengthen its internal controls to ensure that monitoring over new subrecipients are completed in a timely manner. Views of responsible officials: The Texas Division of Emergency Management (TDEM) disagrees with this finding for the following reasons: 1. TDEM?s single audit communications are timely and were not delayed to TDEM?s pandemic response. Under the uniform administrative requirements, subrecipients who are subject to audit must submit their reporting packages within the earlier of 30 calendar days after receipt of the auditor?s report(s), or nine months after the end of the audit period.1 However, as noted in the 2020 Compliance Supplement Addendum, awarding agencies must allow subrecipients that received COVID-19 funding with original due dates from October 1, 2020, through June 30, 2021, an extension for up to three (3) months beyond the normal due date in the completion and submission of the Single Audit reporting package.2 OMB did not release the 2020 Compliance Supplement Addendum until December 2, 2020. It is TDEM?s position that no FY 2020 audit of a non-federal entity receiving COVID-19 funding could be completed before this date. Indeed, TDEM notes that completion of CliftonLarsonAllen?s (CLA) own single audit of TDEM?s administration of the Coronavirus Relief Fund (CRF) was delayed until the addendum was published, and that the applicable compliance requirements for CRF changed from the initial draft addendum CLA used to begin preparing its workpapers. Taking into consideration the Compliance Supplement Addendum publication date and the fiscal year ends of the selected sample of subrecipients, the below table illustrates the applicable single audit submission windows and clearly demonstrates timely outreach and follow-up with each: See Schedule of Findings and Questioned Costs for chart/table 2. There are no prior audit findings or deficiencies to be addressed. The regulation at issue addresses deficiencies pertaining to the federal award provided to the subrecipient and contemplates actions planned or taken to address single audit findings related to the particular subaward. The Coronavirus Relief Fund was signed into law and existence on March 27, 2020, and TDEM began accepting subrecipients on May 11, 2020. Therefore, no prior deficiencies or single audit findings exist related to this subaward. 1 2 CFR 200.512(a) 2 2020 Compliance Supplement Addendum, 8-VII-I CLA Response: We have reviewed management?s response and, based on the Criteria, Condition, Cause and Effect discussed above, we believe our finding is still valid.

2020 ? 031 Subrecipient Monitoring ? Information Technology ? Vendor Management Federal Agency: Federal Emergency Management Agency U.S. Department of Treasury Federal Program Title: Disaster Assistance ? Public Assistance (Presidentially Declared Disasters) Coronavirus Relief Fund CFDA Number: 97.036 21.019 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: Disaster Assistance ? Public Assistance (Presidentially Declared Disasters) 1780DRTXP00000001, 1791DRTXP00000001, 4029DRTXP00000001, 4269DRTXP00000001, 4272DRTXP00000001, 4332DRTXP00000001 7/24//2008-8/27/2020, 9/13/2008-3/13/2021, 9/9/2011-3/17/2020, 4/25/2016- 4/22/2021, 6/11/2016-6/8/2021, 8/25/2019-8/25/2021 Coronavirus Relief Fund 4181401 3/1/2020-12/31/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303, the Texas Division of Emergency Management (TDEM) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Condition: Grant Management System (GMS) is a cloud-based application that assists TDEM in the administration of grants for the Disaster Assistance and Coronavirus Relief Fund programs. The system tracks expenses, awards, project progress, period of availability. In addition, reports on subrecipient risk assessments, monitoring, contractual agreements, record keeping/assessments are maintained on the system. A third-party vendor (GMS) manages the system and processes data. During our testing we noted that TDEM currently outsources the hosting, maintenance, and enhancement over GMS to a third-party service organization. The third-party service organization does not currently provide a Service Organization Controls 1 (SOC 1) Type 2 report. SOC 1 Type 2 reports validate the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process TDEM?s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. Questioned costs: None. Context: See ?Condition.? Cause: The SOC 1 report was not obtained due to management oversight. Effect: Outsourcing services does not relinquish an organization from the responsibility of ensuring an effective control environment is in place and operating effectively. In order to obtain assurance that service providers have a sound control environment, it is important to thoroughly review provided SOC reports and determine any operational risks associated with the noted control exceptions. Repeat Finding: No. Recommendation: TDEM should ensure that they obtain and review SOC reports for each of their third-party vendors that provide services over critical applications in order to evaluate whether they can rely on the third party?s overall control structure. In addition, TDEM should review and test the complementary user entity controls included in each SOC report and document the results of those procedures. Views of responsible officials: The Texas Division of Emergency Management (TDEM) disagrees with this finding. Civix (TDEM?s third-party vendor) contracts with RackSpace to provide server space for the application and all TDEM data. The SOC 1 report for RackSpace was provided to the auditors during this review. The Grants Management System does not serve as TDEM?s financial system of record, and TDEM?s contract with Civix does stipulate IT Standards and Requirements and therefore a SOC 1 report would not be a requirement. The financial record for TDEM is FAMIS and is managed by the Texas A&M University System. The Grants Management System is a project management system. The agreement between TDEM and Civix provides various controls and safeguards that have been deemed appropriate in past single audits since the inception of GMS by TDEM. CLA Response: We have reviewed management?s response and, based on the Criteria, Condition, Cause and Effect discussed above, we believe our finding is still valid.

2020 ? 032 Allowable Costs/ Cost Principles, Matching, Level of Effort, Earmarking, Period of Performance, Reporting ? Information Technology ? WRAPS User Access Reviews Federal Agency: U.S. Department of Education Federal Program Title: Rehabilitation Services ? Vocational Rehabilitation Grants to States CFDA Number: 84.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: H126A180092; H126A190092; H126A200092 10/1/2017-9/30/2018, 10/1/2018-9/30/2019, 10/1/201-9/30/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303, the Texas Workforce Commission (TWC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Per the Texas Workforce Commission Access Control Policy (AC-1), Access to agency IT assets is controlled and managed to ensure that only authorized devices/persons have appropriate access in accordance with an agency?s business needs. All computers that are permanently or intermittently connected to the agency?s network require an approved credentials-based access control system. Regardless of the network connections, all systems handling the agency?s restricted and/or highly restricted data employ approved authentication credentials-based access control and encryption for data in transit. Access to agency systems is controlled by the following: a. User profiles that define roles and access. b. Documented review of standard users? rights, at least annually. c. Documented review of administrator user accounts every 6 months. Condition: The TWC PeopleSoft (PS) application is a single system comprised of integrated process modules. The financial modules are referred to as WRAPS: Workforce, Reporting, Accounting and Purchasing System. PeopleSoft Financials are used for creating and inquiring on financial journals, payment requests and requisitions. Service accounts are non-employee accounts that are required to authenticate to the application to either perform a specific function (for example, backups or transaction processing). During our testing we noted, as part of management?s user access review for WRAPS, the review of service accounts was not documented. Service accounts are required to be reviewed as part of the periodic review process to ensure only accounts with a business purpose are maintained and all other accounts are removed or disabled. Questioned costs: None. Context: See ?Condition.? Cause: TWC completed reviews of service accounts during fiscal year 2020, however the reviews were not documented. Effect: Failure to perform and document user access reviews of service accounts increases the risk that suspicious activities may not be identified and investigated. Repeat Finding: 2019-027 Recommendation: We recommend that TWC implement policies and procedures to require documentation of its review of service accounts. Views of responsible officials: TWC agrees with the importance of reviewing & documenting appropriateness of user and administrative user accounts as noted in the TWC Access Control Policy (AC-1). TWC has a Standard Operating Procedure noting the frequency of user and administrative review requirements.

2020 ? 033 Allowable Costs/ Cost Principles, Matching, Level of Effort, Earmarking, Period of Performance, Reporting ? Information Technology ? CHAPS User Access Reviews Federal Agency: U.S. Department of Education Federal Program Title: Rehabilitation Services ? Vocational Rehabilitation Grants to States CFDA Number: 84.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: H126A180092; H126A190092; H126A200092 10/1/2017-9/30/2018, 10/1/2018-9/30/2019, 10/1/201-9/30/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303, the Texas Workforce Commission (TWC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Per the Texas Workforce Commission Access Control Policy (AC-1), Access to agency IT assets is controlled and managed to ensure that only authorized devices/persons have appropriate access in accordance with an agency?s business needs. All computers that are permanently or intermittently connected to the agency?s network require an approved credentials-based access control system. Regardless of the network connections, all systems handling the agency?s restricted and/or highly restricted data employ approved authentication credentials-based access control and encryption for data in transit. Access to agency systems is controlled by the following: a. User profiles that define roles and access. b. Documented review of standard users? rights, at least annually. c. Documented review of administrator user accounts every 6 months. Condition: The Comprehensive Human Resources and Payroll System (CHAPS) is software that combines several necessary HR functions, such as storing employee data, managing payrolls, recruitment processes, benefits administration, and tracking attendance records. Based on the TWC?s policy, access reviews are to be performed on a periodic basis. During our testing, we noted that TWC had not completed a recent review of its CHAPS administrator user accounts to determine appropriateness based on user roles and employment status. The last review conduced was in May 2019. Questioned costs: None. Context: See ?Condition.? Cause: Due to the COVID outbreak, the Information Technology Department re-prioritized its responsibilities in order to address other matters related to the impact of COVID to TWC?s operations. As a result, user access reviews were unable to be performed in fiscal year 2020 due to other priority matters. Effect: Failure to perform user access reviews increases the risk that suspicious activities may not be identified and investigated. Repeat Finding: No Recommendation: We recommend that TWC should periodically perform user access reviews of its service accounts and document its review. Views of responsible officials: TWC agrees with the importance of reviewing and documenting appropriateness of user and administrative user accounts. TWC will develop a Standard Operating Procedure (SOP) for performing CHAPS system access reviews in compliance with TWC?s Access Control Policy (AC-1).

2020 ? 034 Allowable Costs/ Cost Principles, Matching, Level of Effort, Earmarking, Period of Performance, Reporting ? Information Technology ? Password Management Federal Agency: U.S. Department of Education Federal Program Title: Rehabilitation Services ? Vocational Rehabilitation Grants to States CFDA Number: 84.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Numbers and Periods: H126A180092; H126A190092; H126A200092 10/1/2017-9/30/2018, 10/1/2018-9/30/2019, 10/1/201-9/30/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303, the Texas Workforce Commission (TWC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Per the TWC Access Control Policy (AC-1), a. To the extent possible, an information system limits unsuccessful logon attempts to three (3) during a 120-minute period before the user?s account is disabled, unless a Request for Policy Exception form has been completed. For example, if an incorrect password is provided three (3) consecutive times, remote access systems drop the connection. Per the Texas Workforce Commission - Identification and Authentication Policy, A non-privileged account is generally defined as a standard user account that does not have elevated privileges, such as administrator access to a system. For instance, non-privileged accounts cannot make configuration changes to an information system or change the security posture of a system. TWC information systems that use password-based authentication do the following: a. Passwords have a minimum lifetime of one (1) day and a maximum lifetime of sixty 60 days. b. Passwords [reuse thresholds are set to a level that exceeds the recommended setting] Condition: The TWC PeopleSoft (PS) application is a single system comprised of integrated process modules. The financial modules are referred to as WRAPS: Workforce, Reporting, Accounting and Purchasing System. PeopleSoft Financials are used for creating and inquiring on financial journals, payment requests and requisitions. Service accounts are non-employee accounts that are required to authenticate to the application to either perform a specific function (for example, backups or transaction processing). The Comprehensive Human Resources and Payroll System (CHAPS) is software that combines several necessary HR functions, such as storing employee data, managing payrolls, recruitment processes, benefits administration, and tracking attendance records. During our testing we noted various password configurations within the Network, CHAPS and WRAPS that were not in accordance with TWC?s password policy: ? The Network password configuration for the TWC minimum password age does not align with the TWC password policy. ? The CHAPS and WRAPS password lock out configurations do not align with the TWC password. ? The CHAPS password configuration for password history does not align with the TWC password policy. Questioned costs: None. Context: See ?Condition.? Cause: Password configurations were not in accordance with TWC Access Control Policy and Identification and Authentication Policy due to management oversight. Effect: Failure to set password configurations and password lockout configurations increases the risk of in appropriate access. Repeat Finding: No Recommendation: We recommend that TWC should update password configurations and password lockout configurations for the Network, CHAPS and WRAPS to be compliant with its policies. Additionally, we recommend that TWC perform a periodic review to ensure password configurations continue to be compliant with its policies. Views of responsible officials: TWC agrees with changes to CHAPS and WRAPS password configurations and password lockout configurations to be compliant with its policies. TWC agrees with the recommendation to have the network password configuration and TWC password policy align.

2020 ? 035 Matching, Level of Effort, Earmarking ? Failure to Meet Maintenance of Effort Requirements Federal Agency: U.S. Department of Education Federal Program Title: Rehabilitation Services ? Vocational Rehabilitation Grants to States CFDA Number: 84.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: H126A200092 10/1/2019-9/30/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Material Noncompliance (Modified Opinion) Criteria or specific requirement: Per 34 CFR 361.62(a), the Secretary reduces the amount otherwise payable to a State for any fiscal year by the amount by which the total expenditures from non-Federal sources under the vocational rehabilitation services portion of the Unified or Combined State Plan for any previous fiscal year were less than the total of those expenditures for the fiscal year two years prior to that previous fiscal year. Condition: The Texas Workforce Commission (TWC) failed to meet its maintenance of effort (MOE) requirements by $15,584,060 in fiscal year 2020. TWC's MOE requirement was $66,887,141 in fiscal year 2020, based on non-federal amounts spent during fiscal year 2018. Total State funds expended to meet the MOE requirement in fiscal year 2020 were $51,303,081. Questioned costs: None Context: See ?Condition.? Cause: Due to the COVID outbreak, TWC was unable to administer many of its programs and expend its Vocational Rehabilitation funds. As a result, overall expenditures were significantly less in fiscal year 2020 than in previous years. Effect: TWC may be required to reduce future grant awards for not meeting the fiscal year 2020 MOE requirement. Repeat Finding: No Recommendation: We recommend that TWC request a waiver from the Rehabilitation Service Administration to not withhold amounts due to its failure to meet its MOE requirement. Views of responsible officials: TWC concurs with the recommendation. Unless Congress takes action to waive or reduce match requirements for the FFY 2020 grant award, TWC will submit a request for a waiver of the MOE penalty for the FFY 2020 award. RSA considers MOE waivers after final financial reports (SF-425) are submitted by agencies for each grant award. For the FFY 2020 award, the final report will be submitted by December 31, 2021. TWC VR will prepare and submit a request per RSA guidance on or after submission of the final report. On October 16, 2020, RSA issued FAQ-21-01 related to VR operations during the COVID-19 Pandemic. Question 18 in the FAQ addressed MOE requirements and requesting MOE waivers considering the pandemic. RSA?s response in part stated, ?The Rehabilitation Act and its implementing regulations allow a State to request a waiver or modification of its MOE requirement if the State does not meet that requirement because of certain circumstances. Section 111(a)(2)(C) of the Rehabilitation Act and 34 C.F.R. ? 361.62(d) authorize the Secretary to grant a waiver or modification of the MOE shortfall when such an action would be an equitable response to exceptional or uncontrollable circumstances affecting the State.

2020 ? 036 Matching, Level of Effort, Earmarking ? Failure to Meet Earmarking Requirements Federal Agency: U.S. Department of Education Federal Program Title: Rehabilitation Services ? Vocational Rehabilitation Grants to States CFDA Number: 84.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: H126A200092 10/1/2019-9/30/2020 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Noncompliance Criteria or specific requirement: Per the 2020 Compliance Supplement, states must reserve and expend at least 15 percent of their VR allotment under Section 110(a) of the Act for the provision of pre-employment transition services to students with disabilities who are eligible, or potentially eligible, for VR services. State VR agencies may use the reserved funds to cover the costs of all pre-employment transition services activities described in Section 113(b) through (d) of the Act (29 USC 730(d)(1) and 733)). Condition: The Texas Workforce Commission (TWC) failed to meet its requirement to earmark 15% of the 2019 Vocational Rehabilitation (VR) allotment for the provision of pre-employment transition (pre-ETS) services to students with disabilities who are eligible, or potentially eligible for VR services. TWC was required to earmark 15% of its 2019 grant award, in the amount of $248,760,884, for pre-ETS services to students with disabilities who are eligible, or potentially eligible for VR services, or $37,314,133. TWC expended $31,307,756 for these services in fiscal year 2020, thus missing its earmarking requirements by $6,006,376. Questioned costs: None. Context: See ?Condition.? Cause: Due to the COVID outbreak, TWC was unable to run its pre-ETS programs, which are generally occur during the summer. As a result, TWC was unable to expend the funds allocated for pre-ETS services. Effect: Noncompliance with earmarking requirements could result in the future funding to the State being reduced. Repeat Finding: No Recommendation: We recommend that TWC request a waiver from the Rehabilitation Service Administration to not decrease funding due to its failure to meet its Earmarking requirement. Views of responsible officials: The Texas Workforce Commission (TWC) agrees that it did not meet the earmarked 15 percent pre-employment transition services expenditure requirement for Grant Year 2019. TWC had planned to meet the earmarked requirement through its Summer Earn and Learn (SEAL) program as well as through other programs for students conducted each summer, the peak time in which students with disabilities are available to participate in pre-ETS activities. The COVID-19 pandemic began to spread in Texas in March 2020, just as planning and registration was underway for the agency?s summer programs for students with disabilities. Due to safety concerns for students and communities brought about by the rapid transmission rates of the virus, it was necessary to cancel the 2020 SEAL program, one of the largest summer programs in the nation for students with disabilities. The 2020 SEAL program was expected to be a $10 million summer program, serving more than 2,500 students. Other summer programs were also cancelled. While VR staff were able to work with providers to convert 17 summer programs to virtual formats; it was not feasible to do so with all programs. The Texas experience was also playing out across the country. The Secretary of Education submitted a request to Congress on April 27, 2020, for authority to allow states an additional year to expend the FFY 2019 grant and to waive the requirement that states reserve not less than 15 percent of the allocated funds for pre-employment transition services for the FFY 2020 grant. Congress has not acted on this request.

2020 ? 101 Special Tests and Provisions ? Return of Title IV Funds Activities Allowed or Unallowed Cash Management Eligibility Reporting Special Tests and Provisions ? Verification Special Tests and Provisions ? Disbursements to or on Behalf of Students Special Tests and Provisions ? Borrower Data Transmission and Reconciliation (Direct Loan) Special Tests and Provisions ? General Program Eligibility Special Tests and Provisions ? Distance Education Program Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194110; CFDA 84.063, Federal Pell Grant Program, P063P192301; CFDA 84.268, Federal Direct Student Loans, P268K202301; CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T202301; and CFDA 84.033, Federal Work-Study Program, P033A194110 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $970 Return of Title IV Calculations When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student?s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on his/her behalf for the payment period or period of enrollment as of the student?s withdrawal date (Title 34, CFR, Section 668.22(e)). Undisbursed Federal Direct Student Loans can be counted as Title IV aid that could have been disbursed only if the institution originated the loan before the date the student became ineligible (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 5, Chapter 2, page 5-46). Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The institution must return the lesser of the total amount of unearned Title IV assistance calculated above or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance not earned by the student. For purposes of this calculation, ?institutional charges? are tuition, fees, room and board (if the student contracts with the institution for the room and board), and other educationally related expenses assessed by the institution (Title 34, CFR, Section 668.22(g)). The institutional charges used in the calculation are usually the charges that were initially assessed to the student for the entire payment period or period of enrollment, as applicable. Initial charges may be adjusted only by those changes the institution made prior to the student?s withdrawal (for example, for a change in enrollment status unrelated to the withdrawal) (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 5, Chapter 1, page 5-18). Sam Houston State University (University) made errors in the Title IV return calculations for 5 (8 percent) of 60 students tested. Specifically, the University made errors in determining the amount of institutional charges to be used in the return calculation for those 5 students. There were no questioned costs as a result of those errors because (1) the University returned more Title IV funds than required, (2) the error did not affect the amount of Title IV grant or loan assistance to be returned, or (3) a return of Title IV funds was not required per Section 3508 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act. Not calculating institutional charges correctly increases the risk that the University will not return the correct amount of Title IV assistance to the U.S. Department of Education or may return funds that students have earned. However, for 1 of those 5 students, the University also incorrectly included in the return calculation loans that had not been originated at the time the student withdrew. As a result, the University incorrectly determined that there was no disbursed aid that needed to be returned. Therefore, there were $970 in questioned costs associated with CFDA 84.268, Federal Direct Student Loans, award number P268K202301. Those errors occurred because of (1) errors in the automated process within the University?s student information system to calculate institutional charges, (2) manual errors made by the University, and/or (3) insufficient monitoring controls. Other Compliance Requirements and Award Number Although the general control weaknesses described below apply to activities allowed or unallowed; cash management; eligibility, reporting; special tests and provisions ? verification; special tests and provisions ? disbursements to or on behalf of students; special tests and provisions ? borrower data transmission and reconciliation (direct loan); special tests and provisions ? general program eligibility; and special tests and provisions ? distance education program, auditors identified no compliance issues regarding those compliance requirements. The general control weaknesses described below also apply to CFDA 84.033, Federal Work-Study Program, award number P033A194110. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not have sufficient controls over its change management process for information systems. Specifically, 9 (60 percent) of 15 changes tested lacked documentation showing one or more of the following: (1) validation from information technology staff or the business process owner, (2) approval from the University?s change advisory board, and/or (3) implementation with adequate segregation of duties (for example, the change was migrated to the production environment by someone other than the individual responsible for developing the change). The University had change management policies; however, the University did not have documentation showing that it had recently reviewed those policies and those policies were not sufficiently detailed to help ensure that changes are appropriately documented, validated, reviewed, and approved. Not having sufficient controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: ? Calculate institutional charges correctly in accordance to U.S. Department of Education requirements. ? Strengthen its monitoring controls to ensure that it detects and corrects errors in return of Title IV calculations. ? Strengthen its controls over its change management process. Views of Responsible Officials: Return of Title IV Calculations The University acknowledges and agrees with the findings of this audit. Management recognizes that institutional charges must be included in the Return of Title IV calculation. General Controls The University acknowledges the finding of inadequate documentation within the University?s work order processing system related to Change Requests housed within the system. While the University has controls in place to validate and approve system changes with appropriate segregation of duties through incidents and service request tickets, the documentation within change request ticket types for some request was not as clear as it could have been at the time of this finding. Prior to this audit, the University had undergone a Banner Change Management audit (issued January 19, 2019) conducted by the Office of Internal Audit for the Texas State University System. As an outcome from the internal audit, a remediation plan is being executed to revise and update the University?s Change Management policy, revise and update change type definitions, update the methods used to document the validation and approval of change requests within the University?s work order processing system and train staff on the new Change Management policy and procedures. SHSU Enterprise Services is completing revisions to the Banner Release and Deployment Management procedures. As of the date of this response, the following corrective action items have been completed as part of the internal change management audit. ? The University Change Management Policy has been updated, reviewed, and communicated internal to IT. ? A Retrospective Change type has been eliminated from the work order processing system such that the documentation issues related to this change type (6 of the 9 referenced change requests) no longer exists. ? Auto approval of the Emergency Change type has been eliminated such that all change requests require explicit review and approval by the Change Advisory Board as a post-change review. In addition, in the Release Management and Deployment procedures, all Emergency changes must be tested and approved as part of the post-change review. Approval is clearly documented in Emergency Change ticket such that issues (6 of the 9 referenced change requests) no longer exists. ? Automated controls have been added to the Change Management request system to ensure business process owner validation of all change requests are documented within the Change Request processing system such that this issue (1 of 9 referenced change requests) no longer exists. ? Procedural changes and controls have been put in place to ensure appropriate documentation of the segregation of duties. All Change Requests, and associated incident/service request tickets, identify who migrated the change to production as the owner of the change and cannot be the same person to request the change. This procedural change documents who migrates a change to production within the Change Request ticket without the need to retrieve this information from other systems such that this issue (6 of 9 referenced change requests) no longer exists.

2020 ? 102 Special Tests and Provisions ? Enrollment Reporting Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P192301; and CFDA 84.268, Federal Direct Student Loans, P268K202301 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Enrollment Reporting Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2019, Chapter 2).Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half-time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files must also include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12- 06)). Institutions are required to report the campus- and program-level enrollment for the student, including enrollment status and the effective date of that enrollment status (NSLDS Enrollment Reporting Guide, November 2019, Chapter 1). Institutions may not be immediately aware of a student?s enrollment status change when it happens. When the institution does become aware of such a change, it must report the status change using the actual enrollment status effective date, not the date when the institution became aware of the change (NSLDS Enrollment Reporting Guide, November 2019, Chapter 4; and U.S. Department of Education Electronic Announcement, NSLDS Enrollment Reporting - Submission Dates, Effective Dates and Certification Dates, April 20, 2017). Sam Houston State University (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University?s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University?s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2019, Chapter 3). For 4 (7 percent) of 60 students tested, the University did not report the effective dates of enrollment status changes to NSLDS accurately. Specifically: ? For 3 students, the University incorrectly reported the effective date of the student?s withdrawn status. Two of those students unofficially withdrew from the Fall 2019 term and the University incorrectly reported the last day of the term instead of the student?s last date of attendance. The other student officially withdrew from the Spring 2020 term and the University incorrectly reported the day it processed the withdrawal in the student information system, instead of the actual effective date of the withdrawal. ? For 1 student, the University incorrectly reported the effective date of the student?s graduated status. The University reported the last day of the Fall 2019 term; however, the student graduated at the end of the Spring 2020 term. The University had a process to monitor enrollment information reported to NSC and NSLDS; however, that process was not sufficient to identify the errors discussed above. Not reporting student status changes accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, repayment schedules, and whether a borrower will retain or lose the interest subsidy under the 150 percent subsidized Direct Loan limit. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not have sufficient controls over its change management process for information systems. Specifically, 9 (60 percent) of 15 changes tested lacked documentation showing one or more of the following: (1) validation from information technology staff or the business process owner, (2) approval from the University?s change advisory board, and/or (3) implementation with adequate segregation of duties (for example, the change was migrated to the production environment by someone other than the individual responsible for developing the change). The University had change management policies; however, the University did not have documentation showing that it had recently reviewed those policies and those policies were not sufficiently detailed to help ensure that changes are appropriately documented, validated, reviewed, and approved. Not having sufficient controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: ? Strengthen its controls to ensure that student enrollment information is reported to NSLDS accurately. ? Strengthen its controls over its change management process. Views of Responsible Officials: Enrollment Reporting Sam Houston State University acknowledges and agrees with the auditor?s findings and recommendations to strengthen controls as well as strengthening internal controls over change management processes. Through thorough analysis of the audit findings Sam Houston State University is developing and implementing enhanced internal control and monitoring procedures which will ensure accurate reporting through NCS to the NSLDS. General Controls The University acknowledges the finding of inadequate documentation within the University?s work order processing system related to Change Requests housed within the system. While the University has controls in place to validate and approve system changes with appropriate segregation of duties through incidents and service request tickets, the documentation within change request ticket types for some request was not as clear as it could have been at the time of this finding. Prior to this audit, the University had undergone a Banner Change Management audit (issued January 19, 2019) conducted by the Office of Internal Audit for the Texas State University System. As an outcome from the internal audit, a remediation plan is being executed to revise and update the University?s Change Management policy, revise and update change type definitions, update the methods used to document the validation and approval of change requests within the University?s work order processing system and train staff on the new Change Management policy and procedures. SHSU Enterprise Services is completing revisions to the Banner Release and Deployment Management procedures. As of the date of this response, the following corrective action items have been completed as part of the internal change management audit. ? The University Change Management Policy has been updated, reviewed, and communicated internal to IT. ? A Retrospective Change type has been eliminated from the work order processing system such that the documentation issues related to this change type (6 of the 9 referenced change requests) no longer exists. ? Auto approval of the Emergency Change type has been eliminated such that all change requests require explicit review and approval by the Change Advisory Board as a post-change review. In addition, in the Release Management and Deployment procedures, all Emergency changes must be tested and approved as part of the post-change review. Approval is clearly documented in Emergency Change ticket such that issues (6 of the 9 referenced change requests) no longer exists. ? Automated controls have been added to the Change Management request system to ensure business process owner validation of all change requests are documented within the Change Request processing system such that this issue (1 of 9 referenced change requests) no longer exists. ? Procedural changes and controls have been put in place to ensure appropriate documentation of the segregation of duties. All Change Requests, and associated incident/service request tickets, identify who migrated the change to production as the owner of the change and cannot be the same person to request the change. This procedural change documents who migrates a change to production within the Change Request ticket without the need to retrieve this information from other systems such that this issue (6 of 9 referenced change requests) no longer exists.

2020 ? 103 Special Tests and Provisions ? Disbursements to or on Behalf of Students Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award number: CFDA 84.268, Federal Direct Student Loans, P268K202315 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Disbursement Notification Letters If an institution credits a student?s ledger account with Federal Direct Student Loan (Direct Loan) funds, the institution must notify the student of (1) the anticipated date and amount of the disbursement, (2) the student?s right to cancel all or a portion of that loan and have the loan proceeds returned to the U.S. Department of Education, and (3) the procedures and time by which the student must notify the institution that he or she wishes to cancel the loan or loan disbursement. The institution must provide the notice in writing no earlier than 30 days before, and no later than 30 days after, crediting the student?s ledger account at the institution. (Title 34, Code of Federal Regulations, Section 668.165). For 5 (25 percent) of 20 Direct Loan disbursements tested, Stephen F. Austin State University (University) did not send disbursement notification letters within the required time frame. For those students, the University sent disbursement notification letters 34 days after crediting the students? ledger accounts with subsidized and/or unsubsidized Direct Loans. Those errors occurred because the University did not initiate the automated process for sending the notifications for the Spring 2020 term until more than 30 days after the initial disbursements were made for the term. Based on an analysis of Direct Loan disbursements made for the Spring 2020 term, this issue affected 3,602 subsidized Direct Loan disbursements and 4,925 unsubsidized Direct Loan disbursements. Receiving disbursement notifications late impairs students? ability to cancel their loans. Recommendation: The University should strengthen its controls to ensure that it sends disbursement notifications within the required time frame. Views of Responsible Officials: The University acknowledges and agrees with the recommendation and has formulated a corrective action plan.

2020 ? 104 Special Tests and Provisions ? Return of Title IV Funds Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194129; CFDA 84.063, Federal Pell Grant Program, P063P192315; CFDA 84.268, Federal Direct Student Loans, P268K202315; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T202315 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student?s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). If the total amount of calculated Title IV grant or loan assistance, or both, that a student earned is greater than the total amount of Title IV grant or loan assistance, or both, that was disbursed to the student, as of the date of the institution?s determination that the student withdrew, the difference between those amounts must be treated as a post-withdrawal disbursement in accordance with Title 34, CFR, Section 668.164(j) (Title 34, CFR, Section 668.22(a)(5)). An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution?s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). Stephen F. Austin State University (University) did not always return Title IV funds within the required time frame. For 1 (2 percent) of 43 students tested who withdrew and required a return of Title IV funds, the University returned funds 74 days after it determined that the student had withdrawn. Not making returns within the required time frame reduces the information available to the U.S. Department of Education for its program management. In addition, for 2 (6 percent) of 32 students tested, the University did not perform a return calculation to determine whether the students were eligible for a post-withdrawal disbursement. Both students had not received Title IV assistance at the time they withdrew from the Fall 2019 term because they had not completed the University?s verification requirements. When one of those students completed the verification requirements, the University incorrectly disbursed the full amount of Title IV assistance to the student, instead of performing a return calculation to determine the amount of assistance the student earned. After auditors brought the error to the University?s attention, it performed a return calculation and returned Title IV funds as required; therefore, there were no questioned costs. For the other student, the University did not perform a return calculation and did not disburse any Title IV assistance to the student. After auditors brought the error to the University?s attention, it performed a return calculation and disbursed the amount of Title IV assistance that the student earned. The University had a process to review return of Title IV calculations it performed to verify the accuracy of the calculations; however, the errors identified above occurred because it did not have sufficient controls to ensure that return calculations were performed when required or that funds were returned within the required time frame. Recommendation: The University should strengthen its controls to ensure that it performs return of Title IV calculations and returns funds within the required time frame. Views of Responsible Officials: The University acknowledges and agrees with the recommendation and has formulated a corrective action plan.

2020 ? 105 Special Tests and Provisions ? Enrollment Reporting Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P192315; and CFDA 84.268, Federal Direct Student Loans, P268K202315 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2019, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half-time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files must also include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12- 06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment level changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2019, Chapter 1 and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective (NSLDS Enrollment Reporting Guide, November 2019, Chapters 1 and 4). Institutions may not be immediately aware of a student?s enrollment status change when it happens. When the institution does become aware of such a change, it must report the status change using the actual enrollment status effective date, not the date when the institution became aware of the change (NSLDS Enrollment Reporting Guide, November 2019, Chapter 4, and U.S. Department of Education Electronic Announcement, NSLDS Enrollment Reporting - Submission Dates, Effective Dates and Certification Dates, April 20, 2017). Stephen F. Austin State University (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University?s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University?s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2019, Chapter 3). For 7 (11 percent) of 61 students tested, the University did not accurately report campus-level or program-level data elements to NSLDS. Specifically: ? For 4 students, the enrollment status effective date was reported incorrectly. The date reported for those enrollment level changes was the date when the University processed the student?s drop request, rather than the actual effective date of the enrollment status change. The dates reported for those 4 students ranged from 3 days to 57 days after the actual effective date of the enrollment level change. ? For 2 students, the program-level enrollment status effective date was reported incorrectly because it was updated with a new date although the student did not have a change in enrollment level. ? For 1 student, the effective date for the student?s withdrawn status was reported incorrectly. That student was determined to have never attended the Fall 2019 term. The University incorrectly reported the date that it determined the student never began attendance, rather than the student?s actual last date of attendance, which was the last day of the prior term (Spring 2019). The errors discussed above occurred because the University (1) has not configured its student information system to accurately report student enrollment information to NSLDS and (2) did not have a process to ensure that student enrollment information reported to NSC was accurately reported to NSLDS. Not reporting student status changes accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, repayment schedules, and whether a borrower will retain or lose the interest subsidy under the 150 percent subsidized Direct Loan limit. Recommendation: The University should strengthen its controls to ensure that campus-level and program-level data elements are reported to NSLDS accurately. Views of Responsible Officials: The University acknowledges and agrees with the recommendation and has formulated a corrective action plan.

2020 ? 106 Reporting Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P195286; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T205286 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Institutions must submit Federal Pell Grant, Iraq and Afghanistan Service Grant, Direct Loan, and Teacher Education Assistance for College and Higher Education (TEACH) Grant disbursement records to the Common Origination and Disbursement (COD) system no later than 15 days after making the disbursement or becoming aware of the need to adjust a previously reported disbursement. Reporting this information helps ensure that institutions have the most accurate information available about students? federal awards and to help prevent an institution from over awarding students (Title 34, Code of Federal Regulations (CFR), Section 690.83(b); U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 3, Chapter 1; and Federal Register, Volume 84, Number 212). Certain data elements are required to be reported as part of a student?s origination and disbursement record, including the student?s Social Security number, Central Processing System transaction number, enrollment date, disbursement amount, and disbursement date (2019-2020 COD Technical Reference, Volume II). For 22 (35 percent) of 62 students tested, Texas A&M University (University) did not accurately report origination record data elements to COD. Specifically, the University reported incorrect enrollment dates for students receiving Federal Pell Grant or TEACH Grant assistance. Those errors occurred because the automated reporting process the University used to report information to COD pulled dates from a table in the University?s student information system that had not been updated to reflect the correct enrollment start dates for the 2019- 2020 award year. As a result, this issue would have affected the origination record data for all students who received Federal Pell Grant or TEACH Grant assistance for the 2019-2020 award year. Not accurately reporting information to the COD system could result in the over awarding of federal funds. Recommendation: The University should strengthen its controls to ensure that enrollment dates are reported to COD accurately. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 107 Special Tests and Provisions ? Return of Title IV Funds Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194136; CFDA 84.063, Federal Pell Grant Program, P063P195286; CFDA 84.268, Federal Direct Student Loans, P268K205286; CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T205286; and CFDA 84.408, Postsecondary Education Scholarships for Veteran?s Dependents, P408A195286 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student?s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on his/her behalf for the payment period or period of enrollment as of the student?s withdrawal date. Students earns 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The institution must return the lesser of the total amount of unearned Title IV assistance calculated above or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance not earned by the student. For purposes of this calculation, ?institutional charges? are tuition, fees, room and board (if the student contracts with the institution for the room and board), and other educationally related expenses assessed by the institution (Title 34, CFR, Section 668.22(g)). The institutional charges used in the calculation are usually the charges that were initially assessed to the student for the entire payment period or period of enrollment, as applicable. Initial charges may be adjusted only by those changes the institution made prior to the student?s withdrawal (for example, for a change in enrollment status unrelated to the withdrawal) (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 5, Chapter 1, page 5-18). The total number of calendar days in a payment period or period of enrollment includes all days within the payment period or period of enrollment that the student was scheduled to complete, excluding scheduled breaks of at least five consecutive days. Scheduled breaks of at least five consecutive days are also excluded from the number of calendar days the student completed in that period (Title 34, CFR, Section 668.22(f)(2)(i)). An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution?s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). Texas A&M University (University) made errors in Title IV return calculations for 2 (3 percent) of 61 students tested. Specifically: ? For one student, the University incorrectly calculated the total number of break days for the payment period in which the student was enrolled in a non-traditional term. That error resulted in the University returning $8 less in Federal Direct Student Loan assistance than it should have. After auditors brought that error to the University?s attention, it returned those funds to the U.S. Department of Education; therefore, there were no questioned costs. The University made the initial return within the required time frame, but the additional funds were returned outside of the 45-day time frame. ? For one student, the University omitted one of the tuition and fee charges assessed to the student in its determination of institutional charges for the return calculation. That error did not affect the amount of Title IV grant or loan assistance to be returned; therefore, there were no questioned costs. Those errors occurred because of manual errors the University made in performing the return calculations and the University did not have an effective monitoring process to identify those errors. Having a process that does not consistently calculate and return the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. For 2 (3 percent) of 60 students tested who withdrew and required a return of Title IV funds, the University did not return the funds within the required time frames. For those two students, the University determined the withdrawal dates and performed the return calculations in a timely manner; however, it did not return the Title IV funds within the required 45-day time frame due to an oversight in processing the return of those funds. The University identified the error during its reconciliation process and returned the funds for those two students 48 and 60 days after it had determined that those students had withdrawn. Not making returns within required time frames reduces the information available to the U.S. Department of Education for its program management. Recommendations: The University should: ? Strengthen its controls to ensure that it accurately calculates returns of Title IV funds when required, including review of the variables it uses in those calculations. ? Ensure that it returns Title IV funds within required time frames. ? Strengthen its monitoring controls to ensure that it detects and corrects errors in return of Title IV calculations. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 108 Special Tests and Provisions ? Enrollment Reporting Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P195286; and CFDA 84.268, Federal Direct Student Loans, P268K205286 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2019, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half-time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files must also include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2), and Dear Colleague Letter, March 30, 2012 (GEN-12- 06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment level changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2019, Chapter 1 and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2019, Chapters 1 and 4). Institutions may not be immediately aware of a student?s enrollment status change when it happens. When the institution does become aware of such a change, it must report the status change using the actual enrollment status effective date, not the date when the institution became aware of the change (NSLDS Enrollment Reporting Guide, November 2019, Chapter 4, and U.S. Department of Education Electronic Announcement, NSLDS Enrollment Reporting - Submission Dates, Effective Dates and Certification Dates, April 20, 2017). Texas A&M University (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University?s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University?s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2019, Chapter 3). For 23 (37 percent) of 62 students tested, the University did not accurately report campus-level or program-level data elements to NSLDS. Specifically: ? For 12 students, the program-level enrollment status effective date was reported incorrectly because it did not align with the date reported at the campus-level. Both the program-level and campus-level enrollment data reflected that those 12 students had a decrease in enrollment level between two academic terms. At the campus-level, the effective date was appropriately reported as the day after the last day of the previous term. However, the date at the program-level was incorrectly reported as the first day of the subsequent term. ? For 2 students, the program-level program begin date was reported incorrectly. Those errors occurred because the University incorrectly set up academic term dates in the student information system for certain graduate programs. ? For 1 student, both the program-level enrollment status effective date and the program-level program begin date were reported incorrectly, because of the issues discussed above. ? For 7 students, the program-level enrollment status effective date was incorrect because it was updated with a new date although the student did not have a change in enrollment level. Those errors occurred because the enrollment reporting processes in the University?s student information system (1) incorrectly compared the student?s enrollment status to the advanced registration files instead of the official enrollment files or (2) incorrectly considered the summer term as a break in attendance. ? For 1 student, the enrollment status effective date was reported incorrectly at both the campus- and program levels. The date reported for that student?s enrollment level change was the date that the University processed the student?s drop request, rather than the actual effective date of the enrollment status change. That error was caused by issues related to the configuration of the enrollment reporting processes in the University?s student information system. Specifically, the system is configured to report the date when a change is processed rather than the actual effective date. Not reporting student status changes accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, repayment schedules, and whether a borrower will retain or lose the interest subsidy under the 150 percent subsidized Direct Loan limit. Recommendation: The University should strengthen its controls to ensure that campus-level and program-level data elements are reported to NSLDS accurately. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 109 Eligibility Federal Program Title: Student Financial Assistance Cluster Federal Agencies: U.S. Department of Education and U.S. Department of Health and Human Services Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194138; CFDA 84.033, Federal Work-Study Program, P033A194138; CFDA 84.063, Federal Pell Grant Program, P063P193425; CFDA 84.268, Federal Direct Student Loans, P268K203425; and CFDA 93.925, Scholarships for Health Professions Students from Disadvantaged Backgrounds, 5 T08HP30163-04-00 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Cost of Attendance The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student?s cost of attendance (COA) minus their expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the ?tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.? An institution may also include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Subchapter IV, Section 1087ll). For Title IV programs, the EFC is the amount a student and his/her family are expected to pay for educational expenses, and it is computed by the federal central processor and included on the student?s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student?s financial aid exceeds his/her need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student?s financial need (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). In determining whether a student is eligible for scholarships for health professions students from disadvantaged backgrounds, an institution must determine that the student has a financial need for the scholarship (Title 42, USC, Chapter 6A, Subchapter V, Part B, Section 293a(d)(2)). Texas A&M University ? Corpus Christi (University) uses algorithmic budgeting to build COA budgets for each term based on a student?s classification (undergraduate or graduate); residency (in-state or out-of-state); living status (on-campus, off-campus, or living with parents); and enrollment level (full-time, three-quarter-time, half time, or less-than-half-time). The University also includes an allowance for loan fees for students who were disbursed loans. Budgeting rules within the University?s student information system are established to assign various budget components based on the factors noted above. Certain budget components are calculated amounts. For example, the tuition and fee budget component is calculated based on the actual amount of tuition and fees a student is assessed for each term. For 17 (28 percent) of 61 students tested, the University incorrectly calculated the COA. Specifically: ? For 16 students, the University did not adjust the student?s tuition and fees budget component and/or the loan fee budget component to reflect the student?s actual tuition and fees assessed for the Summer 2020 term. Those errors occurred because the University did not appropriately configure its budgeting rules for the Summer 2020 term. ? For 1 student, the University did not update the student?s COA to reflect a less-than-half-time enrollment status. The University?s process is to manually adjust the COA for students with less-than-half-time enrollment; however, this student?s COA was not adjusted due to a staff oversight. Although those students? COAs were overstated or understated, the errors did not affect the amount of student financial assistance those students received. However, incorrectly calculating COA budgets increases the risk of overawarding or underawarding financial assistance to students. Recommendation: The University should strengthen its controls to ensure that it correctly calculates students? COA budgets in accordance with its process. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 110 Special Tests and Provisions ? Verification Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194138; CFDA 84.033, Federal Work-Study Program, P033A194138; CFDA 84.063, Federal Pell Grant Program, P063P193425; and CFDA 84.268, Federal Direct Student Loans, P268K203425 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: Unknown For each applicant whose Free Application for Federal Student Aid (FAFSA) is selected for verification by the Secretary of the U.S. Department of Education, an institution must verify all of the applicable items, which include household size, number of household members who are in college, adjusted gross income (AGI), U.S. income taxes paid, education credits, individual retirement account deductions, high school completion, the student?s identity, and the student?s statement of educational purpose (Title 34, Code of Federal Regulations (CFR), Sections 668.54 and 668.56; and Federal Register, Volume 83, Number 60). When the verification of an applicant?s eligibility results in any change to a non-dollar item or a change to a single dollar item of $25 or more from the applicant?s FAFSA, the institution must submit a correction to the U.S. Department of Education and adjust the applicant?s subsidized financial aid awards on the basis of the expected family contribution (EFC) on the corrected Institutional Student Information Record (ISIR) (Title 34, CFR, Section 668.59). For students who have not filed and are not required to file an income tax return, the institution must obtain confirmation of non-filing from the Internal Revenue Service (IRS) or other relevant tax authority (Federal Register, Volume 83, Number 60). Students who are selected for verification are placed in a verification tracking group (V1, V4, or V5) to determine which FAFSA information must be verified. A student may move from verification tracking group V1 or V4 to group V5 based on corrections made to his or her ISIR or on other information available to the U.S. Department of Education. If verification was already completed for the previous group, the institution is required to verify only the V5 information that was not already verified (U.S. Department of Education, 2019-2020 Federal Student Handbook, Application and Verification Guide, Chapter 4). For 6 (10 percent) of 61 students tested, Texas A&M University ? Corpus Christi (University) did not accurately verify certain required items on the students? FAFSAs or did not obtain the required documentation from the student. Specifically: ? For 4 students, the University did not accurately verify the household size, number of household members who are in college, or the parent?s U.S. income taxes paid. Those errors occurred because of manual errors the University made during its verification process. When auditors brought those errors to the University?s attention, it corrected them in its student information system; however, it did not request updated ISIRs for those affected students because the deadline had passed for the University to submit corrections. The University performed procedures in its student information system to correct the ISIR information and asserted that there were no overawards or underawards of student financial assistance as a result of those errors. ? For 1 student, the University did not obtain a confirmation of non-filing from the IRS at the time it performed its verification processes. When auditors brought that error to the University?s attention, it obtained confirmation of the student?s non-filing status; therefore, no changes to the student?s ISIR were required. ? For 1 student, the University did not verify all required information for the V5 tracking group. That student?s ISIR was initially placed in a V4 tracking group and the University appropriately verified the applicable items for that tracking group. However, the student?s subsequent ISIR was placed in a V5 tracking group and the University did not verify the V5 information that was not already verified as part of the initial V4 verification. After auditors brought that error to the University?s attention, it verified the additional V5 information. No changes to the student?s ISIR were required as a result. The University has monitoring controls in place to identify students selected for verification to ensure that verification was performed; however, the University does not have a process to review student files to ensure that the verification was performed accurately. Not accurately verifying FAFSA information could result in the University overawarding or underawarding financial assistance. Recommendation: The University should strengthen its controls to ensure that it accurately verifies and requests supporting documentation for all required FAFSA information for students selected for verification. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 111 Special Tests and Provisions ? Return of Title IV Funds Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194138; CFDA 84.063, Federal Pell Grant Program, P063P193425; and CFDA 84.268, Federal Direct Student Loans, P268K203425 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student?s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on his/her behalf for the payment period or period of enrollment as of the student?s withdrawal date. Students earns 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The institution must return the lesser of the total amount of unearned Title IV assistance calculated above or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance not earned by the student. For purposes of this calculation, ?institutional charges? are tuition, fees, room and board (if the student contracts with the institution for the room and board), and other educationally related expenses assessed by the institution (Title 34, CFR, Section 668.22(g)). The institutional charges used in the calculation are usually the charges that were initially assessed to the student for the entire payment period or period of enrollment, as applicable. Initial charges may be adjusted only by those changes the institution made prior to the student?s withdrawal (for example, for a change in enrollment status unrelated to the withdrawal) (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 5, Chapter 1, page 5-18). An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution?s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). Texas A&M University ? Corpus Christi (University) made errors in Title IV return calculations for 1 (1 percent) of 69 students tested. Specifically, the University incorrectly overstated the student?s institutional charges by including the student?s Title IV credit balance in its calculation. That error resulted in the University returning $280 more than required in Federal Direct Student Loans; therefore, there are no questioned costs. However, having a process that does not consistently calculate and return the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. In addition, for 2 (3 percent) of 62 students tested who withdrew and required a return of Title IV funds, the University did not perform the return calculation within the required time frames. For 1 of those students, the University did not disburse the amount of Title IV assistance that the student earned until 84 days after the student withdrew. For the other student, the University did not return Title IV assistance to the U.S. Department of Education until 49 days after the student withdrew. Not making returns within the required time frames reduces the information available to the U.S. Department of Education for its program management. Those errors occurred because of manual errors the University made in performing the return calculations and because the University did not have a monitoring process to identify those errors. Recommendation: The University should strengthen its controls to ensure that it accurately performs return calculations and returns Title IV funds within required time frames. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 112 Special Tests and Provisions ? Enrollment Reporting Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P193425; and CFDA 84.268, Federal Direct Student Loans, P268K203425 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2019, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half-time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files must also include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12- 06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment level changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2019, Chapter 1 and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective (NSLDS Enrollment Reporting Guide, November 2019, Chapters 1 and 4). Texas A&M University ? Corpus Christi (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University?s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University?s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2019, Chapter 3). For 35 (57 percent) of 61 students tested, the University did not accurately report program-level data elements to NSLDS. Specifically, the University incorrectly reported the program enrollment effective date as the date that it ran the enrollment reporting process in its student information system, rather than the actual effective date of the student?s enrollment status. Those errors were caused by issues related to the configuration of the enrollment reporting processes in the University?s student information system. For 2 (10 percent) of 21 students tested who received a Direct Loan and ceased to be enrolled on at least a half-time basis or changed their permanent address, the students? graduated status was not reported to NSLDS in a timely manner. Those two students? graduated statuses were reported to NSLDS 84 days and 92 days after the students graduated. Those errors occurred because the University did not certify its Fall 2019 graduated statuses to NSC in a timely manner. In addition, the University did not always ensure that the files it uploaded to NSC were complete. Auditors reviewed the transmission of graduated student records to NSC for the Summer 2020 term and determined that only 338 of the 638 total records were uploaded. After auditors brought the issue to the University?s attention, it resubmitted the file to NSC. The errors discussed above occurred because the University (1) has not configured its student information system to accurately report student enrollment information to NSLDS, (2) has not developed policies and procedures for reporting enrollment and program information to NSLDS, and (3) does not have a process to monitor student enrollment and program information reported to NSC and NSLDS. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, repayment schedules, and whether a borrower will retain or lose the interest subsidy under the 150 percent subsidized Direct Loan limit. Recommendations: The University should strengthen its controls to: ? Ensure that program-level data elements are reported to NSLDS accurately. ? Ensure that all graduated statuses are reported to NSLDS in a timely manner. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes. Our institution?s planned transmission schedule for the Clearinghouse is used as the framework to complete timely compliance reporting. It also sets reporting expectations for the various departments within the institution, the Clearinghouse, and student loan community, including the Department of Education. The transmission schedule comprises of 12 transmissions per academic year. The reporting frequency enables the institution to communicate enrollment status changes in a timely manner. ? Once a transmission has gone through Clearinghouse system edits, and the institution has corrected any errors within the file, the enrollment information is loaded into the Clearinghouse database. ? The institution?s enrollment information is then sent to the student loan community, which is covered in detail below. ? This process enables guarantors, lenders, and servicers to obtain the most recent enrollment information on their student borrowers, as well as service each student borrower?s loan in a timely fashion. Clearinghouse data flows are in accordance with federal regulations, specifically CFR 682.610 and 685.309. These regulations provide guidance for the institution to communicate enrollment status changes via a Student Status Confirmation Report (SSCR). The Clearinghouse completes SSCRs whenever they receive them from NSLDS (National Student Loan Data System). Typically, NSLDS creates and sends an SSCR transmission to the Clearinghouse on the first business day of each month of the year (January through December). The SSCR contains specific students at specific institutions who received Title IV Federal Financial Aid at your school, or a school other than yours, as determined by NSLDS. As the institution?s agent, the Clearinghouse responds to the SSCR with the students? current information that we have in the Clearinghouse database, as provided by the institution. The Clearinghouse completes and returns the NSLDS SSCR within 15 days of receipt, in accordance with DCL 14- 07 (federal regulation(s) 682.610/685.309).

2020 ? 113 Eligibility Activities Allowed or Unallowed Cash Management Reporting Special Tests and Provisions ? Verification Special Tests and Provisions ? Disbursements to or on Behalf of Students Special Tests and Provisions ? Borrower Data Transmission and Reconciliation (Direct Loan) Special Tests and Provisions ? General Program Eligibility Special Tests and Provisions ? Distance Education Program (Prior Audit Issue 2017-119, 2017-120 (General Controls), 2016-109, 2016-110 (General Controls), 2016-111 (General Controls), 2016-112 (General Controls), and 2016-114 (General Controls)) Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194145; CFDA 84.033, Federal Work-Study Program, P033A194145; CFDA 84.063, Federal Pell Grant Program, P063P192327; CFDA 84.268, Federal Direct Student Loans, P268K202327; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T202327 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Cost of Attendance The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student?s cost of attendance (COA) minus their expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the ?tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.? An institution may also include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Subchapter IV, Section 1087ll). For Title IV programs, the EFC is the amount a student and his/her family are expected to pay for educational expenses, and it is computed by the federal central processor and included on the student?s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student?s financial aid exceeds his/her need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student?s financial need (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). Texas Southern University (University) uses algorithmic budgeting to build COA budgets for each term based on a student?s classification (undergraduate or graduate); residency (in-state or out-of-state); living status (on campus, off-campus, or living with parents); and enrollment level (full-time, three-quarter-time, half-time, or less than-half-time). Budgeting rules within the University?s student information system are established to assign various budget components based on the factors noted above. For 8 (13 percent) of 62 students tested, the University incorrectly calculated the COA. Specifically, those students should have been assigned a books and supplies budget component for graduate and pharmacy students; however, because of an issue in the configuration of the University?s automated budgeting rules, the books and supplies budget component for undergraduate students was incorrectly assigned to those students? COAs. The overall COA was understated for those students, which could inappropriately reduce the amount of financial assistance available to the student. After auditors brought that error to the University?s attention, it corrected those students? COAs and the budgeting rules. Incorrectly calculating COA budgets increases the risk of overawarding or underawarding financial assistance to students. Federal Direct Student Loans Direct Subsidized and Unsubsidized Loans have annual and aggregate limits that are the same for all students at a given grade level and dependency status. In general, a loan may not be more than the amount the borrower requests, the borrower?s COA, the borrower?s maximum borrowing limit, or the borrower?s unmet financial need. The Budget Control Act of 2011 eliminated subsidized loan eligibility for graduate and professional students for loan periods/periods of enrollment beginning on or after July 1, 2012 (U.S. Department of Education 2019-2020 Federal Student Aid Handbook, Volume 3, Chapter 5). The University did not always disburse Federal Direct Student Loans in accordance with applicable limits. Specifically: ? For 1 (2 percent) of 62 students tested, the University disbursed a Subsidized Direct Loan that was $513 in excess of the student?s financial need. That student was initially awarded based on a Fall/Spring COA; however, the student enrolled in only the Spring 2020 term. The University did not identify the overaward after the COA was updated to reflect the student?s enrollment. ? For 1 (2 percent) of 62 students tested, the University disbursed an Unsubsidized Direct Loan that was $17,631 in excess of the student?s aggregate limit. That error was due to a staff oversight when reviewing the student?s remaining eligibility. ? Based on auditors? review of the full population of federal student financial assistance recipients, the University disbursed 1 graduate student $2,721 in Subsidized Direct Loan funds that the student was not eligible to receive. That student was enrolled as a post-baccalaureate student for the Fall 2019 term and was admitted to a graduate program for the Spring 2020 term. The University did not adjust the student?s loans after the student?s classification changed mid-year. After auditors brought the above errors to the University?s attention, the University returned the loan funds to the U.S. Department of Education; therefore, there were no questioned costs. Other Compliance Requirements Although the general control weaknesses described below apply to activities allowed or unallowed, cash management, reporting, special tests and provisions?verification, special tests and provisions?disbursements to or on behalf of students, special tests and provisions?borrower data transmission and reconciliation (direct loan), special tests and provisions?general program eligibility, and special tests and provisions?distance education program, auditors identified no compliance issues regarding those compliance requirements. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not appropriately restrict access to its student information system. Specifically, the University did not always ensure that access to modify key processes in the student information system was limited to only users who needed access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of inappropriate changes to those systems. Recommendations: The University should: ? Strengthen its controls to ensure that it correctly calculates students? COA budgets in accordance with its process. ? Strengthen its controls to ensure that it identifies and corrects overawards of student financial assistance. ? Disburse Direct Loans within the student?s applicable aggregate limit. ? Disburse Subsidized Direct Loans only to eligible undergraduate students. ? Ensure that user access to its student information system is appropriately limited to employees based on job responsibilities. Views of Responsible Officials: Cost of Attendance The Office of Student Financial Assistance agrees with the recommendation to ensure that COA budgets are calculated correctly and over awards are corrected. Federal Direct Student Loans Texas Southern University agrees with the recommendation to strengthen the process of disbursing Direct Loans within the student?s aggregate limits and in accordance with applicable limits. General Controls The Office of Student Financial Assistance agrees with the recommendation to ensure that user access to its student information system is appropriately limited to employees based on job responsibilities.

2020 ? 114 Special Tests and Provisions - Return of Title IV Funds Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194145; CFDA 84.063, Federal Pell Grant Program, P063P192327; CFDA 84.268, Federal Direct Student Loans, P268K202327; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T202327 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Return of Title IV Funds When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student?s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV assistance earned by the student is less than the amount that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution?s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). For students who do not begin attendance, the institution must return those funds for which it is responsible as soon as possible, but no later than 30 days after the date that the institution becomes aware that the student will not or has not begun attendance (Title 34, CFR, Section 668.21(b)). For 3 (12 percent) of 26 students tested, Texas Southern University (University) did not return Title IV funds or did not return funds within the required time frame. Specifically: ? For 1 student, the University did not perform a return of Title IV funds calculation after the student withdrew from the Summer 2020 term. After auditors brought that issue to the University?s attention, it performed a return calculation and returned funds as required; therefore, there are no questioned costs. ? For 2 students who were determined to have never begun attendance in the Fall 2019 term, the University returned funds 61 and 72 days after the University became aware that the student did not begin attendance. Although the University had monitoring controls in place to ensure that return calculations it performed were accurate, it did not have an effective process to identify when a return was required or to ensure that Title IV funds were returned within the required time frame. Not making returns within the required time frame reduces the information available to the U.S. Department of Education for its program management. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not appropriately restrict access to its student information system. Specifically, the University did not always ensure that access to modify key processes in the student information system was limited to only users who needed access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of inappropriate changes to those systems. Recommendations: The University should: ? Develop and implement monitoring controls to ensure that return of Title IV calculations are performed and funds are returned within the required time frame. ? Ensure that user access to its student information system is appropriately limited to employees based on job responsibilities. Views of Responsible Officials: Return of Title IV Funds Texas Southern University agrees with the recommendation to develop and implement monitoring controls to ensure that returns of Title IV calculations are performed, and funds are returned within the required time frame. General Controls The Office of Student Financial Assistance agrees with the recommendation to ensure that user access to its student information system is appropriately limited to employees based on job responsibilities.

2020 ? 115 Special Tests and Provisions ? Enrollment Reporting (Prior Audit Issues 2017-121 (General Controls) and 2016-113 (General Controls)) Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P192327; and CFDA 84.268, Federal Direct Student Loans, P268K202327 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Enrollment Reporting Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2019, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis, (2) has been accepted for enrollment at that institution but failed to enroll on at least a half-time basis for the period for which the loan was intended, or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files must also include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12- 06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment-level changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2019, Chapter 1 and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program (NSLDS Enrollment Reporting Guide, November 2019, Chapters 1 and 4). Texas Southern University (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University?s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University?s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2019, Chapter 3). For 23 (38 percent) of 60 students tested, the University did not report enrollment status changes or did not accurately report enrollment status changes to NSLDS. Specifically: ? For 11 students, the University did not report a graduated status. ? For 10 students, the University incorrectly reported the enrollment level status change. The enrollment level for those students should have been reported as three-quarter-time, but it was incorrectly reported as half time. For 2 of those 10 students, the University also reported an incorrect enrollment status effective date. ? For 1 student, the University did not report the enrollment level status. ? For 1 student, the University incorrectly reported the program-level enrollment status effective date for the student?s withdrawal. The effective date was incorrectly reported as the first day of the academic term, instead of the date the student withdrew from the term. n addition, for 10 (17 percent) of 60 students tested who received a Direct Loan and ceased to be enrolled on at least a half-time basis or changed their permanent address, the students? enrollment status was not reported to NSLDS in a timely manner. The University asserted that it reported those statuses to NSC in a timely manner; however, NSLDS received those statuses between 83 and 246 days after the effective date of the change. The errors discussed above occurred because the University (1) has not developed sufficiently detailed policies and procedures to assist staff when performing enrollment reporting processes, (2) has not configured its student information system to accurately report student enrollment information to NSLDS, and (3) does not have a process to monitor student enrollment and program information reported to NSC and NSLDS. Not reporting student status changes or not reporting status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, repayment schedules, and whether a borrower will retain or lose the interest subsidy under the 150 percent subsidized Direct Loan limit. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not appropriately restrict access to its student information system. Specifically, the University did not always ensure that access to modify key processes in the student information system was limited to only users who needed access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of inappropriate changes to those systems. Recommendations: The University should: ? Develop and implement controls to ensure that status changes are reported to NSLDS accurately and in a timely manner. ? Ensure that user access to its student information system is appropriately limited to employees based on job responsibilities. Views of Responsible Officials: Enrollment Reporting Texas Southern University agrees with the recommendation to develop and implement controls to ensure that status changes are reported to NSLDS accurately and in a timely manner. General Controls The Office of Student Financial Assistance agrees with the recommendation to ensure that user access to its student information system is appropriately limited to employees based on job responsibilities.

2020 ? 116 Eligibility Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194151; CFDA 84.033, Federal Work-Study Program, P033A194151; CFDA 84.063, Federal Pell Grant Program, P063P192328; CFDA 84.268, Federal Direct Student Loans, P268K202328; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T202328 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Cost of Attendance The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student?s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the ?tuition and fees normally assessed a student carrying the same academic workload as determined by the institution and including costs for rental or purchase of any equipment materials, or supplies required of all students in the same course of study.? An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his/her family are expected to pay for educational expenses and is computed by the federal central processor and included on the student?s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student?s financial aid exceeds his/her need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student?s financial need (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). Texas Tech University (University) uses algorithmic budgeting to build COA budgets based on student classification (undergraduate or graduate), academic program (for example, certain programs have increased tuition costs), enrollment level (full-time, three-quarter-time, half-time, or less-than-half-time), living status (on campus, off-campus, or living with parents), and residency (in-state or out-of- state). Budgeting rules within the University?s student information system are established to assign various budget components based on the student?s reported expected enrollment. For 5 (8 percent) of 61 students tested, the University incorrectly calculated the COA. Specifically: ? For two students, the University made errors when manually adjusting the COA. For one student, the University transposed the tuition and fee budget component and for the other student, the University deleted the room and board budget component. For both students, the overall COA was understated; therefore, those errors did not result in an overaward and there were no questioned costs. ? For one student, the University overstated the COA by assigning a room and board budget component that did not reflect the student?s living status. The University budgeted the student based on an off-campus living status prior to receiving an ISIR for the student. When the ISIR was received, the University did not update the student?s COA to reflect that the student was living with parents. As a result, that student was overawarded $3,500 associated with CFDA 84.268, Federal Direct Student Loans, award number P268K202328. After auditors brought that error to the University?s attention, it adjusted the student?s COA and returned funds to the U.S. Department of Education; therefore, there were no questioned costs. ? For one student, the University calculated the COA using an incorrect tuition and fees budget component because it incorrectly set up the 2019-2020 award year budget tables in its student information system for full time graduate students. The University identified that issue and asserted that the budget tables were corrected in February 2019; however, the University did not recalculate the COA for students who were previously budgeted. Through data analysis, auditors identified 138 additional students who received Title IV financial assistance who were affected by this issue. Those students? COAs were understated by amounts between $386 (in-state residents) to $801 (out-of-state residents) for each full-time term attended. Because the COA for those students was understated, those errors did not result in any overawards and there were no questioned costs. ? For one student, the University calculated the COA using incorrect room and board, transportation, and miscellaneous personal expense budget components because it incorrectly set up the Summer 2020 budget tables in its student information system for Executive Master of Business Administration students. As a result, the student?s COA was overstated by $3,224 and the student was overawarded $1,947 associated with CFDA 84.268, Federal Direct Student Loans, award number P268K202328. Through data analysis, auditors identified 62 additional students who received Title IV financial assistance who were affected by this issue; 11 of those 62 students were overawarded a total of $24,114 associated with CFDA 84.268, Federal Direct Student Loans, award number P268K202328. After auditors brought those errors to the University?s attention, it adjusted the students? COAs and returned funds to the U.S. Department of Education; therefore, there were no questioned costs. Incorrectly calculating COA budgets increases the risk of overawarding or underawarding financial assistance to students. Recommendation: The University should strengthen its controls to ensure that it correctly calculates students? COA budgets in accordance with its process and does not overaward financial assistance to students. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.

2020 ? 117 Special Tests and Provisions ? Enrollment Reporting Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P192328; and CFDA 84.268, Federal Direct Student Loans, P268K202328 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2019, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half-time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Sections 685.309(b)). Enrollment reporting roster files must also include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2), and Dear Colleague Letter, March 30, 2012 (GEN-12- 06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment level changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2019, Chapter 1 and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, program begin date (which is the date the student first began attending the program being reported), and other data about the program (NSLDS Enrollment Reporting Guide, November 2019, Chapters 1 and 4). Texas Tech University (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University?s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University?s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2019, Chapter 3). For 22 (37 percent) of 60 students tested, the University did not report enrollment level changes or did not accurately report campus-level or program-level data elements to NSLDS. Specifically: ? For 19 students, the University did not report the student?s change in enrollment status at the campus-level or the program-level, as required. Those students dropped a course or courses after the University?s census date for that term. Those errors occurred because the University configured its student information system based on its grading methodology for state reporting purposes, and as a result, the system is not configured to report changes for students who drop courses after the census date of a term. ? For 1 student, the University incorrectly reported the student?s enrollment status as less-than-half-time, although the student was not enrolled for that term. The University asserted that when NSC updated the enrollment roster, it incorrectly reported that student?s status. ? For 1 student, the student?s program begin date was reported incorrectly. The student began his/her program in the Spring 2020 term; however, the University reported the first day of the Fall 2019 term as the student?s program begin date. ? For 1 student, the CIP code for the student?s program was reported incorrectly. The student graduated from an electrical engineering program; however, the University reported the student?s program as pre engineering, which is a generic CIP code used for students who are taking pre-requisites to be admitted into an engineering program. For 2 (6 percent) of 35 students tested who received a Direct Loan and ceased to be enrolled on at least a half-time basis or changed their permanent address, the students? graduated status was not reported to NSLDS in a timely manner. Both students graduated in December 2019; however, the University did not report the students? graduated status until July 2020. The University asserted that it had issues when submitting its degree verification files to NSC that caused the delay in reporting. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, repayments schedules, and whether a borrower will retain or lose the interest subsidy under the 150 percent subsidized Direct Loan limit. Recommendations: The University should: ? Develop and implement a process to report enrollment level changes to NSLDS for students who drop courses after the census date of a term. ? Strengthen its controls to ensure that campus-level and program-level data elements are reported to NSLDS accurately and in a timely manner. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.

2020 ? 118 Allowable Costs/Cost Principles Federal Program Title: Education Stabilization Fund Federal Agency: U.S. Department of Education Award year: May 6, 2020, to May 5, 2021 Award number: CFDA 84.425F, Higher Education Emergency Relief Fund Institutional Portion, P425F200816 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned costs: $4,968 Allowable costs charged to federal programs must (1) be necessary and reasonable; (2) conform to any limitations or exclusions set forth in the cost principles or in the federal award; (3) be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-federal entity; (4) be accorded consistent treatment; (5) be determined in accordance with generally accepted accounting principles, (6) not be included as a cost or used to meet cost sharing or matching requirements of any other federally financed program; and (7) be adequately documented (Title 2, Code of Federal Regulations (CFR), Section 200.403). Texas Tech University (University) did not ensure that all costs charged to its Higher Education Emergency Relief Fund (HEERF) awards were adequately documented. Specifically, for 12 (18 percent) of 65 transactions tested, the University did not maintain adequate documentation to support the allowability of the cost. The University used a portion of its HEERF awards to reimburse students for costs associated with the cancellation of study abroad programs or other planned trips. The University required students to complete a request for reimbursement and to provide receipts or other evidence of flights purchased or other travel-related costs; however, the University did not always ensure that the documentation the students provided included the dates associated with the travel, whether the flight(s) had been cancelled, and/or if the airlines had issued any credits or refunds to the student. The University expended $15,375 associated with those 12 reimbursements. After auditors brought those errors to the University?s attention, it obtained additional documentation from some of those students to support the cost; therefore, only $4,968 associated with 4 of those reimbursements were considered questioned costs. Recommendation: The University should ensure that it obtains and maintains adequate documentation to support costs charged to federal awards. Views of Responsible Officials: The University acknowledges the finding.

2020 ? 119 Reporting Federal Program Title: Education Stabilization Fund Federal Agency: U.S. Department of Education Award year: April 20, 2020, to April 19, 2021 Award number: CFDA 84.425E, Higher Education Stabilization Fund Student Portion, P425E200163 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned costs: $0 An institution receiving funds under Section 18004(a)(1) of the Coronavirus Aid, Relief, and Economic Security (CARES) Act was required to report (1) an acknowledgement that the institution signed and returned the Certification and Agreement document; (2) the total amount of funds that the institution will receive for Emergency Financial Aid Grants to Students; (3) the total amount of Emergency Financial Aid Grants distributed to students as of the date of submission; (4) the estimated total number of students at the institution eligible to receive Emergency Financial Aid Grants; (5) the total number of students who have received Emergency Financial Aid Grants; (6) the method(s) used by the institution to determine which students receive Emergency Financial Aid Grants and how much they would receive; and (7) any instructions, directions, or guidance the institution provided to students concerning the Emergency Financial Aid Grants. An initial report was required to be posted publicly on the institution?s website within 30 days from the date of the Recipient?s Funding Certification and Agreement; subsequent reports are then required to be posted publicly every 45 days after the initial posting. On August 31, 2020, the U.S. Department of Education changed the reporting requirement from every 45 days to quarterly (Public Law 116-136, Section 18004(e); U.S Department of Education Electronic Announcement titled Higher Education Emergency Relief Fund Reporting - Emergency Financial Aid Grants to Students, May 6, 2020; and Federal Register, Volume 85, Number 169). Texas Tech University (University) did not maintain documentation to support some of the information it was required to report for the Student Portion of the Higher Education Emergency Relief Fund (HEERF). Specifically, for both its initial 30-day report and subsequent 45-day report, the University did not maintain support for (1) the total amount of grants disbursed to students, (2) the estimated total number of students eligible to receive grants, and (3) the total number of students who received grant funds. The University used its student information system to generate the data at the time it posted the report on its website; however, it did not maintain that data and it could not recreate the information it reported. As a result, auditors could not verify the accuracy of the information posted on the University?s website for the Student Portion of the HEERF award. Recommendation: The University should ensure that it maintains documentation to support reports for federal awards. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.

2020 ? 120 Cash Management Reporting Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194153; and CFDA 84.033, Federal Work-Study Program, P033A194153 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Cash Management An institution must (1) identify, in its accounts, all federal awards received and expended and the federal programs under which they were received; (2) provide for accurate, current, and complete disclosure of the financial results of each federal award or program in accordance with the reporting requirements in Title 2, Code of Federal Regulations (CFR), Sections 200.328 and 200.329; (3) maintain records that adequately identify the source and application of funds for federally funded activities; (4) establish effective internal control, and accountability for, all funds, property, and other assets; (5) compare actual expenditures with the approved budget for the federal award; (6) establish written procedures to implement the requirements of Title 2, CFR, Section 200.305; and (7) establish written procedures for determining the allowability of costs in accordance with the terms and conditions of the federal award (Title 2, CFR, Section 200.302). In addition, an institution must establish and maintain effective internal control over federal programs that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). Texas Woman?s University (University) did not always manage its federal awards in compliance with federal statutes, regulations, and the terms and conditions of its federal awards. For 1 (3 percent) of 30 drawdowns tested, the University erroneously drew down funds from the wrong award year and wrong federal award number. Specifically, in August 2019, using the U.S. Department of Education?s G5 System (G5 System), it drew down funds from its 2018-2019 Federal Work-Study (FWS) Program to reimburse itself for $16,669 in 2019- 2020 Federal Supplemental Educational Opportunity Grant (FSEOG) expenditures and $6,703 in 2019-2020 FWS expenditures. After auditors brought the issue to the University?s attention, it made appropriate adjustments to its FWS and FSEOG awards; therefore, there were no questioned costs. The University uses the G5 system to request reimbursement of federal funds. For financial reporting purposes, the University is considered to have submitted a financial report at the time it makes a request for reimbursement using the G5 system. Therefore, as a result of the errors discussed above, the University did not accurately report financial information. The University had a review and approval process for its drawdowns of federal awards; however, that process was not adequate and did not identify the error discussed above. The University also did not have adequate monitoring controls over its cash management process. Specially, the University maintains a worksheet to monitor cash needs on a daily basis and reconcile its general ledger, student information system, and the G5 system; however, that process also did not identify the error noted above. Not having adequate controls over cash management increases the risk that the University could draw down funds in excess of its needs. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only current employees. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate access to its student information system increases the risk of inappropriate changes to that system. Recommendations: The University should: ? Request drawdowns only from the correct award number and award year. ? Strengthen its controls to ensure compliance with cash management and financial reporting requirements. ? Appropriately limit user access to current employees and strengthen its user access review process. Views of Responsible Officials: TWU is committed to the management of federal awards in compliance with federal statutes, regulations and the terms and conditions of its federal awards as it is with all University funds. To this end, the University has added additional staff this fiscal year in this area and will review all operating procedures. We will also strengthen our user access review process and ensure user access is limited to current employees.

2020 ? 121 Eligibility Activities Allowed or Unallowed Special Tests and Provisions ? Disbursements to or on Behalf of Students Special Tests and Provisions ? Borrower Data Transmission and Reconciliation (Direct Loan) Special Tests and Provisions ? General Program Eligibility Special Tests and Provisions ? Distance Education Program Federal Program Title: Student Financial Assistance Cluster Federal Agencies: U.S. Department of Education and U.S. Department of Health and Human Services Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194153; CFDA 84.033, Federal Work-Study Program, P033A194153; CFDA 84.063, Federal Pell Grant Program, P063P192330; CFDA 84.268, Federal Direct Student Loans, P268K202330; CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T202330; CFDA 93.264, Nurse Faculty Loan Program, 2 E01HP31828-02-00; CFDA 93.364, Nursing Student Loans, Award Number Not Applicable; and CFDA 93.925, Scholarships for Health Professions Students from Disadvantaged Backgrounds, 5 T08HP30222-04-00 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Cost of Attendance The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student?s cost of attendance (COA) minus their expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the ?tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.? An institution may also include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Subchapter IV, Section 1087ll). Nurse faculty loan program assistance may be used to pay the cost of tuition, fees, books, laboratory expenses, and other reasonable education expenses (Title 42, USC, Chapter 6A, Subchapter VI, Part E, Section 297n-1(c)). For Title IV programs, the EFC is the amount a student and his/her family are expected to pay for educational expenses, and it is computed by the federal central processor and included on the student?s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student?s financial aid exceeds his/her need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student?s financial need (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). In determining whether a student is eligible for scholarships for health professions students from disadvantaged backgrounds or nursing student loans, an institution must determine that the student has a financial need for the assistance (Title 42, USC, Chapter 6A, Subchapter V, Part B, Section 293a(d)(2); and Title 42, CFR, Section 57.306). Texas Woman?s University (University) builds COA budgets for each term based on a student?s classification (undergraduate or graduate); residency (in-state or out-of-state); living status (on-campus, off-campus, or living with parents); and enrollment level (full-time, three-quarter-time, half-time, or less-than-half-time). The University also includes an allowance for loan fees for students who were disbursed loans. Budgeting rules within the University?s student information system are established to assign various budget components based on students? anticipated enrollment. After the census date for each term, the University re-performs the budgeting process to recalculate students? budgets based on actual enrollment, if necessary. For 5 (7 percent) of 68 students tested, the University incorrectly calculated the COA. Specifically: ? For 2 students, certain budget components were not accurately calculated due to an error in the University?s student information system. For one of those students, the COA incorrectly excluded budget components for tuition and fees and books. As a result, the student?s COA was understated by $6,318, which could inappropriately reduce the amount of financial assistance available to the student. For the other student, the COA incorrectly included an additional room and board component, which overstated the student?s COA by $10,068. As a result, the University overawarded that student $784 in Federal Direct PLUS Loan funds. After auditors brought the error to the University?s attention, it returned the loan funds to the U.S. Department of Education; therefore, there were no questioned costs. ? For 2 students, the University did not account for all terms in the 2019-2020 award year in which the students enrolled and received student financial assistance. Both students were enrolled in the Summer 2019, Fall 2019, and Spring 2020 terms; however, not all terms were included in the students? COA due to a staff oversight. As a result, the COA for each student was understated, which could inappropriately reduce the amount of financial assistance available to the students. ? For 1 student, the University did not adjust the student?s tuition and fees budget component to reflect the student?s actual enrollment. That error occurred because the University had locked the student?s COA after a previous review, which prevented the automated process from recalculating that budget component. The University also did not remove the loan fee budget component after the student did not accept loans for the award year, per its process. The student?s COA was overstated by $1,977; however, the University did not overaward financial assistance to that student. Incorrectly calculating COA budgets increases the risk of overawarding or underawarding financial assistance to students. Federal Supplemental Educational Opportunity Grants (FSEOG) The FSEOG program provides grants to eligible undergraduate students. Institutions are required to award FSEOG first to Federal Pell Grant recipients who have the lowest expected family contribution (EFC). If an institution has FSEOG funds remaining after giving FSEOG awards to all Federal Pell Grant recipients, it can then award the remaining FSEOG funds to eligible students with the lowest EFCs who did not receive Federal Pell Grants (Title 34, Code of Federal Regulations (CFR), Section 676.10). Based on a review of the full population of student financial assistance recipients, the University awarded a total of $3,003 in FSEOG assistance to 4 students who were not eligible for that assistance. The University had not awarded FSEOG assistance to all other Federal Pell Grant recipients before awarding FSEOG assistance to those 4 students. Those students were initially awarded Federal Pell Grant funds, but the funds were not disbursed because the University determined the students were ineligible to receive a Federal Pell Grant because they (1) had already received the maximum lifetime eligibility amount for Federal Pell Grants or (2) received Federal Pell Grant funds from another institution for the same period. After auditors brought the errors to the University?s attention, it canceled the FSEOG awards; therefore, there were no questioned costs. Teacher Education Assistance for College and Higher Education (TEACH) Grants The Budget Control Act of 2011 requires changes in the percentage reduction that institutions must apply to awards in the TEACH Grant program. A TEACH Grant for which the first disbursement is on or after October 1, 2019, and before October 1, 2020, requires a reduction of 5.9 percent from the award amount for which the student would otherwise have been eligible. (U.S. Department of Education Electronic Announcement, FY 2020 Sequester - Required Changes to Award Amounts, May 30, 2019). Based on a review of the entire population of student financial assistance recipients, the University awarded an incorrect amount of TEACH Grant assistance to 7 students. The University underawarded those students a total of $84 in TEACH Grant assistance because it reduced the awards by the incorrect percentage. After auditors brought those errors to the University?s attention, it adjusted the TEACH Grant awards to reflect the correct award amounts. Other Compliance Requirements Although the general control weaknesses described below apply to activities allowed or unallowed; special tests and provisions?disbursements to or on behalf of students; special tests and provisions?borrower data transmission and reconciliation (direct loan); special tests and provisions?general program eligibility; and special tests and provisions?distance education program, auditors identified no compliance issues regarding those compliance requirements. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only current employees. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate access to its student information system increases the risk of inappropriate changes to that system. Recommendations: The University should: ? Strengthen its controls to ensure that it correctly calculates students? COA budgets in accordance with its process and does not overaward financial assistance to students. ? Award FSEOG assistance only to eligible students. ? Award TEACH Grants to students based on the correct percentage reduction. ? Appropriately limit user access to current employees and strengthen its user access review process. Views of Responsible Officials: TWU acknowledges and agrees with the findings and recommendations. We will strengthen our controls to ensure that we correctly calculate students? COA budgets in accordance with our process and do not over award financial assistance to students. We will strengthen our controls to ensure FSEOG is only awarded to eligible students. We will strengthen our controls to ensure TEACH Grants are awarded based on the correct percentage reduction. And we will strengthen our user access review process and ensure user access is limited to current employees.

2020 ? 122 Special Tests and Provisions ? Verification (Prior Audit Issue 2017-126 and 2016-124) Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194153; CFDA 84.033, Federal Work-Study Program, P033A194153; CFDA 84.063, Federal Pell Grant Program, P063P192330; CFDA 84.268, Federal Direct Student Loans, P268K202330; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T202330 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: Unknown Verification of Applications For each applicant whose Free Application for Federal Student Aid (FAFSA) is selected for verification by the Secretary of the U.S. Department of Education, an institution must verify all of the applicable items, which include household size, number of household members who are in college, adjusted gross income (AGI), U.S. income taxes paid, education credits, individual retirement account deductions, high school completion, the student?s identity, and the statement of educational purpose (Title 34, Code of Federal Regulations (CFR), Sections 668.54 and 668.56, and Federal Register, Volume 83, Number 60). When the verification of an applicant?s eligibility results in any change to a non-dollar item or a change to a single dollar item of $25 or more from the applicant?s FAFSA, the institution must submit a correction to the U.S. Department of Education and adjust the applicant?s subsidized financial aid awards on the basis of the expected family contribution (EFC) on the corrected Institutional Student Information Record (ISIR) (Title 34, CFR, Section 668.59). Acceptable documentation for verifying household size and the number of household members who are in college includes a statement signed by the applicant, and if the applicant is a dependent student, by one of the applicant?s parents. That statement must list the name and age of each household member, the relationship of each household member to the applicant, and the name of the educational institution for each household member who is or will be attending at least half-time in a program that leads to a degree or certificate (Title 34, CFR, Sections 668.57(b) and (c); and Federal Register, Volume 83, Number 60). For 2 (3 percent) of 62 students tested, Texas Woman?s University (University) did not accurately verify certain required items on the students? FAFSA. Specifically: ? For one of those students, the University did not accurately verify the education credits on the student?s parent?s tax return. This error occurred because of a manual error the University made during its verification process. When auditors brought that error to the University?s attention, the deadline to submit corrections for the award year had passed. However, the University performed procedures in its student information system to correct the error and asserted the error did not result in a change to the student?s EFC or student financial assistance awards. ? For the other student, the University did not obtain acceptable documentation to verify the student?s household size. Specifically, the University obtained the names of each household member, but not the age or relationship of each household member to the student, as required. As a result, auditors could not determine whether the student?s household size was accurate and the effect on the students? EFCs or financial assistance awards, if applicable. Not accurately verifying and not obtaining sufficient documentation to verify FAFSA information could result in the University overawarding or underawarding student financial assistance. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only current employees. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate access to its student information system increases the risk of inappropriate changes to that system. Recommendations: The University should: ? Strengthen its controls to ensure that it accurately verifies and obtains sufficient documentation for all required FAFSA information for students selected for verification. ? Appropriately limit user access to current employees and strengthen its user access review process. Views of Responsible Officials: TWU acknowledges and agrees with the findings and recommendations. We will strengthen our controls to ensure that we collect sufficient documentation and accurately verify students selected for verification. And we will strengthen our user access review process and ensure user access is limited to current employees.

2020 ? 123 Special Tests and Provisions ? Return of Title IV Funds Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194153; CFDA 84.033, Federal Work-Study Program, P033A194153; CFDA 84.063, Federal Pell Grant Program, P063P192330; CFDA 84.268, Federal Direct Student Loans, P268K202330; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T202330 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Return of Title IV Funds When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student?s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). If the total amount of calculated Title IV grant or loan assistance, or both, that a student earned is greater than the total amount of Title IV grant or loan assistance, or both, that was disbursed to the student, as of the date of the institution?s determination that the student withdrew, the difference between those amounts must be treated as a post-withdrawal disbursement in accordance with Title 34, Section 668.164(j) (Title 34, CFR, Section 668.22(a)(5)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on his/her behalf for the payment period or period of enrollment as of the student?s withdrawal date. Students earns 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The institution must return the lesser of the total amount of unearned Title IV assistance calculated above or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance not earned by the student. For purposes of this calculation, ?institutional charges? are tuition, fees, room and board (if the student contracts with the institution for the room and board), and other educationally related expenses assessed by the institution (Title 34, CFR, Section 668.22(g)). The institutional charges used in the calculation are usually the charges that were initially assessed to the student for the entire payment period or period of enrollment, as applicable. Initial charges may be adjusted only by those changes the institution made prior to the student?s withdrawal (for example, for a change in enrollment status unrelated to the withdrawal) (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 5, Chapter 1, page 5-18). The total number of calendar days in a payment period or period of enrollment includes all days within the payment period or period of enrollment that the student was scheduled to complete, excluding scheduled breaks of at least five consecutive days. Scheduled breaks of at least five consecutive days are also excluded from the number of calendar days the student completed in that period (Title 34, CFR, Section 668.22(f)(2)(i)). A ?crossover payment period? is a payment period that falls into two award years (in that it begins before July 1 and ends on or after July 1). For Federal Pell Grant purposes, an institution must consider a crossover payment period to occur entirely within one award year and calculate the student?s Pell award and disburse Pell funds from the award year the institution selected for inclusion of that crossover period. If the student has a valid Institutional Student Information Record (ISIR) for both award years, an institution may make a payment for a crossover payment period out of either award year. The institution must assign the crossover payment period to the award year that will be most beneficial to the student based on the student?s remaining eligibility (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 3, Chapter 3, page 3-75 and Title 34, CFR, Section 690.64). A program is offered in modules if a course or courses in the program do not span the entire length of the payment period or period of enrollment (Title 34, CFR, Section 668.22(l)(6)). For all programs offered in modules, a student is considered to have withdrawn for Title IV purposes if the student ceases attendance in all courses at any point prior to completing the payment period or period of enrollment, unless the institution obtains written confirmation from the student at the time of the withdrawal that he or she will attend a module that begins later in the same payment period or period of enrollment (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 5, Chapter 2, page 5-66). Texas Woman?s University (University) made errors in Title IV return calculations for 16 (27 percent) of 60 students tested. Specifically: ? For 6 students, the University incorrectly cancelled the students? Federal Pell Grant awards because the students withdrew from the Summer 2019 term prior to July 1, 2019. The University asserted that due to a limitation in its student information system, students could not receive 2019-2020 Federal Pell Grant funds during the Summer 2019 term if the student withdraws prior to July 1. Therefore, the University implemented an improper policy to cancel Pell awards for students who withdrew prior to July 1. As a result, those students were under-awarded a total of $1,991 in Federal Pell Grant funds. ? For 4 students, the University inappropriately made adjustments to the students? aid prior to performing the return calculation or incorrectly included a negative adjustment in the students? return calculation. As a result, those students were underawarded a total of $1,529 in Federal Pell Grant funds. ? For 3 students, the University did not consider the total number of days enrolled for the payment period. The University incorrectly performed return calculations for those students based only on the specific module from which the students withdrew and did not consider the students? enrollment in the overall Fall 2019 payment period. As a result, the University did not accurately determine the amount of Title IV aid to return. After auditors brought the errors to the University?s attention, it recalculated those students? return amounts. For two of those students, the University returned more Title IV funds than required. For one student, the University returned less Federal Direct Student Loan funds than it should have returned. After auditors brought that error to the University?s attention, it returned those funds to the U.S. Department of Education; therefore, there were no questioned costs. ? For 3 students, the University used in the return calculation an incorrect (1) percentage of the payment period completed, (2) amount of institutional charges, or (3) withdrawal date. Two of those errors resulted in the University returning less Title IV funds than required. After auditors brought those two errors to the University?s attention, it returned those funds to the U.S. Department of Education; therefore, there were no questioned costs. One of those errors resulted in the University returning more Title IV funds than required; therefore, there were no questioned costs for that student. In addition, for 2 (3 percent) of 60 students tested, the University did not perform the required Title IV return calculation. Specifically: ? For 1 student, the University did not perform a return calculation because it incorrectly determined the student was not eligible to receive Federal Pell Grant funds because the student withdrew from the Summer 2019 term prior to July 1, 2019, as discussed above. ? For 1 student, the University incorrectly disbursed Federal Pell Grant funds for a term in which the student withdrew. Because the student had not received Title IV assistance at the time of withdrawal, the University did not perform a return calculation. Due to a system error, the University inadvertently made a post withdrawal disbursement to the student for that term, rather than completing a return calculation to determine whether the student was eligible for a post-withdrawal disbursement. The University later identified this issue and canceled the Federal Pell Grant disbursement for that term; however, it did not perform a return calculation to determine the amount of Title IV assistance the student earned. Those errors occurred because of issues with the configuration of the University?s student information system and manual errors the University made in performing the return calculations. In addition, the University did not have an effective monitoring process to identify those errors. Having a process that does not consistently calculate and return the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only current employees. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate access to its student information system increases the risk of inappropriate changes to that system. Recommendations: The University should: ? Develop and implement a process to disburse Federal Pell Grant funds to eligible students who withdraw from a crossover payment period before July 1. ? Strengthen its controls to ensure that it accurately calculates returns of Title IV funds when required, including review of the variables it uses in those calculations. ? Strengthen its monitoring controls to ensure that it detects and corrects errors in return of Title IV calculations. ? Appropriately limit user access to current employees and strengthen its user access review process. Views of Responsible Officials: TWU acknowledges and agrees with the findings and recommendations. We will develop and implement a process to disburse Federal Pell Grant funds to eligible students who withdraw from a crossover payment period. We will strengthen our controls to ensure returns of Title IV funds are calculated correctly. We will strengthen our monitoring controls to detect and correct errors. And we will strengthen our user access review process and ensure user access is limited to current employees.

2020 ? 124 Special Tests and Provisions ? Enrollment Reporting (Prior Audit Issues 2017-129 and 2016-126) Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P192330; and CFDA 84.268, Federal Direct Student Loans, P268K202330 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Enrollment Reporting Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2019, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half-time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files must also include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12- 06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment-level changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2019, Chapter 1 and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported. (NSLDS Enrollment Reporting Guide, November 2019, Chapters 1 and 4). Texas Woman?s University (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University?s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University?s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2019, Chapter 3). For 10 (17 percent) of 60 students tested, the University did not report enrollment status changes or did not accurately report campus-level or program-level data elements to NSLDS. Specifically: ? For 4 students, the University incorrectly reported different enrollment effective dates at the program- and campus-levels for the same enrollment status. ? For 3 students, the University incorrectly reported the program begin date for the CIP code at the program level. The University reported the date of administrative changes to the student?s majors, instead of the first day of the term in which the students actually began attendance in the programs. ? For 2 students, the University did not report a graduated status at the campus-level. However, the graduated status for both students was correctly reported at the program-level. ? For 1 student, the University incorrectly reported the program begin date and program enrollment effective date as the first day of the Fall 2019 term; however, the student did not begin attendance until the Spring 2020 term. The errors discussed above occurred because the University does not have a documented process to monitor student enrollment and program information reported to NSLDS. Not reporting student status changes accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, repayment schedules, and whether a borrower will retain or lose the interest subsidy under the 150 percent subsidized Direct Loan limit. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only current employees. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate access to its student information system increases the risk of inappropriate changes to that system. Recommendations: The University should: ? Strengthen its controls to ensure that campus-level and program-level data elements are reported to NSLDS accurately. ? Appropriately limit user access to current employees and strengthen its user access review process. Views of Responsible Officials: The Registrar?s Office accepts the recommendations of the State Auditors to strengthen our controls for NSLDS reporting, specifically in regards to the campus and program level data. Per the findings from the 2016 and 2017 audits, the Registrar?s Office has implemented additional reporting measures to address the graduated student status at the campus level. A graduates-only file is sent to the National Student Clearinghouse prior to the start of the subsequent term that reflects the students on the previous term?s enrollment files with the new graduated status. This ensures that continuing students are reported as graduated at the campus and program level before the next term?s initial enrollment file is submitted.

2020 ? 125 Special Tests and Provisions ? Gramm-Leach-Bliley Act ? Student Information Security Federal Program Title: Student Financial Assistance Cluster Federal Agencies: U.S. Department of Education and U.S. Department of Health and Human Services Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194153; CFDA 84.033, Federal Work-Study Program, P033A194153; CFDA 84.063, Federal Pell Grant Program, P063P192330; CFDA 84.268, Federal Direct Student Loans, P268K202330; CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T202330; CFDA 93.264, Nurse Faculty Loan Program, 2 E01HP31828-02-00; CFDA 93.364, Nursing Student Loans, Award Number Not Applicable; and CFDA 93.925, Scholarships for Health Professions Students from Disadvantaged Backgrounds, 5 T08HP30222-04-00 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Gramm-Leach-Bliley Act The Gramm-Leach-Bliley Act (GLBA) requires institutions to safeguard sensitive data, which includes information obtained in support of the administration of the federal student financial assistance programs (Public Law 106- 102). In order to develop, implement, and maintain an information security program, institutions must: (a) designate an employee or employees to coordinate the information security program; (b) perform a risk assessment that addresses (1) employee training and management, (2) information systems, including network and software design, as well as information processing, storage, transmission, and disposal, and (3) detecting, preventing, and responding to attacks, intrusions, or other systems failures; and (c) design and implement information safeguards to control the risks identified (Title 16, Code of Federal Regulations (CFR), Section 314.4). Texas Woman?s University (University) did not perform a risk assessment for its information security program as required by the GLBA. The University has designated an individual to coordinate its information security program and has information security policies and controls in place; however, it does not have a documented process or procedure to perform a risk assessment. Not performing a risk assessment for its information security program as required by the GLBA increases the risk that the University?s information technology safeguards may not be aligned to risks the University faces, which may increase the risk of data breach or loss. Recommendation: The University should develop and implement a process to perform a risk assessment as required by the GLBA and document safeguards for each risk identified. Views of Responsible Officials: TWU has previously completed an internal assessment of its information security program in FY20. The report on this assessment, the Agency Security Plan has been submitted and is on file with the Texas Department of Information Resources (DIR). It currently addresses some, but not all aspects of the GLBA. TWU has requested, and DIR as approved, an institution-wide security risk assessment to be performed by an independent 3rd party. This 3rd party assessment is provided through DIR?s Managed Security Services program, and the assessment is based on the security objectives of the Texas Cybersecurity Framework. TWU has completed initial planning calls with the 3rd party assessor, and is continuing to work with the assessors to finalize the timeframe for execution of the assessment. The outcome of this assessment will provide TWU with a report identifying the risks to the institution and documented safeguards, as well as recommendations.

2020 ? 126 Eligibility Special Tests and Provisions ? Institutional Eligibility Activities Allowed or Unallowed Cash Management Special Tests and Provisions ? Verification Special Tests and Provisions ? Disbursements to or on Behalf of Students Special Tests and Provisions ? Borrower Data Transmission and Reconciliation (Direct Loan) Special Tests and Provisions ? General Program Eligibility Special Tests and Provisions ? Distance Education Program Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P192333; CFDA 84.268, Federal Direct Student Loans, P268K202333; CFDA 84.033, Federal Work-Study Program, P033A194166; and CFDA 93.925, Scholarships for Health Professions Students from Disadvantaged Backgrounds, 5 T08HP30152- 04-00 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Incarcerated Students An institution does not qualify as an eligible institution if, for its latest complete award year, more than 25 percent of its regular enrolled students were incarcerated (Title 34, CFR, Section 600.7(a)(1)(iii)), and institutions must demonstrate compliance with that requirement (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 2, Chapter 1). The University of Houston (University) did not have procedures to identify incarcerated students, and it was not able to demonstrate that less than 25 percent of its enrolled students were incarcerated for the 2019-2020 award year. The University did not have a process to identify incarcerated students to demonstrate that it is meeting the incarcerated student limitation; however, auditors did not note any evidence of incarceration for the 60 students tested. Not having procedures in place to identify incarcerated students increases the risk that the University may not qualify as an eligible institution. Other Compliance Requirements and Award Numbers Although the general control weaknesses described below apply to activities allowed or unallowed; cash management; special tests and provisions?verification; special tests and provisions?disbursements to or on behalf of students; special tests and provisions?borrower data transmission and reconciliation (direct loan); special tests and provisions?general program eligibility; and special tests and provisions?distance education program, auditors identified no compliance issues regarding those compliance requirements. The general control weaknesses described below also apply to CFDA 84.033, Federal Work-Study Program, P033A194166 and CFDA 93.925, Scholarships for Health Professions Students from Disadvantaged Backgrounds, award number 5 T08HP30152-04-00. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not always comply with its change management process for information systems. Specifically, for 2 (25 percent) of 8 changes tested, the University did not ensure that its change manager and/or change management committee formally approved the change prior to migrating that change to the production environment, as required by the University?s policies and procedures. The University asserted that occurred due to staff oversight, and that informal approvals had been obtained prior to migrating those changes. Not obtaining approvals in accordance with University policies and procedures increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: ? Develop and implement procedures to demonstrate its compliance with the incarcerated student limitation. ? Consistently follow its change management policies and procedures to obtain required approvals for changes to information systems. Views of Responsible Officials: Incarcerated Students The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has developed and will begin to implement corrective action to further improve the process. General Controls We agree that the UHS change management policies and procedures should be consistently followed and the required approvals obtained for changes to university information systems used to administer student financial assistance.

2020 ? 127 Reporting Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award number: CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T202333 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 COD Reporting Institutions must submit Teacher Education Assistance for College and Higher Education (TEACH) Grant disbursement records to the Common Origination and Disbursement (COD) system no later than 15 days after making the disbursement or becoming aware of the need to adjust a previously reported disbursement. Reporting this information helps ensure that institutions have the most accurate information available about students? federal awards and to help prevent an institution from overawarding students (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 3, Chapter 1; and Federal Register, Volume 84, Number 212). Certain data elements are required to be reported as part of a student?s origination and disbursement record, including the student?s Social Security number, Central Processing System (CPS) transaction number, enrollment date, disbursement amount, and disbursement date (2019-2020 COD Technical Reference, Volume II). An institution must report the following information for each TEACH Grant recipient: (1) the student?s eligibility for a TEACH Grant, (2) the student?s TEACH Grant amounts, and (3) the anticipated and actual disbursement date(s) and disbursement amount(s) of the TEACH Grant funds (Title 34, Code of Federal Regulations, Section 686.37(a)). The University of Houston (University) incorrectly reported origination and/or disbursement information for all 10 (100 percent) TEACH Grant awards it made for the 2019-2020 award year. For all 10 students, the University reported incorrect disbursement dates for one or more disbursements made to the students during the award year. The incorrect disbursement dates ranged from 161 days prior to 8 days after the actual dates the TEACH Grants were disbursed to the students. In addition, the University reported the incorrect enrollment date for 5 of those students and an incorrect CPS transaction number for 2 of those students. The University also incorrectly reported disbursement amounts for 3 of those students. Specifically: ? For 2 students, the University disbursed the student?s TEACH Grant award in two separate payments: a disbursement for the Fall 2019 term and a disbursement for the Spring 2020 term. However, the University incorrectly reported the total amount paid to the student as one disbursement record in COD. ? For one student, the University inaccurately reported the disbursement amount for each term; however, the overall amount reported as disbursed for the 2019-2020 award year was correct. The University?s process is to manually report TEACH Grant awards on COD?s website; the incorrect award and disbursement information reported for all 10 students was a result of manual entry errors made during that process. In addition, the University did not have a process to review the manual data entries for accuracy. Not accurately reporting information to the COD system could result in the institution overawarding federal funds. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not always comply with its change management process for information systems. Specifically, for 2 (25 percent) of 8 changes tested, the University did not ensure that its change manager and/or change management committee formally approved the change prior to migrating that change to the production environment, as required by the University?s policies and procedures. The University asserted that occurred due to staff oversight, and that informal approvals had been obtained prior to migrating those changes. Not obtaining approvals in accordance with University policies and procedures increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: ? Strengthen its controls to ensure that TEACH Grant origination and disbursement information is reported to COD accurately. ? Consistently follow its change management policies and procedures to obtain required approvals for changes to information systems. Views of Responsible Officials: COD Reporting The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has developed and will begin to implement corrective action to further improve the process. General Controls We agree that the UHS change management policies and procedures should be consistently followed and the required approvals obtained for changes to university information systems used to administer student financial assistance.

2020 ? 128 Special Tests and Provisions ? Return of Title IV Funds Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194166; CFDA 84.063, Federal Pell Grant Program, P063P192333; CFDA 84.268, Federal Direct Student Loans, P268K202333; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T202333 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Return of Title IV Calculations When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student?s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). If the total amount of calculated Title IV grant or loan assistance, or both, that a student earned is greater than the total amount of Title IV grant or loan assistance, or both, that was disbursed to the student, as of the date of the institution?s determination that the student withdrew, the difference between those amounts must be treated as a post-withdrawal disbursement in accordance with Title 34, CFR, Section 668.164(j) (Title 34, CFR, Section 668.22(a)(5)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on his/her behalf for the payment period or period of enrollment as of the student?s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The institution must return the lesser of the total amount of unearned Title IV assistance calculated above or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance not earned by the student. For purposes of this calculation, ?institutional charges? are tuition, fees, room and board (if the student contracts with the institution for the room and board), and other educationally related expenses assessed by the institution (Title 34, CFR, Section 668.22(g)). The institutional charges used in the calculation are usually the charges that were initially assessed to the student for the entire payment period or period of enrollment, as applicable. Initial charges may be adjusted only by those changes the institution made prior to the student?s withdrawal (for example, for a change in enrollment status unrelated to the withdrawal) (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 5, Chapter 1, page 5-18). The University of Houston (University) made errors in the Title IV return calculations for 3 (5 percent) of 66 students tested. Specifically, the University made errors in determining the amount of institutional charges to be used in the return calculation for those students. There were no questioned costs as a result of those errors because (1) the University returned more than the required amount, (2) the error did not affect the amount of Title IV grant or loan assistance to be returned, or (3) a return of Title IV funds was not required per Section 3508 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act. Those errors occurred because of manual errors the University made in its calculation; in addition, the University?s review of return calculations was not sufficient to identify those errors. Not calculating institutional charges correctly increases the risk that the University will not return the correct amount of Title IV assistance to the U.S. Department of Education or may return funds that students have earned. In addition, the University did not perform the required Title IV return calculations for 2 (3 percent) of 66 students tested. Specifically: ? For 1 student, the University did not identify that the student withdrew from the Spring 2020 term and had received Title IV assistance for that term. That error occurred because of a staff oversight. After auditors brought the issue to the University?s attention, it performed the return calculation and returned Title IV funds as required; therefore, there were no questioned costs. ? For 1 student, the University incorrectly disbursed Title IV assistance for a term in which the student withdrew. Because the student had not completed the University?s verification requirements, the student had not received Title IV assistance at the time of withdrawal. As a result, the University did not perform a return calculation. When the student completed the verification requirements, the University incorrectly disbursed Title IV assistance to the student for the term in which the student withdrew, rather than completing a return calculation to determine whether the student was eligible for a post-withdrawal disbursement. After auditors brought the error to the University?s attention, it performed a return calculation and returned Title IV funds as required; therefore, there were no questioned costs. The University did not have sufficient monitoring controls to identify all students requiring a Title IV return calculation. In addition, the University did not have controls to prevent its student information system from disbursing Title IV assistance to withdrawn students. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not always comply with its change management process for information systems. Specifically, for 2 (25 percent) of 8 changes tested, the University did not ensure that its change manager and/or change management committee formally approved the change prior to migrating that change to the production environment, as required by the University?s policies and procedures. The University asserted that occurred due to staff oversight, and that informal approvals had been obtained prior to migrating those changes. Not obtaining approvals in accordance with University policies and procedures increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: ? Strengthen its controls to ensure that it accurately calculates returns of Title IV funds when required, including review of the variables it uses in those calculations. ? Develop and implement controls to prevent its student information system from disbursing Title IV assistance to withdrawn students prior to performing a return of Title IV funds calculation. ? Consistently follow its change management policies and procedures to obtain required approvals for changes to information systems. Views of Responsible Officials: Return of Title IV Calculations The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has developed and will begin to implement corrective action to further improve the process. General Controls We agree that the UHS change management policies and procedures should be consistently followed and the required approvals obtained for changes to university information systems used to administer student financial assistance.

2020 ? 129 Special Tests and Provisions ? Enrollment Reporting (Prior Audit Issues 2017-134, 2016-131, 2015-124, 2014-140, 2013-165, 13-147, 12-153, 11-154, 10-98, 09-87, 08-74, and 07-58) Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P192333; and CFDA 84.268, Federal Direct Student Loans, P268K202333 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Enrollment Reporting Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2019, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half-time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12- 06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment-level changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2019, Chapter 1 and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported. (NSLDS Enrollment Reporting Guide, November 2019, Chapters 1 and 4). The University of Houston (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University?s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University?s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2019, Chapter 3). For 40 (66 percent) of 61 students tested, the University did not report enrollment status changes or did not accurately report campus-level or program-level data elements to NSLDS. For many of the students tested, there were one or more data elements reported incorrectly. Specifically: ? For 27 students, the enrollment effective date was reported incorrectly at the program-level. For enrollment level changes and withdrawals occurring in the Fall 2019 term, the program-level effective date was incorrectly backdated to the first day of the term instead of the actual effective date of the status change. ? For 19 students, the program begin date was reported incorrectly. The University reported a date related to an administrative action (for example, the date that the student was approved to enroll in the program or the date the student applied for graduation), instead of the first day of the term in which the student actually began attendance in the program. The University asserted that it had correctly reported the program begin dates to NSC; however, the dates were reported incorrectly to NSLDS. ? For 3 students, the University did not report a graduated status to NSLDS. The University asserted that it reported those graduated statuses to NSC; however, those statuses were not reported to NSLDS. ? For 3 students, a withdrawal status was reported incorrectly. For those students, the University (1) reported an incorrect effective date for the withdrawal, (2) did not report the withdrawal status at the program-level, or (3) incorrectly reported the student?s status as withdrawn instead of never attended. For 4 (11 percent) of 35 students tested who received a Direct Loan and ceased to be enrolled on at least a half-time basis or changed their permanent address, the students? enrollment status was not reported to NSLDS in a timely manner. Those four students either withdrew or dropped to less-than-half-time enrollment. The University asserted that it reported those statuses to NSC in a timely manner; however, NSLDS received those statuses between 67 and 69 days after the effective date of the change. The errors discussed above occurred because the University (1) has not configured its student information system to accurately report student enrollment and program information to NSLDS and (2) did not have a process to ensure that student enrollment and program information reported to NSC was accurately reported to NSLDS in a timely manner. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, repayments schedules, and whether a borrower will retain or lose the interest subsidy under the 150 percent subsidized Direct Loan limit. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not always comply with its change management process for information systems. Specifically, for 2 (25 percent) of 8 changes tested, the University did not ensure that its change manager and/or change management committee formally approved the change prior to migrating that change to the production environment, as required by the University?s policies and procedures. The University asserted that occurred due to staff oversight, and that informal approvals had been obtained prior to migrating those changes. Not obtaining approvals in accordance with University policies and procedures increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: ? Develop and implement controls to ensure that campus-level and program-level data elements are reported to NSLDS accurately and in a timely manner. ? Consistently follow its change management policies and procedures to obtain required approvals for changes to information systems. Views of Responsible Officials: Enrollment Reporting The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has developed and will begin to implement corrective action to further improve the process. General Controls We agree that the UHS change management policies and procedures should be consistently followed and the required approvals obtained for changes to university information systems used to administer student financial assistance.

2020 ? 130 Activities Allowed or Unallowed Allowable Costs/Cost Principles Matching, Level of Effort, Earmarking Reporting Federal Program Title: Education Stabilization Fund Federal Agency: U.S. Department of Education Award years: See below Award numbers: See below Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned costs: $0 See Schedule of Findings and Questioned Costs for chart/table Allowable Costs Allowable costs charged to federal programs must (1) be necessary and reasonable; (2) conform to any limitations or exclusions set forth in the cost principles or in the federal award; (3) be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-federal entity; (4) be accorded consistent treatment; (5) be determined in accordance with generally accepted accounting principles, (6) not be included as a cost or used to meet cost sharing or matching requirements of any other federally financed program; and (7) be adequately documented (Title 2, Code of Federal Regulations (CFR), Section 200.403). Section 18004(c) of the Coronavirus Aid, Relief, and Economic Security (CARES) Act allows recipients to use up to 50 percent of the funds received for the Institutional Portion of the Higher Education Emergency Relief Fund (HEERF) award to cover any costs associated with significant changes to the delivery of instruction due to the coronavirus so long as such costs do not include payment (1) to contractors for the provision of pre-enrollment recruitment activities, (2) to endowments, or (3) for capital outlays associated with facilities related to athletics, sectarian instruction, or religious worship. Section 18004(a)(2) of the CARES Act allows recipients to use funds received for the Minority Serving Institutions portion of the HEERF award under that section to defray expenses incurred by the recipient, including lost revenue, reimbursement for expenses already incurred, technology costs associated with a transition to distance education, faculty and staff trainings, and payroll (Public Law 116-136). The University of Houston (University) did not ensure that all costs charged to its Higher Education Emergency Relief Fund (HEERF) awards were allowable. For 6 (14 percent) of 42 transactions tested, the University charged $3,113,517 to its HEERF awards that was not related to the University?s response to the coronavirus. Specifically: ? For one of those transactions, the University was unable to provide evidence that the pre-planned technology improvement project totaling $39,000 addressed a need directly related to the coronavirus. The University?s review process was not sufficient to identify the unallowable cost. ? For the remaining five transactions, the University charged approximately $3.1 million in lost revenue related to food service commission revenue and uncollected fees to the Institutional Portion of its HEERF award. The University recorded those transactions prior to October 2020 when the U.S Department of Education clarified its guidance to explain that using the Institutional Portion of the HEERF award to defray revenue losses the institution incurred is not allowable per section 18004(c) of the CARES Act. After auditors brought the errors related to the 6 transactions discussed above to the University?s attention, it transferred those costs to an institutional account; therefore, there were no questioned costs. Other Compliance Requirements and Award Number Although the general control weaknesses described below apply to matching, level of effort, earmarking, and reporting, auditors identified no compliance issues regarding those compliance requirements. The general control weaknesses described below also apply to CFDA 84.425E, Higher Education Emergency Relief Fund Student Portion, award number P425E200642. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not always comply with its change management process for information systems. Specifically, for 2 (25 percent) of 8 changes tested, the University did not ensure that its change manager and/or change management committee formally approved the change prior to migrating that change to the production environment, as required by the University?s policies and procedures. The University asserted that occurred due to staff oversight, and that informal approvals had been obtained prior to migrating those changes. Not obtaining approvals in accordance with University policies and procedures increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: ? Ensure that only allowable costs are charged to federal awards. ? Consistently follow its change management policies and procedures to obtain required approvals for changes to information systems. Views of Responsible Officials: The University acknowledges and agrees with the finding and will develop a corrective action plan.

2020 ? 131 Period of Performance Federal Program Title: Education Stabilization Fund Federal Agency: U.S. Department of Education Award year: June 4, 2020, to June 3, 2021 Award number: CFDA 84.425L, Higher Education Emergency Relief Fund Minority Serving Institutions, P425L200374 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned costs: $0 Period of Performance A recipient may charge to a federal award only allowable costs incurred during the period of performance and any costs incurred before the federal award that were authorized by the federal awarding agency or pass-through entity (Title 2, Code of Federal Regulations (CFR), Section 200.309). Pre-award costs are those incurred prior to the effective date of the federal award or subaward directly pursuant to the negotiation and in anticipation of the federal award for which such costs are necessary for efficient and timely performance of the scope of work. Such costs are allowable only to the extent that they would have been allowable if incurred after the date of the federal award and only with the written approval of the federal awarding agency (Title 2, CFR, 200.458). Pre-award costs incurred on or after March 13, 2020, the date of the Proclamation of National Emergency, are approved per the Recipient?s Funding Certification and Agreement for the Institutional Portion of the Higher Education Emergency Relief Fund (HEERF), as well as for the Minority Serving Institutions portion of the funding (Public Law 116-136). The University of Houston (University) did not ensure that all costs charged to its HEERF awards were incurred within the period of performance. Specifically, for 8 (19 percent) of 42 expenditures tested, the University incurred the cost between February 12, 2020, and March 12, 2020. The University charged those expenditures totaling $5,035 to the Minority Serving Institutions portion of its HEERF award. The University had a process to identify costs related to its response to the coronavirus and to transfer those costs to its HEERF awards; however, the University?s review process for the transfer of those costs was not sufficient to identify that those expenditures were outside of the period of performance. After auditors brought those errors to the University?s attention, it transferred those expenditures to an institutional account; therefore, there were no questioned costs. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not always comply with its change management process for information systems. Specifically, for 2 (25 percent) of 8 changes tested, the University did not ensure that its change manager and/or change management committee formally approved the change prior to migrating that change to the production environment, as required by the University?s policies and procedures. The University asserted that occurred due to staff oversight, and that informal approvals had been obtained prior to migrating those changes. Not obtaining approvals in accordance with University policies and procedures increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: ? Ensure that all costs it charges to federal awards are incurred within the period of performance. ? Consistently follow its change management policies and procedures to obtain required approvals for changes to information systems. Views of Responsible Officials: The University acknowledges and agrees with the finding and will develop a corrective action plan.

2020 ? 132 Eligibility Special Tests and Provisions ? Institutional Eligibility Activities Allowed or Unallowed Cash Management Reporting Special Tests and Provisions ? Disbursements to or on Behalf of Students Special Tests and Provisions ? Borrower Data Transmission and Reconciliation (Direct Loan) Special Tests and Provisions ? General Program Eligibility Special Tests and Provisions ? Distance Education Program Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194160; CFDA 84.033, Federal Work-Study Program, P033A194160; CFDA 84.063, Federal Pell Grant Program, P063P193465; CFDA 84.268, Federal Direct Student Loans, P268K203465; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T203465 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $135,318 Cost of Attendance The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student?s cost of attendance (COA) minus their expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the ?tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.? An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his/her family are expected to pay for educational expenses, and it is computed by the federal central processor and included on the student?s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student?s financial aid exceeds his/her need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student?s financial need (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). The University of Houston ? Clear Lake (University) established different COA budgets for each term based on a student?s classification (undergraduate or graduate); residency (in-state or out-of-state); living status (on-campus, off-campus, or living with parents); and enrollment level (full-time, three-quarter-time, half-time, or less-than-half time). For 27 (42 percent) of 64 students tested, the University incorrectly calculated the COA. Those errors occurred because the University did not correctly load the budget components for the Summer 2020 term into its student information system. This issue would have affected all students who enrolled in the Summer 2020 term. Auditors did not identify students during testing who were overawarded financial assistance as a result of the COA issue; therefore, there are no questioned costs. However, incorrectly establishing COA budgets increases the risk of overawarding or underawarding financial assistance to students. Federal Pell Grant When awarding Federal Pell Grant assistance to students, institutions use the payment and disbursement schedules provided each year by the U.S. Department of Education for determining award amounts (Title 34, CFR, Section 690.62). Those schedules provide the maximum annual amount a student would receive for a full academic year for a given enrollment status, EFC, and COA. There are separate schedules for three-quarter time, half-time, and less-than-half-time students (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 3, Chapter 3, page 3-56; and Title 34, CFR, Section 690.63(b)). For 1 (3 percent) of 36 students tested who received Federal Pell Grants, the University did not award the correct amount of Federal Pell Grant assistance. Specifically, the University awarded the student an amount that was less than the amount the student was eligible to receive. That occurred because the University awarded Federal Pell Grants to the student based on three-quarter-time enrollment, instead of the student?s actual enrollment (full-time). As a result, the student was underawarded $774 in Federal Pell Grant assistance. Federal Supplemental Educational Opportunity Grants (FSEOG) The FSEOG program provides grants to eligible undergraduate students. Institutions are required to award FSEOG first to Federal Pell Grant recipients who have the lowest expected family contribution (EFC). If an institution has FSEOG funds remaining after giving FSEOG awards to all Federal Pell Grant recipients, it can then award the remaining FSEOG funds to eligible students with the lowest EFCs who did not receive Federal Pell Grants (Title 34, CFR, Section 676.10). Based on a review of the full population of student financial assistance recipients, the University awarded $7,000 in FSEOG assistance to 5 students who were not eligible for that assistance. The University had not awarded FSEOG assistance to all other Federal Pell Grant recipients before awarding FSEOG assistance to those 5 students. Those 5 students had already received their lifetime eligibility amount for Federal Pell Grants; therefore, they were no longer eligible to receive Federal Pell Grants. After auditors brought those errors to the University?s attention, it corrected the FSEOG awards; therefore, there were no questioned costs. Eligibility and Certification Approval Report Each institution?s most recent Eligibility and Certification Approval Report (ECAR) lists the institution?s main campus and any additional approved locations. For any other locations at which an institution offers 50 percent or more of an eligible program, the institution must notify the U.S. Department of Education of that location if the institution wants to disburse Title IV funds to students enrolled at that location (Title 34, CFR, Section 600.21(a)(3)). An institution may not disburse Title IV funds to students at that location before it reports to the U.S. Department of Education about that location (Title 34, CFR, Section 600.21(d)). The University?s most recent ECAR did not include all additional locations. Specifically, the University offers eligible programs for incarcerated students at three of the state?s prison units. The University reported one of those locations on its ECAR; however, the University did not include the other two locations on its most recent ECAR. That error occurred because the University did not adequately review its ECAR to ensure that it reported all locations at which it offered more than 50 percent of an eligible program. The University disbursed $135,318 in federal student financial assistance to 27 students at the unreported locations during the 2019-2020 award year. Those disbursements were associated with CFDA 84.063, Federal Pell Grant Program, award number P063P193465, and they were considered questioned costs. Other Compliance Requirements Although the general control weaknesses described below apply to activities allowed or unallowed; cash management; reporting; special tests and provisions?disbursements to or on behalf of students, special tests and provisions?borrower data transmission and reconciliation (direct loan), special tests and provisions?general program eligibility, and special tests and provisions?distance education program, auditors identified no compliance issues regarding those compliance requirements. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not always comply with its change management process for information systems. Specifically, for 2 (25 percent) of 8 changes tested, the University did not ensure that its change manager and/or change management committee formally approved the change prior to migrating that change to the production environment, as required by the University?s policies and procedures. The University asserted that occurred due to staff oversight, and that informal approvals had been obtained prior to migrating those changes. Not obtaining approvals in accordance with University policies and procedures increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: ? Strengthen its controls to ensure that it correctly calculates students? COA budgets in accordance with its process. ? Award students the correct amount of Federal Pell Grant assistance for an award year. ? Award FSEOG assistance only to eligible students. ? Update its ECAR as required, and ensure that it does not disburse financial assistance to students at locations that are not on its ECAR. ? Consistently follow its change management policies and procedures to obtain required approvals for changes to information systems. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 133 Special Tests and Provisions ? Verification Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award number: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194160; CFDA 84.033, Federal Work-Study Program, P033A194160; CFDA 84.063, Federal Pell Grant Program, P063P193465; CFDA 84.268, Federal Direct Student Loans, P268K203465; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T203465 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Verification of Applications For each applicant whose Free Application for Federal Student Aid (FAFSA) is selected for verification by the Secretary of the U.S. Department of Education, an institution must verify all of the applicable items, which include household size, number of household members who are in college, adjusted gross income (AGI), U.S. income taxes paid, education credits, individual retirement account deductions, high school completion, the student?s identity, and the statement of educational purpose (Title 34, Code of Federal Regulations (CFR), Sections 668.54 and 668.56; and Federal Register, Volume 83, Number 60). When the verification of an applicant?s eligibility results in any change to a non-dollar item or a change to a single dollar item of $25 or more from the applicant?s FAFSA, the institution must submit a correction to the U.S. Department of Education and adjust the applicant?s subsidized financial aid awards on the basis of the expected family contribution (EFC) on the corrected Institutional Student Information Record (ISIR) (Title 34, CFR, Section 668.59). For 2 (3 percent) of 62 students tested, the University of Houston ? Clear Lake (University) did not accurately verify certain required items on the students? FAFSAs. For one of those students, the University did not accurately verify the student?s U.S. income taxes paid. For the other student, the University did not accurately verify the parent?s AGI. Those errors occurred because of manual errors the University made during its verification process. When auditors brought those errors to the University?s attention, the University made corrections to the students? ISIRs. Although those errors caused the EFC to be incorrect for both students, there was no impact on the amount of student financial assistance the student received; therefore, there were no questioned costs. However, not verifying FAFSA information accurately could result in the University overawarding or underawarding student financial assistance. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not always comply with its change management process for information systems. Specifically, for 2 (25 percent) of 8 changes tested, the University did not ensure that its change manager and/or change management committee formally approved the change prior to migrating that change to the production environment, as required by the University?s policies and procedures. The University asserted that occurred due to staff oversight, and that informal approvals had been obtained prior to migrating those changes. Not obtaining approvals in accordance with University policies and procedures increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: ? Strengthen its controls to ensure that it accurately verifies all required FAFSA information for students selected for verification. ? Consistently follow its change management policies and procedures to obtain required approvals for changes to information systems. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 134 Special Tests and Provisions ? Return of Title IV Funds Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194160; CFDA 84.063, Federal Pell Grant Program, P063P193465; CFDA 84.268, Federal Direct Student Loans, P268K203465; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T203465 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Return of Title IV Calculations When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student?s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on his/her behalf for the payment period or period of enrollment as of the student?s withdrawal date. Students earns 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The institution must return the lesser of the total amount of unearned Title IV assistance calculated above or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance not earned by the student. For purposes of this calculation, ?institutional charges? are tuition, fees, room and board (if the student contracts with the institution for the room and board), and other educationally related expenses assessed by the institution (Title 34, CFR, Section 668.22(g)). The institutional charges used in the calculation are usually the charges that were initially assessed to the student for the entire payment period or period of enrollment, as applicable. Initial charges may be adjusted only by those changes the institution made prior to the student?s withdrawal (for example, for a change in enrollment status unrelated to the withdrawal) (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 5, Chapter 1, page 5-18). The total number of calendar days in a payment period or period of enrollment includes all days within the payment period or period of enrollment that the student was scheduled to complete, excluding scheduled breaks of at least five consecutive days. Scheduled breaks of at least five consecutive days are also excluded from the number of calendar days the student completed in that period (Title 34, CFR, Section 668.22(f)(2)(i)). For 13 (48 percent) of 27 students tested, the University of Houston ? Clear Lake (University) incorrectly calculated the amount of Title IV funds to be returned or returned the incorrect amount of funds. For a majority of the students discussed below, there were multiple errors in the return calculation. Specifically: ? For 10 students, the University incorrectly determined the total number of days in the payment period for the Spring 2020 or Summer 2020 terms. Specifically, the University used start and end dates for the payment period that did not correspond to the actual start and end dates for the specific parts of the term that each student was scheduled to complete. Although the amount of unearned Title IV assistance calculated for those students was incorrect, funds were not required to be returned per Section 3508 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act; therefore, there were no questioned costs. ? For five students, the University did not exclude any break days from the Spring 2020 term as required. Those errors occurred because the University did not load the break days into its student information system when setting up the payment period; therefore, this issue would have affected all students who withdrew from the Spring 2020 term. Although the amount of unearned Title IV assistance calculated for those five students was incorrect, there were no questioned costs because (1) the University returned more funds than required or (2) funds were not required to be returned per Section 3508 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act. ? For three students, the University made a manual error in determining the amount of institutional charges to be used in the return calculation. For two of those students who withdrew from the Summer 2020 term, a return of Title IV funds was not required per Section 3508 of the CARES Act; therefore, there are no questioned costs. However, for one student who withdrew from the Fall 2019 term, the University returned $949 less than it should have returned. After auditors brought the error to the University?s attention, it returned those funds to the U.S. Department of Education; therefore, there were no questioned costs. ? For one student, the University returned the incorrect amount of Title IV funds due to a manual entry error. Specifically, the University returned $36 less than it should have returned. After auditors brought the error to the University?s attention, it returned those funds to the U.S. Department of Education; therefore, there were no questioned costs. ? For one student, the University incorrectly included a loan in the return calculation that had not been originated at the time the student withdrew. As a result, the amount of unearned Title IV assistance calculated for that student was incorrect. However, a return of Title IV funds was not required per Section 3508 of the CARES Act; therefore, there were no questioned costs. In addition, for 6 (17 percent) of 36 students tested who did not have a return of Title IV funds made, the University did not perform a return calculation as required. Specifically: ? For five students who withdrew from the Spring 2020 or Summer 2020 terms, the University did not perform a return calculation as required. After auditors brought those errors to the University?s attention, it performed return calculations as required. However, returns of Title IV funds were not required per Section 3508 of the CARES Act; therefore, there were no questioned costs. ? For one student, the University did not perform a return calculation and return funds as required due to a staff oversight. That student did not begin attendance in the Spring 2020 term; therefore, the student did not earn any Title IV funds for that term. After auditors brought the error to the University?s attention, it returned the $12,218 in Federal Direct Student Loans for which the student was not eligible to the U.S. Department of Education; therefore, there were no questioned costs. The University did not have an effective monitoring process to identify those errors. Having a process that does not consistently calculate and return the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. Returning Funds in the Required Order Unearned funds returned by the institution or the student must be credited to outstanding balances on Title IV loans made to the student or on behalf of the student for the payment period or period of enrollment for which a return of funds is required. Those funds must be credited to outstanding balances for the payment period or period of enrollment for which a return of funds is required in the following order: (1) Unsubsidized Federal Direct Loans; (2) Subsidized Federal Direct Loans; and (3) Federal Direct PLUS received on behalf of the student. If unearned funds remain to be returned after repayment of all outstanding loan amounts, the remaining excess must be credited to any amount awarded for the payment period or period of enrollment for which a return of funds is required in the following order: (1) Federal Pell Grants; (2) FSEOG Program aid; and (3) TEACH Grants (Title 34, CFR, Section 668.22(i)). For 2 (10 percent) of 20 students tested who withdrew and required a return of Title IV funds, the University did not return the Title IV funds in the required order. Specifically: ? For one student, the University incorrectly returned the student?s Federal Pell Grant and did not return any of the student?s unsubsidized or subsidized Federal Direct Student Loan funds as required. As a result, the student was overawarded $3,030 in Federal Direct Student Loan funds. After auditors brought the error to the University?s attention, it returned those funds to the U.S. Department of Education; therefore, there were no questioned costs. ? For one student, the University correctly returned the student?s unsubsidized Federal Direct Student Loan amount; however, it incorrectly returned $34 from the student?s Federal Pell Grant instead of returning that amount from the student?s subsidized Federal Direct Student Loan. After auditors brought the error to the University?s attention, it returned the $34 in Federal Direct Student Loans to the U.S. Department of Education; therefore, there were no questioned costs. Those errors occurred because the University (1) made manual errors in interpreting the return calculation for those students and should have returned the students? loan funds prior to returning Federal Pell Grant funds and (2) did not have an effective monitoring process to identify those errors. Timeliness of Returns An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution?s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). For 2 (10 percent) of 20 students tested who withdrew and required a return of Title IV funds, the University did not return the funds within the required time frame. Specifically, for those students, the University determined the withdrawal dates and performed the return calculations; however, it did not return the Title IV funds within the required 45-day time frame due to an oversight in processing the return of those funds. The University returned the funds for those two students 62 and 208 days after it had determined that those students had withdrawn. Not making returns within required time frames reduces the information available to the U.S. Department of Education for its program management. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not always comply with its change management process for information systems. Specifically, for 2 (25 percent) of 8 changes tested, the University did not ensure that its change manager and/or change management committee formally approved the change prior to migrating that change to the production environment, as required by the University?s policies and procedures. The University asserted that occurred due to staff oversight, and that informal approvals had been obtained prior to migrating those changes. Not obtaining approvals in accordance with University policies and procedures increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: ? Strengthen its controls to ensure that it accurately calculates returns of Title IV funds when required, including review of the variables it uses in those calculations. ? Return Title IV funds in the order required by the U.S. Department of Education. ? Strengthen its monitoring controls to ensure that it detects and corrects errors in return of Title IV calculations and returns Title IV funds within required time frames. ? Consistently follow its change management policies and procedures to obtain required approvals for changes to information systems. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 135 Special Tests and Provisions ? Enrollment Reporting Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P193465; and CFDA 84.268, Federal Direct Student Loans, P268K203465 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Enrollment Reporting Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2019, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half-time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files must also include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12- 06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment level changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2019, Chapter 1 and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2019, Chapters 1 and 4). The University of Houston ? Clear Lake (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University?s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University?s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2019, Chapter 3). For 22 (35 percent) of 62 students tested, the University did not report the enrollment status change or did not accurately report program-level data elements to NSLDS. Specifically: ? For 13 students, the program begin date was reported incorrectly. The University reported the date that the students declared their majors or changed their academic programs, instead of the first day of the term in which the student actually began attendance in the program. Those errors were caused by issues related to the configuration of the enrollment reporting processes in the University?s student information system. ? For 6 students, the enrollment effective date was reported correctly to NSLDS at the campus-level; however, a different enrollment effective date was incorrectly reported at the program-level for the same enrollment status. The effective date reported at the program-level should be the same date reported at the campus-level because those dates reflect the same enrollment status change. The University did not have a process to ensure that information was reported accurately at the program-level. ? For 2 students, both the program begin date and the program-level enrollment status effective date were reported incorrectly because of the issues discussed above. ? For 1 student, the University did not report the student?s withdrawal status to NSLDS. That student unofficially withdrew from the Spring 2020 term. The University did not report any students who were determined to have unofficially withdrawn from the Spring 2020 term. The University asserted that it did not report the student withdrawals because it had been waiting on guidance for reporting requirements under Section 3508 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act, which waived the statutory requirement for institutions to return Title IV funds as the result of student withdrawals related to a qualifying emergency. The CARES Act did not waive the requirement for institutions to report student withdrawals to NSLDS. Not reporting student enrollment and program information accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, repayment schedules, and whether a borrower will retain or lose the interest subsidy under the 150 percent subsidized Direct Loan limit. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not always comply with its change management process for information systems. Specifically, for 2 (25 percent) of 8 changes tested, the University did not ensure that its change manager and/or change management committee formally approved the change prior to migrating that change to the production environment, as required by the University?s policies and procedures. The University asserted that occurred due to staff oversight, and that informal approvals had been obtained prior to migrating those changes. Not obtaining approvals in accordance with University policies and procedures increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: ? Strengthen its controls to ensure that program-level data elements are reported to NSLDS accurately. ? Ensure that students who unofficially withdrew from a term are reported to NSLDS. ? Consistently follow its change management policies and procedures to obtain required approvals for changes to information systems. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 136 Special Tests and Provisions ? Enrollment Reporting Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P192293; and CFDA 84.268, Federal Direct Student Loans, P268K202293 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2019, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half-time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files must also include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2), and Dear Colleague Letter, March 30, 2012 (GEN-12- 06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment level changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2019, Chapter 1 and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported. (NSLDS Enrollment Reporting Guide, November 2019, Chapters 1 and 4). For instances in which a student completes one academic program and then enrolls in another academic program at the same school, the school must report two separate enrollment transactions: one showing the completion of the first program and its effective date and credential level, and the other showing the enrollment in the second program and its effective date (Dear Colleague Letter, March 30, 2012 (GEN-12-06). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a ?G? status at the campus-level and/or program-level as appropriate. The graduated status may protect the interest subsidy on the student?s current loans (NSLDS Enrollment Reporting Guide, Chapter 4). The University of North Texas (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University?s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University?s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2019, Chapter 3). For 60 (95 percent) of 63 students tested, the University did not accurately report campus-level and/or program-level data elements to NSLDS or did not report enrollment statuses in a timely manner. For a majority of the students tested, there were one or more data elements reported incorrectly. Specifically: ? For 57 students, the program begin date was reported incorrectly. The University reported the date that the student declared their major or was otherwise approved to enroll in the program, instead of the first day of the term in which the student actually began attendance in the program. Those errors were caused by issues related to the configuration of the enrollment reporting processes in the University?s student information system. ? For 30 students, the enrollment effective date was reported correctly to NSLDS at the campus-level; however, a different enrollment effective date was incorrectly reported at the program-level for the same enrollment status. The effective date reported at the program-level should be the same date reported at the campus-level because those dates reflect the same enrollment status change. Those errors were caused by issues related to the configuration of the enrollment reporting processes in the University?s student information system. ? For 2 students, a withdrawal status was not reported to NSLDS within 60 days of the date the University determined that the student unofficially withdrew from the Spring 2020 term. The University?s process is to (1) identify the last date of attendance for students who unofficially withdraw from the term during the end-of term grade processing and (2) manually update the student?s record on the NSLDS website. However, the unofficial withdrawal status was not reported for those two students due to staff turnover and delays in processing. After auditors notified the University about the oversight, the University reported the status changes to NSLDS, but that reporting was done 71 and 80 days after the University determined the students? dates of withdrawal. ? For one student, a graduated status was not reported at the campus-level. That student graduated at the end of the Spring 2020 term and subsequently enrolled half-time in another program in the Summer 2020 term. The graduated status was correctly reported at the program-level; however, only the half-time status was reported at the campus-level. ? For one student, a graduated status was not reported timely to NSLDS. The student was appropriately reported as withdrawn after the Fall 2019 term; however, a graduated status was not reported after the student?s degree was conferred after the Spring 2020 term. After auditors brought the issue to the University?s attention, it reported the graduated status to NSLDS 119 days after the student?s graduated status became effective. ? For one student, the effective date for the student?s withdrawal status was reported incorrectly at the campus and program-levels. The University initially correctly reported the effective date as the student?s last day of attendance; however, it asserted that NSC overrode that effective date with the last day of the term. ? For one student, the program length was reported incorrectly. The student was enrolled in a 4-year Bachelor?s program; however, the program length was incorrectly reported as 2 years. That error was caused by a data entry error in the University?s student information system. ? For one student, the enrollment level was reported incorrectly using graduate-level enrollment (three-quarter time). Because that student was enrolled in a post-baccalaureate program and was treated as an undergraduate for student financial assistance purposes (for example, the student?s cost of attendance was based on undergraduate-level enrollment), the enrollment level should have been reported using undergraduate-level enrollment (half-time). The University asserted it made this error because it admits post baccalaureate students through its graduate school; however, the enrollment level reported to NSLDS should be consistent with the University?s student financial assistance processes. The errors discussed above occurred because the University does not have a process to monitor student enrollment and program information reported by NSC to NSLDS. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, repayment schedules, and whether a borrower will retain or lose the interest subsidy under the 150 percent subsidized Direct Loan limit. Recommendation: The University should develop and implement controls to ensure that campus-level and program-level data elements are reported to NSLDS accurately and in a timely manner. Views of Responsible Officials: The University acknowledges the findings. The University recognizes the importance of accurate and timely enrollment reporting and will work accordingly for timely processing of updates and that system audit controls are in place to ensure updates to programs, like change of majors, comply with the program effective dates for start of a term. The University acknowledges and agrees with the finding regarding the unofficial withdrawal reporting to NSLDS. Through analysis of this exception identified in the audit, the University has worked to develop and implement corrective action to further improve the process.

2020 ? 137 Eligibility Activities Allowed or Unallowed Cash Management Special Tests and Provisions ? Disbursements to or on Behalf of Students Special Tests and Provisions ? Borrower Data Transmission and Reconciliation (Direct Loan) Special Tests and Provisions ? Institutional Eligibility Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A199321; CFDA 84.033, Federal Work-Study Program, P033A199321; CFDA 84.063, Federal Pell Grant Program, P063P198229; CFDA 84.268, Federal Direct Student Loans, P268K208229; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T208229 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $1,584 Cost of Attendance The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student?s cost of attendance (COA) minus their expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the ?tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.? An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his/her family are expected to pay for educational expenses, and it is computed by the federal central processor and included on the student?s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student?s financial aid exceeds his/her need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student?s financial need (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). The University of North Texas at Dallas (University) established different COA budgets for each term based on a student?s classification (undergraduate or graduate); residency (in-state or out-of-state); living status (on-campus, off-campus, or living with parents); and enrollment level (full-time, three-quarter-time, half-time, or less-than-half time). The University used a student?s expected enrollment level to calculate COA. For 7 (11 percent) of 62 students tested, the University incorrectly or inconsistently calculated the COA. Specifically: ? For 6 students, the University (1) did not assign a budget component for living status in accordance with its process, or (2) made errors when manually adjusting the COA. Although the COA was over- or understated, those errors did not affect the amount of student financial assistance the students received. ? For 1 student, the University did not budget the student correctly based on expected enrollment. That student indicated that expected enrollment for the Fall 2019 term was three-quarter-time and no enrollment was expected for the Spring 2020 term. However, the student was budgeted for both the Fall 2019 and Spring 2020 terms, which caused the student to be overawarded. After auditors brought this issue to the University?s attention, it updated the student?s Fall 2019 budget to reflect the student?s actual enrollment for that term (half-time) and removed the student?s Spring 2020 budget. As a result of the error, the University overawarded the student $1,584 associated with CFDA 84.268, Federal Direct Student Loans, award number P268K208229. Incorrectly calculating COA budgets increases the risk of overawarding or underawarding financial assistance to students. Federal Pell Grant When awarding Federal Pell Grant assistance to students, institutions use the payment and disbursement schedules provided each year by the U.S. Department of Education for determining award amounts (Title 34, CFR, Section 690.62). Those schedules provide the maximum annual amount a student would receive for a full academic year for a given enrollment status, EFC, and COA. There are separate schedules for three-quarter time, half-time, and less-than-half-time students (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 3, Chapter 3; and Title 34, CFR, Section 690.63(b)). For 2 (6 percent) of 34 students tested who received Federal Pell Grants, the University did not award the correct amount of Federal Pell Grant assistance. Specifically, the University awarded the students an amount that was less than the amount the students were eligible to receive. That occurred because the University awarded Federal Pell Grants to those students based on expected enrollment (three-quarter-time), instead of actual enrollment (full-time). As a result, each student was underawarded $775 in Federal Pell Grant assistance. After auditors brought those errors to the University?s attention, it corrected those awards. Satisfactory Academic Progress A student is eligible to receive Title IV assistance if the student maintains satisfactory progress in his/her course of study according to the institution?s published standards of satisfactory progress (SAP) that satisfy the provisions of Title 34, CFR, Section 668.34 (Title 34, CFR, Section 668.32(f)). An institution?s SAP policy should include a qualitative component that consists of grades or comparable factors that are measureable against a norm and a quantitative component that consists of the pace at which students must progress through their program to ensure that they will graduate within the maximum time frame required to complete their education. For a graduate program, a period defined by the institution that is based on the length of the educational program should be used to determine the maximum time frame for the quantitative component of SAP. (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 1, Chapter 1, and Title 34, CFR, Section 668.34(b)). The University did not always calculate SAP in accordance with its SAP policy. The University?s policy states that all students must complete degree program requirements within 150 percent of the published length of their degree, which is measured in credit hours. However, for Graduate and Law students, the automated process in the University?s student information system calculated the maximum time frame based on the number of academic terms in which a student enrolled, rather than the number of credit hours a student attempted. Because the number of hours a student can enroll in per academic term can vary, calculating the maximum time frame based on the number of academic terms, rather than based on a student?s attempted credit hours, increases the risk that the University could deny student financial assistance to eligible students or disburse student financial assistance to ineligible students. Other Compliance Requirements Although the control weaknesses described below apply to activities allowed or unallowed, cash management, special tests and provisions - disbursements to or on behalf of students, special tests and provisions - borrower data transmission and reconciliation (direct loan), and special tests and provisions - institutional eligibility, auditors identified no compliance issues regarding those compliance requirements. Policies and Procedures Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not have updated policies and procedures for the 2019-2020 award year. The University?s most recent operational policy manual was updated for the 2017-2018 award year and that manual was last reviewed and approved in 2016. In addition, some policies were updated or created when requested by auditors. The University did have other informal procedures available for staff to use when performing various functions; however, having incomplete and/or outdated policies and procedures increases the risk that the University may not administer student financial assistance programs in compliance with requirements. Recommendations: The University should: ? Strengthen controls to ensure that it correctly calculates students? COA budgets in accordance with its process and does not overaward financial assistance to students. ? Award students Federal Pell Grant assistance based on actual enrollment. ? Configure its student information system to align with its SAP policy by defining maximum time frame based on 150 percent of credit hours attempted for Graduate and Law students. ? Review policies and procedures and update as needed for each award year. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 138 Reporting Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award number: CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T208229 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Institutions must submit Teacher Education Assistance for College and Higher Education (TEACH) Grant disbursement records to the Common Origination and Disbursement (COD) system no later than 15 days after making the disbursement or becoming aware of the need to adjust a previously reported disbursement. Reporting this information helps ensure that institutions have the most accurate information available about students? federal awards and to help prevent an institution from overawarding students (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 3, Chapter 1; and Federal Register, Volume 84, Number 212). Certain data elements are required to be reported as part of a student?s origination and disbursement record, including the student?s Social Security number, Central Processing System (CPS) transaction number, enrollment date, disbursement amount, and disbursement date (2019-2020 COD Technical Reference, Volume II). An institution must report the following information for each TEACH Grant recipient: (1) the student?s eligibility for a TEACH Grant, (2) the student?s TEACH Grant amounts, and (3) the anticipated and actual disbursement date(s) and disbursement amount(s) of the TEACH Grant funds (Title 34, Code of Federal Regulations, Section 686.37(a)). The University of North Texas at Dallas (University) incorrectly reported origination and/or disbursement information for all 8 (100 percent) TEACH Grant awards it made for the 2019-2020 award year. For all 8 students, the University reported an incorrect disbursement date for one or more disbursements made to the students during the award year. The actual disbursement dates for those students ranged from 1 to 32 days after the disbursement dates reported to COD. The University also reported the CPS transaction number incorrectly for 2 students and the TEACH Grant award amount incorrectly for one student. The University?s process is to manually report TEACH Grant awards on COD?s website; the incorrect award and disbursement information reported for all 8 students was a result of manual entry errors made during that process. In addition, the University did not have a process to review the manual data entries for accuracy. Not accurately reporting information to the COD system could result in the institution overawarding federal funds. Recommendation: The University should strengthen its controls to ensure that TEACH Grant origination and disbursement information is reported to COD accurately. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 139 Special Tests and Provisions ? Verification Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A199321; CFDA 84.033, Federal Work-Study Program, P033A199321; CFDA 84.063, Federal Pell Grant Program, P063P198229; CFDA 84.268, Federal Direct Student Loans, P268K208229; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T208229 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: Unknown Verification of Applications For each applicant whose Free Application for Federal Student Aid (FAFSA) is selected for verification by the Secretary of the U.S. Department of Education, an institution must verify all of the applicable items, which include household size, number of household members who are in college, adjusted gross income (AGI), U.S. income taxes paid, education credits, individual retirement account deductions, high school completion, the student?s identity, and the statement of educational purpose (Title 34, Code of Federal Regulations (CFR), Sections 668.54 and 668.56, and Federal Register, Volume 83, Number 60). When the verification of an applicant?s eligibility results in any change to a non-dollar item or a change to a single dollar item of $25 or more from the applicant?s FAFSA, the institution must submit a correction to the U.S. Department of Education and adjust the applicant?s subsidized financial aid awards on the basis of the expected family contribution (EFC) on the corrected Institutional Student Information Record (ISIR) (Title 34, CFR, Section 668.59). Household size for a dependent student includes (1) the student; (2) the student?s parents; (3) the student?s siblings and children, if they will receive more than half their support from the student?s parent(s) for the entire award year; and (4) other persons who live with and receive more than half their support from the student?s parent(s) and will receive more than half support for the entire award year. Household size for an independent student includes (1) the student; (2) his or her spouse; (3) the student?s children if they will receive more than half their support from the student for the entire award year; and (4) other persons who live with and receive more than half their support from the student and will receive more than half support for the entire award year. Number in college always includes (1) the student and (2) those in the household size who are or will be enrolled at least half time during the award year in a degree or certificate program at a Title IV-eligible school and who can reasonably be expected to receive aid from the family for their education (U.S. Department of Education, 2019- 2020 Federal Student Aid Handbook, Application and Verification Guide, Chapter 2). Acceptable documentation for verifying household size and the number of household members who are in college includes a statement signed by the applicant and, if the applicant is a dependent student, by one of the applicant?s parents that lists the name and age of each household member, the relationship of that household member to the applicant, and the name of the educational institution for each household member who is or will be attending at least half-time in a program that leads to a degree or certificate (Title 34, CFR, Sections 668.57(b) and (c), and Federal Register, Volume 83, Number 60). For 2 (3 percent) of 61 students tested, the University of North Texas at Dallas (University) did not accurately verify certain items on the FAFSA. For one of those students, the University did not accurately verify the parent?s U.S. income taxes paid. For the other student, the University inappropriately removed the student?s spouse from the number in household. Those errors occurred because of manual errors the University made during its verification process that it did not identify in its monitoring of the verification process. When auditors brought those errors to the University?s attention, it corrected them in its student information system; however, it did not request updated ISIRs for those affected students because the deadline had passed for the University to submit corrections. The University performed procedures in its student information system to correct the ISIR information. As a result, the errors did not result in changes to the EFC, and those students were not overawarded or underawarded student financial assistance. For 5 (8 percent) of 61 students tested, the University did not document its justification for removing individuals from the student?s household size and/or number in college reported on the student?s FAFSA. Per the University?s procedures, staff are instructed to have a conversation with the student to determine if individuals listed in the household size receive more than half of their support from the student or parent. For those 5 students, the University asserts that it followed that process and determined that an individual should be removed from the household size; however, because the University did not document those determinations in the students? records or in the University?s student information system, auditors could not verify that assertion. As a result, auditors could not determine whether there was an effect on the students? EFCs or financial assistance awards. Verification Policies and Procedures An institution must establish and use written policies and procedures for verifying an applicant?s FAFSA information. Those policies must include (1) the time period within which an applicant must provide any documentation requested by the institution in accordance with Title 34, CFR, Section 668.57; (2) the consequences of an applicant?s failure to provide the requested documentation within the specified time period; (3) the method by which the institution notifies an applicant of the results of its verification if, as a result of verification, the applicant?s EFC changes and that results in a change in the amount of the applicant?s assistance under Title IV, Higher Education Act of 1965 (HEA) programs; (4) the procedures the institution will follow itself or the procedures the institution will require an applicant to follow to correct FAFSA information determined to be in error; and (5) the procedures for making referrals under Title 34, CFR, Section 668.16(g). An institution?s procedures must provide that it will furnish, in a timely manner, to each applicant whose FAFSA information is selected for verification a clear explanation of (1) the documentation needed to satisfy the verification requirements and (2) the applicant?s responsibilities with respect to the verification of FAFSA information, including the deadlines for completing any required actions and the consequences of failing to complete any required action. An institution?s procedures also must provide that an applicant whose FAFSA information is selected for verification is required to complete verification before the institution exercises any authority under Section 479A(a) of the HEA to make changes to the applicant?s cost of attendance or to the values of the data items required to calculate the EFC (Title 34, CFR, Section 668.53). The University did not have updated verification policies and procedures for the 2019-2020 award year. The University?s most recent operational policy manual was updated for the 2017-2018 award year and that policy was last reviewed and approved in 2016. Because the policy had not been updated, it contained outdated information (for example, the policy described the verification tracking groups for prior award years, including verification of child support paid and Supplemental Nutrition Assistance Program benefits, which were not applicable items to verify for the 2019-2020 award year). In addition, the policy that included a statement specifying that an applicant whose FAFSA information is selected for verification is required to complete verification before the institution makes changes based on professional judgment to the applicant?s cost of attendance or to the values of the data items required to calculate the EFC had not been updated since 2014. The University did have other informal procedures available for staff to use when performing verification of applications; however, those procedures were inconsistent with the University?s operational policy manual. Having incomplete, outdated, and inconsistent policies and procedures increases the risk that the University may not perform verifications in compliance with requirements. Recommendations: The University should: ? Strengthen its controls to ensure that it accurately verifies all required FAFSA information for students selected for verification. ? Retain documentation to support changes it makes to student FAFSA information. ? Include all required elements in its verification policies and procedures and ensure that those policies are reviewed and updated for each award year. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 140 Special Tests and Provisions ? Return of Title IV Funds Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A199321; CFDA 84.063, Federal Pell Grant Program, P063P198229; CFDA 84.268, Federal Direct Student Loans, P268K208229; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T208229 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: Unknown When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student?s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). If the total amount of calculated Title IV grant or loan assistance, or both, that a student earned is greater than the total amount of Title IV grant or loan assistance, or both, that was disbursed to the student, as of the date of the institution?s determination that the student withdrew, the difference between those amounts must be treated as a post-withdrawal disbursement in accordance with Title 34, CFR, Section 668.164(j) (Title 34, CFR, Section 668.22(a)(5)). An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution?s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). The University of North Texas at Dallas (University) did not always return Title IV funds within the required time frame. For 2 (14 percent) of 14 students tested who withdrew and required a return of Title IV funds, the University returned funds 52 and 156 days after the students had withdrawn. The University processed the adjustments in its student information system within the required time frame; however, the funds were not returned to the U.S. Department of Education at that time. Not making returns within the required time frame reduces the information available to the U.S. Department of Education for its program management. In addition, for 1 (3 percent) of 31 students tested, the University did not perform a return calculation to determine whether the student was eligible for a post-withdrawal disbursement. The University disbursed Title IV funds to that student in January 2020 for the Fall 2019 term; however, the student did not earn any passing grades for that term. The University has a process to determine last dates of attendance for unofficially withdrawn students who have received Title IV funds. However, the University had not yet disbursed funds to the one student at the time it performed that process and the University did not perform any other procedures prior to the disbursement of funds to determine whether (1) the student completed the coursework and was therefore eligible for the full amount of Title IV funds, or (2) the student unofficially withdrew from the term and was therefore eligible for only a post-withdrawal disbursement based on the last day of attendance in an academically related activity. As a result, that student?s eligibility was not reviewed and auditors were unable to determine whether there were any questioned costs associated with that error. The University did not have a formal review process or monitoring controls to ensure that return of Title IV funds calculations were performed and funds were returned within required timeframes. Recommendation: The University should develop and implement monitoring controls to ensure that it performs return of Title IV calculations and returns funds within the required time frame. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 141 Special Tests and Provisions ? Enrollment Reporting Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P198229; and CFDA 84.268, Federal Direct Student Loans, P268K208229 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2019, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half-time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files must also include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2), and Dear Colleague Letter, March 30, 2012 (GEN-12- 06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment-level changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2019, Chapter 1 and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported. (NSLDS Enrollment Reporting Guide, November 2019, Chapters 1 and 4). The University of North Texas at Dallas (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University?s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University?s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2019, Chapter 3). For all 60 (100 percent) students tested, the University did not report enrollment status changes or did not accurately report campus-level or program-level data elements to NSLDS. Specifically: ? For all 60 students tested, the program credential level was reported incorrectly. The University reported the program credential level as ?99 - Non-Credential Program (Preparatory Coursework/Teacher Certification)? for all students instead of the student?s actual credential level (for example, Bachelor?s degree or Master?s degree). Those errors were caused by issues related to the configuration of the enrollment reporting processes in the University?s student information system and would have affected all students enrolled at the University. ? For all 60 students tested, the program begin date was reported incorrectly. The University reported the date that the students declared their majors or were otherwise approved to enroll in the programs, instead of the first day of the term in which the students actually began attendance in the programs. Those errors were caused by issues related to the configuration of the enrollment reporting processes in the University?s student information system. The University made additional reporting errors for 59 (98 percent) of the 60 students tested: ? For 30 students, the University did not report a graduated status to NSLDS. The University asserted that it reported those graduated statuses to NSC; however, it did not have a process in place to ensure that graduated statuses were reported to NSLDS. This issue would have affected all students that graduated from the University in the 2019-2020 award year. ? For 5 students, the University did not report a withdrawal status to NSLDS. Those 5 students unofficially withdrew from either the Fall 2019 or Spring 2020 term. The University had a process to identify students who have unofficially withdrawn from a term for purposes of the return of Title IV funds; however, the University did not have a process to report those students as withdrawn to NSLDS. ? For 7 students, the University did not report a withdrawal status to NSLDS for students who officially withdrew or reported the withdrawal status incorrectly. ? For 17 students, the University did not report enrollment level status changes to NSLDS or reported those changes incorrectly. The errors discussed above occurred because the University (1) has not established formal policies and procedures for its enrollment reporting processes, (2) has not configured its student information system to accurately report student enrollment and program information to NSLDS, and (3) does not have a process to monitor student enrollment and program information reported to NSLDS. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, repayment schedules, and whether a borrower will retain or lose the interest subsidy under the 150 percent subsidized Direct Loan limit. Recommendations: The University should: ? Develop and implement controls to ensure that campus-level and program-level data elements are accurately reported to NSLDS. ? Ensure that graduated statuses are reported to NSLDS. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 142 Special Tests and Provisions ? Return of Title IV Funds Activities Allowed or Unallowed Cash Management Eligibility Reporting Special Tests and Provisions ? Verification Special Tests and Provisions ? Disbursements to or on Behalf of Students Special Tests and Provisions ? Borrower Data Transmission and Reconciliation (Direct Loan) Special Tests and Provisions ? General Program Eligibility Special Tests and Provisions ? Distance Education Program Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194172; CFDA 84.063, Federal Pell Grant Program, P063P192335; CFDA 84.268, Federal Direct Student Loans, P268K202335; CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T202335; and CFDA 84.033, Federal Work-Study Program, P033A194172 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Return of Title IV Funds When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student?s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV assistance earned by the student is less than the amount that was disbursed to the student or on his or her behalf as of the date of the institution?s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). For an institution that is not required to take attendance, the institution must determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew (Title 34, CFR, Section 668.22(j)(2)). An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date when the institution made its determination that the student withdrew (Title 34, CFR, Section 668.22(j)). The University of Texas at Arlington (University) did not always identify students that required Title IV funds to be returned or did not identify students in a timely manner. Specifically: ? For 3 (5 percent) of 60 students tested who withdrew and required a return of Title IV funds, the University did not identify the student?s withdrawal date in a timely manner. Those students unofficially withdrew from the Fall 2019 term. The University asserted that there was an issue with the automated report used to identify unofficially withdrawn students that caused the University to not identify those three students. The University identified the issue related to the automated report in June 2020, 182 days after the end of the Fall 2019 term. The University appropriately performed return calculations and returned Title IV funds for those students within 45 days of when it determined that those students withdrew. ? For 1 (2 percent) of 60 students tested who did not have a return of Title IV funds made, the University did not perform a return calculation or return Title IV funds as required. That student unofficially withdrew from the Summer 2019 term and the University did not identify this student as withdrawn. After auditors brought the issue to the University?s attention, it performed a return calculation and returned Title IV funds as required; therefore, there are no questioned costs. Other Compliance Requirements and Award Number Although the general control weaknesses described below apply to activities allowed or unallowed; cash management; eligibility; reporting, special tests and provisions?verification, special tests and provisions? disbursements to or on behalf of students, special tests and provisions?borrower data transmission and reconciliation (direct loan), special tests and provisions?general program eligibility, and special tests and provisions?distance education program, auditors identified no compliance issues regarding those compliance requirements. The general control weaknesses described below also apply to CFDA 84.033, Federal Work-Study Program, award number P033A194172. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not appropriately restrict user access to its student information system. Specifically, an excessive number of users outside of the student financial assistance office had access to modify key processes in the student information system. In addition, the University could not always provide evidence that administrative access to system accounts was limited only to users who needed access. Allowing users inappropriate or excessive access to systems increases the risk of inappropriate changes to systems. Recommendations: The University should: ? Strengthen its controls to ensure that it identifies withdrawn students and returns Title IV funds within required time frames. ? Ensure that user access to its student information system is appropriately limited to employees based on job responsibilities. Views of Responsible Officials: Return of Title IV Funds The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes. General Controls The University acknowledges and agrees with the general controls finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the process.

2020 ? 143 Special Tests and Provisions ? Enrollment Reporting Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P192335; and CFDA 84.268, Federal Direct Student Loans, P268K202335 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Enrollment Reporting Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2019, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half-time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files must also include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12- 06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment level changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2019, Chapter 1 and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2019, Chapters 1 and 4). The University of Texas at Arlington (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University?s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University?s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2019, Chapter 3). For 46 (77 percent) of 60 students tested, the University did not accurately report program-level data elements to NSLDS. Specifically: ? For 30 students, the program begin date was reported incorrectly. The University reported a date other than the first day of the term in which the student actually began attendance in the program. For example, the University reported dates related to administrative actions such as the date that students declared their majors or changed their academic plan within the same CIP code. Those errors were caused by issues related to the configuration of the enrollment reporting processes in the University?s student information system. ? For 6 students, the enrollment effective date was reported correctly to NSLDS at the campus-level; however, a different enrollment effective date was incorrectly reported at the program-level for the same enrollment status. The effective date reported at the program-level should be the same date reported at the campus-level because those dates reflect the same enrollment status change. As noted above, the errors were caused by issues related to the configuration of the enrollment reporting processes in the University?s student information system. ? For 9 students, both the program begin date and the program-level enrollment status effective date were reported incorrectly because of the issues related to the University?s student information system discussed above. ? For 1 student, the program enrollment status was reported incorrectly. That student was enrolled full-time in a graduate nursing program for the Spring 2020 academic term and that status was reported correctly at the campus-level; however, the enrollment status was incorrectly reported as half-time at the program-level. The University asserted that it manually reported the enrollment status for students enrolled in the graduate nursing program during the 2019-2020 award year and it did not have a process to reconcile differences in campus- and program-level information. In addition, both the program begin date and the program-level enrollment status effective date were reported incorrectly for this student, because of the issues related to the University?s student information system discussed above. Not reporting student enrollment and program information accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, repayment schedules, and whether a borrower will retain or lose the interest subsidy under the 150 percent subsidized Direct Loan limit. General Controls Institutions must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, CFR, Section 200.303). The University did not appropriately restrict user access to its student information system. Specifically, an excessive number of users outside of the student financial assistance office had access to modify key processes in the student information system. In addition, the University could not always provide evidence that administrative access to system accounts was limited only to users who needed access. Allowing users inappropriate or excessive access to systems increases the risk of inappropriate changes to systems. Recommendations: The University should: ? Strengthen its controls to ensure that program-level data elements are reported to NSLDS accurately. ? Ensure that user access to its student information system is appropriately limited to employees based on job responsibilities. Views of Responsible Officials: Enrollment Reporting The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes. General Controls The University acknowledges and agrees with the general controls finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the process.

2020 ? 144 Special Tests and Provisions ? Enrollment Reporting Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P192336; and CFDA 84.268, Federal Direct Student Loans, P268K202336 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2019, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half-time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files must also include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12- 06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment level changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2019, Chapter 1 and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2019, Chapters 1 and 4). The University of Texas at Austin (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University?s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University?s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2019, Chapter 3). For 10 (17 percent) of 60 students tested, the University did not accurately report program-level data elements to NSLDS. Specifically: ? For 8 students, the program enrollment effective date was reported incorrectly. The University incorrectly reported the first day of the term in which the student?s enrollment level changed at the program-level, instead of the actual effective date of the change. The University reported the correct enrollment effective date at the campus-level for those students. ? For 1 student, the program begin date was reported incorrectly. The University reported the date the student?s major was changed, instead of the first day of the term in which the student actually began attendance in the program. ? For 1 student, both the program enrollment effective date and the program begin date were reported incorrectly. The University reported the date the student?s major was changed, instead of the first day of the term in which the student actually began attendance in the program. The errors discussed above occurred because the University had not configured its student information system to accurately report student program information to NSLDS. Not reporting student program information accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, repayment schedules, and whether a borrower will retain or lose the interest subsidy under the 150 percent subsidized Direct Loan limit. Recommendation: The University should strengthen its controls to ensure that program-level data elements are reported to NSLDS accurately. Views of Responsible Officials: The University acknowledges and agrees with the Program Enrollment Effective Date finding. Program Enrollment Effective Date is defined as the date a student?s enrollment status changes during a semester of enrollment (i.e. student?s enrollment status changes from full-time to half-time status). Through analysis of the exceptions identified in the audit, the University has developed and implemented corrective action to further improve the processes. The University acknowledges and agrees with the Program Begin Date finding. The State Auditor?s Office?s (SAO) Enrollment Reporting finding for the 2019-2020 financial aid award year for the University of Texas at Austin cites the 7.14.4 Improper Reporting of Program Begin Date (2019-20 NSLDS Enrollment Reporting Guide) regarding how the Department of Education defines Program Begin Date for federal financial aid recipients. NSLDS defines Program Begin Date as follows, ?The Program Begin Date is the date on which the student began attending the program. This date should not change based on a new term or interruption in enrollment at the same school location. Additionally, NSLDS will use COD's Payment Period Begin Date as the Program Begin Date for the first program data reported to NSLDS by COD. Schools must verify and correct Program Begin Date as needed. COD data will never replace school certified data.?

2020 ? 145 Eligibility Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194174; CFDA 84.033, Federal Work-Study Program, P033A194174; CFDA 84.063, Federal Pell Grant Program, P063P193234; CFDA 84.268, Federal Direct Student Loans, P268K203234; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T203234 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Cost of Attendance The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student?s cost of attendance (COA) minus their expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the ?tuition and fees normally assessed a student carrying the same academic workload as determined by the institution and including costs for rental or purchase of any equipment materials, or supplies required of all students in the same course of study.? An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his/her family are expected to pay for educational expenses, and it is computed by the federal central processor and included on the student?s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student?s financial aid exceeds his/her need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student?s financial need (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). The University of Texas at Dallas (University) established different COA budgets for each term based on a student?s tuition rate (guaranteed or variable), classification (undergraduate or graduate); residency (in-state and out-of- state); living status (on-campus, off-campus, or living with parents), and enrollment level (full-time, three quarter-time, half-time, or less-than-half-time). Budgeting rules within the University?s student information system are used to assign various budget components based on the factors noted above. For 3 (5 percent) of 63 students tested, the University incorrectly or inconsistently calculated the COA. Specifically: ? For 1 student, the University assigned an incorrect budget for the cost of tuition. That student was incorrectly assigned a budget based on the University?s summer 2016 tuition rates, but the student should have been assigned a budget based on the University?s summer 2018 tuition rates. That error was caused by an issue related to the budget component configuration in the University?s student information system. After auditors brought that issue to the University?s attention, it identified a total of 42 students that were affected by it. The overall COA was understated for those students, which could inappropriately reduce the amount of financial assistance available to the student. ? For 1 student, the University incorrectly overstated the COA by assigning a half-time tuition budget based on 6 hours of enrollment, instead of 5 hours of enrollment, which is its process for graduate students. That error was caused by an issue related to the budget component configuration in the University?s student information system. After auditors brought that issue to the University?s attention, it identified a total of 20 students that were affected by it; 5 of those 20 students were overawarded a total of $5,178 in student financial assistance. The University adjusted those students? COAs and corrected the overawards; therefore, there were no questioned costs. ? For 1 student, the University did not assign a budget component to account for student loan fees in accordance with its process. After auditors brought that issue to the University?s attention, it identified 10 additional students that were affected by it. The overall COA was understated for those students, which could inappropriately reduce the amount of financial assistance available to the students. Incorrectly calculating COA budgets increases the risk of overawarding or underawarding financial assistance to students. Satisfactory Academic Progress A student is eligible to receive Title IV, Higher Education Act Program assistance if the student maintains satisfactory progress in his or her course of study according to the institution?s published standards of satisfactory progress that comply with the provisions of Title 34, CFR, Section 668.34 (Title 34, CFR, Section 668.32(f)). An institution?s satisfactory academic progress (SAP) policy must include a qualitative component that consists of grades or comparable factors that are measurable against a norm, and a quantitative component that consists of the pace at which students must progress through their program to ensure that they will graduate within the maximum time frame required to complete their education (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 1, Chapter 1; and Title 34, CFR, Section 668.34). For 2 (5 percent) of 44 students tested, the University did not apply its SAP policy standards consistently. Specifically: ? For 1 student, the University incorrectly calculated the student?s pace of completion. The University made a manual error when it entered the student?s transfer credit hours into its student information system, which caused the student?s earned credit hours to exceed the student?s attempted credit hours. ? For 1 student, the University did not perform a SAP calculation after the Spring 2020 term, as required by its SAP policy. That error was the result of staff oversight. Those two students were ultimately eligible for the student financial assistance they received; however, not calculating pace correctly and not performing required SAP calculations at the end of each term increases the risk that students could receive financial assistance for which they are not eligible or be denied financial assistance for which they are eligible. Recommendations: The University should strengthen its controls to ensure that it: ? Correctly calculates students? COA budgets in accordance with its process and does not overaward financial assistance to students. ? Performs SAP calculations accurately and timely in accordance with its SAP policy. Views of Responsible Officials: The University of Texas at Dallas acknowledges and agrees with the Cost of Attendance and Satisfactory Academic Progress finding. The University has identified the cause of error and will work to further develop procedures to minimize potential for error and develop additional quality controls to identify errors if any should occur.

2020 ? 146 Special Tests and Provisions ? Enrollment Reporting Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P193234; and CFDA 84.268, Federal Direct Student Loans, P268K203234 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2019, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half-time basis for the period for which the loan was attended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Sections 685.309(b)). Enrollment reporting roster files must also include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12- 06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment level changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2019, Chapter 1 and Appendix C). The University of Texas at Dallas (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University?s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University?s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2019, Chapter 3). For 2 (3 percent) of 61 students tested, the University did not report the effective dates of enrollment level changes to NSLDS accurately. For one of those students, the effective date was incorrectly reported as the date the student?s academic plan was changed. For the other student, the effective date was incorrectly reported as the first day of the term instead of the date the student dropped to a half-time enrollment status. Those errors were due to manual errors the University made during its enrollment reporting process. In addition, the University?s monitoring process was not sufficient to identify those errors. Not reporting student status changes accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, repayment schedules, and whether a borrower will retain or lose the interest subsidy under the 150 percent subsidized Direct Loan limit. Recommendation: The University should strengthen its controls to ensure that enrollment level changes are reported to NSLDS accurately. Views of Responsible Officials: The University acknowledges and agrees with the enrollment reporting finding. Based on previous findings, the University is reporting more frequently to the NSLDS ensuring more accurate reporting. Due to the frequency of the reporting, the frequency of the accompanying manual review can offer the possibility of error.

2020 ? 147 Eligibility Federal Program Title: Student Financial Assistance Cluster Federal Agencies: U.S. Department of Education and U.S. Department of Health and Human Services Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194176; CFDA 84.033, Federal Work-Study Program, P033A194176; CFDA 84.063, Federal Pell Grant Program, P063P192338; CFDA 84.268, Federal Direct Student Loans, P268K202338; CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T202338; and CFDA 93.925, Scholarships for Health Professions Students from Disadvantaged Backgrounds, 5 T08HP30206-04-00, 5 T08HP30178-04-00, and 4 T08HP30184-04-01 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student?s cost of attendance (COA) minus their expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the ?tuition and fees normally assessed a student carrying the same academic workload as determined by the institution and including costs for rental or purchase of any equipment materials, or supplies required of all students in the same course of study.? An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For a term-based program, a student?s workload may include repeating any coursework previously taken in the program but may not include more than one repetition of a previously passed course (Title 34, CFR, Section 668.2(b)). For Title IV programs, the EFC is the amount a student and his/her family are expected to pay for educational expenses, and it is computed by the federal central processor and included on the student?s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student?s financial aid exceeds his/her need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student?s financial need (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). In determining whether a student is eligible for scholarships for health professions students from disadvantaged backgrounds, an institution must determine that the student has a financial need for the scholarship (Title 42, USC, Chapter 6A, Subchapter V, Part B, Section 293a(d)(2)). The University of Texas at El Paso (University) uses algorithmic budgeting to build COA budgets for each term based on a student?s classification (undergraduate or graduate); residency (in-state or out-of-state); academic program (certain programs have increased tuition costs); living status (on-campus, off-campus, or living with parents); and enrollment level (full-time, three-quarter-time, half-time, or less-than-half-time). Budgeting rules within the University?s student financial assistance system are established to assign various budget components based on the factors noted above. For 3 (5 percent) of 63 students tested, the University incorrectly calculated the COA. Specifically: ? For 1 student, the University did not calculate the budget component for tuition and fees based on the student?s actual enrollment (three-quarter-time) and did not include a budget component for miscellaneous personal expenses, for which the student was eligible. As a result, the student?s COA was understated by $2,456. ? For 1 student, the University incorrectly assigned a budget component for books and supplies based on full time enrollment; however, the student was enrolled for only half-time. As a result, the student?s COA was overstated by $436. ? For 1 student, the University incorrectly assigned a COA based on full-time enrollment; however, the student was eligible to receive student financial assistance only for three-quarter-time enrollment due to repeat coursework. The University overstated the student?s COA by $1,242; however, it appropriately awarded financial assistance to the student based on three-quarter-time enrollment. The errors discussed above occurred because of manual errors the University made when adjusting those students? COAs. Although those students? COAs were overstated or understated, the errors did not affect the amount of student financial assistance those students received. However, incorrectly calculating COA budgets increases the risk of overawarding or underawarding financial assistance to students. Recommendation: The University should strengthen its controls to ensure that it correctly calculates students? COA budgets in accordance with its process. Views of Responsible Officials: The University acknowledges the findings and recommendations. For all three students documented in the audit, the errors were caused by manual adjustments made to the student?s Cost of Attendance.

2020 ? 148 Special Tests and Provisions ? Verification Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194176; CFDA 84.033, Federal Work-Study Program, P033A194176; CFDA 84.063, Federal Pell Grant Program, P063P192338; CFDA 84.268, Federal Direct Student Loans, P268K202338; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T202338 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: Unknown For each applicant whose Free Application for Federal Student Aid (FAFSA) is selected for verification by the Secretary of the U.S. Department of Education, an institution must verify all of the applicable items, which include household size, number of household members who are in college, adjusted gross income (AGI), U.S. income taxes paid, education credits, individual retirement account deductions, high school completion, the student?s identity, and the student?s statement of educational purpose (Title 34, Code of Federal Regulations (CFR), Sections 668.54 and 668.56, and Federal Register, Volume 83, Number 60). When the verification of an applicant?s eligibility results in any change to a non-dollar item or a change to a single dollar item of $25 or more from the applicant?s FAFSA, the institution must submit a correction to the U.S. Department of Education and adjust the applicant?s subsidized financial aid awards on the basis of the expected family contribution (EFC) on the corrected Institutional Student Information Record (ISIR) (Title 34, CFR, Section 668.59). Household size for a dependent student includes (1) the student; (2) the student?s parents; (3) the student?s siblings and children, if they will receive more than half their support from the student?s parent(s) for the entire award year; and (4) other persons who live with and receive more than half their support from the student?s parent(s) and will receive more than half support for the entire award year. Household size for an independent student includes (1) the student; (2) his or her spouse; (3) the student?s children if they will receive more than half their support from the student for the entire award year; and (4) other persons who live with and receive more than half their support from the student and will receive more than half support for the entire award year. Number in college always includes (1) the student and (2) those in the household size who are or will be enrolled at least half time during the award year in a degree or certificate program at a Title IV-eligible school and who can reasonably be expected to receive aid from the family for their education (U.S. Department of Education, 2019- 2020 Federal Student Aid Handbook, Application and Verification Guide, Chapter 2). Acceptable documentation for verifying household size and the number of household members who are in college includes a statement signed by the applicant and, if the applicant is a dependent student, by one of the applicant?s parents that lists the name and age of each household member, the relationship of that household member to the applicant, and the name of the educational institution for each household member who is or will be attending at least half-time in a program that leads to a degree or certificate (Title 34, CFR, Sections 668.57(b) and (c); and Federal Register, Volume 83, Number 60). For 3 (5 percent) of 60 students tested, the University of Texas at El Paso (University) did not accurately verify certain required items on the FAFSA or update its records and request updated ISIRs as required. Specifically: ? For 1 student, the University did not accurately verify the student?s parent?s income taxes paid because of an error in translating taxes paid in a foreign currency. The University asserted that it identified that error and performed procedures in its student information system to correct the ISIR information and recalculate the student?s EFC. The University asserted that there was no effect on the student?s EFC or student financial assistance; however, it did not submit a correction to the U.S. Department of Education as required. ? For 2 students, the University did not accurately verify the number of household members who are in college. Those students certified the number of household members in college on the verification forms they submitted to the University. However, for one of those students, the University incorrectly removed the student?s sibling from the number in college. For the other student, the University did not update the student?s ISIR with the correct information as required. After auditors brought those errors to the University?s attention, it did not request updated ISIRs for those students because the deadline had passed for the University to submit corrections. As a result, auditors could not determine whether there was an effect on the students? EFCs or financial assistance awards. The University contracts with a third-party to perform its verification processing; however, the University?s monitoring of the contractor was not sufficient to detect those errors. Not properly verifying FAFSA information could result in the University overawarding or underawarding financial assistance. Recommendation: The University should strengthen its controls to ensure that it accurately verifies all required FAFSA information for students selected for verification. Views of Responsible Officials: The University acknowledges the findings and recommendations.

2020 ? 149 Special Tests and Provisions ? Return of Title IV Funds Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194176; CFDA 84.063, Federal Pell Grant Program, P063P192338; CFDA 84.268, Federal Direct Student Loans, P268K202338; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T202338 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student?s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on his/her behalf for the payment period or period of enrollment as of the student?s withdrawal date. Students earns 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on his/her behalf as of the date of the institution?s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The institution must return the lesser of the total amount of unearned Title IV assistance calculated above or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance not earned by the student (Title 34, CFR, Section 668.22(g)). A program is offered in modules if a course or courses in the program do not span the entire length of the payment period or period of enrollment (Title 34, CFR, Section 668.22(l)(6)). For all programs offered in modules, a student is considered to have withdrawn for Title IV purposes if the student ceases attendance in all courses at any point prior to completing the payment period or period of enrollment, unless the institution obtains written confirmation from the student at the time of the withdrawal that he or she will attend a module that begins later in the same payment period or period of enrollment (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 5, Chapter 2, page 5-66). In determining the percentage of the payment period or period of enrollment completed for a student who withdraws from a program offered in modules, an institution must (1) include all days within the period that the student was scheduled to complete prior to ceasing attendance and (2) exclude any scheduled breaks of at least five consecutive days when the student was not scheduled to attend a module or other course offered during that period of time. Scheduled breaks include both those that take place within and between modules (U.S. Department of Education, 2019-2020 Federal Student Aid Handbook, Volume 5, Chapter 2, page 5-75). An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution?s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). The University of Texas at El Paso (University) made errors in Title IV return calculations for 2 (3 percent) of 60 students tested. Specifically, the University incorrectly determined the number of days in the payment period because it included scheduled breaks of more than five consecutive days when the students were not scheduled to attend courses between modules. As a result, the University returned more Title IV funds than required for those students; therefore, there were no questioned costs. In addition, for 1 (2 percent) of 60 students tested who withdrew and required a return of Title IV funds, the University did not return the funds within the required time frame. Specifically, the University did not return Federal Direct Student Loan assistance to the U.S. Department of Education until 56 days after the student withdrew and did not return Federal Pell Grant assistance until 62 days after the student withdrew. Not making returns within the required time frames reduces the information available to the U.S. Department of Education for its program management. The University did not detect those errors because it did not have adequate monitoring controls to review its return calculations for accuracy or to ensure that funds were returned timely. Recommendations: The University should: ? Accurately determine the number of days in the payment period for students enrolled in modules and exclude any scheduled breaks as required. ? Strengthen its monitoring controls to ensure that it detects and corrects errors in return of Title IV calculations and returns funds within the required time frame. Views of Responsible Officials: The University acknowledges the findings and recommendations. The University offers accelerated courses (?parts of term?) that are not considered as part of a modular program. Although the courses are not modular, the Institution understands the need to exclude any breaks that are more than 5 days between the parts of term. Additionally, in the one-off situation in which the Registration and Records Office reported the student withdrawal late, which caused the Office of Student Financial Aid to return funds outside the regulatory time-frame, the University will address the importance of reporting all withdrawals in a timely manner with the Registration and Records Office.

2020 ? 150 Special Tests and Provisions ? Enrollment Reporting (Prior Audit Issues 2017-148 and 2016-146) Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award number: CFDA 84.063, Federal Pell Grant Program, P063P192338; and CFDA 84.268, Federal Direct Student Loans, P268K202338 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2019, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half-time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Sections 685.309(b)). Enrollment reporting roster files must also include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12- 06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment level changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2019, Chapter 1 and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, program begin date (which is the date the student first began attending the program being reported), and other data about the program (NSLDS Enrollment Reporting Guide, November 2019, Chapters 1 and 4). To protect a student?s interest subsidy, institutions are required to report a graduated status for students who have completed their course of study (NSLDS Enrollment Reporting Guide, Chapter 4 and Appendix C). For instances in which a student completes one academic program and then enrolls in another academic program at the same institution, the institution must report two separate enrollment transactions: one showing the completion of the first program and its effective date and credential level, and the other showing the enrollment in the second program and its effective date (Dear Colleague Letter, March 30, 2012 (GEN-12-06)). The University of Texas at El Paso (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University?s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University?s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2019, Chapter 3). For 8 (13 percent) of 61 students tested, the University did not report enrollment status changes or did not accurately report program-level data elements to NSLDS. Specifically: ? For 5 students, the University did not report a graduated status to NSLDS. For 4 of those students, the University reported those statuses to NSC; however, due to issues with the student?s CIP code or because the student enrolled in another academic program for the subsequent term, those statuses were not reported from NSC to NSLDS. For 1 of those students, the University did not report the graduated status to NSC until auditors identified the error. ? For 3 students, the University incorrectly reported the program begin date. Specifically, the University did not report the date the students actually began attending the program being reported. The errors discussed above occurred because the University did not have a process to ensure that student enrollment and program information was accurately reported to NSC and NSLDS. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, repayments schedules, and whether a borrower will retain or lose the interest subsidy under the 150 percent subsidized Direct Loan limit. Recommendations: The University should: ? Strengthen its controls to ensure that program-level data elements are reported to NSLDS accurately. ? Ensure that graduated statuses are reported to NSLDS in a timely manner. Views of Responsible Officials: The University?s Enrollment Reporting falls under the responsibility of the Registration and Records Office. The University will continue to strengthen its controls and monitor program-level data elements and graduation status processes to remain in compliance with Federal Enrollment Reporting regulations.

2020 ? 151 Special Tests and Provisions ? Enrollment Reporting Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P192296; and CFDA 84.268, Federal Direct Student Loans, P268K202296 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2019, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half-time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files must also include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2), and Dear Colleague Letter, March 30, 2012 (GEN-12- 06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment level changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2019, Chapter 1 and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective (NSLDS Enrollment Reporting Guide, November 2019, Chapters 1 and 4). Institutions may not be immediately aware of a student?s enrollment status change when it happens. When the institution does become aware of such a change, it must report the status change using the actual enrollment status effective date, not the date when the institution became aware of the change (NSLDS Enrollment Reporting Guide, November 2019, Chapter 4, and U.S. Department of Education Electronic Announcement, NSLDS Enrollment Reporting - Submission Dates, Effective Dates and Certification Dates, April 20, 2017). The University of Texas Rio Grande Valley (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University?s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University?s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2019, Chapter 3). For 12 (20 percent) of 60 students tested, the University did not accurately report campus-level or program-level data elements to NSLDS or did not report enrollment statuses in a timely manner. Specifically: ? For 7 students, the enrollment status effective date was reported incorrectly at both the campus- and program-levels. The date reported for those enrollment level changes was the date when the University processed the student?s drop request, rather than the actual effective date of the enrollment status change. The dates reported for those 7 students ranged from 1 to 29 days after the actual effective date of the enrollment level change. Those errors were caused by issues related to the configuration of the enrollment reporting processes in the University?s student information system. Specifically, the system is configured to report the date when a change is processed rather than the actual effective date. ? For 2 students, the enrollment effective date was reported accurately to NSLDS at the campus-level; however, a different enrollment effective date was inaccurately reported at the program-level for the same enrollment status. As noted above, those errors were caused by issues related to the configuration of the enrollment reporting processes in the University?s student information system. ? For 3 students, a withdrawal status was not reported to NSLDS within 60 days of the date the University determined that the student unofficially withdrew from the Spring 2020 term. The University?s process is to (1) identify the last date of attendance for students who unofficially withdraw from the term during the end of term grade processing and (2) manually update the student?s record on the NSLDS website. However, the unofficial withdrawal status was not reported for those three students due to a staff oversight. After auditors notified the University about the oversight, the University reported the status changes to NSLDS, but that reporting was done 79 days after the University determined the students? date of withdrawal. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, repayment schedules, and whether a borrower will retain or lose the interest subsidy under the 150 percent subsidized Direct Loan limit. Recommendations: The University should: ? Strengthen its controls to ensure that campus-level and program-level data elements are reported to NSLDS accurately. ? Ensure that students who unofficially withdrew from a term are reported to NSLDS in a timely manner. Views of Responsible Officials: UTRGV acknowledges and concurs with the audit finding and is in the process of strengthening existing policies and procedures to address and correct each of the recommendations listed above. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 152 Activities Allowed or Unallowed Allowable Costs/Cost Principles Federal Program Title: Education Stabilization Fund Federal Agency: U.S. Department of Education Award years: See below Award numbers: See below Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned costs: $0 See Schedule of Findings and Questioned Costs for chart/table Direct Costs Allowable costs charged to federal programs must (1) be necessary and reasonble; (2) conform to any limitations or exclusions set forth in the cost principles or in the federal award; (3) be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-federal entity; (4) be accorded consistent treatment; (5) be determined in accordance with generally accepted accounting principles, (6) not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program; and (7) be adequately documented (Title 2, Code of Federal Regulations (CFR), Section 200.403). Section 18004(c) of the Coronavirus Aid, Relief, and Economic Security (CARES) Act allows recipients to use up to 50 percent of the funds received for the Institutional Portion of the Higher Education Emergency Relief Fund (HEERF) award to cover any costs associated with significant changes to the delivery of instruction due to the coronavirus so long as such costs do not include payment (1) to contractors for the provision of pre-enrollment recruitment activities, (2) to endowments, or (3) for capital outlays associated with facilities related to athletics, sectarian instruction, or religious worship. Section 18004(a)(2) of the CARES Act allows recipients to use funds received for the Minority Serving Institutions portion of the HEERF award under that section to defray expenses incurred by the recipient, including lost revenue, reimbursement for expenses already incurred, technology costs associated with a transition to distance education, faculty and staff trainings, and payroll (Public Law 116-136). The University of Texas Rio Grande Valley (University) did not ensure that all costs charged to its Higher Education Emergency Relief Fund (HEERF) awards were allowable. Specifically, for 2 (3 percent) of 61 non payroll expenditures tested, the University expended $1,836 on floor mats and live streaming software that were not related to the University?s response to the coronavirus. In addition, for 3 (5 percent) of 60 payroll expenditures tested, the University allocated payroll expenditures totaling $5,232 for unallowable activities. While the University?s review and approval process identified those costs as unallowable, the University recorded the expenditures in its financial system as a result of staff oversight. After auditors brought those errors to the University?s attention, it transferred those expenditures to an institutional account and reversed the associated indirect costs; therefore, there were no questioned costs. After correcting those errors, the University performed a self-review and identified and corrected other unallowable non-payroll expenditures totaling $3,972 and payroll expenditures totaling $4,495. Indirect Costs Indirect costs are incurred for common or joint objectives and, therefore, cannot be identified readily and specifically with a particular sponsored project, an instructional activity, or any other institutional activity. Indirect costs shall be distributed to applicable federal awards on the basis of modified total direct costs, consisting of all salaries and wages, fringe benefits, materials and supplies, services, travel, and up to the first $25,000 of each subaward. Modified total direct costs excludes equipment, capital expenditures, charges for patient care, rental costs, tuition remission, scholarships and fellowships, and participant support costs, as well as the portion of each subaward in excess of $25,000 (Title 2, CFR, Part 200, Section 200.68 and Appendix III). For 2 (20 percent) of 10 indirect cost charges tested, the University included unallowable costs in the direct cost base it used to calculate the indirect cost charge. Specifically, the University included a capital equipment expense of $10,710 and a rental cost expense of $2,170 in the direct cost base. As a result, the University overcharged $2,872 in indirect costs for those two charges tested. After auditors brought those errors to the University?s attention, the University removed those expenses from the direct cost base and reversed the $2,872 in indirect costs; therefore, there were no questioned costs. Recommendations: The University should: ? Strengthen its review and approval process to ensure that only allowable costs are charged to federal awards. ? Use the correct modified total direct cost base to calculate indirect cost charges. Views of Responsible Officials: The University of Texas Rio Grande Valley (UTRGV) concurs with the recommendations to strengthen reviews of expenditures charged to federal awards, including using the correct modified total direct cost base to calculate indirect cost charges.

2020 ? 153 Cash Management Federal Program Title: Education Stabilization Fund Federal Agency: U.S. Department of Education Award years: See below Award numbers: See below Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned costs: Unknown See Schedule of Findings and Questioned Costs for chart/table Cash Draws For non-federal entities, payments methods must minimize the time between the transfer of funds from the United States Treasury and the disbursement of those funds by the non-federal entity. Advance payments to a non federal entity must be limited to the minimum amounts needed and be timed to be in accordance with the actual, immediate cash requirements of the non-federal entity in carrying out the purpose of the approved program or project. The timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the non-federal entity for any direct program or project costs and the proportionate share of any allowable indirect costs (Title 2, Code of Federal Regulations (CFR), Section 200.305(b)). The University of Texas Rio Grande Valley (University) did not minimize the time between transfer of funds from the U.S. Treasury and the disbursement of those funds. The University drew down its full allocation of Higher Education Emergency Relief Fund (HEERF) awards upon authorization from the U.S. Department of Education; however, it did not have actual or immediate cash requirements at the time it drew down those funds. Specifically: ? For the HEERF Student Portion, the University drew down $17,167,129 on April 28, 2020; however, it had expended only approximately $476,000 at the time of the draw. As of the end of the fiscal year (August 31, 2020), the University still had not expended approximately $4.5 million of those funds. ? For the HEERF Institutional Portion, the University drew down $17,167,129 on May 11, 2020; however, it did not begin expending those funds until 42 days later. As of the end of the fiscal year (August 31, 2020), the University still had not expended approximately $10 million of those funds. ? For the HEERF Minority Serving Institutions Portion, the University drew down $2,425,833 on June 2, 2020; however, it did not begin expending those funds until 20 days later. The University expended all of those funds as of the end of the fiscal year (August 31, 2020). The University had established policies and procedures for managing federal funds and for requesting and documenting cash draws; however, it did not follow those procedures when it drew down its HEERF awards. Interest on Advances A non-federal entity must maintain advances of federal funds in interest-bearing accounts unless: (1) the non federal entity receives less than $120,000 in federal awards per year, (2) the best reasonably available interest bearing account would not be expected to earn interest in excess of $500 per year on federal cash balances, or (3) the depository would require an average or minimum balance so high that it would not be feasible within the expected federal and non-federal cash resources (Title 2, CFR, Section 200.305(b)(8)). Interest earned up to $500 per year may be retained by the non-federal entity for administrative expense. Any additional interest earned on federal advance payments deposited in interest-bearing accounts must be remitted annually to the U.S. Department of Health and Human Services Payment Management System (Title 2, CFR, Section 200.305(b)(9)). The University did not identify, track, or remit to the U.S. Department of Health and Human Services interest it earned on federal funds received in advance of program expenses for fiscal year 2020. The University did not maintain its advances of HEERF funds, as described above, in interest-bearing accounts. As a result, auditors were unable to determine the amount of interest that it would have been required to remit, if any, to the federal government for fiscal year 2020. Recommendations: The University should: ? Return unexpended funds to the U.S. Department of Education. ? Follow its established cash management policies and procedures when requesting cash draws for all federal funds. ? Maintain advances of federal funds in interest-bearing accounts. Views of Responsible Officials: UTRGV concurs with the recommendations of returning unexpended funds to the U.S. Department of Education, following our established cash management policies and procedures when requesting cash draws for all federal funds, and maintaining advances of federal funds in interest-bearing accounts.

2020 ? 154 Period of Performance Federal Program Title: Education Stabilization Fund Federal Agency: U.S. Department of Education Award years: See below Award numbers: See below Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned costs: $0 See Schedule of Findings and Questioned Costs for chart/table A recipient may charge to a federal award only allowable costs incurred during the period of performance and any costs incurred before the federal award that were authorized by the federal awarding agency or pass-through entity (Title 2, Code of Federal Regulations (CFR), Section 200.309). Pre-award costs are those incurred prior to the effective date of the federal award or subaward directly pursuant to the negotiation and in anticipation of the federal award for which such costs are necessary for efficient and timely performance of the scope of work. Such costs are allowable only to the extent that they would have been allowable if incurred after the date of the federal award and only with the written approval of the federal awarding agency (Title 2, CFR, 200.458). Pre-award costs incurred on or after March 13, 2020, the date of the Proclamation of National Emergency, are approved per the Recipient?s Funding Certification and Agreement for the Institutional Portion of the Higher Education Emergency Relief Fund (HEERF), as well as for the Minority Serving Institutions portion of the funding (Public Law 116-136). The University of Texas Rio Grande Valley (University) did not ensure that all costs charged to its HEERF awards were incurred within the period of performance. Specifically, for 10 (16 percent) of 61 expenditures tested, the University incurred the costs between March 4, 2020, and March 12, 2020, before the date of the Proclamation of National Emergency. Those expenditures and associated indirect costs totaled $14,853. The University?s review process was not sufficient to identify those errors. After auditors brought those errors to the University?s attention, the University transferred those expenditures to an institutional account and reversed the associated indirect costs; therefore, there were no questioned costs. In addition, based on an analysis of the full population of the University?s HEERF expenditures, auditors identified 15 additional expenditures and associated indirect costs that were incurred prior to March 13, 2020, totaling $34,684. However, the University independently identified and corrected those errors in October 2020 prior to being notified by the auditors. Recommendation: The University should ensure that all costs it charges to federal awards are incurred within the period of performance. Views of Responsible Officials: UTRGV concurs with the recommendation that all costs charged to federal awards be incurred within the period of performance.

2020 ? 155 Special Tests and Provisions ? Disbursements to or on Behalf of Students Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019 to June 30, 2020 Award numbers: CFDA 84.063, Federal Pell Grant Program, P063P193294; CFDA 84.268, Federal Direct Student Loans, P268K203294; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T203294 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $0 Disbursement Notification Letters If an institution credits a student?s ledger account with Teacher Education Assistance for College and Higher Education (TEACH) Grants, the institution must notify the student of (1) the anticipated date and amount of the disbursement, (2) the student?s right to cancel all or a portion of that grant and have the grant proceeds returned to the U.S. Department of Education, and (3) the procedures and time by which the student must notify the institution that he/she wishes to cancel the grant or grant disbursement. The institution must provide the notice in writing no earlier than 30 days before, and no later than 30 days after, crediting the student?s ledger account at the institution (Title 34, Code of Federal Regulations (CFR), Section 668.165). For 1 (2 percent) of 43 disbursements tested, the University of Texas at San Antonio (University) did not send a disbursement notification letter within the required time frame. For that student, the University sent the disbursement notification letter 46 days after crediting the student?s ledger account with TEACH Grant funds. That error occurred because of an issue related to the configuration of the University?s automated process for sending TEACH Grant disbursement notification letters to students during the Fall 2019 academic term. Based on an analysis of TEACH Grant disbursements made for the Fall 2019 term, this issue affected a total of 84 disbursements. The University identified and corrected the problem, and disbursement notification letters were sent to students. However, those letters were sent between 40 and 46 days after the initial disbursements were made for the term. Receiving disbursement notification letters late impairs students? ability to cancel their grants. Transfer Monitoring If a student transfers from one institution to another institution during the same award year, the institution to which the student transfers must request from the Secretary of the U.S. Department of Education, through the National Student Loan Data System (NSLDS), updated information about that student so that it can make certain eligibility determinations. The institution may not make a disbursement to that student for seven days following its request, unless it (1) receives the information from NSLDS in response to its request or obtains that information directly by accessing NSLDS and (2) the information it receives allows it to make the disbursement (Title 34, CFR, Section 668.19). For 2 (67 percent) of 3 transfer students tested, the University disbursed funds without first reviewing the students? financial assistance history from NSLDS. Both students were admitted to the University for the Spring 2020 term. The University received the application for student financial assistance for those two students in January 2020; however, the University had already performed its transfer monitoring process for the Spring 2020 term in December 2019 and did not perform it again after that date. The University did not overaward student financial assistance as a result of those two errors; however, not reviewing the financial assistance history from NSLDS prior to disbursing funds increases the risk that the University could overaward financial assistance to students. Recommendations: The University should strengthen its controls to ensure that it: ? Sends disbursement notifications within the required time frame. ? Reviews the financial assistance history from NSLDS for all transfer students prior to disbursing funds. Views of Responsible Officials: TEACH Grant The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes. Transfer Monitoring The University acknowledges the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

2020 ? 156 Special Tests and Provisions ? Return of Title IV Funds Federal Program Title: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Award year: July 1, 2019, to June 30, 2020 Award numbers: CFDA 84.007, Federal Supplemental Educational Opportunity Grants, P007A194169; CFDA 84.063, Federal Pell Grant Program, P063P193294; CFDA 84.268, Federal Direct Student Loans, P268K203294; and CFDA 84.379, Teacher Education Assistance for College and Higher Education Grants, P379T203294 Statistically valid sample: No and not intended to be a statistically valid sample Type of finding: Significant Deficiency and Noncompliance Questioned Costs: $971 When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student?s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV assistance earned by the student is less than the amount that was disbursed to the student or on his or her behalf as of the date of the institution?s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). If the total amount of calculated Title IV grant or loan assistance, or both, that a student earned is greater than the total amount of Title IV grant or loan assistance, or both, that was disbursed to the student, as of the date of the institution?s determination that the student withdrew, the difference between those amounts must be treated as a post-withdrawal disbursement in accordance with Title 34, CFR, Section 668.164(j) (Title 34, CFR, Section 668.22(a)(5)). For 2 (3 percent) of 61 students tested, the University of Texas at San Antonio (University) did not perform the required Title IV return calculations. Specifically: ? For 1 student, the University did not identify that the student unofficially withdrew from the Fall 2019 term. That error occurred because of a manual error the University made during its process for determining unofficial withdrawals for the term. After auditors brought the issue to the University?s attention, it performed the return calculation and returned Title IV funds as required; therefore, there were no questioned costs. ? For 1 student, the University incorrectly disbursed Title IV assistance for a term in which the student withdrew. Because the student had not completed all of the University?s requirements to receive aid, the student had not received Title IV assistance at the time of withdrawal. As a result, the University did not perform a return calculation. When the student completed those requirements, the University incorrectly disbursed Title IV assistance to the student for the term in which the student withdrew, rather than completing a return calculation to determine whether the student was eligible for a post-withdrawal disbursement. As a result, the University disbursed $971 associated with CFDA 84.063, Federal Pell Grant Program, award number P063P193294 more than the student was eligible to receive based on the percentage of the term the student completed. The University did not have sufficient monitoring controls to identify all students requiring a Title IV return calculation. In addition, the University did not have controls to prevent its student information system from disbursing Title IV assistance to withdrawn students. Recommendations: The University should: ? Strengthen its controls to ensure that it identifies withdrawn students and performs return of Title IV calculations when required. ? Develop and implement controls to prevent its student information system from disbursing Title IV assistance to withdrawn students prior to performing a return of Title IV funds calculation. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Reference No. 2019-001 Allowable Costs/Cost Principles Cash Management Food Distribution Cluster Award years ? October 1, 2017 to September 30, 2018, July 1, 2018 to September 30, 2018, October 1, 2018 to September 30, 2019, and June 1, 2019 to September 30, 2019 Award numbers ? 6TX430816, 6TX801816, 6TX810817, and 6TX810877 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.303, Texas Department of Agriculture (TDA) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. TDA uses Active Directory to grant network access to TDA personnel. TDA utilizes Personnel, Accounting, Timekeeping, Human Resource System (PATHS) to process time and effort reporting under 2 CFR 200.430. TDA utilizes Contracts, Awards Management, and Procurement System (CAMPS) for procurement of vendors and approval of the associated payments on the resulting contracts, including subrecipients. Additionally, TDA utilizes TXUNPS Pentaho as a reporting tool to assist in federal reporting requirements. 1) As part of TDA?s internal controls procedures, periodic user access reviews are required to be completed for Active Directory, PATHS and CAMPS applications in order to ensure that access granted to TDA personnel are consistent with their respective job description. During fiscal year 2019, user reviews were not performed for Active Directory, PATHS, and CAMPS applications. User access reviews should include reviewing users with privilege access, ensuring all active service accounts (i.e., non-employee accounts) have a required business purpose, verifying that users are assigned to security groups or roles based on their existing job description, and ensuring that accounts no longer required are adequately removed. 2) In fiscal year 2019, two (2) terminated users had access to requesting coding changes to the CAMPS application after termination. Access to coding changes allows users to request changes to configurations or program functionalities. The two users had not logged in subsequent to their date of termination, which mitigated the risk of inappropriate access, and access for these accounts was removed on September 24, 2019. Additionally, one (1) terminated user had access to Active Directory after termination. The user was terminated on November 30, 2019; however, the request to remove access to Active Directory was not submitted until December 13, 2019. The user had not logged in subsequent to their date of termination, which mitigated the risk of inappropriate access. An effective mechanism should be in place to ensure that access is appropriately removed when an employee is terminated. Without an effective termination control, the risk of unauthorized access to programs and data is increased. 3) For the TXUNPS Pentaho application, TDA maintained a shared administrative account. Administrative accounts allow a user to add users, remove users, as well as make report configuration changes. Shared administrative accounts limit the effectiveness of audit logs in identifying the origination of changes to access or report configurations. Each administrator should have a unique administrative account in order to monitor changes made to the application. Without unique administrative accounts, the risk of unauthorized changes to report configurations or user access is increased. No questioned costs were noted with regard to allowable costs/cost principles or cash management as a result of the issues noted above. Recommendation: TDA should enforce its policies and procedures in place to ensure user access reviews are performed and documented on a periodic basis. This review should entail verifying that privilege access, service accounts, and employee access are restricted to authorized personnel in accordance with their respective job description. Regarding terminated users, TDA should immediately remove a user?s access upon termination. Additionally, regarding shared administrative accounts, TDA should revise its policies and procedures to eliminate shared administrative accounts. A unique account should exist for each administrator and TDA should continue to perform reviews of audit logs to ensure inappropriate changes are not made to report configurations. Views of Responsible Officials: TDA management agrees with the concept that system controls are necessary. The TDA ISO, IT and Program staff will continue to follow and adhere to all posted agency policies and procedures as they pertain to ?Quarterly Security Access Reviews? for all in-scope agency applications.

Reference No. 2019-002 Allowable Costs/Cost Principles Cash Management Eligibility Special Tests and Provisions ? Accountability for USDA Foods Food Distribution Cluster Award years ? October 1, 2017 to September 30, 2018, July 1, 2018 to September 30, 2018, October 1, 2018 to September 30, 2019, and June 1, 2019 to September 30, 2019 Award numbers ? 6TX430816, 6TX801816, 6TX810817, and 6TX810877 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.303, the Texas Department of Agriculture (TDA) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. TDA utilizes TXUNPS, a web application that allows TDA personnel and subrecipients to submit and approve documents. TXUNPS manages information regarding subrecipient contracts, entitlement, inventory, orders, and other Food Distribution Cluster (FDC) functions. Specific functions of TXUNPS include submitting and tracking commodity orders, viewing or declining commodity allocations, viewing invoices, and submitting and maintaining annual commodity contract packets and contract entitlements. TDA currently outsources the hosting, maintenance, and enhancement over TXUNPS to a third-party service organization. The third-party service organization does not currently provide a Service Organization Controls 1(SOC 1) Type 2 report. SOC 1 Type 2 reports validate the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process TDA?s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. TDA also outsources their primary data backup services to a third party cloud service provider. During fiscal year 2019, management received the following SOC reports from this provider: a) SOC 1 Type 2 report, which validates the suitability of design and operating effectiveness of internal controls over financial reporting. b) System and Organization Controls 2 (SOC 2) Type 2 report, which reports on controls at the service organization relevant to security, availability, and confidentiality principles. Both reports noted above provided an unqualified opinion, which signifies that the service provider?s controls are designed and operating effectively. However, the report also specifies that certain control objectives can only be met if complementary user entity controls at TDA are suitably designed and operating effectively. These user entity controls have been outlined within the respective reports. We determined that no formal documentation has been maintained to validate TDA?s compliance with the identified complementary user entity controls. No questioned costs were noted with regard to allowable costs/cost principles, cash management, or eligibility as a result of the issues noted above. Recommendation: TDA should ensure that they obtain and review SOC reports for each of their third party vendors that provide services over critical applications in order to evaluate whether they can rely on the third party?s overall control structure. In addition, TDA should review and test the complementary user entity controls included in each SOC report and document the results of those procedures. Views of Responsible Officials: TDA management agrees with the concept that system controls are necessary. We have process and procedures in place, but we will refine those procedures to incorporate a formal review of the SOC reports and strengthen our related complementary controls.

Reference No. 2019-003 Allowable Costs/Cost Principles (Prior Audit Issues ? 2018-002, 2017-005, and 2016-008) Medicaid Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1905TXINCT, 1905TXIMPL, 1905TX5MAP, 1905TX5ADM, 1805TXINCT, 1805TXIMPL, 1805TX5MAP, and 1805TX5ADM TANF Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1901TXTANF, 1901TXTAN3, 1801TXTANF, and 1801TXTAN3 CCDF Cluster Award years ? October 1, 2018 to September 30, 2021, October 1, 2017 to September 30, 2020, October 1, 2016 to September 30, 2019, and October 1, 2015 to September 30, 2018 Award numbers ? G1901TXCCDF, G1801TXCCDF, G1701TXCCDF, and G1601TXCCDF Non-Major Programs: 93.090 ? Guardianship Assistance 93.658 ? Foster Care ? Title IV ? E 93.659 ? Adoption Assistance Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency and Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.303, Department of Family and Protective Services (DFPS) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. DFPS?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either monthly or quarterly depending on the Project ID. There are approximately 20 Project IDs. Control procedures are in place to review these reallocation entries. During fiscal year 2019, reallocations were done through December of 2018 for recording in the general ledger. Monthly reconciliations were completed through June 2019, and posted through a top-side entry. However, reallocations required for projects reallocations for the months of July and August were not completed. And as of January 2020, reallocations were not complete. As such, the amount of questioned costs was unable to be determined. DFPS has determined that this delay for completing the final reallocations timely is related to current year changes to the process implemented for automated data collection procedures in preparing the reallocation rates. Recommendation: DFPS should continue to improve the timeliness of reallocations to ensure the amounts included in the Schedule of Federal Expenditures meet 2 CFR 200.303. Views of Responsible Officials: In October 2019, DFPS observed a declining number of children in the ?reasonable candidates for foster care? case count methodology. This was attributed to an issue identified with the IMPACT system. As a result, reallocation for Q4 could not be completed until this issue was resolved. A correction to the system was implemented in late December 2019. The data warehouse refresh was completed in February 2020, allowing DFPS to move forward with Q4 reallocation using the new counts.

Reference No. 2019-004 Eligibility (Prior Audit Issues ? 2018-003, 2017-006, 2016-010, and 2015-008) TANF Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1901TXTANF, 1901TXTAN3, 1801TXTANF, and 1801TXTAN3 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency and Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.303, Department of Family and Protective Services (DFPS) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Per the TANF State Plan, DFPS provides any service the State previously was authorized to use IV-A or IV-F funds under prior law, as in effect on September 30, 1995 and as clarified by the State's 1997 plan amendment. This includes the TANF Emergency Assistance (EA) program. Per the Texas Administrative Code, Title 40, Part 19, Chapter 700, Subchapter Z, Rule ?700.2703: (a) The Department of Family and Protective Services (DFPS) or its authorized designee determines eligibility of a child and/or his family for Title IV-A Emergency Services if all of the following criteria are met: (1) An emergency exists, as defined in subsection (b) of this section. (2) The family applies for care and services available in emergency situations, or DFPS or its authorized designee applies on behalf of a child whose parents are unavailable or unwilling to apply. (3) The child has lived with a relative at sometime within the six-month period prior to application. (4) The emergency arose for a reason other than an adult family member's refusal to accept employment without good cause. (5) The applicant, child, or family declares annual income of less than $63,000. (b) An emergency exists when DFPS: (1) Determines that a child is at risk; (2) Has removed a child from the child's home and placed the child in its care; or (3) Determines that a child formerly in its care is at risk of being returned to that care. There are no automated controls to require recertification of EA recipients in Information Management Protecting Adults and Children in Texas (IMPACT), DFPS?s eligibility system. The process of gathering information related to EA eligibility is done in conjunction with the case investigation process. Information, including the reason for an emergency and income levels, is determined based on the caseworker?s interviews with the family and child. This information is input into IMPACT to determine eligibility. IMPACT?s automated controls to determine if the child is EA eligible were found to be effective, including the assignment of service codes that determine monthly payment amounts. Only the information that the caseworker considers necessary to support the conclusions regarding eligibility is included in IMPACT as case notes. A supervisor within Child Protective Services will then review and approve the entire case for placement. Of the 65 cases sampled, one instance was noted where the supervisor approval was not received until after the participant was determined to be eligible to receive benefit payments. Of the 65 cases sampled, there was one instance where the Emergency Assistance application within IMPACT was not used; however, assistance was provided. Recommendation: DFPS should continue to enhance the automation between authorization of participant eligibility and the applications within IMPACT that determine eligibility. These automations should also apply for recertification and exits from the applicable programs. Additionally, DFPS should ensure that appropriate documentation related to cases is maintained. Views of Responsible Officials: DFPS will continue to work in enhancing the automation with the applications within IMPACT for eligibility.

Health and Human Services Commission / Department of Family and Protective Services Reference No. 2019-005 Allowable Costs/Cost Principles (Prior Audit Issues ? 2018-026 and 2017-025) CFDA 10.557 ? WIC Special Supplemental Nutrition Program for Women, Infants, and Children Award years ? October 1, 2018 to September 30, 2019, October 1, 2017 to September 30, 2019, October 1, 2017 to September 30, 2018, January 1, 2017 to September 30, 2018, and January 1, 2016 to September 30, 2018 Award numbers ? 6TX700507 and 6TX700527 Medicaid Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1905TXINCT, 1905TXIMPL, 1905TX5MAP, 1905TX5ADM, 1805TXINCT, 1805TXIMPL, 1805TX5MAP, and 1805TX5ADM SNAP Cluster Award years ? October 1, 2018 to September 30, 2019, October 1, 2017 to September 30, 2018, and October 1, 2016 to September 30, 2018 Award numbers ? 6TX430165, 6TX400106, 6TX400105, and 6TX430176 TANF Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1901TXTANF, 1901TXTAN3, 1801TXTANF, and 1801TXTAN3 Non-Major Programs: 84.181 ? Special Education-Grants for Infants and Families 93.917 ? HIV Care Formula Grants 93.958 ? Block Grants for Community Mental Health Services 97.050 ? Presidential Declared Disaster Assistance to Individuals and Households ? other Needs Aging Cluster Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. HHSC has their own instance of the Centralized Accounting and Payroll/Personnel System ? Financials (CAPPS Financials). CAPPS Financials is the HHSC accounting system of record. This system is responsible for financial-related transaction processing that occurs for the entire Enterprise, encompassing the Accounts Payables, General Ledger, Asset Management and Purchasing functions for administrative and client services related to provider payments. CAPPS Financials personnel provide system support, including development changes. CAPPS Financials is an Oracle PeopleSoft application. Based on our review, we determined CAPPS Financials developers have the ability to migrate PeopleSoft objects into the production environment, which creates a segregation of duties conflict since developers should not have the ability to migrate their own code changes into production. The process of performing migrations utilizing PeopleSoft may require that tables be built in the subsequent environments, and to perform this function the migrator must log into PeopleSoft Application Designer to build the scripts to run against the database. The ability to perform this function requires the same level of access as a developer, which impedes the ability to segregate a PeopleSoft migrator from a developer. The STAT workflow process utilized to migrate code changes into production does not have the functionality to ensure the migrator and developer are different individuals. While a procedure is outlined in a memo instruction to developers to not migrate their own changes into production, there are no detective controls in place to ensure this procedure is adhered to. Based on our review of CAPPS Financials privileged access, we determined one (1) individual with Data Base Administrator (DBA) access had a last logon date of August 31, 2017. The individual was terminated on January 26, 2018 and the CAPPS Financials access was locked on October 10, 2019. Privileged accounts pose an increased risk since they have the ability to directly access and change data. The risk of unauthorized access is increased when an account is not timely locked when a user is terminated. Recommendation: Change Management HHSC should consider implementing a detective control to monitor code migration to ensure developers are not migrating their own changes to production. User Access HHSC should timely lock accounts at the application layer to prevent unauthorized access Views of Responsible Officials: Agree

Reference No. 2019-006 Allowable Costs/Cost Principles Matching, Level of Effort, Earmarking (Prior Audit Issues ? 2018-005, 2017-009, and 2016-024) CFDA 10.557 ? WIC Special Supplemental Nutrition Program for Women, Infants, and Children Award years ? October 1, 2018 to September 30, 2019, October 1, 2017 to September 30, 2019, October 1, 2017 to September 30, 2018, January 1, 2017 to September 30, 2018, and January 1, 2016 to September 30, 2018 Award numbers ? 6TX700507 and 6TX700527 CFDA 93.767 ? Children?s Health Insurance Program (CHIP) Award years ? October 1, 2018 to September 30, 2020 and October 1, 2016 to September 30, 2018 Award numbers ? 1905TX5021 and 1705TX0301 CFDA 93.791 ? Money Follows the Person Rebalancing Demonstration Award year ? January 1, 2007 to September 30, 2020 Award number ? 1LICMS300151 Medicaid Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1905TXINCT, 1905TXIMPL, 1905TX5MAP, 1905TX5ADM, 1805TXINCT, 1805TXIMPL, 1805TX5MAP, and 1805TX5ADM SNAP Cluster Award years ? October 1, 2018 to September 30, 2019, October 1, 2017 to September 30, 2018, and October 1, 2016 to September 30, 2018 Award numbers ? 6TX430165, 6TX400106, 6TX400105, and 6TX430176 TANF Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1901TXTANF, 1901TXTAN3, 1801TXTANF, and 1801TXTAN3 CCDF Cluster Award years ? October 1, 2018 to September 30, 2021, October 1, 2017 to September 30, 2020, October 1, 2016 to September 30, 2019, and October 1, 2015 to September 30, 2018 Award numbers ? G1901TXCCDF, G1801TXCCDF, G1701TXCCDF, and G1601TXCCDF Non-Major Programs: 10.578 ? WIC Grants to States (WGS) 10.579 ? Child Nutrition Discretionary Availability 84.126 ? Rehabilitation Services Vocational Rehabilitation Grants to States 84.181 ? Special Education-Grants for Infants and Families 93.052 ? National Family Caregiver Support, Title III, Part E 93.071 ? Medicare Enrollment Assistance Program 93.104 ? Comprehensive Community Mental Health Services for Children with Serious Emotional Disturbances 93.150 ? Projects for Assistance in Transition from Homelessness (PATH) 93.235 ? Title V State Sexual Risk Avoidance Education (Title V State SRAE) Program 93.243 ? Substance Abuse and Mental Health Services Projects of Regional and National Significance 93.296 ? State Partnership Grant Program to Improve Minority Health 93.658 ? Foster Care Title IV-E 93.667 ? Social Services Block Grant 93.671 ? Family Violence Prevention and Services/Domestic Violence Shelter and Supportive Services 93.752 ? Cancer Prevention and Control Programs for State, Territorial and Tribal Organizations financed in part by Prevention and Public Health Funds 93.788 ? Opioid STR 93.796 ? State Survey Certification of Health Care Providers and Suppliers (Title XIX) Medicaid 93.829 ? Section 223 Demonstration Programs to Improve Community Mental Health Services 93.898 ? Cancer Prevention and Control Programs for State, Territorial and Tribal Organizations 93.958 ? Block Grants for Community Mental Health Services 93.959 ? Block Grants for Prevention and Treatment of Substance Abuse 93.994 ? Maternal and Child Health Services Block Grant to the States SSI Cluster Aging Cluster Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency and Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. HHSC?s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. During testing over the application of the 2019 PACAP, the following items were noted: ? The PACAP does not include all department codes that HHSC is using to charge items. One department was not included in the PACAP and could not be tied to an allocation method. ? The PACAP contains department IDs that are allocated using two different Project IDs/allocation factors. Two departments were listed to two different allocation factors and determined to be allocated using one of the two indicated allocation methods. ? As changes occur in business operations, the Department can update the information in PACAP and adjust what allocation factor is used for different groups of costs. During 2019, one department ID was updated in the PACAP, but did not complete the process to be updated in the CAPPS system, resulting in the department being charged according to the incorrect allocation factor. ? The PACAP also summarizes whether current or historical statistics will be used in each allocation method. In application, one of the factors tested used both current and prior month?s metrics. ? The PACAP includes allocation methods that are dependent on other allocation methods. One of the allocations tested was based on factors that are no longer included in the PACAP, due to updates to the plan. ? The PACAP summaries the funding sources, including state general revenue and federal programs, which will be used by each allocation method. There are two federal program funding sources which, for budget reasons, are not being charged to the federal programs; rather, they are being charged to the State General Revenue in lieu of those programs. ? The estimates that are used for each project ID are not subject to review periodically and are only being adjusted for the new grant years and adjusted FMAP rates. HHSC is required to pay part of the costs of providing health care to the poor and part of the costs of administering the program. Different State participation rates apply to medical assistance payments. The Federal Medical Assistance Percentage (FMAP) is updated in each allocation method in CAPPS FIN, the book of record, annually based on the Federal Register Circular. The FMAP is effective on October 1 of each year. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2019, when the costs for the months of July and August 2018 were allocated using the federal fiscal year 2018 FMAP rates, when they were reallocated during federal fiscal year 2019. Recommendation: HHSC should review and update the cost allocation plan to ensure that the PACAP accurately describes how costs will be allocated between the federal programs and the state. HHSC should also document how the PACAP will be applied, including how the FMAP will be applied to transactions and reallocations. Views of Responsible Officials: HHSC acknowledges and agrees with the finding.

Reference No. 2019-007 Allowable Costs/Cost Principles CFDA 93.767 ? Children?s Health Insurance Program (CHIP) Award years ? October 1, 2018 to September 30, 2020 and October 1, 2016 to September 30, 2018 Award numbers ? 1905TX5021 and 1705TX0301 CFDA 93.791 ? Money Follows the Person Rebalancing Demonstration Award year ? January 1, 2007 to September 30, 2020 Award number ? 1LICMS300151 Medicaid Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1905TXINCT, 1905TXIMPL, 1905TX5MAP, 1905TX5ADM, 1805TXINCT, 1805TXIMPL, 1805TX5MAP, and 1805TX5ADM SNAP Cluster Award years ? October 1, 2018 to September 30, 2019, October 1, 2017 to September 30, 2018, and October 1, 2016 to September 30, 2018 Award numbers ? 6TX430165, 6TX400106, 6TX400105, and 6TX430176 TANF Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1901TXTANF, 1901TXTAN3, 1801TXTANF, and 1801TXTAN3 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. HHSC oversees the operations of the Health and Human Services system, provides administrative oversight of Texas Health and Human Services programs, and provides direct administration of some programs, such as Medicaid, Children's Health Insurance Program (CHIP), Temporary Assistance for Needy Families (TANF), and SNAP Food Benefits and Nutritional Programs. To determine eligibility for these programs, HHSC uses the Texas Integrated Eligibility Redesign System (TIERS). Based on HHSC?s policy, user access reviews are to be performed on a periodic basis. We determined a review was performed in May 2019 and during the review, a user with privileged access was identified to be removed. However, the user?s access was not removed until October 16, 2019 after it was brought to management?s attention. Upon further investigation, we noted that the last logon date for this account was November 8, 2008. We also identified another privileged account that had not been utilized since January 21, 2010. This particular account was removed on November 6, 2019 after it was brought to management?s attention. There was a third privileged account which did not appear to be assigned to an individual. The account was removed on October 16, 2019. A qualitative user review should include monitoring of last logon activity to identify accounts which are not being used. Title 1, Part 10, Texas Administrative Code (TAC), Chapter 202, Rule ?202.24 Agency Information Security Program requires that all state agencies have an information security program consistent with the rules defined in the TAC 202. The Texas Health and Human Services (HHS) Circular C-021 establishes the Information Security Program for HHSC, which is promulgated within the HHS Information Security ? Information Security Controls document. One of the policies addresses minimum password age, which is utilized to prevent users from reverting to their old password immediately after an enforced password change. The policy indicates the minimum password age should have a value of one (1) day. We determined that TIERS had a minimum password age value of zero (0), which is not in compliance with the password policy. Recommendation: User Access HHSC should ensure user access reviews include monitoring of last logon activity to identify accounts which are not being used and to reduce the risk of unauthorized access. Authentication HHSC should periodically review system password policy configurations to ensure they are in compliance with the HHS Information Security ? Information Security Controls. Views of Responsible Officials: Agree

Reference No. 2019-008 Allowable Costs/Cost Principles CFDA 10.557 ? WIC Special Supplemental Nutrition Program for Women, Infants, and Children Award years ? October 1, 2018 to September 30, 2019, October 1, 2017 to September 30, 2019, October 1, 2017 to September 30, 2018, January 1, 2017 to September 30, 2018, and January 1, 2016 to September 30, 2018 Award numbers ? 6TX700507 and 6TX700527 TANF Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1901TXTANF, 1901TXTAN3, 1801TXTANF, and 1801TXTAN3 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency and Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.430(i-vii), the Department of Human and Health Services Commission must ensure that charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) be incorporated into the official records of the non-Federal entity; (iii) reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities (for IHE, this per the IHE?s definition of IBS); (iv) encompass both federally assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity?s written policy; (v) comply with established accounting policies and practices of the non-Federal entity; and (vii) support the distribution of the employee?s salary or wages among specific activities or cost objectives if the employee works on more than one Federal award, a Federal award and non-Federal award, an indirect cost activity and a direct cost activity, two or more indirect activities which are allocated using different allocation bases, or an unallowable activity and a direct or indirect cost activity. The process in place for verification of the employee pay towards a federal grant includes the use of the Financial Services CFO System hosted by the HHS Enterprise Portal in FSS-CFO to certify employee time on a semiannual basis. During testing of TANF Cluster for one out of 13 selections, the time and effort was not certified. The individual who was not certified was due to an IT system error. During testing of CFDA #10.557, for six out of 40 selections, the time and effort was not certified. Certification was missed as the project id used to identify an individual?s time was a temporary id that was not linked with the certification system. Therefore, these individuals for this time period were not certified until inquired through the audit. Recommendation: HHSC should implement procedures to ensure certification of time and effort. These procedures should include a monthly or quarterly review of time and effort reports to ensure all are signed. Views of Responsible Officials: The HHSC Chief Financial Officer Area agrees with the IT system error noted and that time and effort not initial paid with a sole source are not certified in the FSS-CFO system but instead certified via the agency?s expenditure transfer process as corrections.

Health and Human Services Commission / Department of State Health Services Reference No. 2019-009 Procurement and Suspension and Debarment (Prior Audit Issues ? 2018-007, 2017-023, 2016-026, and 2015-024) CFDA 10.557 ? WIC Special Supplemental Nutrition Program for Women, Infants, and Children Award years ? October 1, 2018 to September 30, 2019, October 1, 2017 to September 30, 2019, October 1, 2017 to September 30, 2018, January 1, 2017 to September 30, 2018, and January 1, 2016 to September 30, 2018 Award numbers ? 6TX700507 and 6TX700527 CFDA 93.074 ? Hospital Preparedness Program (HPP) and Public Health Emergency Preparedness (PHEP) Aligned Cooperative Agreements Award years ? July 1, 2017 to June 30, 2020 Award numbers - NU90TP921879 CFDA 93.791 ? Money Follows the Person Rebalancing Demonstration Award year ? January 1, 2007 to September 30, 2020 Award number ? 1LICMS300151 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Material Weakness and Material Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR Section 200.317, States and governmental subrecipients of States, will use the same State policies and procedures used for procurements from non-Federal funds. They also must ensure that every purchase order or other contract includes any clauses required by Federal statutes and executive orders and their implementing regulations. Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. An open market solicitation is used to purchase a good or service by soliciting from any available source. The open market solicitation procedure is authorized by Texas Government Code ?2155.062(a) (3) and 2156.061. Open market informal solicitations can be used for procurements of commodities or services greater than $5,000 but not greater than $25,000. Open Market Formal Solicitation is used for agency-administered open market purchases of services greater than $25,000 and for commodities if delegated by Texas Comptroller or through statutory authority specific to an agency. Per the HHSC Procurement Manual, for small purchases ($5,000 or less excluding IT purchases) competition is not required; however, HHSC?s PCS Division does require contact with at least one Historically Underutilized Business (HUB) vendor to provide them with an opportunity to quote. HHSC PCS conducts procurement activities for all HHSC agencies, resulting in a purchase order, contract, or other agreement for the requesting agency. Following the procurement process, HHSC agency staff are responsible for subsequent contract management and monitoring activities. Per Texas Government Code 531.0055, for each health and human services system agency or division, the operational authority and responsibility for the contracting, purchasing, and related policies rests with HHSC?s Procurement and Contracting Services (PCS). In addition, all procurement functions are performed by HHSC PCS on behalf of the Department of State Health Services. Audit procedures included a review of procurement files related to 15 WIC purchases, 5 Money Follows the Person Rebalancing Demonstration purchases, and 12 HPP & PHEP purchases. Results of test work are as follows: WIC ? 1 out of 15 procurement files were coded to the wrong PCC code. PO amounts were approximately $27,266. No questioned costs as documentation error only. ? 1 out of 15 procurement files did not contain evidence that a TCI search was performed. Contract amount was approximately $248,525. Money Follows the Person Rebalancing Demonstration ? 3 out of 5 procurement files reviewed were later determined to be subrecipient contracts. The PO amounts were approximately $1,163,710. No questioned cost as these were coded to the wrong general ledger account. Hospital Preparedness Program (HPP) and Public Health Emergency Preparedness (PHEP) Aligned Cooperative Agreements ? 3 out of 12 procurement files did not contain evidence that a TCI search was performed. PO amounts were approximately $74,726. Recommendation: We recommend that HHSC PCS continue to provide training to employees, including supervisors and management, to ensure compliance of internal procedures, Texas Government Code, and federal regulations. HHSC PCS should implement effective controls that include a review and approval process to address the significant elements of the procurement process. HHSC PCS should review their current checklists and procurement tools to determine if revision is necessary to further facilitate compliance with State and Federal regulations. Also, automated controls should be considered to ensure segregation of duties between initiation of procurement activities and buying activities. Views of Responsible Officials: Health and Human Services Commission (HHSC) agrees with the finding and has fully implemented a corrective action plan to address the recommendations.

Reference No. 2019-010 Special Tests and Provisions ? Compliance Investigations of High-Risk Vendors (Prior Audit Issue ? 2018-009) CFDA 10.557 ? WIC Special Supplemental Nutrition Program for Women, Infants, and Children Award years ? October 1, 2018 to September 30, 2019, October 1, 2017 to September 30, 2019, October 1, 2017 to September 30, 2018, January 1, 2017 to September 30, 2018, and January 1, 2016 to September 30, 2018 Award numbers ? 6TX700507 and 6TX700527 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency See Schedule of Findings and Questioned Costs for chart/table A State agency operating a retail food delivery system must conduct compliance investigations. These investigations consist of inventory audits and/or compliance buys, on a minimum of 5 percent of the vendors authorized as of October 1 of each year. Farmers are not included in this requirement. A State agency must conduct compliance investigations on its high-risk vendors up to the 5% minimum. High-risk vendors are identified at least once annually, using criteria developed by FNS and/or other statistically based criteria developed by the State agency and approved by FNS. If the number of high-risk vendors exceeds 5% of the total, then the State agency must prioritize vendors for investigative purposes based on their potential for noncompliance and/or loss. If the number of high-risk vendors falls short of 5% of the total, the State agency must randomly select enough additional vendors to meet the 5% requirement. When a compliance investigation discloses vendor violations, the State agency must take appropriate action against the vendor. Such action includes delaying payment or establishing a claim if a violation affects payment to the vendor; imposing sanctions mandated by program regulations for certain stated violations; and imposing other, less severe sanctions prescribed by the State agency?s sanction schedule for lesser violations (7 CFR sections 246.2 (definitions of ?compliance buy,? ?high-risk vendor,? and ?inventory audit?), 246.12(j)(4)(i) through (iii), 246.12(k)(2) through (4), and 246.12(l)(1) and (2)). Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. HHSC performs compliance buys and invoice audits in each given fiscal year for high risk vendors selected from the risk assessment. The inspector performing the audit summarizes the results provided to the WIC Vendor Monitoring Manager for review. The summary results are reviewed in detail by the Women, Infants, and Children (WIC) Vendor Monitoring Manager for consistency with the supporting data prior to the vendor being notified. During our testing, 4 out of 4 samples reviewed did not have formal documentations of review documented. Per WIIC/VMO - Compliance Oversight Branch - Procedures, the Compliance Oversight Branch (COB) Manager or Vendor Management Operations (VMO) Director sign off with approval for Inspector General Vendor Management Unit (IG VMU) to continue the process. The signed document is saved to the shared drive and the IG VMU staff is notified via email. The Program is not following or updating its policy to reflect the current review process. Recommendation: We recommend that HHSC revise its policy or continue to assist the Programs by providing training to employees, including supervisory-level employees, to ensure compliance with Program policy and federal regulations. Views of Responsible Officials: HHSC concurs that the policy needs to be updated to reflect the current review process.

Reference No. 2019-011 Equipment/Real Property Management CFDA 10.557 ? WIC Special Supplemental Nutrition Program for Women, Infants, and Children Award years ? October 1, 2018 to September 30, 2019, October 1, 2017 to September 30, 2019, October 1, 2017 to September 30, 2018, January 1, 2017 to September 30, 2018, and January 1, 2016 to September 30, 2018 Award numbers ? 6TX700507 and 6TX700527 CFDA 93.791 ? Money Follows the Person Rebalancing Demonstration Award year ? January 1, 2007 to September 30, 2020 Award number ? 1LICMS300151 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency and Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per Texas Government Code Title 4. Subchapter L, Sec. 403.273. (g), ?At all times, the property records of a state agency must accurately reflect the property possessed by the agency. Property may be deleted from the agency's records only in accordance with rules adopted by the comptroller.? According to SPA Process User?s Guide - Chapter 2 - General Policies - Records Retention, ?The Texas State Records Retention Schedule requires agencies to maintain property records for the life of the asset and for a period not less than three fiscal years after the disposal of property. Property records should include any paymentrelated source documentation (i.e., invoices, payment vouchers, receipts, etc.) necessary to substantiate the value of the asset. When applicable, agencies must adhere to the federal rules and regulations for retention of records for property purchased with federal grants or funds. Where federal guidelines and state guidelines apply, the greater required time period for records retention applies. If a state agency fails to keep the records, the Comptroller?s office may refuse to draw warrants or initiate electronic funds transfers on behalf of the agency.? Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Per SPA Process User's Guide - Chapter 2 - General Policies - Policy and Contacts, ?Per Government Code, Section 403.271, each state agency (and university choosing to report to SPA) is responsible for ensuring that its fiscal year-end capitalized asset balance(s) reflected in SPA are accurate and materially correct?. According to SPA Process User?s Guide - Chapter 6 - Deleting Property and Funds - Disposal method 15, ?Property must be in a disposal method 5c before it can be updated to disposal method 15?. During our testing, we noted the following: ? 1 out of 40 samples does not have the correct asset description per the invoice. ? 17 out of 40 samples did not maintain disposal record. ? 8 out of 40 samples were not disposed timely ? 6 out of 40 samples did not utilize disposal method 5c before utilized disposal method 15 per the SPA Manual. Recommendation: We recommend that HHSC continue to providing training to employees, including supervisory-level employees, to ensure compliance with State policy and federal regulations. Views of Responsible Officials: Agreement

Reference No. 2019-012 Special Tests and Provisions ? EBT Reconciliation (Prior Audit Issue ? 2018-015) SNAP Cluster Award years ? October 1, 2018 to September 30, 2019, October 1, 2017 to September 30, 2018, and October 1, 2016 to September 30, 2018 Award numbers ? 6TX430165, 6TX400106, 6TX400105, and 6TX430176 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency and Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. The SNAP Cluster is an entitlement program with standard eligibility and benefits. The benefits each household receives are used to purchase food at authorized retail stores. States issue benefits in the form of debit cards, which recipients can use to purchase food. This is known as electronic benefits transfer (EBT). The State?s EBT contractor is responsible for settlement, or payment, to retailers that have accepted EBT cards for food purchases. The contractor?s ?concentrator bank? makes the payment through the National Automated Clearing House (ACH) system. The concentrator bank is reimbursed for the payments by a draw made on the State?s EBT benefit account with the U.S. Treasury. The State is responsible for reconciling the payments made to retailers by its EBT contractor with the amounts drawn from its EBT account with the U.S. Treasury. Per the Compliance Supplement, Texas must obtain a system and organization controls for service organization examination report (SOC 1) by an independent auditor of the State EBT service providers (service organization) regarding the issuance, redemption, and settlement of benefits under SNAP. States must have systems in place to reconcile all of the funds entering into, exiting from, and remaining in the system each day with the State?s benefit account with Treasury and EBT contractor records (7 CFR sections 274.3(a)(1) and 274.4(a)). Also, the State is required to maintain adequate security over, and documentation/records for, EBT cards, to prevent their theft, embezzlement, loss, damage, destruction, unauthorized transfer, negotiation, or use (7 CFR section 274.8(b)(3)). HHSC is responsible for determining eligibility of the SNAP recipients and validating amounts paid to the retailers by performing daily reconciliations between the EBT system and the Automated Standard Application for Payments (ASAP) and Account Management Agent (AMA) maintained by the US Treasury. No compliance exceptions were noted with regard to eligibility or the daily EBT reconciliations to cash. EBT Reconciliations to Eligible Recipients HHSC must have systems in place to reconcile all of the funds entering into, exiting from, and remaining in the system each day with the State?s Treasury benefit account and EBT contractor records. This includes a reconciliation of the State?s issuance files of posting to recipient accounts with the EBT contract. HHSC must also have systems in place to reconcile retailer credit activity as reported into the banking system to client transactions maintained by the processor and to the funds drawn down from the EBT benefit account with Treasury (7 CFR section 274.4(a)). HHSC utilizes the Texas Integrated Eligibility Reporting System (TIERS) for determining eligibility for SNAP. However, there were no reconciliations from the EBT system to TIERS performed during fiscal year 2018 to fulfill the requirement to reconcile to client transactions maintained by the processor (i.e., eligible recipients utilized the EBT card benefits). No compliance exceptions were noted with regard to eligibility. Recommendation: HHSC should perform reconciliations from the EBT system to TIERS to fulfill the requirement to reconcile retailer credit activity as reported into the banking system to client transaction. Views of Responsible Officials: HHSC agrees with the finding related to EBT system to TIERS client benefit issuance reconciliation. TIERS benefit issuance requests are sent to EBT via automated interface and EBT returns an acknowledgement for each record. Records that do not match generate issuance exceptions which are reconciled on a daily basis. Additionally, HHSC has processes in place to reconcile benefits issued in TIERS and EBT on a daily basis through issuance summary reports with the EBT vendor. HHSC will strengthen existing processes by adding a reconciliation of benefit issuance summaries between EBT and TIERS on a monthly basis.

Reference No. 2019-013 Allowable Costs/Cost Principles CFDA 93.767 ? Children?s Health Insurance Program (CHIP) Award years ? October 1, 2018 to September 30, 2020 and October 1, 2016 to September 30, 2018 Award numbers ? 1905TX5021 and 1705TX0301 Medicaid Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1905TXINCT, 1905TXIMPL, 1905TX5MAP, 1905TX5ADM, 1805TXINCT, 1805TXIMPL, 1805TX5MAP, and 1805TX5ADM Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Material Weakness and Material Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. HHSC utilizes various service providers to perform system processing and other functions on behalf of HHSC. One service provider is Accenture State Healthcare Services, LLC (Accenture), who commenced the full responsibility for operations of the Texas Medicaid Claims Administration System on August 1, 2014 to provide services to the State of Texas (State) and the State?s Medicaid clients and providers. Prior to August 2014, Accenture performed only the information technology services to support the maintenance and operation of the Medicaid Claims Administration System as part of a team referred to as the Texas Medicaid & Healthcare Partnership (TMHP). Another service provider is Conduent State Healthcare, LLC (Conduent), who began processing outpatient pharmacy claims through the Medicaid/Children?s Health Insurance Program (CHIP) Vendor Drug Program?s point-of-sale pharmacy claim system starting in 2010. They now perform services related to the pharmacy claims processing system and managing the rebate administration functions for the HHSC Vendor Drug Program (VDP). The Medicaid Vendor Drug Program processes prescription drug claims for: Medicaid, Children with Special Health Care Needs (CSHCN) Services Program, and the Kidney Health Care (KHC) program. The Vendor Drug Program provides services for nearly 5,000 Texas pharmacies. Service providers annually provide a System and Organization Controls (SOC) Report. The report from a Certified Public Accounting (CPA) firm provides their opinion on the fairness of the presentation of the description and the suitability of the design and operating effectiveness of the controls to achieve the control objectives stated in the description, based on the firm?s examination. Based on our review, we noted a qualified opinion was issued by the CPA firm for the Accenture SOC report. A qualified opinion effectively means one or more controls were not designed and/or operating effectively. For Accenture, the qualified opinion was due to a developer having access to production, which is a segregation of duties conflict. Our review of the Conduent SOC report noted that, while their CPA firm issued an unqualified opinion (meaning in the CPA firm?s opinion the controls appear to be designed and operating effectively), Conduent had a similar segregation of duties conflict of a developer having access to production. Conduent also had numerous other exceptions. Outsourcing services does not relinquish an organization from the responsibility of ensuring an effective control environment is in place and operating effectively. In order to obtain assurance that service providers have a sound control environment, it is important to thoroughly review provided SOC reports and determine any operational risks associated with the noted control exceptions. We determined the HHSC Contract Administration & Provider Monitoring group does perform a review of the SOC reports and, when warranted, follow-up with the service providers based on the exceptions identified. However, we did note there are no documented procedures in place to ensure consistency of the review process, which is especially beneficial when there is staff turnover. Recommendation: We recommend management document their process for reviewing service provider?s SOC reports. Items to consider include assessing the service auditor?s opinion, identified control exceptions and the service provider's response, complementary user entity controls, and reliance on subservice providers. Views of Responsible Officials: CAPM agrees with the finding.

Reference No. 2019-014 Special Tests and Provisions ? ADP Risk Analysis and System Security Review (Prior Audit Issues ? 2018-023, 2017-015, 2016-020, and 2015-021) Medicaid Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1905TXINCT, 1905TXIMPL, 1905TX5MAP, 1905TX5ADM, 1805TXINCT, 1805TXIMPL, 1805TX5MAP, and 1805TX5ADM Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency and Non-Compliance See Schedule of Findings and Questioned Costs for chart/table State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. SysCat, HHSC?s enterprise-wide repository for approved HHS systems, is HHSC?s book of record of all information technology (IT) systems, including both in-house and third party systems. During 2018, HHSC worked to consolidate the list by linking subsystems to the parent system, resulting in 83 Medicaid related systems. HHSC refreshed the Information Security Controls Guide and completed standardizing security assessment templates for both in-house and third party systems. Additional templates were developed to track potential deficiencies and resolution. The deficiencies and resolutions are tracked in a centralized database and a review is conducted to close any open recommendations. During fiscal year 2018, 19 risk assessments were executed based on internal methodology or third party assessments. In fiscal year 2019, an additional 12 risk assessments were completed. Noncompliance is due to HHSC not performing risk assessments over all 83 systems in a two-year period. Recommendation: HHSC should ensure all systems are reviewed in a two year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two year period, including resolution of remediation items. Views of Responsible Officials: CAPM agrees with and has as of December 2019 fully complied with the Acute Care Recommendation.

Reference No. 2019-015 Special Tests and Provisions ? Provider Health and Safety Standards (Prior Audit Issues ? 2018-020, 2017-016, 2016-021, 2015-026, 2014-015, and 2013-017) Medicaid Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1905TXINCT, 1905TXIMPL, 1905TX5MAP, 1905TX5ADM, 1805TXINCT, 1805TXIMPL, 1805TX5MAP, and 1805TX5ADM Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency and Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per 42 CFR part 442, providers must meet the prescribed health and safety standards for hospitals, nursing facilities, and ICF/MR. The standards may be modified in the State plan. Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Acute Care An out-of-state (OOS) provider may come into the program based on several different circumstances, including: (1) the client being sent out of state for services that are not readily available in Texas; and (2) border states where it is the norm for clients to receive a service in that border state. Under current HHSC procedures, HHSC requires OOS providers to fill out the same application as an in-state provider. OOS providers are to receive a letter that tells them that their enrollment is limited and informing them of the amount of time that has been granted. Effective June 18, 2018, the Termination Notification Database (CMS Medicaid Termination File and the CMS Medicare for Cause Revocations File) was combined into one file titled the Averse Action File. As directed by HHSC, TMHP implemented a project (deploying end of January 2019) to perform monthly post-enrollment data matches against the Adverse Actions file in order to identify TMHP-enrolled providers, including their owner and managing employees, who Texas is required to take termination action against, to include out of state providers. Although the service organization utilizes Medicare enrollment as a prerequisite for the provider adhering to standards, the monitoring protocol was not finalized until December 2019 to check on the providers Medicare numbers to ensure that they are current and up to date. Recommendation: Acute Care The implementation date of the new monitoring protocol for OOS providers was outside of fiscal year 2019. HHSC should continue performing monthly checks on all providers to ensure that they are not excluded or prohibited from participation in Medicaid through contract requirement and validate that the contractor is fulfilling its requirements through the Functional Requirement review. Views of Responsible Officials: Agree

Reference No. 2019-016 Matching, Level of Effort, Earmarking CFDA 93.767 ? Children?s Health Insurance Program (CHIP) Award years ? October 1, 2018 to September 30, 2020 and October 1, 2016 to September 30, 2018 Award numbers ? 1905TX5021 and 1705TX0301 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Per the 2018 Compliance Supplement, expenditures not directly related to providing child health insurance assistance under the plan are limited to 10% of the state?s total expenditures through CHIP. In prior years, HHSC Budget staff were monitoring compliance with this requirement through a series of calculations. In fiscal year 2019, this calculation was not being performed to review compliance. No compliance issues were noted during the recalculation of the requirements. Recommendation: HHSC should ensure that the controls over earmarking requirements are being followed to ensure that any future changes to the program funding will not result in noncompliance. Views of Responsible Officials: Concurs with the finding.

Reference No. 2019-017 Eligibility CFDA 93.791 ? Money Follows the Person Rebalancing Demonstration Award years ? January 1, 2007 to September 30, 2020 Award number ? 1LICMS300151 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Material Weakness and Material Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.303, Health and Human Services Commission (HHSC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. The Money Follows the Person Demonstration (MFPD) was implemented to eliminate barriers and enable Medicaid-eligible individuals to transition from nursing facilities (NF) to the community and receive necessary long term services and supports (LTSS) in the setting of the individual's choice. Individuals can participate in the program through the STAR+ program and through the Home and Community Based Services (HCS) program. To be eligible for MFPD, the individual must meet eligibility criteria that requires the individual to: ? reside continuously in an institutional setting for at least 90 days prior to the eligibility date and be enrolled from a Medicaid certified nursing facility (NF); ? be Medicaid eligible under Title XIX of the Social Security Act; ? be transitioning* from a NF into a qualified residence that includes: o a home owned or leased by the individual or individual's family member; o an apartment with an individual lease that includes living, sleeping, bathing, and cooking areas in which the individual/or family member has domain; o Assisted Living (AL) apartment (service code 19); o Residential Care apartment (service code 19A); and o Adult Foster Care (AFC) home (no more than four unrelated individuals living in the home); ? agree to participate in the MFPD by completing Form 1580, Texas Money Follows the Person Demonstration Project Informed Consent for Participation, signed by the individual or authorized representative (AR) and MCO staff after explanation of MFPD and prior to delivery of services.*The MCO must include the AR in the actual transition planning, if applicable. HHSC has outsourced the eligibility determination for the STAR+ program and the HCS program to Managed Care Organizations (MCO) and Local Intellectual and Developmental Disability Authorities (LIDDA). During our testing, we noted the following: ? Out of 40 individuals determined eligible by MCOs/LIDDAs, HHSC did not retain or receive Form 1580 for 6 individuals. ? HHSC did not retain or receive documentation showing that the MCO/LIDDAs screened the case for eligibility for the MFPD program for 2 out of 40 cases. ? 1 out of 40 participants reviewed stayed in the program more than 365-days entitlement period. ? 1 out of 40 participants reviewed did not stay in a qualified institutions for 90 days or more. ? 14 out of 40 participants reviewed were not eligible for MFPD. ? 40 out of 40 samples selected did not have a monitoring process in place to ensure if the MCO/service coordinator determined eligibility correctly. Recommendation: We recommend the Program to maintain effective internal controls, implement monitoring procedures, and provide training to staff to ensure proper record retention in order to comply with applicable procedures and federal regulations. Views of Responsible Officials: In accordance with The Centers for Medicare and Medicaid (CMS) approved Sustainability Plan, Texas ended MFPD enrollment December 31, 2017, with the entitlement period continuing for the following 12 months. MFPD was modeled after the Texas Promoting Independence initiative, the state?s model to transition people from institutional services to community settings. Texas implemented MFPD with sustainability in mind, using its own waiver structure. Over the course of the project, functions such as informed consent and verifying eligibility for the demonstration were transferred through contract changes to the entities performing service coordination or transition planning. The contracts are to be monitored by the specific HHSC division issuing the contract. The informed consent form was used to obtain permission to be in the national evaluation. During the evaluation, DADS/HHSC monitored those closely each month. The evaluation ended in September 2017. The consent form also identified unique demonstration services. Those services were incorporated into the service array and are now available to anyone who transitions from an institution to STAR+PLUS HCBS or HCS. Verifying MFPD eligibility continues to be important. For people in HCS, the LIDDAs were required to determine eligibility. For members enrolled in STAR+PLUS HCBS, the MCOs check eligibility, the PSU is required to verify eligibility before entering the MFPS code.

Reference No. 2019-018 Allowable Costs/Cost Principles TANF Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1901TXTANF, 1901TXTAN3, 1801TXTANF, and 1801TXTAN3 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency and Non-Compliance See Schedule of Findings and Questioned Costs for chart/table According to ?200.303 Internal Controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Beginning September 1, 2017, HHSC utilizes version 9.2 of PeopleSoft?s General Ledger (referred to at HHSC as CAPPS FIN) as a financial management application. HHSC relies on information produced from CAPPS FIN to comply with various aspects of compliance requirements, including Allowable Costs/Cost Principles. Specific to the Department, each voucher is reviewed and approved prior to the payment being made.The item noted below appeared to no have been reviewed appropriately. During our testing, we noted the following: ? 1 out of 9 invoices coded the incorrect department ID, resulting in the expense being drawn off the incorrect grant and, therefore, resulting in an over payment by the federal grant awards involved. Recommendation: We recommend the Department implements procedures to ensure compliance with federal Allowable Costs/Cost Principles regulation. Views of Responsible Officials: The prosecuting authority?s payment voucher was divided between the two programs involved in the beneficiary prosecution case (Medicaid and the Supplemental Nutrition Assistance Program). However, the wrong budget code (the one assigned with TANF) was associated with the Medicaid portion of the invoice allocation.

Reference No. 2019-019 Eligibility TANF Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1901TXTANF, 1901TXTAN3, 1801TXTANF, and 1801TXTAN3 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency and Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per policy in the Texas Works Handbook, Part A, Section 2110, caretakers, second parents, payees, and disqualified adults are required to sign form H1073, the Personal Responsibility Agreement (PRA), in order to receive TANF benefits. Per Texas Works Handbook, Part A, Section 1600, school attendance by the dependent children is required. Staff must verify school attendance at application, if school is in session, and at each complete review. Staff must document their verification source and the date they verified school attendance. Out of 40 TANF cases sampled: ? One case did not have a Personal Responsibility Agreement (PRA) on file. A signed PRA is required at initial application and at redeterminations. ? One case did not have school verification on file. School attendance must be verified for children receiving TANF benefits at initial application and at redeterminations. A signed PRA was either not obtained or not retained electronically in TIERS as it should be. School attendance was not verified, or the verification procedures were not documented in TIERS as it should be. Recommendation: When a case worker is verifying all components of eligibility are documented to begin issuing benefits or to recertify benefits for another period, they should check to see that a signed PRA and verified school attendance exists in the recipient's case in TIERS. Views of Responsible Officials: HHSC agrees with the finding. After a thorough review of both cases, HHSC determined the PRA was likely obtained, but not imaged for document retention. The client demonstrates knowledge of the requirements by complying with all requirements over the past three years. The case missing the school attendance verification was completed while school in the Houston Independent School District was not in session for Spring Break and the eligibility advisor followed policy in place for summer breaks.

Reference No. 2019-020 Special Tests and Provisions ? Child Support Non-Cooperation TANF Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1901TXTANF, 1901TXTAN3, 1801TXTANF, and 1801TXTAN3 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency and Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per policy in the Texas Works Handbook, Part B, Section 810, households are entitled to restored benefits when HHSC makes an error in the household?s amount of benefits and the household was not at fault. Per policy in Texas Works Handbook, Part A, Section 2146 case workers should apply sanctions received from the OAG Child Support Division within five workdays. Per policy in the Texas Works Handbook, Part B, Section 700, staff must file an overpayment referral when a household receives benefits the household is not entitled to receive. Out of 40 TANF cases sampled: ? One case did not receive benefits for a month in which they should have. The case had been sanctioned for non-cooperation, but it was later determined that the sanction was imposed in error. Upon removal of the sanction, the case should have received the benefit amount for the month they were sanctioned. TIERS did not automatically issue this corrective benefit and no manual issuance was processed for the case. ? One case received benefits for a month in which they were not eligible. The case was sanctioned for noncooperation, but the sanction was not input into TIERS timely, resulting in the case receiving an additional month of benefits. Additionally, recoupment for that benefit amount was not pursued. ? One case received benefits for months in which they were not eligible. The sanction was not worked timely or properly by a case worker, resulting in the case receiving eight months of benefits erroneously. Additionally, recoupment for those benefit amounts was not pursued. Policy in the Texas Works Handbook was not followed in all three cases by the workers who dealt with the cases. Recommendation: Upon removal of an improper sanction, the worker should check to see if benefits need to be issued to the client for missed months, and should begin that process. Sanction requests should be worked timely per policy to ensure clients don?t receive benefits for ineligible months. The case worker should check to see if recoupment needs to be pursued for benefit amounts when they are imposing a sanction on a case. Views of Responsible Officials: HHSC agrees with the finding.

Reference No. 2019-021 Special Tests and Provisions ? Penalty for Refusal to Work TANF Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1901TXTANF, 1901TXTAN3, 1801TXTANF, and 1801TXTAN3 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency and Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per policy in the Texas Works Handbook, Part A, Section 2146, case workers should apply sanctions received from Choices within five workdays. Per policy in the Texas Works Handbook, Part B, Section 700, staff must file an overpayment referral when a household receives benefits the household is not entitled to receive. Out of 40 TANF cases sampled, two cases received benefits for a month in which they were not eligible. The cases were sanctioned by Texas Workforce Commission (TWC) Choices program for non-cooperation. The sanction was worked untimely resulting in an additional month of benefits being issued. Additionally, recoupment for the benefit amounts was not pursued. In the first case, the sanction from Choices was transmitted in a bundle with several other items. This bundle was not addressed by a worker for 32 days, at which point the sanction was imposed on the recipient. Due to the sanction not being imposed for over a month, TIERS issued benefits for the month in which the recipient should have begun receiving nothing. In the second case, Choices transmitted a sanction that exceptioned out due to the case being in complete action mode. This exception was not addressed and a second sanction request was sent a month later, which also exceptioned out. These exceptions were not worked until two months from the first sanction request. Due to untimely action, TIERS issued benefits for the month in which the recipient should have begun receiving nothing. Recommendation: Bundles received should be reviewed by a case worker timely to check for time-sensitive items that require action, such as sanctions. Those items should then be addressed in a timely manner. Exception reports should be addressed timely by workers to ensure time-sensitive items get addressed appropriately. Views of Responsible Officials: HHSC agrees with the finding.

Reference No. 2019-022 Reporting Special Tests and Provisions ? Penalty for Failure to Comply with Work Verification Plan TANF Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1901TXTANF, 1901TXTAN3, 1801TXTANF, and 1801TXTAN3 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency and Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 265.7, each State's quarterly reports (the TANF Data Report, the TANF Financial Report (or Territorial Financial Report), and the SSP-MOE Data Report) must be complete and accurate and filed by the due date. For an aggregated data report, ?a complete and accurate report? means that: (1) The reported data accurately reflect information available to the State in case records, financial records, and automated data systems; (2) The data are free from computational errors and are internally consistent (e.g., items that should add to totals do so); (3) The State reports data on all applicable elements; and (4) Monthly totals are unduplicated counts for all families (e.g., the number of families and the number of outof- wedlock births are unduplicated counts). 60 cases from the TANF ACF-199 report were sampled for accuracy. One case in the sample had incorrect birth demographics listed on the report. The altered birth demographics were received by HHSC from TWC in the process of compiling the report. The altered birth demographics were not reviewed by HHSC to ensure accuracy of the information prior to submitting the report. Recommendation: HHSC should institute system controls that flag key item changes for worker review. This would allow HHSC an opportunity to correct the disputed data before submission of the report. Views of Responsible Officials: HHSC CADS acknowledges the finding that one record had an incorrect birth date and work participation status code.

Reference No. 2019-023 Reporting CFDA 93.568 ? Low-Income Home Energy Assistance Award year ? October 1, 2018 to September 30, 2019 Award number ? G-1901TXLIEA Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency and Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.303, the Texas Department of Housing and Community Affairs (TDHCA) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. TDHCA must submit the LIHEAP Performance Data Form (OMB No 0970-0449) each year regarding the prior Federal fiscal year. Module 1 of the report is the Grantee Survey that covers sources and allocation of funding. Module 2 of the report is regarding performance metrics, mostly related to home energy burden targeting and reduction, as well as the continuity of home energy service. Audit procedures included tracing and agreeing amounts from the supporting schedules generated from PeopleSoft and the Community Affairs Contract System to the 2019 LIHEAP Performance Data Form. The following line items did not agree to the supporting schedules for amounts reported in Module 2: ? Part V.B Line 4: Average Annual Main Heating Fuel Bill for Propane and Other Fuels ? Part V.B Line 5: Average Annual Electricity Bill for All Households and Electricity ? Part V.C Line 4: Average Annual Main Heating Fuel Bill for High Burden Households for Other Fuels ? Part VI.A Line 2: Fuel Delivered to Home that Ran Out of Fuel for All Occurrences, Propane and Other Fuels ? Part VI.A Line 3: Repair/ Replacement of Inoperable Home Energy Equipment for Propane and Other Fuels ? Part VII.A Line 1: Past Due Notice or Utility Disconnect Notice for All Occurrences and Electricity Line items that are calculations based on the amounts above were also incorrect as a result of the errors identified. Incorrect reporting was due to transcription and calculation errors as data is manually transcribed onto the LIHEAP Performance Data Form. Management made all corrections to the report prior to submission. Recommendation: TDHCA should enhance review controls over the LIHEAP Performance Data Form. Reviews should include verifying that the data is transcribed completely and accurately from supporting schedules and calculated correctly in accordance with the Performance Data Form Instructions. Views of Responsible Officials: Texas Department of Housing and Community Affairs agrees with the finding.

Reference No. 2019-024 Reporting Medicaid Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1905TXINCT, 1905TXIMPL, 1905TX5MAP, 1905TX5ADM, 1805TXINCT, 1805TXIMPL, 1805TX5MAP, and 1805TX5ADM Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.303, Office of Attorney General (OAG) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. OAG uses Active Directory to grant network access to OAG personnel. OAG also utilizes their mainframe accounting application for recording of daily transactions as well as for general reports to assist with the federal reporting requirements. Based on the OAG?s Information Security policy, account access levels will be reviewed, at a minimum, every twelve (12) months for appropriateness. We determined that management has not completed this review for Active Directory as well as for their mainframe accounting application during the single audit period. User access reviews include but are not limited to reviewing users with privilege access, ensuring all active service accounts (non-employee accounts) have a required business purpose, verifying that users are assigned to security groups or roles based on their existing job description, and ensuring that accounts no longer required are adequately removed. Based on our review of the listing of individuals with administrative rights to the active directory, we identified two domain admin accounts that have not logged-in for over a year. As a domain administrator, an individual is able to add/remove users, modify group policy configuration, and access files on the network. Hence, it is critical to ensure that access is limited to only authorized personnel. Recommendation: OAG should resolve this exception by performing a periodic review in accordance with the agency?s information security program. As part of this review, OAG should also ensure that privilege access, service accounts, and employee access are restricted to authorized personnel in accordance with their respective job description. Views of Responsible Officials: The OAG agrees with the reporting observations and recommendation identified in Attachment A related to user account access reviews. The OAG will implement quality control checks to ensure periodic performance of user account access reviews as specified in established OAG Information Security Policy (ISP). The OAG completed the required 2020 active directory and mainframe accounting system user access reviews. Future reviews will be conducted at least annually per the OAG ISP. User access reviews may be executed more frequently for privileged and system user accounts.

Reference No. 2019-025 Allowable Costs/Cost Principles CFDA 84.048 ? Career and Technical Education ? Basic Grants to States Award years ? July 1, 2018 to September 30, 2020 and July 1, 2017 to September 30, 2019 Award numbers ? V048A180043 ? 18A and V048A170043 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency and Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.303, Texas Education Agency (TEA) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a direct and material effect on each of its Federal programs. Title 2 Code of Federal Regulations Section 200.430 Compensation ? Personal Services sets standards for payroll documentation, which include: (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities (for IHE, this per the IHE?s definition of IBS); (iv) Encompass both federally assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity?s written policy; (v) Comply with established accounting policies and practices of the non-Federal entity and (vi) Reserved] (vii) Support the distribution of the employee?s salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (viii) Budget estimates (i.e., estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes, provided that: (A) The system for establishing the estimates produces reasonable approximations of the activity actually performed; (B) Significant changes in the corresponding work activity (as defined by the non-Federal entity?s written policies) are identified and entered into the records in a timely manner. Short term (such as one or two months) fluctuation between workload categories need not be considered as long as the distribution of salaries and wages is reasonable over the longer term; and (C) The non-Federal entity's system of internal controls includes processes to review after-the-fact interim charges made to a Federal award based on budget estimates. All necessary adjustment must be made such that the final amount charged to the Federal award is accurate, allowable, and properly allocated. TEA?s payroll process ensures only allowable salaries are charged to the federal program by reallocating costs on a quarterly basis through the Cost Allocation Feeder System for employees included in its cost allocation method plan. The reallocation reflects differences between budgeted time allocations and actual time allocations reported by employees in the time and effort system. For employees not included in the cost allocation method plan, TEA?s payroll process requires that employees? time be certified by their supervisor through a time and effort certification. Time and effort is entered into TEA?s time and effort system by the employee and electronically approved by their supervisor. Of the 40 payroll and payroll-related samples tested, one employee, who was not included in the cost allocation method plan, did not have a time and effort certification approved by their supervisor. The error was a result of an oversight by the supervisor to complete the certification. Recommendation: TEA should strengthen controls in place to ensure time and effort certifications are reviewed and approved by each employee?s supervisor. Views of Responsible Officials: The Texas Education Agency (TEA) agrees with this recommendation. To address the Budget Division?s need to strengthen controls, Budget management has met to discuss the need for a delinquent supervisory report to be created and generated from the existing Time & Effort System.

Reference No. 2019-026 Subrecipient Monitoring CFDA 84.048 ? Career and Technical Education ? Basic Grants to States Award years ? July 1, 2018 to September 30, 2020 and July 1, 2017 to September 30, 2019 Award numbers ? V048A180043 ? 18A and V048A170043 Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency and Non-Compliance See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.331(a), Texas Higher Education Coordinating Board (THECB) must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and, if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the passthrough entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal Award Identification ? (iv) Federal Award Date (see 2 CFR 200.39 Federal award date) of award to the recipient by the Federal agency and (xii) Identification of whether the award is R&D. THECB issues a Notice of Grant Award (NOGA) to each approved subrecipient prior to expending funds to that subrecipient under each grant. THECB maintains a template NOGA that is used for all agreements with subrecipients under the grant. In accordance with 2 CFR 200.331(a) and per THECB?s template NOGA, each NOGA includes the following information: amount of federal funds, federal grant title, CFDA number, federal grant award number, term of grant, date all funds must be expended by, federal grant funding agency, and DUNS number. THECB?s template NOGA does not contain fields for the grant?s federal award date or whether the grant is considered research development. For five (5) out of five (5) NOGAs tested, the grant?s federal award date or whether the grant was considered research and development was not included. In fiscal year 2019, THECB passed through approximately 97.6% of Career and Technical Education funds to subrecipients. Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by THECB. Recommendation: THECB should revise its standard NOGA template to include all required information to be communicated to subrecipients per 2 CFR 200.331. Additionally, for existing NOGAs, THECB should communicate required information to subrecipients in an addendum to the NOGA. Views of Responsible Officials: THECB agrees with this recommendation.

Reference No. 2019-027 Allowable Costs/Cost Principles TANF Cluster Award years ? October 1, 2018 to September 30, 2019 and October 1, 2017 to September 30, 2018 Award numbers ? 1901TXTANF, 1901TXTAN3, 1801TXTANF, and 1801TXTAN3 CCDF Cluster Award years ? October 1, 2018 to September 30, 2021, October 1, 2017 to September 30, 2020, October 1, 2016 to September 30, 2019, and October 1, 2015 to September 30, 2018 Award numbers ? G1901TXCCDF, G1801TXCCDF, G1701TXCCDF, and G1601TXCCDF Statistically valid sample ? No and Not Intended to be a Statistically Valid Sample Type of finding ? Significant Deficiency See Schedule of Findings and Questioned Costs for chart/table Per 2 CFR 200.303, Texas Workforce Commission (TWC) must establish and maintain effective internal controls over Federal awards that provide reasonable assurance they are managing Federal awards in compliance with Federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. The TWC PeopleSoft (PS) application is a single system comprised of integrated process modules. The financial modules are referred to as WRAPS: Workforce, Reporting, Accounting and Purchasing System. PeopleSoft Financials is used for creating and inquiring on financial journals, payment requests, and requisitions. The Cash Draw and Expenditure Reporting System (CDER) is an automated accounting system used by Local Workforce Development Boards (LWDB) to process and track cash draws to grant recipients. The functions for LWDB users include editing, submitting, making adjustments, and generating reports relating to cash draws. Based on the TWC?s policy, access reviews are to be performed on a periodic basis. We determined that this review of access to WRAPS was conducted in May 2019 by submission of employees? names and access information to the various supervisors. We determined there were several instances of no responses being received; as a result, the review was only partially completed. Access reviews are critical to ensure that TWC personnel only have access in accordance with their respective job description. As part of management?s user access review for WRAPS, we determined that review of service accounts was not documented. Service accounts are non-employee accounts that are required to authenticate to the application to either perform a specific function (for example, backups or transaction processing). Service accounts are required to be reviewed as part of the periodic review process to ensure only accounts with a business purpose are maintained and all other accounts are removed or disabled. Based on our review of privilege accounts for the WRAPS application, we identified one shared account which is being used by TWC personnel to release code into production. In addition, password changes were not forced on this user account. Shared administrative accounts limit the effectiveness of audit logs in identifying the origination of changes to access or report configurations. Each administrator should have a unique administrative account in order to monitor changes made to the application. Without unique administrative accounts, the risk of unauthorized changes is increased. Password changes are critical to ensure that privilege accounts are not accessed by employees no longer with TWC, as well as for better security. Based on our review of privilege accounts for the CDER application, we identified one instance of an employee having administrative access to the application that was outside of their job description. This individual was a developer with administrative rights to the application, thus causing a segregation of duty conflict. The user?s access was removed on September 19, 2019 once it was brought to management?s attention. Administrator access gives the rights to the individual to add or remove users, modify configuration, as well as modify reports. Recommendation: TWC should ensure that user access reviews are completed for accounts for WRAPS. As part of this review, TWC should also ensure that privilege access, service accounts, and employee access are restricted to authorized personnel in accordance with their respective job description. Views of Responsible Officials: Texas Workforce Commission (TWC) agrees with the finding. TWC will strengthen procedures to ensure WRAPS access reviews are completed. Reviews will include privileged and service accounts with employee access restricted to authorized personnel in accordance with their respective job duties.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION