Montana Reinsurance AssociationLocal Government

Finding 2023-001: U.S. Department of Agriculture ALN #10.553, 10.555, 10.559, 10.582, Child Nutrition Cluster (COVID-19) Grant #3MT300306, 3MT310376, and 3MT308901 Criteria: Federal regulation, 2 CFR 170, Appendix A(I)(a) and (a)(2)(ii), requires non-federal entities to report to the Federal Funding Accountability and Transparency Act (FFATA) reporting system each action that equals or exceeds $30,000 in federal funds for a subaward to a non-Federal entity. The report should be submitted no later than the end of the month following the month in which the obligation was made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal year 2022 and fiscal year 2023, the Office of Public Instruction (office) did not accurately file any of the required FFATA reports for its subrecipients of the Child Nutrition Cluster (Child Nutrition), as required by federal regulations. The office’s internal controls were not sufficient to ensure accurate reporting. Questioned Costs: No questioned costs identified. Context: Child Nutrition payments to Local Educational Agencies (LEAs) are set up differently than other federal programs at the office because their funding is based on meals served monthly, not on predetermined allocation amounts like most federal programs at the office. LEAs are paid monthly based on meals served. During the beginning of fiscal year 2022, the office posted FFATA reports monthly based on actual expenditures. The office stopped posting FFATA report information in the middle of state fiscal year 2022 because they discovered the information was incorrect. The office was reporting the cumulative total for the year thus far each month, not the total for that month. Office staff said they planned to update information at the end of the grant. However, the office did not update fiscal year 2022 FFATA report information during state fiscal year 2023. Reporting annually conflicts with 2 CFR 170, Appendix A(I)(a) and (a)(2)(ii). The following describes what the office should have reported versus what was actually reported in fiscal year 2022: • ALN 10.555: The office reported 143 LEAs totaling $71,046,572 but should have reported 363 totaling $78,830,539. This leaves $7,783,967 not reported. • ALN 10.582: Nothing was reported but 14 LEAs totaling $707,459 should have been reported. This leaves $707,459 not reported. The table below summarizes activity for the two bullets above. See the Schedule of Findings and Questioned Costs for chart/table. Effect: The office is not in compliance with FFATA reporting requirements, limiting the federal grantor agency’s ability to transparently report program activity. Cause: When the office was reporting monthly during fiscal year 2022, reports were inaccurate because the office was reporting the cumulative total for the year thus far each month, not the total for that month. To try to avoid inaccurate reporting for fiscal year 2023, the office determined they would report actual expenditures at the end of the grant award. As a result, there was no information reported for state fiscal year 2023 subawards. Recommendation: We recommend the Office of Public Instruction: A. Enhance internal controls to ensure the accurate and timely submission of FFATA reports. B. Submit FFATA reports in accordance with federal regulations, including correcting the prior reports. Views of Responsible Officials: The office partially concurs with the recommendation. Management believes that many of the issues noted in this finding were the result of communication issues with the FFATA submission system and the USAspending application, which are maintained by the federal government. Rebuttal of Views of Responsible Officials: We considered the office’s partial concurrence. As noted above, the office was able to enter information into the federal system, but the information entered was incorrect. The office later determined they would report expenditures at the end of the grant award. The incorrect information entered by the office was not the result of communication issues and the office did not have documentation to support only reporting expenditures at the end of the grant award. As such, our recommendation stands.

Finding 2023-002: U.S. Department of Agriculture ALN #10.542, Pandemic EBT Food Benefits (P-EBT) (COVID-19) Grant #Not Applicable ALN #10.551 and 10.561, Supplemental Nutrition Assistance Program Cluster (SNAP) Grant #Various Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Public Health and Human Services (department) did not have sufficient internal controls in place to ensure accounting records for SNAP and P-EBT were accurate and adequate to trace expenditures to each federal program. Questioned Costs: No questioned costs identified. Context: The P-EBT program was established in 2021 in response to the pandemic. When the initial accounting for the program was set up, it was co-mingled with SNAP funds on the accounting records. The department made correcting entries to separate the activity between the P-EBT and SNAP programs. The initial error and subsequent corrections resulted in SEFA misstatements in fiscal years 2021 and 2022. This issue is discussed in finding 2023-11. While we did not identify any reportable errors related to the SEFA in fiscal year 2023, underlying accounting records contained multiple errors due to additional clean-up and numerous correcting entries. As a result of these accounting errors and adjustments, financial activity in both programs was also misstated in both years of the audit period. Our analysis of the P-EBT and SNAP activity involved a review of revenue and expenditure totals at the end of each fiscal years 2021, 2022, and 2023. We compared ending totals on the accounting records to amounts of benefits issued and settled from a separate system. We did not review the individual accounting transactions made throughout the year. As state accounting policy allows for prior year corrections, we considered the need for correcting entries as part of our analysis. Based on our analysis, we projected the cumulative errors remaining in each program. The table below summarizes these errors in revenue and expenditures at the end of fiscal year 2023. See the Schedule of Findings and Questioned Costs for chart/table. As a result of the initial co-mingled funds, the department is not in compliance with federal regulation 2 CFR 200.302 which in part requires the state’s financial management system be able to trace expenditures adequately and identify the source and application of funds for each federal program. Department personnel provided additional reports separate from the accounting records that allowed us to distinguish activity by program. Therefore, we do not consider this to be material noncompliance for either PEBT or SNAP. Effect: Without adequate internal control over the accounting for federal programs, the department is at risk of noncompliance with federal regulations. Additionally, since the state uses accounting records to compile the Schedule of Expenditures of Federal Awards (SEFA), corresponding misstatements on the SEFA could impact major federal program determinations. Misstating expenditures could also result in federal revenues drawn in advance of actual expenditures, which doesn’t follow federal regulations for reimbursement grants. Cause: Per the department, the initial accounting for P-EBT was not set up correctly and was co-mingled with SNAP due to limited award guidance received. Additionally, the original pandemic-related budget authority was initially insufficient to cover actual issuances and redemptions under the program, resulting in the department using SNAP budget authority until additional P-EBT authorization was obtained. As part of clean-up and corrections for this activity, numerous journal entries were made, resulting in additional errors. Recommendation: We recommend the Department of Public Health and Human Services enhance internal controls to ensure accounting records accurately reflect the financial activity of a federal program. Views of Responsible Officials: The department conditionally concurs with this recommendation. The department disagrees with our position that they were not in compliance with 2 CFR 200.302, as they tracked activity by program in a separate system. Rebuttal of Views of Responsible Officials: We considered the department’s conditional concurrence, however, since the system used to track program activity was not the state’s financial management system, it is our position that the department’s internal controls are not adequate to ensure compliance with 2 CFR 200.302. As such, our recommendation stands.

Finding 2023-003: U.S. Department of Defense ALN #12.401, National Guard Operations and Maintenance (O&M) Projects Grant #W9124V-21-2-1000 Criteria: National Guard Regulations (NGR) 5-1, section 3.15 states claims shall be made within 60 days after the basis of the claim is known or should have been known, whichever is earlier. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Military Affairs (department) did not have controls in place to consistently seek reimbursement for the federal portion of O&M grant expenditures in the time period required by federal regulations. Questioned Costs: No questioned costs identified. Context: From July 2021 through February 2023, the department requested $41 million in reimbursements for the program. We completed a statistical sample of reimbursement requests which covered $2.7 million of the total. Because each reimbursement includes multiple invoices, we selected a judgmental sample of 46 individual invoices included in the requests totaling $459,619. The sample was not statistically valid. Of the 46 tested, we found 13 items were requested more than 60 days after the expenditure occurred. Of the sample errors, reimbursement was requested between 4 and 718 days later than the 60 days allowed. We reviewed an additional 22 reimbursement requests for the remainder of the audit period, from March 2023 through June 2023. We identified two additional late requests. For these items, the billings were 49 and 68 days late. Effect: The department is not in compliance with federal regulations. Requesting reimbursement more than 60 days after the expenditure could result in the federal government denying the reimbursement. Cause: The department did not have adequate controls in place to ensure reimbursement requests were made within 60 days of the expenditure being paid. Additionally, the chief financial officer position has turned over several times in the last three years, there were some vacant positions during the audit period, and additional full time equivalent (FTE) staff are needed to timely process the volume of department transactions. The two additional errors noted in the remainder of the audit period were limited to one appendix and primarily the result of program staff not providing the necessary accounting coding to post it earlier. Recommendation: We recommend the Department of Military Affairs: A. Enhance internal controls to ensure requests for reimbursement are made within 60 days of the expenditure. B. Request reimbursement for expenditures within 60 days of expenditure claims being known or paid. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-004: U.S. Department of Housing and Urban Development ALN #14.871 & 14.879 Housing Voucher Cluster (COVID – 19) Grant #MT901 Criteria: Federal guidance, OMB No. 2577-0282, requires the Public Housing Authority (PHA) to submit a report monthly through the Voucher Management System (VMS). This report includes information such as the unit months leased and the monthly housing assistance payments. The Department of Commerce (department) is the PHA. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department’s controls were insufficient to ensure that monthly reports submitted through VMS were accurate during the audit period, and VMS reports were inaccurate during the audit period. Questioned Costs: No questioned costs identified. Context: The monthly report submitted through VMS requires various information such as the number of unit months leased by voucher type and monthly housing assistance payment. We identified the following errors in the monthly reports: • In seven reports from July 2021 through December 2021, the number of vouchers for the Veterans Affairs Supportive Housing (VASH) program was incorrect as the department did not include all VASH vouchers in the total. Amounts reported were understated between 38 and 42 vouchers. This is approximately 16% of the reported vouchers. • The amount of Emergency Housing Voucher (EHV) Program vouchers were understated by 46 vouchers, or 124%, on the January 2023 report. After identifying the issue during our testing, we communicated these errors to the department. The department indicated it did submit corrections to the reports after we identified these errors. These corrections were made outside the audit period. Effect: The department did not comply with federal reporting requirements, and the information in the monthly report submitted through VMS was inaccurate. Cause: While the reports are reviewed by department staff before submission, the review was insufficient to identify errors in the VMS reports. The department cites turnover in the position responsible for preparing the reports as contributing to inaccurate reporting during the audit period. Recommendation: We recommend the Department of Commerce: A. Enhance internal controls over the preparation and review of monthly reports submitted through the VMS to ensure they are complete and accurate, and B. Submit complete and accurate monthly VMS reports. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-005: U.S. Department of Housing and Urban Development ALN #14.871 & 14.879 Housing Voucher Cluster (COVID – 19) Grant #MT901 Criteria: Federal regulation, 24 CFR 982.405(a), requires the Public Housing Authority (PHA) to inspect the unit leased to a family before the initial term of the lease, at least biennially during assisted occupancy, and at other times as needed, to determine if the unit meets the Housing Quality Standards (HQS). The Department of Commerce (department) is the PHA. Federal regulation, 24 CFR 5.705 (c)(1), requires that a physical inspection shall be conducted no earlier than six months before and no later than six months after the date marking the anniversary of the previous inspections. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department contracts with field agents, such as housing authorities and non-profits, to conduct HQS inspections. We identified instances where the required inspections were either not completed, or not completed in the required timeframe, in fiscal years 2022 or 2023. The ultimate responsibility for the HQS inspections resides with the department. Since not all inspections were performed, or performed timely, the department’s internal controls are insufficient to ensure that HQS inspections are occurring as required by federal regulations. Questioned Costs: No questioned costs identified. Context: During fiscal year 2022 and 2023, approximately 3,300 families participated in the vouchers program each year. All of these are subject to move-in inspections and biennial HQS inspections. The department conducts monitoring reviews of its field agents to make sure inspections are complete and performed as required. The department also uses a computer system to track when inspections are due. Using this information from the department, we considered overdue inspections. We determined: • Fiscal year 2022 had 118 overdue inspections. • Fiscal year 2023 had 120 overdue inspections. • Approximately 4% of inspections were overdue in both years. • The most delinquent inspection was approximately six years overdue. Effect: By not completing the required HQS inspections, the department has not complied with federal regulations. When these inspections are not completed, the individuals participating in the program could live in unsafe conditions. Cause: Department staff indicates significant turnover in field agent staff contributed to these late or incomplete HQS inspections. Additionally, there were instances where department staff or field agent staff did not understand the requirements for HQS inspections or were unable to complete the inspections due to various circumstances, such as illness or program participants not showing up to the inspection. The inspections were not rescheduled in these cases but should have been. Recommendation: We recommend the Department of Commerce: A. Develop internal controls, including training, to ensure that inspections are completed as required by federal regulations and inspectors understand requirements of federal regulations. B. Conduct HQS inspections as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-006: U.S. Department of Housing and Urban Development ALN #14.195 & 14.856 Section 8 Projects-Based Cluster Grant #MT800 ALN #14.871 & 14.879 Housing Voucher Cluster (COVID – 19) Grant #MT901 Criteria: Montana Operation Manual, Information Security Controls Standard, outlines baseline security controls for every state agency to implement for information technology systems they manage. Included among the baseline controls are requirements for developing and documenting a security plan; documentation of access control policies and procedures, including periodic review of user access; and documentation of a formal change management system so that Information Technology (IT) best practices are followed, and controls over computer systems are sufficient. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Commerce (department) uses the Housing Assistance Payment Plan Yearly (HAPPY) system to assist in administering both the Housing Vouchers Cluster program and the Lower Income Housing Assistance - Moderate Rehabilitation Program (Moderate Rehabilitation). The department’s controls over HAPPY are insufficient to ensure state information security policy requirements are followed. Questioned Costs: No questioned costs identified. Context: The HAPPY system is used by the department to gather applicant data, maintain the required waiting list, determine eligibility for the programs, monitor whether inspections are occurring, house inspection data, and assist in calculating the monthly housing assistance payment. We identified the following instances where controls over the HAPPY system need enhancement: • Password Requirements - To log into the HAPPY system, a user must log into two separate applications: a hosting platform and the HAPPY system. The department and the vendor supporting HAPPY shares responsibilities for managing how users log in to each system; however, the department is accountable for ensuring both logins meet state requirements. State policy contains password complexity and length requirements, periodic password changes, and history requirements so passwords are not reused to mitigate the chances of inappropriate access to the system and the chances that the system would be compromised. We identified noncompliance concerning password requirements and the security of login credentials when new users are added to HAPPY. • Login Credential Security - Login credentials to the hosting platform and HAPPY applications are not securely provided to staff or retained within system documentation. If login credentials are not provided to the employee securely, there is a risk that they could be compromised, and unauthorized individuals could gain access to the system. o While HAPPY does force a password change at the initial login, the initial login information is provided in an email. Before the end of May 2023, this email was not encrypted when provided to users. o The hosting platform system does not require a password change at initial login. All login information is provided in the same email and work order as the HAPPY login information. • Access Reviews - The department does not perform a formal documented review, at least annually, of user roles and privileges in the system as required by state policy. o While reviewing access to the system, we identified two staff members who had more access than needed for their job duties. Department staff indicate this occurred because the roles and privileges of the prior staff member in those positions were copied when setting up the access. However, the former employee had more job duties than the current staff members are currently assigned. o In January 2022 the department determined a field agent they contract with had access to perform duties only the department should be performing. • Written Policies - The department does not have written access control or change control policies. As part of controls over systems, the department should have a written policy that addresses purpose, scope, roles, responsibilities, and configuration management. This is especially important as only one staff member currently performs these functions, so having the documented policies would allow other staff members to step into their roles in an emergency. o Without a written access policy, there is no consistency in access management and access could be granted inappropriately. This is especially important for the HAPPY system as the system allows for each user to have a customized role. If customized roles are not clearly defined when they are allowed, users could have inappropriate access to the system and could enter inappropriate data. o While the department does not actively contribute to the development of the HAPPY system, a written change control policy is important so that the department understands how changes made to the HAPPY system impact the system and data. It is also important for the department to have a documented policy for how the department tests and deploys changes to the system to ensure no unapproved or inappropriate changes are made. • Staff Cross-Training - The agency uses a single IT contact for its access and change management. This single IT contact handles significant responsibilities associated with system controls, and no alternate staff member could provide the same level of necessary support. While some staff have access roles in HAPPY to perform many, if not all, of the same duties as the IT contact, they are not familiar with the duties, and the responsibilities are not formally documented. As a result, some services, such as granting and removing access, could be unavailable if the IT contact is unavailable for any reason. o While the IT contact was out of office, there were 5 individuals who did not have access removed timely because staff did not know how to perform that action within HAPPY. Program staff sought help from the system vendor and were able to remove the access, but there was a delay in deactivating the accounts. Effect: Without sufficient controls over the HAPPY system, there is a risk of inappropriate access, improper system functionality, or erroneous data within the system that could affect program operations for the Vouchers Cluster and Moderate Rehabilitation Program. This also resulted in inappropriate access to HAPPY during the audit period and resulted in the federal noncompliance reported in Finding #2023-007. Cause: Department staff indicated system management was primarily handled by the vendor for the HAPPY system. However, the department is responsible for ensuring controls over and within the system comply with state policy and are appropriate to ensure accurate system operation and data integrity even if system management is handled by a vendor. Recommendation: We recommend the Department of Commerce enhance internal controls by: A. Updating password requirements for the HAPPY and hosting platform applications to conform with requirements in state policy. B. Enhancing security when providing login credentials to users and force password changes at initial login for both the HAPPY and hosting platform applications. C. Conducting access reviews at least annually and ensure that all customized permissions are considered and documented during this review. D. Developing written policies over system access and change management, and E. Cross-training staff in the HAPPY system to avoid delays in granting or removing system access. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-007: U.S. Department of Housing and Urban Development ALN #14.871 & 14.879 Housing Voucher Cluster (COVID – 19) Grant #MT901 Criteria: Federal regulation, 24 CFR 982.204, requires that except for special admissions, participants must be selected from the Public Housing Authority (PHA) waiting list. The PHA must select participants from the waiting list in accordance with admission policies in the PHA administrative plan. This means that families seeking assistance apply to the program and are placed on the waiting list until a spot in the program is available. The PHA’s method of selecting families from the waiting list determines the order in which the families receive assistance. The Department of Commerce (department) is the PHA. The department’s administrative plan (Chapter 4 II.A. Overview) indicates eligible applicants will be placed on the waiting list and sorted according to preference and then the date and time of application. Preferences are given to those transitioning out of institutional settings, at risk of institutionalization, and at serious risk of homelessness. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department did not select participants for the Vouchers program from the waiting list as specified in their administrative plan, indicating the department’s controls were insufficient to ensure compliance with federal regulations. Questioned Costs: No questioned costs identified. Context: When there is an opening in the program, the field agent will notify the department that they need applicants selected from the waiting list. The relevant staff at the department then select the applicants and inform the field agent of this so the information gathering can begin. The waiting list is stored and generated in the Housing Assistance Payment Plan Yearly (HAPPY) system. Only the staff at the department responsible for the waiting list should be able to select applicants from this list in the system. During January 2022, the department became aware of instances where an employee at a field agent was making actual selections from the waiting list, and they were not selecting from the top of the waiting list. After learning of this situation, the department took steps to remedy it and to determine its impact. The department confirmed there were seven instances where applicants were selected out of order. Because the department has not reviewed access to the HAPPY system for other field agents, this situation could exist for other field agents. We reviewed access to the HAPPY system and identified two other department staff who had inappropriate access to the waiting list in fiscal year 2023. However, we did not identify instances where these individuals selected applicants from the waiting list. Department controls over HAPPY are addressed in Finding #2023-006. Effect: The department did not comply with federal regulations and its administrative plan. Additionally, seven families had to wait for affordable, safe housing to become available despite being at the top of the waiting list. Cause: The department’s controls over selecting from the waiting list and granting system access related to the waiting list were not sufficient to ensure that all applicants were selected as required by the department’s administrative plan. Recommendation: We recommend the Department of Commerce: A. Continue to enhance and implement controls over selecting applicants from the waiting list. B. Ensure access in the Housing Assistance Payment Plan Yearly (HAPPY) system to the waiting list is only granted to those with a business need, and C. Select applicants from the waiting list as required by the administrative plan and federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-008: U.S. Department of Housing and Urban Development ALN #14.195 & 14.856, Section 8 Project-Based Cluster Grant #MT800 Criteria: Federal regulation, 31 CFR Part 205, implements the Cash Management Improvement Act (CMIA). The CMIA requires the state to enter into agreements that prescribe specific methods to draw down Federal funds and make payments via Electronic Funds Transfer (EFT). The details of these methods are included in the annual Treasury State Agreement (TSA) between the state and the Federal government if federal program expenditures are over a set threshold as defined by federal regulations. For the Section 8 Project-Based Cluster, the fiscal year 2022 TSA requires the Department of Commerce (department) to disburse funds to property owners by EFT so that the settlement date is the first business day of the month, except for January and July when the settlement date is the second business day of the month. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department did not process payments as required by the TSA agreement. Since the department made payments outside of the schedule in the TSA agreement, the department’s controls are insufficient to ensure they are following the TSA agreement. Additionally, the department’s controls were insufficient to ensure the TSA agreement matched business practice in fiscal year 2022. Questioned Costs: No questioned costs identified. Context: The department provides housing assistance payments to about 80-90 projects each month, averaging over $2 million in total monthly payments. The department makes one large payment at the beginning of the month. In fiscal year 2022, 5 of the 12 months had a settlement date not on the first business day of the month. These payments were approximately $2 million each and were one business day late in most months. Every month, at least one payment was made outside of the initial payments, as the department delayed payment while ensuring all required information was obtained before issuing payment. This practice does not align with the TSA requirements. There were on average three payments made in addition to the initial payment, with March 2022 having five additional payments. These additional payments averaged about $66,000. These trends continued into fiscal year 2023, but the Section 8 Projects Cluster is not part of the TSA in fiscal year 2023, so the department has more flexibility in when they can make the payment if they are minimizing the days between the cash draw and cash disbursement. The timing of payments in fiscal year 2022 does align with the department’s Annual Contribution Contract (ACC) with HUD, indicating payments should be made the first business day after receiving the funds from HUD. It also allows for the payment of owners throughout the month if they are late submitting required information. However, this does not match the required payment timing in the TSA, and federal regulations require the TSA to be followed. Effect: The department did not comply with federal regulations or the TSA agreement for fiscal year 2022. Cause: The department’s controls are insufficient to ensure the TSA aligns with business practice and the ACC with HUD. This resulted in two different conflicting requirements for how payments were to be made during the audit period. However, the requirements should not have been conflicting as the department should have updated the TSA to align with the requirements in the ACC with HUD. Recommendation: We recommend the Department of Commerce: A. Enhance internal controls to ensure payments to landlords are consistent with the Treasury State Agreement. B. Distribute payments to landlords in accordance with the Treasury State Agreement. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-009: U.S. Department of Labor ALN #17.225, Unemployment Insurance Program (COVID-19) Grant #: • 23-A60UR000026 • UI-37990-22-60-A-30 • UI-34726-20-55-A-30 • UI-37075-21-55-A-30 • UI-37234-22-55-A-30 • UI-38784-22-55-A-30 • UI-38792-22-55-A-30 • UI-39333-23-55-A-30 Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Labor and Industry (department), as part of the Benefits Accuracy Measurement (BAM) program, completes investigations of paid and denied unemployment insurance claims to help ensure the accuracy of the unemployment insurance determinations. Federal regulations dictate the number of claims that the department must review weekly, quarterly, and annually. However, during the audit period, the department did not retain evidence of a control being used to monitor the completion of the claim reviews. Questioned Costs: No questioned costs identified. Context: As part of administering the BAM program, the department must draw a weekly sample of paid and denied claims, and complete in-depth investigations to determine if the administration of the unemployment compensation program is consistent with state and federal law. The table below shows the total number of sample reviews required annually. It also shows the regular number usually reviewed and the minimum number required to be reviewed – both weekly and quarterly. See the Schedule of Findings and Questioned Costs for chart/table. The department uses a federal reporting system to monitor the status of the BAM reviews and ensure the department is on track to review the required number and types of claims. However, documentation from the federal reporting system demonstrating the department’s monitoring of the BAM reviews was not saved and we were unable to verify the federal reporting system was used for monitoring purposes during the audit period. Based on our work, we were able to verify the required number of reviews occurred and, as a result, we did not identify material noncompliance in relation to this control deficiency. Effect: Because the department does not have evidence of a control in place to ensure the completion of the required number of BAM case reviews, the department is at risk of not identifying and correcting errors in a timely manner. In addition, the department is not in compliance with federal regulations requiring recipients of federal funding to maintain effective internal control over the federal award. Cause: Per department personnel, the department utilized the federal system to ensure an adequate number of cases were selected and reviewed but did not consider the need to retain support for, or otherwise document evidence of, monitoring these reviews. Recommendation: We recommend that the Department of Labor and Industry retain evidence of internal controls used for monitoring completion of required BAM case reviews. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-010: U.S. Department of Labor ALN #17.225, Unemployment Insurance Program (COVID-19) Grant #: • 23-A60UR000026 • UI-37990-22-60-A-30 • UI-34726-20-55-A-30 • UI-37075-21-55-A-30 • UI-37234-22-55-A-30 • UI-38784-22-55-A-30 • UI-38792-22-55-A-30 • UI-39333-23-55-A-30 Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Federal Unemployment Tax Act (FUTA) imposes a federal tax on employers of six percent on the first $7,000 of employee wages. A tax credit of up to 5.4 percent against this tax liability is available for employers who pay state unemployment insurance (UI) contributions timely. The Department of Labor (department) must annually certify to the federal government the total amount of state UI contributions each employer paid for the employer to receive a credit toward their federal unemployment tax. To certify the information, the department matches its records against tax information provided by the federal government. However, the department has no control in place to ensure this certification is completed by the established deadline. Questioned Costs: No questioned costs identified. Context: During the audit period, to remind them to complete the certification, the department relied on a notification from the federal government that the tax information was available. This tax information is made available several months prior to the due date. Two certifications were due during our audit period. The certification due January 31, 2022, was completed and submitted on January 25, 2022. However, staff missed the notification from the federal government in fiscal year 2023 and failed to complete the certification by the January 31, 2023, deadline. The department had to work with the federal government to reobtain the tax information and match it against the department’s records to provide the certification. The department did not complete the certification until March 2, 2023, 30 days after the due date. We do not consider the late submission to be material non-compliance. Effect: By not having adequate controls in place to ensure the certification was completed and submitted timely, the department is not in compliance with federal regulations. If the department does not complete the certification, taxpayers may not receive the tax credit owed to them. Cause: Department personnel indicated that because of the increased workload caused by the department’s migration to its new unemployment insurance information system, staff overlooked completing the match when the files were initially received from the federal government. Recommendation: We recommend the Department of Labor and Industry implement internal controls to ensure the required certification over taxpayer information for each calendar year is completed within the deadline established by the federal government. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-011: U.S. Department of Labor ALN #17.225, Unemployment Insurance Program (COVID-19) Grant #: • 23-A60UR000026 • UI-37990-22-60-A-30 • UI-34726-20-55-A-30 • UI-37075-21-55-A-30 • UI-37234-22-55-A-30 • UI-38784-22-55-A-30 • UI-38792-22-55-A-30 • UI-39333-23-55-A-30 Criteria: Federal guidance, ETA (Employment and Training Administration) 2112 Handbook, part B, requires the ETA 2112 report to reflect all money received, passed through, or paid out of the state unemployment fund. Federal guidance, ETA 2112 Handbook, part D, requires that the ETA 2112 report accurately show the net result of all transactions in the three accounts comprising the state unemployment fund. Federal guidance, ET Handbook No 336, section III(A)(2) requires that the UI-3 report data fairly and accurately represent the utilization of staff time and that data be traceable to supporting documentation. Federal regulation, 2 CFR 200.334, requires the retention of supporting documents relevant to a federal award for three years. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Labor and Industry (department) does not have sufficient internal controls in place related to the ETA 2112, ETA 2208A (UI-3), and ETA 9050 unemployment insurance program reports, resulting in reporting errors during the audit period. Questioned Costs: No questioned costs identified. Context: The department submits various unemployment insurance (UI) reports to the federal government. Some report financial information while others report performance metrics. We identified internal control deficiencies related to the preparation of three key reports: the ETA 2112 report, the UI-3 report, and the ETA 9050 report. • The ETA 2112 report summarizes state UI tax collections, benefits paid, and other transactions affecting the unemployment trust fund. We reviewed all 24 reports submitted during fiscal years 2022 and 2023 and found the 12 submitted in fiscal year 2023 reported incorrect or incomplete benefit account disbursement data. The total disbursements reported in the benefits account deviated from bank data by at least $387,548, with one month reporting $3,596,028 fewer disbursements than the bank data. The June 2023 report’s ending benefits account balance was 50 percent, or $6,577,256, higher than the bank’s account balance. • The ETA 2208A report, or UI-3, is a quarterly report that summarizes department staff hours worked and paid in relation to various UI program categories. This information is used by the federal government to help determine the level of funding awarded for administrative costs for the UI program. We completed a sample of the eight reports submitted during fiscal years 2022 and 2023. The sample was not statistically valid. We tested, and found issues with, four of the reports as outlined below: o Three reports included employee time allocations that were not approved by the appropriate UI program supervisor. o One report used allocations other than those that were approved by the appropriate supervisor. o One report did not include all the required employee hours. o One report used incorrect prior period data to calculate year-to-date amounts. In addition, while reviewing supporting information, we identified errors in a fifth report that was not part of our chosen sample. The report contained data that differed from the supported calculation and department staff could not explain where the reported values came from. • The ETA 9050 report outlines the time it takes the state to pay benefits to claimants for the first week of unemployment. The department’s benefit management system produces the data used to populate the report. Every state is required to validate the ETA 9050 data through a process prescribed by the U.S. Department of Labor. The department did not validate the data during fiscal years 2022 and 2023, but it has not done so for many years prior to this time, and it is on a corrective action plan with the federal government as a result. Effect: Due to internal control deficiencies, the department did not comply with federal reporting requirements during fiscal years 2022 and 2023 and reported, in some instances, materially inaccurate information. In addition, not complying with federal reporting requirements could result in reduced funding for the almost $10 million in administrative costs incurred related to the UI program or result in additional conditions imposed by the federal government. Cause: Based on discussions with department personnel, the following were identified as the cause of the issues for the various reports: • ETA 2112 report, the department’s internal control procedures did not include a reconciliation of reported account balances to the related bank statements. • ETA 2208A report, the department’s procedures did not include an appropriate level of review and approval given the complicated nature of the report. • ETA 9050 report, the validation process involved technical difficulties and the department lacked resources to address the issue. During the audit period, resources were directed at migrating to a new benefits management system where the validation issue will be addressed. However, the department did not have another control in place to verify the accuracy and completeness of the ETA 9050 report data in the interim. Recommendation: We recommend the Department of Labor and Industry: A. Improve internal controls over the preparation of key Unemployment Insurance program reports, and B. Report accurate and complete report data on key Unemployment Insurance program reports as required by federal rules and regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-012: U.S. Department of Transportation ALN #20.205, 20.219, 20.224, Highway Planning and Construction Cluster (COVID-19) Grant #Not applicable Criteria: Federal regulation, 29 CFR 5.5, requires certified payrolls be submitted for each week in which any contract work is performed. Federal regulation, 29 CFR 5.6, indicates no payment be made if the contractor and its subcontractors are not in compliance with the provisions of 29 CFR 5.5. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. This establishes an expectation that the Montana Department of Transportation (department) will have internal controls to ensure contractors and subcontractors comply with wage rate requirements. Condition: The department’s internal controls were insufficient to ensure certified payrolls were received from all contractors weekly and prior to making monthly contractor payments, as required by federal regulations. Questioned Costs: While we did not identify known questioned costs, we project likely questioned costs of more than $25,000. These likely questioned costs are based on the active project testing and the likelihood that payments went out before the department received the required certified payrolls prior to payment. This impacts ALN # 20.205 Highway Planning and Construction Program. Context: As work is completed on highway construction projects, Daily Work Reports (DWR) are completed by department staff. These DWRs are required for each day contract work is being performed and include a list of each contractor performing work on site that day. Completing this information in the department’s construction and materials system (system) triggers a notification for the contractor or subcontractor to submit weekly certified payroll information. Contractors are paid monthly based on information in the system submitted and verified by the 25th of the previous month. In order for the contractor to be paid, the DWRs must be complete. The DWR functionality is not currently utilized by department staff to ensure certified payroll data has been received prior to payment. Active Project Testing As part of the current audit, we completed a sample of 17 of 158 active projects and reviewed them for completeness of DWRs. This sample was not statistically valid. Each project had multiple DWRs completed during the month we reviewed. We identified 10 projects that contained DWR errors within the month tested for that project. Within those 10 projects, we identified 54 errors indicating department personnel do not consistently or fully complete DWRs on days construction work was performed. Because certified payroll submission is required weekly, we defined timely completion of the DWR as within six calendar days of work. Our testing identified: • 20 DWRs completed 7 to 10 days past the construction date, • 16 DWRs completed 11 to 15 days past the construction date, and • Eight DWRs completed 16 or more days past the construction date. Of the DWRs completed more than 16 days past the construction date, four were completed 27 days after construction took place. These four late submissions resulted in the contractor not being paid timely as the DWR was completed after the 25th of the month which is the cutoff date for contractor payments. Additionally, late DWR completion resulted in untimely certified payrolls submissions. In eight of the active projects sampled, a total of 24 weekly certified payrolls were not received before the contractor payments, contrary to federal regulation. Delinquent payroll notifications within the system rely on the field inspectors’ completion of the DWRs. The delinquent payroll notifications cannot be effective if the contractor section of the daily work report is incomplete or untimely. Additionally, without tracking when the contractors are onsite, the department cannot ensure compliance with certified payroll requirements before issuing the monthly contractor payments. Closed Project Testing As reported in the prior audit finding #2021-002, we previously identified noncompliance with final contractor payments being issued without the certified payrolls for all weeks being obtained. As part of this audit, we completed a sample of 19 of 181 projects completed during the audit period and determined all certified payrolls were received by project close. This sample was not statistically valid. Repeat Finding: This is a repeat finding and has been reported as Single Audit findings 2017-028, 2019-026, and 2021-002 in the audits for the two fiscal years ending June 30, 2017, June 30, 2019, and June 30, 2021, respectively. Effect: These untimely or incomplete certified payroll submissions constitute noncompliance with federal regulations. Further, the department is in noncompliance with federal regulations requiring the withholding of payment until certified payrolls are submitted. Additionally, there is risk the department will not identify instances where contractors or subcontractors are not paying prevailing wages. Cause: While the system was implemented for all new projects let from October 2019 forward, the use of the system features is still not consistent across all project managers or districts, indicating additional training is necessary. For the certified payroll module to work, the department personnel must complete DWRs timely and fill in the contractor and subcontract performing on the day reported. The department’s internal control manual and requirements for project managers do not ensure compliance with federal certified payroll requirements. Department policy and procedure do not define when DWRs should be completed. Recommendation: We recommend the Montana Department of Transportation: A. Modify requirements in the department’s policy and procedures for daily work reports to define timely completion and require complete submission to assist with receipt of certified payrolls prior to payment. B. Provide training to department personnel regarding the use and system functionality of the daily work reports to enhance compliance with federal compliance requirements over certified payrolls. C. Obtain and review certified payrolls from contractors and subcontractors prior to payment, as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-013: U.S. Department of Transportation ALN #20.509, Formula Grants for Rural Areas (COVID-19) Grant #MT-2022-022-00 and MT-2023-011-00 Criteria: Federal regulation, 2 CFR 200.317, requires the Montana Department of Transportation (department) to follow state procurement policy when procuring property and services with federal funds. Federal regulation, 2 CFR 200.403, indicates costs must meet certain criteria to be allowable, such as being consistent with policies and procedures that apply uniformly to both federally and state financed activities of the department. Federal regulation, 2 CFR 200.332(d), requires the state to perform monitoring of subrecipients sufficient to ensure subrecipients have complied with federal requirements. Federal regulation, 2 CFR 200.313(d), requires the department to maintain accurate property records and have adequate internal controls to safeguard equipment purchased with federal funds. State policy in the Montana Operations Manual (MOM) policy requires all procurements either have a purchase order or contract. The purchase order or contract must include all elements negotiated and required for the purchase. Department policy and procedures require an inspection on each received vehicle be documented by a post-delivery certification. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department’s internal controls did not ensure vehicle procurement, funded by federal funds, followed state policy and procedures. Further, the department did not adequately review and monitor vehicle records to ensure compliance with federal requirements. Questioned Costs: We question $37,990 of costs charged to the program related to the vehicle purchase made without a contract. Context: In administering the Formula Grants for Rural Areas program, the department provides capital grants to subrecipients for purchase of equipment. The department utilizes a data processing system to obtain and store information from the subrecipients to assist in monitoring compliance with various requirements of the program. We reviewed the system information regarding equipment records, procurements, and subrecipient monitoring for the subrecipient’s equipment and procurement federal requirements. We sampled five of the department’s 15 vehicle purchases as part of our audit. This sample was not statistically valid. Our review identified: • Three purchases did not contain evidence of post-delivery certifications. • One purchase with inaccurate vehicle information in the system. • One purchase without a contract, totaling $37,990. The information maintained in the system is necessary to demonstrate compliance with federal procurement and equipment requirements. We analyzed the population of 127 vehicle records in the system and identified the records did not contain all the elements necessary to track and monitor vehicles purchased with federal funds properly. We conducted a sample of 23 vehicle records. The sample was not statistically valid. Our sample identified: • 11 vehicle records did not contain complete and accurate system information, including inaccurate VIN numbers and the condition of vehicle at time of inspection. • Three vehicles did not contain mileage reported. This information is used during the department’s biennial inspections of subrecipient fleet vehicles to determine reasonableness of mileage reimbursements. Repeat Finding: This is a repeat finding and was reported as Single Audit finding #2021-003 in the audit for the two fiscal years ended June 30, 2021. Effect: The department is not in compliance with state procurement policies and procedures. Additionally, the vehicle purchased without a contract resulted in questioned costs which the department may be required to repay to the federal government. Failure to complete post-delivery certifications may mean vehicles do not meet program specifications. Cause: The post-delivery certifications were overlooked by staff who completed the vehicle inspections at the time of delivery. Further, staff turnover and lack of necessary training contributed to the internal control deficiencies and noncompliance. Recommendation: We recommend the Montana Department of Transportation: A. Enhance internal controls and provide training to staff to ensure vehicle procurements follow state policy to comply with federal requirements. B. Enhance internal controls and provide training to staff to ensure information maintained in the system is complete and accurate. C. Comply with state procurement policy by using a contract agreement for all vehicle purchases. D. Complete and submit the post-delivery certifications, as required by department policy. E. Review and update the system vehicle records to ensure they are complete and accurate. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-014: U.S. Department of Transportation ALN #20.509, Formula Grants for Rural Areas (COVID-19) Grant #MT-2022-022-00 and MT-2023-011-00 Criteria: Federal regulation, 2 CFR 200.332, specifies the 14 required elements to communicate to subrecipients, the requirements for risk assessments, and monitoring during and after the award to ensure subrecipient compliance. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Montana Department of Transportation (department) did not ensure subrecipients of the Formula Grants for Rural Areas program funds were provided required information to identify their subaward or consistently assess and respond to risk levels for subrecipients, contrary to federal regulations. Previously reported internal control deficiencies continue to require improvement. Questioned Costs: No questioned costs identified. Context: The department provides operating and capital grant awards to subrecipients. The department’s 44 subrecipients include local government transit authorities, nonprofit organizations, and operators of public transportation or intercity bus services. As part of our audit, we conducted two samples to review various subrecipient monitoring requirements including award notification, risk assessment, and subrecipient reviews. Neither sample was statistically valid. In our sample of eight subrecipients that received federal funding during the audit period, we determined: • The department did not assess a risk level or perform post-award monitoring for two subrecipients. • The department, after assessing a higher level of risk to one subrecipient, did not conduct increased monitoring. Department policy requires staff perform additional reviews of all the subrecipient’s quarterly reports when higher risk levels are assigned. In our second sample, we reviewed five of 15 vehicle purchases made during the audit period. We determined two contracts did not contain the 14 elements, which include award identification and requirements, the department is required to communicate to subrecipients. Repeat Finding: This is a repeat finding and was reported as a Single Audit finding 2021-004 in the audit for the two fiscal years ended June 30, 2021. Effect: Without efficient internal controls over compliance to ensure all elements of subrecipient monitoring are followed, the department is noncompliant with federal regulations. Additionally, noncompliance with subrecipient monitoring could result in undetected noncompliance on the part of the subrecipients and potentially unidentified questioned costs. Cause: Department staff identified turnover and the need for training as reasons for the internal control deficiencies and noncompliance. Recommendation: We recommend the Montana Department of Transportation: A. Enhance internal controls and provide training to staff to ensure subrecipient monitoring is completed following department policy and procedure and federal subrecipient monitoring requirements. B. Perform and document risk assessments for subrecipients. C. Perform enhanced monitoring in response to higher assessed subrecipient risk levels. D. Include required elements in subaward agreements for vehicle purchases. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-015: U.S. Department of the Treasury ALN #21.027, Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Grant #SLFRP1747 Criteria: Federal regulation, 2 CFR 200.332, requires pass-through entities, as part of subrecipient monitoring, to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate monitoring. The activities of the subrecipient must then be monitored as necessary to ensure compliance. Pass-through entities are also responsible for verifying every subrecipient that expends $750,000 in federal awards in a fiscal year is audited. Non-federal entities are required to follow up on and resolve any findings pertaining to the federal award identified by these audits. Federal regulation, 2 CFR 200.303, requires non-federal entities to, among other things, establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Natural Resources and Conservation (department) did not have sufficient controls to ensure every subrecipient receiving State and Local Fiscal Recovery Fund (SLFRF) grant funds was evaluated for risk of noncompliance or reviewed for the applicability of single audit requirements, as required by federal regulations. Questioned Costs: No questioned costs identified. Context: As part of administering the SLFRF program, which was a new grant program for the department, subawards were made to local governments to improve drinking water access and support wastewater and stormwater infrastructure. We sampled 45 of 655 grant expenditure transactions totaling approximately $18.5 million. The sample was not statistically valid. We reviewed the subawards to determine if department controls were effective and if the department complied with program requirements. We found six local governments, affecting seven subawards, where the department did not obtain all information necessary to complete their risk assessments. In addition, due to the missing information on the risk assessments, the applicability of single audit requirements was not determined for those six local governments. Effect: Due to internal control deficiencies, the department did not comply with all subrecipient monitoring requirements for fiscal years 2022 and 2023. In addition, not establishing monitoring procedures based on a subrecipient’s risk level increases the risk of funds being used for unallowable costs, also increasing the department’s risk of noncompliance with other federal regulations. Cause: Based on our work and discussions with department staff, processes were in place to gather the necessary data, evaluate risk, and to determine the applicability of single audit requirements. However, these processes relied on subrecipient participation in a survey. If a survey was not returned, the risk assessment process remained incomplete, and the applicability of single audit requirements were not determined. The department did not establish procedures to address unreturned surveys. Recommendation: We recommend the Department of Natural Resources and Conservation: A) Enhance internal controls to ensure every subrecipient is evaluated for risk of noncompliance and reviewed for the applicability of single audit requirements. B) Perform all subrecipient monitoring activities as required by federal regulations. Views of Responsible Officials: The department partially concurs with this recommendation. The department disagrees with the interpretation that subrecipient monitoring activities must occur within a specified time period and believes controls were in place during the audit period. In addition, because the department’s policy is to assign every subrecipient the same risk level until an assessment is completed, it believes it is following subrecipient monitoring requirements. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. Assigning all subrecipients a common risk level is not the same as evaluating each subrecipient’s risk for the purpose of determining appropriate subrecipient monitoring. In addition, the department is subject to federal time requirements specific to monitoring subrecipient single audit reports. The subrecipient’s risk of noncompliance and single audit requirements are only documented as part of the risk assessment process, which was not completed for six subrecipients tested. In addition, four of the grants closed without this process being completed. As such, our recommendation stands.

Finding 2023-016: U.S. Department of the Treasury ALN #21.023, Emergency Rental Assistance (COVID-19) Grant #ERA-0425 (ERA 1) ERA-E0032 (ERA 2) Criteria: The Consolidated Appropriations Act, 2021, section 501, and the American Rescue Plan Act of 2021 (ARPA), section 3201, established the Emergency Rental Assistance (ERA) program and indicate who is eligible, including income thresholds, and that the recipient must be facing housing instability. They must have experienced a direct or indirect financial hardship due to the COVID-19 pandemic. This includes reduced income, receiving unemployment benefits, and past due rent and utilities. In addition, Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Commerce (department) received funding from the Federal government through the Consolidated Appropriations Act of 2021, and the American Rescue Plan Act of 2021 (ARPA) to establish the ERA Program. This program aided with housing and utility costs for those facing housing instability if they were impacted by the COVID-19 pandemic. Federal guidance allowed the department to receive a self-attestation about whether an applicant experienced a direct or indirect COVID financial hardship. While reviewing a sample of applicants from the ERA program, we determined that individuals received benefits despite the fact they self-attested that they did not experience a direct or indirect financial hardship due to COVID. Because the department did not identify these instances until our audit, the department’s controls were not sufficient. The department did perform a multi-level review of all applications, but that review did not catch these situations before assistance was paid to the individuals. Questioned Costs: We identified $154,648 in questioned costs. Context: The department has provided housing assistance to approximately 20,000 individuals. We performed a statistically valid sample of 45 individuals. Through the sample, we identified one recipient who did not meet eligibility requirements as they self-attested that they did not have a COVID hardship. To determine the extent of the issue, we obtained data from the department of all applicants who had a self-attestation indicating they did not experience a COVID hardship. Using this data, we found that 22 applicants received assistance despite indicating they had not experienced a financial hardship due directly or indirectly to COVID. These applicants were paid a total of $154,648 during the audit period. The department was unaware of the issue until we brought it to their attention. The agency stopped taking applications for this program on March 24, 2023, and the last application was processed in September 2023. Since learning of this issue, the department has indicated they confirmed the individuals who received assistance did experience financial hardship due to the COVID pandemic. However, this information was not available or documented in the application information when assistance was provided. Effect: The department is not in compliance with federal regulations, and we have identified questioned costs for this program. Cause: The department’s controls over the ERA program were inadequate to prevent noncompliance with federal requirements. The department indicates that they had a large number of applications to process quickly, along with quickly changing federal guidance. As a result, these instances were not prevented or detected and corrected in a timely manner. Recommendation: We recommend the Department of Commerce: A. Develop controls to comply with federal requirements. B. Comply with federal requirements for all new federal programs. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-017: U.S. Department of Education ALN #84.007, 84.033, 84.038, 84.063, 84.268, Student Financial Assistance Cluster (COVID-19) Grant #Various U.S. Department of Health & Human Services ALN #93.264, 93.364, 93.925, Student Financial Assistance Cluster Grant #Various Criteria: Federal law, 20 USC 1087ll, dictates what is to be included in the Cost of Attendance calculations. Additionally, it states that for less than half-time students (as determined by the institution), it only includes tuition and fees and an allowance for: (A) Books, supplies, and transportation, (as determined by the institution) (B) Dependent care expenses, and (C) Room and board costs. Federal regulation, 34 CFR 668.24(a)(3), requires institutions to maintain any program records that document its administration of the Title IV Higher Education Act (HEA) programs in accordance with all applicable requirements. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Internal controls at Montana State University (MSU) were insufficient to ensure review and approval of the cost of attendance (COA) calculations by someone not involved in creating it. Additionally, Montana State University – Northern (MSU Northern) and Great Falls College – Montana State University (Great Falls College MSU) did not have supporting documentation for some amounts used in the calculations, and MSU Northern included one unallowable item in the calculation. Questioned Costs: No questioned costs identified. Context: MSU comprises four campuses: Montana State University – Bozeman (MSU Bozeman), Montana State University – Billings (MSU Billings), MSU Northern, and Great Falls College MSU. Each campuses’ financial aid office calculates and awards financial aid to students based on the COA and the individual's expected family contribution. The COA typically includes: • Tuition and fees; • Allowance for books, supplies, transportation, and miscellaneous personal expenses; • Allowance for room and board; and • Allowances for dependent care, study abroad, cooperative education, disability-related costs, and student loan fees (where applicable). Each campus uses slightly different methodologies to create the COA, incorporating historical costs, estimated tuition and fee increases, meal plan and local rent averages, and consumer price index increases. Different COAs are established for various student categories: resident vs. nonresident, off-campus vs. on-campus, graduate, undergraduate, and full-time vs. part-time. To award aid in the spring, all COAs are calculated in the preceding winter. For instance, the COAs for the 2022-23 academic year (August 2022 through June 2023) were calculated between January and March 2022. During our audit, we tested the COAs for evidence of review by someone not involved in creating it. The results are summarized in the table below. See the Schedule of Findings and Questioned Costs for chart/table. The lack of a documented review of the COAs was a prior audit recommendation. Campus staff worked to update their processes to ensure the reviews were documented in the fall of 2022. As noted in the table above, we reviewed the COAs completed after the changes in winter 2023. We found the COAs consistently contained documentation of review by a staff member not involved in creating them. If the campuses continue to follow these new processes, this issue should be resolved. We performed a sample of 32 of the 1,361 total COAs for the academic years 2021-22 and 2022-23. This sample was for all eight Montana University System campuses, comprised of four University of Montana (UM) campuses and four MSU campuses, and was not statistically valid. The noncompliance identified for the MSU campuses is summarized below, and the noncompliance for the UM campuses is summarized in finding 2023-018. MSU Northern did not have adequate support to determine if the amounts used for Room & Board and Miscellaneous expenses for the 2021-22 and 2022-23 academic years were reasonable. We tested two COAs from both academic years during the audit period. Three of the four COAs tested did not have adequate support for Room & Board expenses; while all four COAs tested did not have adequate support for the Miscellaneous expenses used. Without proper documentation, we cannot determine if the Room & Board and Miscellaneous expenses included in the COA are reasonable. In addition, Miscellaneous expenses were included in the 2022-23 COA for less than half-time students. While Miscellaneous expenses are generally allowed per the Student Financial Aid Handbook, they are not allowed in COAs for students attending less than half-time. Great Falls College MSU did not have adequate support for the amounts used as the Books and Other Living expenses in the 2021-22 and 2022-23 COAs. We tested two COAs for each of the award years. Each COA contained a books expense that, while allowable and appearing reasonable, did not have support. Additionally, while the campus had documented amounts justifying increases in Other Living expenses, they did not have support for the base amounts used. Repeat Finding: Montana’s Single Audit for the two fiscal years ended June 30, 2021, included a recommendation (#2021-025) to each campus of Montana State University to document its internal controls over calculating the of Cost of Attendance. Effect: Unallowed and unsupported items were included in the 2021-22 and 2022-23 COA calculations at MSU Northern and Great Falls College MSU. This could result in students receiving an incorrect amount of financial aid. The MSU campuses did not comply with federal COA regulations. Additionally, without effective internal controls that ensure the Montana State University campuses are managing federal awards according to federal statutes and regulations, they are not in compliance with the federal requirement to maintain effective internal control over federal awards. Finally, the campuses could be fined by the Department of Education for not following the administrative requirements for the Student Financial Aid programs. Cause: This was a finding in the prior audit report issued in summer of 2022. By that time, the COA had already been completed for academic years 2021-22 and 2022-23, and thus, the campuses did not have time to implement any changes for the COAs calculated for the academic years covered during the audit period. Additionally, internal controls over the 2021-22 and 2022-23 COA calculations were insufficient to ensure the calculations were fully documented and supported, and only included allowed items at MSU Northern and Great Falls College MSU. Recommendation: We recommend: A. Each campus of Montana State University continue to implement internal controls to ensure the COA calculations are fully documented and supported and only include allowed items. B. MSU Northern and Great Falls College MSU comply with federal requirements governing the Student Financial Assistance programs by retaining required supporting documentation for the COA calculations. C. MSU Northern comply with federal requirements governing the Student Financial Assistance programs by only including allowed items in the COA calculations. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-018: U.S. Department of Education ALN #84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Cluster (COVID-19) Grant #Various U.S. Department of Health & Human Services ALN #93.342, Student Financial Assistance Cluster Grant #Various Criteria: Federal law, 20 USC 1087ll, dictates what is to be included in the Cost of Attendance calculations. Federal regulation, 34 CFR 668.24(a)(3), requires institutions to maintain any program records that document its administration of the Title IV Higher Education Act (HEA) programs in accordance with all applicable requirements. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Internal controls at three of the University of Montana (UM) campuses were insufficient to ensure review and approval of the cost of attendance (COA) calculations by someone not involved in creating it. Additionally, the University of Montana – Western (UM Western) did not have supporting documentation for some amounts used in the calculations. Questioned Costs: No questioned costs identified. Context: The UM is comprised of four individual campuses: University of Montana – Missoula (UM Missoula), Montana Technological University (MT Tech), University of Montana – Western (UM Western), and Helena College University of Montana (Helena College). Each campuses’ financial aid office calculates and awards financial aid to students based on the COA and the individual's expected family contribution. The COA typically includes: • Tuition and fees; • Allowance for books, supplies, transportation, and miscellaneous personal expenses; • Allowance for room and board; and • Allowances for dependent care, study abroad, cooperative education, disability-related costs, and student loan fees (where applicable). Each campus uses slightly different methodologies to create the COA, incorporating historical costs, estimated tuition and fee increases, meal plan and local rent averages, and consumer price index increases. Different COAs are established for various student categories: resident vs. nonresident, off-campus vs. on-campus, graduate, undergraduate, and full-time vs. part-time. To award aid in the spring, all COAs are calculated in the preceding winter. For instance, the COAs for the 2022-23 academic year (August 2022 through June 2023) were calculated between January and March 2022. During our audit, we tested the COAs for evidence of review by someone not involved in creating it. The results are summarized in the table below. See the Schedule of Findings and Questioned Costs for chart/table. The lack of a documented review of the COAs was a prior audit recommendation. Campus staff worked to update their processes to ensure the reviews were documented in the fall of 2022. As noted in the table above, we reviewed the COAs completed after the changes in winter 2023. We found the COAs consistently contained documentation of review by a staff member not involved in creating them. If the campuses continue to follow these new processes, this issue should be resolved. We performed a sample of 32 out of the 1,361 total COAs for the academic years 2021-22 and 2022-23. This sample was for all eight Montana University System campuses, comprised of four UM campuses and four Montana State University (MSU) campuses, and was not statistically valid. The noncompliance identified for the UM campuses is summarized below, and the noncompliance for the MSU campuses is summarized in finding 2023-017. UM Western did not have adequate support to determine whether the amount used for Books expenses in the 2021-22 COAs were reasonable. While including books expenses in the COA is acceptable per the Federal Student Aid handbook, the campus did not have support for the amount used. For the 2022-23 COAs, the campus fixed this and had support for the Books amount used, and we determined the amount used was reasonable. Repeat Finding: Montana’s Single Audit for the two fiscal years ended June 30, 2021, included a recommendation (#2021-027) to the University of Montana campuses to implement internal controls as required by federal regulations to ensure the COA calculations are accurate and supported. Effect: Unsupported items were included in the 2021-22 COA calculations at UM Western. This could result in students receiving an incorrect amount of financial aid. Additionally, not having internal controls in place could result in UM Missoula, UM Western, and Helena College including unallowed or unsupported items in the COA calculations. Without effective internal controls that ensure the University of Montana campuses are managing federal awards according to federal statutes and regulations, they are also not in compliance with the federal requirement to maintain effective internal control over federal awards. Finally, the campuses could be fined by the Department of Education for not following the administrative requirements for the Student Financial Aid programs. Cause: This was a finding in the prior audit report issued in summer of 2022. By that time, the COA had already been completed for academic years 2021-22 and 2022-23, and thus, the campuses did not have time to implement any changes for the COAs calculated for the academic years covered during the audit period. Additionally, internal controls over the 21-22 and 22-23 COA calculations were insufficient to ensure the calculations were fully documented and supported. Recommendation: We recommend: A. UM Missoula, UM Western, and Helena College continue to implement internal controls to ensure the Cost of Attendance calculations are fully documented and supported. B. UM Western comply with federal requirements governing the Student Financial Assistance programs by retaining required supporting documentation for the Cost of Attendance calculations. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-019: U.S. Department of Education ALN #84.007, 84.033, 84.038, 84.063, 84.268, Student Financial Assistance Cluster (COVID-19) Grant #Various U.S. Department of Health & Human Services ALN #93.264, 93.364, 93.925, Student Financial Assistance Cluster Grant #Various Criteria: Federal regulation, 34 CFR 675.19(b)(3), states, regarding the Federal Work Study program, each year an institution shall submit Fiscal Operations Reports plus other information the Secretary of Education (Secretary) requires. The institution shall ensure that the information reported is accurate and shall submit it on the form and at the time specified by the Secretary. Federal regulation, 34 CFR 674.19(d)(2), states regarding the Federal Perkins Loans program, each year an institution shall submit a Fiscal Operations Report plus other information the Secretary requires. The institution shall ensure that the information reported is accurate and shall submit it on the form and at the time specified by the Secretary. Federal regulation, 34 CFR 676.19(b)(3), requires, for the Federal Supplemental Educational Opportunity Grant program, institutions to submit the Fiscal Operations Report and other information required by the Secretary and to ensure the information reported is accurate. Federal regulation, 34 CFR 668.24(e)(1)(i), requires institutions to keep the Fiscal Operations Report and Application to Participate (FISAP) for the Federal Perkins Loan, Federal Work-Study, and Federal Supplemental Educational Opportunity Grant (FSEOG) programs and any records necessary to support the data contained in the FISAP for three years after the end of the award year in which the FISAP was submitted. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Controls at Montana State University – Bozeman (MSU Bozeman), Montana State University – Northern (MSU Northern), and Montana State University – Billings (MSU Billings) were not sufficient to ensure that the FISAP was complete and accurate in fiscal years 2022 and 2023. We identified multiple errors in the FISAP reports submitted by the three campuses. Questioned Costs: No questioned costs identified. Context: Each campus is required to complete the FISAP yearly for its campus-based programs. The campuses use the Fiscal Operations Report portion of the FISAP to report expenditures and students served in the previous award year. The Application to Participate portion of the FISAP is to apply for funding for the following year. We identified errors in both the dollar amounts and student counts reported by each campus that varied between 7% and 44%. As outlined in the table below, the total number of items with errors we identified indicate an internal control deficiency over the FISAP at these campuses. See the Schedule of Findings and Questioned Costs for chart/table. Effect: By reporting inaccurate information in the FISAP, the campuses are not in compliance with federal requirements and have violated one of the requirements in their program participation agreements with the Department of Education. This noncompliance could affect the amount of future funding awarded or the ability to participate in these programs. Additionally, they could be fined by the Department of Education for not following the administrative requirements for these programs. Cause: MSU Northern staff stated although it is their process to keep all supporting reports used in preparing the FISAP, they could not find the report to support the version submitted. MSU Billings staff stated the error was due to staff transposing a number while entering data, which was not caught in reviews. MSU Bozeman staff stated the error was an inconsistency in how two items were reported between years due to staff not looking at the prior year’s FISAP as part of completing the current one. Recommendation: We recommend MSU Bozeman, MSU Northern, and MSU Billings: A. Enhance internal controls to ensure the FISAP reports submitted are accurate and supported in compliance with federal regulations and B. Comply with federal requirements governing the Federal Perkins Loan, the Federal Work-Study, and Federal Supplemental Education Opportunity Grant programs by accurately completing the FISAP reports and maintaining the required supporting documentation. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-020: U.S. Department of Education ALN #84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Cluster (COVID-19) Grant #Various U.S. Department of Health & Human Services ALN #93.342, Student Financial Assistance Cluster Grant #Various Criteria: Federal regulation, 34 CFR 675.19(b)(3), states, regarding the Federal Work Study program, each year an institution shall submit Fiscal Operations Reports plus other information the Secretary of Education (Secretary) requires. The institution shall ensure that the information reported is accurate and shall submit it on the form and at the time specified by the Secretary. Federal regulation, 34 CFR 674.19(d)(2), states regarding the Federal Perkins Loans program, each year an institution shall submit a Fiscal Operations Report plus other information the Secretary requires. The institution shall ensure that the information reported is accurate and shall submit it on the form and at the time specified by the Secretary. Federal regulation, 34 CFR 676.19(b)(3), requires, for the Federal Supplemental Educational Opportunity Grant program, institutions to submit the Fiscal Operations Report and other information required by the Secretary and to ensure the information reported is accurate. Federal regulation, 34 CFR 668.24(e)(1)(i), requires institutions to keep the Fiscal Operations Report and Application to Participate (FISAP) for the Federal Perkins Loan, Federal Work-Study, and Federal Supplemental Educational Opportunity Grant (FSEOG) programs and any records necessary to support the data contained in the FISAP for three years after the end of the award year in which the FISAP was submitted. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Controls at the University of Montana – Western (UM Western), Montana Technological University (MT Tech), and Helena College University of Montana (Helena College) were not sufficient to ensure that the FISAP was complete and accurate in fiscal years 2022 and 2023. We identified multiple errors in the FISAP reports submitted by the three campuses. Questioned Costs: No questioned costs identified. Context: Each campus is required to complete the FISAP yearly for its campus-based programs. The campuses use the Fiscal Operations Report portion of the FISAP to report expenditures and students served in the previous award year. The Application to Participate portion of the FISAP is to apply for funding for the following year. We identified errors in both the dollar amounts and student counts reported by each campus that varied between 5% and 31%. As outlined in the table below, the total number of items with errors we identified indicate an internal control deficiency over the FISAP at these campuses. See the Schedule of Findings and Questioned Costs for chart/table. Repeat Finding: Montana’s Single Audit for the two fiscal years ended June 30, 2021, included a recommendation (#2021-031) for UM Western and Helena College to implement internal controls to ensure the FISAP reports are accurate and supported, and comply with federal requirements to accurately complete the FISAP reports and to maintain the required supporting documentation. Effect: By reporting inaccurate information in the FISAP, the campuses are not in compliance with federal requirements and have violated one of the requirements in their program participation agreements with the Department of Education. This noncompliance could affect the amount of future funding awarded or the ability to participate in these programs. Additionally, they could be fined by the Department of Education for not following the administrative requirements for these programs. Cause: UM Western stated they did identify the error after it was made, but university staff did not submit any corrections. The staff could not say why a correction was not submitted. The error at MT Tech was identified by the audit and university staff were unable to say why the errors were included in the FISAP. MT Tech staff submitted a correction after we identified and communicated the error. Helena College staff stated one of the errors was due to a systems issue with the Department of Education’s system used to submit the FISAP. For the other error, Helena College staff mistakenly included FWS students in the FSEOG information, and corrections were not submitted timely. Recommendation: We recommend UM Western, MT Tech, and Helena College: A. Enhance internal controls to ensure the Fiscal Operations Report and Application to Participate (FISAP) reports submitted are accurate and supported in compliance with federal regulations and B. Comply with federal requirements governing the Federal Perkins Loan, the Federal Work-Study, and Federal Supplemental Education Opportunity Grant programs by accurately completing the FISAP reports. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-021: U.S. Department of Education ALN #84.007, 84.033, 84.038, 84.063, 84.268, Student Financial Assistance Cluster (COVID-19) Grant #Various U.S. Department of Health & Human Services ALN #93.264, 93.364, 93.925, Student Financial Assistance Cluster Grant #Various Criteria: Federal regulation, 16 CFR 314, implements sections 501 and 505(b)(2) of the Gramm-Leach-Bliley Act (GLBA). The overall objectives of the GLBA are to: 1. Ensure the security and confidentially of customer information; 2. Protect against any anticipated threats or hazards to the security or integrity of such information; and 3. Protect against unauthorized access to, or use of, such information that could result in substantial harm or inconvenience to any customer. To achieve this, an institution shall “develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue.” Federal regulation, 16 CFR 314.4, further describes the specific elements needed to develop, implement, and maintain a security program. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Montana State University (MSU) campuses do not have sufficient controls in place to ensure compliance with the requirements of the GLBA, and we identified multiple instances of noncompliance with the GLBA. Questioned Costs: No questioned costs identified. Context: As part of administering the Student Financial Assistance program, MSU is considered a financial institution and is thus subject to the GLBA. MSU gathers and stores various types of sensitive information electronically related to students’ education and personal information, employees’ personal information, credit and bank account information, intellectual property, and personal health information. Personally identifiable information (PII) can include student names, mothers’ maiden names, social security numbers, identification numbers, or parent/guardian information. The GLBA is meant to safeguard this information and went into effect in 2003 but was not subject to audit until 2019. Security governance within the University system was reviewed in 2020-2021 as part of an information systems audit. Material noncompliance and internal control deficiencies with the GLBA requirements were identified as part of that audit. A lack of support, guidance, and oversight were all contributing to the university’s struggle to develop comprehensive security programs. Because it takes time for security programs to be developed and implemented, we focused our audit efforts on the steps MSU has taken to move toward GLBA compliance during the current audit period. Since the previous audit MSU hired a consultant, who completed a GLBA assessment, and has action plans to move towards compliance. The GLBA assessment noted noncompliance consistent with what was identified in the initial information systems audit, thus confirming the internal control deficiencies and noncompliance was still present during the current audit. Currently, MSU is waiting to formalize draft, foundational documents and implement major controls that will help lead to proper GLBA compliance. The university system as a whole has also improved security governance to better guide and monitor security programs for each university. Repeat Finding: Montana’s Single Audit for the two fiscal years ended June 30, 2021, included a recommendation (#2021-022) to MSU to complete a comprehensive Information Technology (IT) risk assessment. Effect: MSU is not in compliance with federal requirements. These federal requirements are in place to ensure a secure environment for customer information. Any missing controls over these requirements could result in the mishandling of customer information. The security programs needed to meet the federal requirements will involve many aspects of MSU’s operations and, as a result, will have significant costs. Because there are various ways MSU could implement controls to become compliant with GLBA, all of which would have varying costs, we are not able to estimate the total cost to implement these recommendations. Cause: Recently, OCHE has implemented a reporting structure to monitor IT governance across the university system and delegated the authority to administer their own information network to the major campuses, leaving this responsibility to MSU. As a result, campuses are responsible for assessing their IT environments and security programs for various risks from external threats, weak controls, and compliance with state and federal requirements. While MSU works towards a mature security program, MSU does not have sufficient controls to ensure complete compliance with the GLBA requirements at this time. Recommendation: We recommend Montana State University: A. Continue to develop and implement internal controls to comply with the GLBA requirements, and B. Continue to work towards GLBA compliance. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-022: U.S. Department of Education ALN #84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Cluster (COVID-19) Grant #Various U.S. Department of Health & Human Services ALN #93.342, Student Financial Assistance Cluster Grant #Various Criteria: Federal regulation, 16 CFR 314, implements sections 501 and 505(b)(2) of the Gramm-Leach-Bliley Act (GLBA). The overall objectives of the GLBA are to: 1. Ensure the security and confidentially of customer information; 2. Protect against any anticipated threats or hazards to the security or integrity of such information; and 3. Protect against unauthorized access to, or use of, such information that could result in substantial harm or inconvenience to any customer. To achieve this, an institution shall “develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue.” Federal regulation, 16 CFR 314.4, further describes the specific elements needed to develop, implement, and maintain a security program. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The University of Montana (UM) campuses do not have sufficient controls in place to ensure compliance with the requirements of the GLBA, and we identified multiple instances of noncompliance with the GLBA. Questioned Costs: No questioned costs identified. Context: As part of administering the Student Financial Assistance program, UM is considered a financial institution and is thus subject to the GLBA. UM gathers and stores various types of sensitive information electronically related to students’ education and personal information, employees’ personal information, credit and bank account information, intellectual property, and personal health information. Personally identifiable information (PII) can include student names, mothers’ maiden names, social security numbers, identification numbers, or parent/guardian information. The GLBA is meant to safeguard this information and went into effect in 2003 but was not subject to audit until 2019. Security governance within the University system was reviewed in 2020-2021 as part of an information systems audit. Material noncompliance and internal control deficiencies with the GLBA requirements were identified as part of that audit. A lack of support, guidance, and oversight were all contributing to the university’s struggle to develop comprehensive security programs. Because it takes time for security programs to be developed and implemented, we focused our audit efforts on the steps UM has taken to move toward GLBA compliance during the current audit period. Since the previous audit UM hired a consultant, who completed a GLBA assessment, and has action plans to move towards compliance. The GLBA assessment noted noncompliance consistent with what was identified in the initial information systems audit, thus confirming the internal control deficiencies and noncompliance was still present during the current audit. Currently, UM is waiting to formalize draft, foundational documents and implement major controls that will help lead to proper GLBA compliance. The university system as a whole has also improved security governance to better guide and monitor security programs for each university. Repeat Finding: Montana’s Single Audit for the two fiscal years ended June 30, 2021, also included a recommendation (#2021-023) to UM to update and formalize job descriptions for positions that have responsibilities for developing, maintaining, or supporting the security program, and complete a comprehensive Information Technology (IT) risk assessment. Effect: UM is not in compliance with federal requirements. These federal requirements are in place to ensure a secure environment for customer information. Any missing controls over these requirements could result in the mishandling of customer information. The security programs needed to meet the federal requirements will involve many aspects of UM’s operations and, as a result, will have significant costs. Because there are various ways UM could implement controls to become compliant with GLBA, all of which would have varying costs, we are not able to estimate the total cost to implement these recommendations. Cause: Recently, OCHE has implemented a reporting structure to monitor IT governance across the university system and delegated the authority to administer their own information network to the major campuses, leaving this responsibility to UM. As a result, campuses are responsible for assessing their IT environments and security programs for various risks from external threats, weak controls, and compliance with state and federal requirements. While UM works towards a mature security program, UM does not have sufficient controls to ensure complete compliance with the GLBA requirements at this time. Recommendation: We recommend the University of Montana: A. Continue to develop and implement internal controls to comply with the GLBA requirements, and B. Continue to work towards GLBA compliance. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-023: U.S. Department of Education ALN #84.007, 84.033, 84.038, 84.063, 84.268, Student Financial Assistance Cluster (COVID-19) Grant #Various U.S. Department of Health & Human Services ALN #93.264, 93.364, 93.925, Student Financial Assistance Cluster Grant #Various Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Montana State University (MSU) does not have sufficient controls to ensure employees do not receive compensation prohibited by federal regulations. Questioned Costs: No questioned costs identified. Context: The Montana University System (MUS) Staff Compensation Plan applies to all staff at MUS campuses, excluding student employees, faculty, coaches, and those with employment contracts or appointment letters. Staff can receive various compensation adjustments, including strategic pay adjustments for retention and in-range progress reflecting increased job knowledge and duties, as well as lump sum bonuses. Pay adjustments are initiated by an employee’s supervisor, approved, and then processed by the human resources office (HR). Federal regulations prohibit MSU from providing commissions, bonuses, or other incentives based on securing enrollment or financial aid. The MUS Staff Compensation Plan does not explicitly prohibit such payments. The pay adjustment process does not verify that employees involved in enrollment, admissions, or financial aid are not receiving incentive compensation. Forms justifying pay increases often cite factors like quantity and revenue generation. Since quantity and revenue generation can be related to recruiting students, there is an increased risk of pay adjustments being tied to enrollment or financial aid success. Nonetheless, our testing found no instances of prohibited incentive compensation. While this prohibition has been in place since 2012, it was not subject to audit until 2023. When we initially asked human resources staff about the prohibition, there was limited to no awareness of the requirements. This is likely related to the compensation plan not addressing it. However, later in the audit, staff indicated the Student Financial Aid and Admissions personnel were aware of the activities expressly prohibited by the federal regulations. Effect: If MSU does not perform checks to ensure that no commissions, bonuses, or other incentive payments were paid to employees involved in enrollment, admissions, or financial aid, they could be paying those employees for unallowed compensation. This could result in questioned costs and noncompliance with federal program requirements. Cause: MSU staff believe their current process has sufficient internal controls to prevent material noncompliance with the incentive compensation requirements. Specifically, they are relying on the supervisor’s knowledge of these requirements to catch anything in the review process. However, without any documented policies or language on the approval forms, when positions turnover, there is risk for noncompliance. Recommendation: We recommend that all Montana State University campuses enhance internal controls to ensure employees do not receive compensation prohibited by federal regulations. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-024: U.S. Department of Education ALN #84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Cluster (COVID-19) Grant #Various U.S. Department of Health & Human Services ALN #93.342, Student Financial Assistance Cluster Grant #Various Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The University of Montana (UM) does not have sufficient controls to ensure employees do not receive compensation prohibited by federal regulations. Questioned Costs: No questioned costs identified. Context: The Montana University System (MUS) Staff Compensation Plan applies to all staff at MUS campuses, excluding student employees, faculty, coaches, and those with employment contracts or appointment letters. Staff can receive various compensation adjustments, including strategic pay adjustments for retention and in-range progress reflecting increased job knowledge and duties, as well as lump sum bonuses. Pay adjustments are initiated by an employee’s supervisor, approved, and then processed by the human resources office (HR). Federal regulations prohibit UM from providing commissions, bonuses, or other incentives based on securing enrollment or financial aid. The MUS Staff Compensation Plan does not explicitly prohibit such payments. The pay adjustment process does not verify that employees involved in enrollment, admissions, or financial aid are not receiving incentive compensation. Forms justifying pay increases often cite factors like quantity and revenue generation. Since quantity and revenue generation can be related to recruiting students, there is an increased risk of pay adjustments being tied to enrollment or financial aid success. Nonetheless, our testing found no instances of prohibited incentive compensation. While this prohibition has been in place since 2012, it was not subject to audit until 2023. When we initially asked human resources staff about the prohibition, there was limited to no awareness of the requirements. This is likely related to the compensation plan not addressing it. However, later in the audit, staff indicated the Student Financial Aid and Admissions personnel were aware of the activities expressly prohibited by the federal regulations. Effect: If UM does not perform checks to ensure no commissions, bonuses, or other incentive payments were paid to employees involved in enrollment, admissions, or financial aid they could be paying those employees for unallowed compensation. This could result in questioned costs and noncompliance with federal program requirements. Cause: UM staff believe their current process has sufficient internal controls to prevent material noncompliance with the incentive compensation requirements. Specifically, they are relying on the supervisor’s knowledge of these requirements to catch anything in the review process. However, without any documented policies or language on the approval forms, when positions turnover, there is risk for noncompliance. Recommendation: We recommend that all of the University of Montana campuses enhance internal controls to ensure employees do not receive compensation prohibited by federal regulations. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-025: U.S. Department of Education ALN #84.007, 84.033, 84.038, 84.063, 84.268, Student Financial Assistance Cluster (COVID-19) Grant #Various U.S. Department of Health & Human Services ALN #93.264, 93.364, 93.925, Student Financial Assistance Cluster Grant #Various Criteria: Federal regulation, 34 CFR 668.166(a), allows an institution to maintain a cash balance of any amount of Title IV Higher Education Act (HEA) funds for up to three business days before it becomes excess cash. Federal regulation, 34 CFR 668.166(b), allows an institution to maintain an excess cash tolerance of less than one percent of their prior year’s drawdowns for up to seven calendar days. The institution must immediately return any amount of excess cash over the one percent tolerance and any amount of excess cash remaining in its account after the seven-day period. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Controls at Montana State University – Bozeman (MSU Bozeman), Montana State University – Northern (MSU Northern), Montana State University – Billings (MSU Billings), and Great Falls College – Montana State University (Great Falls College MSU) were not sufficient to ensure the campuses were not maintaining excess cash balances of HEA funds. We identified multiple instances of excess cash balances at these campuses during the audit period. Questioned Costs: No questioned costs identified. Context: Montana State University (MSU) has four campuses: MSU Bozeman, MSU Billings, MSU Northern, and Great Falls College MSU. Each of these campuses receives funding from the Department of Education (ED) as part of the Student Financial Assistance Program (SFA). The amount of funds available for each campus to draw from ED and disburse to students depends on the individual program within SFA, the amount of money awarded to and accepted by students, and the amount already disbursed. For the Pell Grant and Direct Loan programs, the amount available is the total of each student’s awards and depends on the students who attend each campus; thus, fluctuates throughout the year. For the Federal Supplemental Educational Opportunity Grants (FSEOG) and Federal Work-Study (FWS) programs, the amount available is a flat amount awarded to each campus for each year. It does not fluctuate based on the number of students who are eligible. ED’s Common Origination and Disbursement system (COD) shows the total amount awarded, already disbursed to students, and available for each program. Regardless of the program, all campuses are under the advance payment method, which allows them to draw down funds (request payment) prior to disbursement. We analyzed the cash balances for each campus and found multiple instances where each had excess cash for one or more of the SFA programs during the audit period. These instances varied significantly in length. For example, MSU Bozeman maintained an excess cash balance for 368 days in the FWS program but only 1 day for the Direct Loan program. The number of instances of excess cash we identified for each campus are summarized in the table below. See the Schedule of Findings and Questioned Costs for chart/table. Effect: MSU Bozeman, MSU Northern, MSU Billings, and Great Falls College MSU did not comply with federal cash management requirements. As a result, the campuses had excess cash that should have been returned to the federal government but was not. The excess cash balances resulted in the MSU Bozeman campus earning $29,119 in interest on the excess cash during the audit period. This noncompliance could affect the amount of future funding awarded or the ability to participate in these programs. Additionally, they could be fined by the Department of Education for not following the administrative requirements for these programs. Cause: Staff at MSU Billings, MSU Northern, and Great Falls College MSU staff attributed the balances to the complexity of the program activity as SFA funds are constantly being disbursed to students, adjusted for changes in student circumstances, and reported to and drawn from ED. MSU Northern staff also attributed the FSEOG balances to the state match portion of the funds that is deposited in the account. These funds are deposited in total at the beginning of the school year and then spent down. However, we removed the state activity as part of our analysis and the excess cash balances reported above remained. MSU Bozeman staff do not believe the cash balances were created by program funds from the current audit period for FWS and FSEOG for multiple reasons: • The state match portion of the FSEOG funds is deposited in the account along with the federal funds. These funds are deposited in total at the beginning of the school year and then spent down. However, we removed the state activity as part of our analysis and the excess cash balances reported above remained. • There were non-financial aid funds that were temporarily placed into the FWS account while a separate account was created. Staff stated they lost track of the new account and these funds remained in the FWS account for the majority of the audit period. However, we removed these funds as part of our analysis and the excess cash balances reported above remained. • In total, the FWS and FSEOG programs have had $76,894 in cash in their accounts since 2000. University staff do not know the history of these funds and are unable to determine the source of this cash. However, given these accounts are intended to only be used for SFA activity, it is likely these balances were excess cash from these programs at some point. As such, they should have been returned to the Department of Education or disbursed to students long ago. Finally, MSU Bozeman staff believe the Direct Loan instance represents an appropriate cash balance for the three business days plus the afforded tolerance of up to seven days. However, while the balance was reduced after three business days, it was not within the seven-day tolerance level. Recommendation: We recommend MSU Bozeman, MSU Northern, MSU Billings, and Great Falls College MSU: A. Enhance internal controls to ensure compliance with federal cash management requirements. B. Comply with federal requirements over cash management and excess cash. Views of Responsible Officials: MSU Billings, MSU Northern, and Great Falls College MSU concur with the recommendation. MSU Bozeman conditionally concurs with the recommendation. While management agree with the excess cash balances for the FWS and FSEOG programs, they do not agree with the instance related to the Direct Loan program. Management believes that while their records show a positive cash balance on the third day, it was negative by day four, which is within the seven-day tolerance. Rebuttal of Views of Responsible Officials: We considered MSU Bozeman’s conditional concurrence with the recommendation. We agree the excess Direct Loan program cash balance was eliminated within seven days. However, the seven-day tolerance is only applicable if the excess cash balance is within one percent of their prior year’s drawdowns. At $1,127,403, the amount was not within this one percent tolerance, which was approximately $639,000. As such, our recommendation stands.

Finding 2023-026: U.S. Department of Education ALN #84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Cluster (COVID-19) Grant #Various U.S. Department of Health & Human Services ALN #93.342, Student Financial Assistance Cluster Grant #Various Criteria: Federal regulation, 34 CFR 668.22(c)(1), outlines how an institution determines a student’s withdrawal date to calculate the amount of the term attended by the student. Federal regulation, 34 CFR 668.22(c)(4), requires an institution to document a student’s withdrawal date and maintain the documentation as the date of the institution’s determination that a student withdrew. Federal regulations, 34 CFR 668.22(g)(1) and (2), require institutions to return the lesser of the total unearned Title IV assistance or an amount equal to the student's total institutional charges multiplied by the percentage of unearned Title IV assistance. Institutional charges used in this calculation include only tuition, fees, room and board, and other educational expenses assessed by the institution. Federal regulation, 34 CFR 668.22(j)(1), requires an institution to return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution’s determination that the student withdrew. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Internal controls at the University of Montana – Missoula (UM Missoula) and the University of Montana – Western (UM Western) were not sufficient to ensure accurate calculations and timely returns of unearned Title IV aid for a significant portion of the audit period. During fiscal year 2022, UM Missoula failed to comply with federal regulations regarding these returns in multiple instances. Questioned Costs: No questioned costs identified. Context: Each university awards federal financial aid based on the cost of attendance and the student's expected family contribution. This cost is determined before the academic year based on the student’s anticipated enrollment. If a student drops courses or withdraws from the university, their aid must be adjusted. For students who withdraw completely, federal regulations require the university to calculate the aid earned based on the time attended. If the student attended less than 60% of the term, unearned aid must be returned to the federal government within 45 days. During the prior audit, we found UM Missoula and UM Western had material weaknesses in internal controls and material noncompliance related to returning Title IV funds. As part of the Department of Education’s follow-up on the prior recommendation, both campuses performed additional analysis. They identified additional funds to be returned (indicating the initial calculations were incorrect) through November 2022. Based on this timing, the internal control weakness, along with likely noncompliance, continued through approximately 17 months of the current audit period. We did not test compliance for this period because material noncompliance had already been identified. UM Missoula recalculated all 360 students who withdrew during the first year of the audit period, finding 71 errors and returning an additional $87,708. Because these funds were returned before the audit, we did not consider them questioned costs. The audit focused testing on changes the campuses had made to their processes and returns calculated after November 2022. Staff at both campuses worked to update their processes and policies to prevent future errors. We reviewed these changes from November 2022 through June 30, 2023, which affected the fall 2022 and spring 2023 semesters, and found the new control activities were in place and consistently performed. If UM Missoula and UM Western continue to follow these new processes, this issue should be resolved. Although material noncompliance had already been identified for the audit period based on the UM Missoula recalculations alone, we reviewed returns for six students at UM Missoula and four at UM Western, to determine if the new processes resulted in correct calculations. We determined returns for the 10 students were correctly completed and supported. Repeat Finding: Montana’s Single Audit for the two fiscal years ended June 30, 2021, included a recommendation (#2021-028) to UM Missoula to enhance internal controls to ensure the amount of financial aid to be returned is calculated correctly and the aid is returned to ED timely; to UM Western to implement internal controls to ensure the amount of financial aid to be returned is calculated correctly and supporting documentation is maintained; and to both campuses to comply with the federal requirements governing the return of Title IV funds process. Effect: Without effective internal controls that ensure that UM Missoula and UM Western are managing federal awards according to federal statutes and regulations, they are not in compliance with the federal requirement to maintain effective internal control over federal awards. Additionally, UM Missoula did not comply with the federal return of Title IV requirements. Finally, the campuses could be fined by the Department of Education for not following the administrative requirements for the Student Financial Aid programs. Cause: As part of the prior audit, we determined UM Missoula and UM Western had a material weakness in internal controls and material noncompliance. When this issue was communicated in spring 2022, most of the first year of the audit period was already complete, meaning they could not address the issues for at least the first half of the audit period. As noted above, UM Missoula and UM Western changed their processes to address this issue in fall 2022, and if they continue to follow the new processes, this should be resolved. Recommendation: We recommend: A. UM Missoula and UM Western continue to follow their improved processes to ensure accurate calculations and timely return of unearned Title IV aid, and B. UM Missoula comply with federal regulations to accurately calculate and timely return unearned Title IV aid. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-027: U.S. Department of Education ALN #84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Cluster (COVID-19) Grant #Various U.S. Department of Health & Human Services ALN #93.342, Student Financial Assistance Cluster Grant #Various Criteria: Federal regulation, 34 CFR 685.309(b), outlines the enrollment reporting process requirements for schools participating in the Direct Loan program. It states upon receipt of an enrollment report from the Secretary of Education (Secretary), a school must update all information included in the report and return the report within the allowed timeframe and in the manner and format prescribed by the Secretary. Additionally, on behalf of a student who receives a loan under Title IV of the Higher Education Act, the school must notify the Secretary within 30 days (unless its next updated enrollment report is to be submitted within the next 60 days) if the student has a change of address or drops below at least half-time enrollment. Federal regulation, 34 CFR 690.83(b)(2), states an institution shall submit, in accordance with deadline dates established by the Secretary, through publication in the Federal Register, other reports and information the Secretary requires and shall comply with procedures the Secretary finds necessary to ensure that the reports are correct. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Controls at the University of Montana – Missoula (UM Missoula, campus) were not sufficient to ensure that federal enrollment reporting was complete and accurate. We identified errors in the enrollment reporting for the academic years 2021-2022 and 2022-2023 at UM Missoula. Questioned Costs: No question costs identified. Context: The Department of Education (ED) requires each campus to complete student enrollment reporting throughout the year. ED maintains a central federal database, the National Student Loan Data System (NSLDS), that houses student enrollment information. Periodically, NSLDS provides a roster file of enrollment information for students who receive Pell Grants or Direct Loans. UM Missoula must review, update, and verify student enrollment statuses, program information, and effective dates within 15 days of receiving the file. Although ultimately responsible for all reporting, UM Missoula uses a third-party organization, the National Student Clearinghouse (clearinghouse), to complete the reporting. Campus staff extracts the current enrollment information from the university’s computer system, Banner, which houses various campus data including student data. UM Missoula uses standard reports and reviews them for errors and students who should not be included. Staff then send the report to the clearinghouse, which matches it up to the roster file provided by ED and sends it back to NSLDS. If NSLDS identifies errors or inconsistencies, they provide an error file that must be corrected and resubmitted within 10 days. We identified the following errors in enrollment reporting at UM Missoula: • From July 2021 through September 2022, UM Missoula did not complete the required enrollment reporting for 306 students. While these students were not included in the required enrollment reporting, all received their intended federal aid. These students either did not provide a social security number when applying for admission or initially attended as dual enrollment students, and Banner was not updated once enrolled as a regular student. These two situations are described in further detail as follows: Missing Social Security Numbers (SSN): Students are not required to provide SSNs during the campus admissions process but must do so to receive federal financial aid through the Free Application for Federal Student Aid (FAFSA). If a student provides their SSN only through the FAFSA, it is stored in the financial aid Banner data and not included in reports run by campus staff, resulting in unreported SSNs. Since the SSN is how data is matched to NSLDS student records, these students do not get reported. Dual Enrollment Students: Eligible Montana high school students can take college courses for free or at a reduced cost. At UM Missoula, these students are marked in Banner with a specific attribute code, which is filtered out since they are not eligible for federal financial aid. However, this code is not updated when these students become regular students. We identified the missing SSNs and dual enrollment noncompliance above in the prior audit in spring of 2022. UM Missoula staff worked through the issue as part of responding to the prior audit finding and corrected the errors identified by the end of September 2022. Staff worked to update their processes and policies to ensure these errors would not continue. We reviewed these changes from September 2022 through June 30, 2023, and found the new control activities were in place and consistently performed. However, we did not test individual students during this period, as material noncompliance had already been identified for the audit period. If UM Missoula continues to follow these new processes, this issue should be resolved. • For fiscal years 2022 and 2023, program length and program type were misreported for an estimated 150-200 students due to programming rules in Banner. Banner has default program durations and program types which were set approximately 10 years ago that do not necessarily match current programs. Staff were unaware of these defaults, resulting in misreported data. • From March 2023 through June 2023 the program enrollment and beginning dates were misreported. An update to Banner resulted in the Banner extract reverting certain dates to the student original enrollment date instead of the program enrollment and begin dates required by federal regulations. Repeat Finding: Montana’s Single Audit for the two fiscal years ended June 30, 2021, included a recommendation (#2021-029) to UM Missoula to improve internal controls to ensure all required students are reported to NSLDS and comply with federal requirements governing the enrollment reporting process. This recommendation was specifically related to the noncompliance in the first bullet in the section above. Effect: By not reporting students as required UM Missoula is not in compliance with federal enrollment reporting requirements. By not having internal controls over this process, UM Missoula is also noncompliant with federal requirements requiring internal controls. These students would also not be considered enrolled from the perspective of ED. Additionally, UM Missoula could be fined by the Department of Education for not following the administrative requirements for these programs. Cause: Controls are not sufficient to ensure that enrollment reporting is complete and accurate. Internal controls ensure staff understand the processes to report the required data, and how that data is stored. Campus staff lacked the training and knowledge of how the data is stored and coded in Banner to produce accurate and complete reports. While staff identified many of these issues while working through returned errors, the underlying issues were in place for multiple months to years before staff identified the issue. Recommendation: We recommend the University of Montana – Missoula: A. Enhance internal controls to ensure all required students are reported to NSLDS and staff are aware of Banner programming rules, and B. Comply with the federal requirements governing the enrollment reporting process. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-028: U.S. Department of Education ALN #84.425E and 84.425F, Education Stabilization Fund (ESF) (COVID 19) Grant #P425E200626, P425F204054 Criteria: The Office of Management and Budget 2022 and 2023 Compliance Supplements (Section III, Part L) for the Higher Education Emergency Relief Fund (HEERF) program require three components of reporting: quarterly public reporting on the Student Aid Portion, quarterly public reporting on the Institutional Aid Portion, and annual reporting on all funds. The Office of Management and Budget 2023 Compliance Supplement (Section III, Part L) for the HEERF program stated ED collected an annual report for HEERF grantees in March 2023 covering calendar year 2022 expenditures. It refers to the U.S. Department of Education’s Education Stabilization Fund – Higher Education Emergency Relief Fund (HEERF) Data Collection Tool User Guide published March 2023, which states the calendar year 2022 reporting tool will close March 24, 2023, on page 1. The Office of Management and Budget 2022 Compliance Supplement (Section III, Part L) for the HEERF program states the quarterly public reporting for the Student Aid Portion (ALN 84.425E) must be updated no later than 10 days after the end of each calendar quarter. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Internal controls were not sufficient to ensure the University of Montana – Missoula (UM Missoula) completed required quarterly reports accurately and submitted those reports timely for the Higher Education Emergency Relief Fund (HEERF) program. UM Missoula also did not maintain documentation of their review of those reports. We identified multiple instances where UM Missoula did not comply with the reporting requirements for the HEERF program. Questioned Costs: No questioned costs identified. Context: The Education Stabilization Fund (ESF) was established in March 2020 to aid educational institutions in their efforts to prevent, prepare for, and respond to the coronavirus and its impact on institutions of higher education. Higher education institutions received funding under the HEERF program. Most of UM Missoula’s funding was in grants for emergency student financial aid and to cover coronavirus-related expenses, including lost revenue. During the audit period, UM Missoula disbursed $10,818,525 in emergency financial aid to students and received $11,754,099 in lost revenue reimbursement. The U.S. Department of Education required institutions to submit quarterly and annual reports detailing the use of HEERF funds for both Student Aid and Institutional Aid and to publicly post the quarterly reports. We identified the following issues with UM Missoula’s HEERF reporting: Public Quarterly Reports – Student Aid: We reviewed four Student Aid Portion public quarterly reports. We found the report for the quarter ending September 30, 2021, was posted on October 18, 2021, ten days after the due date. We also found that two reports were missing key line items: • Report for the quarter ending December 31, 2021: o Total number of eligible students. o Total number of students who received a grant. o Methods used to determine which students received grants and how much. • Reports for the quarters ending September 30, 2022: o Total number of eligible students. o Methods used to determine which students received grants and how much. Quarterly Expenditure and Budgeting Reporting We performed a sample of four out of the eight Quarterly Expenditure and Budgeting Reporting for all HEERF I, II, and III grant funds reports from the audit period. The sample was not statistically valid. We found the following errors: • Report for the quarter ended September 30, 2022: o The total amount of funds disbursed to students for emergency financial aid grants to date for the program was underreported by $2,274. The amount was reported as $18,424,028, but the support stated the total was $18,426,304. o The amount of HEERF student aid funds remaining was overreported by $2,274. The amount was reported as $183,097 when it should be $180,823. o The amounts disbursed to students for all HEERF funds for the quarter were incorrectly reported as $0. The support shows $677,225 in total, $398,675 for undergraduates, and $278,550 for graduates. o The average amounts awarded per student for the quarter were incorrectly reported as $0, but there should be amounts reported as financial aid grants were made with the funds. Based on the other amounts in the report, the amounts should be $271 in total, $290 for undergraduates, and $248 for graduates. • Reports for the quarter ended March 31, 2023, and June 30, 2023: o The total amount of funds disbursed to students for emergency financial aid grants to date for the program was underreported by $2,274. The amount was reported as $18,424,028, but the support stated the total was $18,426,304. University staff intended for these quarterly reports to be reviewed by both Business Services and Financial Aid staff. In our review of the four reports, we found: • Quarter ended December 31, 2021, had no evidence of review by either department. • Quarters ended September 30, 2022, and March 31, 2023, had no evidence of review by Business Services. • Quarter ended June 30, 2023, had no evidence of review by Financial Aid. Annual Reports: We also reviewed the two annual reports due during the audit period, covering calendar years 2021 and 2022. Staff could not provide support for reported lost revenue from auxiliary services sources, canceled ancillary events, and parking in the calendar year 2021 report. We also found that the calendar year 2022 report was submitted twenty-five days past the March 24, 2023, due date, and staff could not provide support for the total lost revenue amount reported. The American Rescue Plan Act created two new required uses for the HEERF institutional funds: (a) to implement evidence-based practices to monitor and suppress coronavirus in accordance with public health guidelines and (b) conduct direct outreach to financial aid applicants about the opportunity to receive a financial aid adjustment due to the recent unemployment of a family member or independent student, or other circumstances. UM Missoula had expenses related to these new requirements but did not report them. Effect: UM Missoula is not in compliance with the reporting requirements for the HEERF program. Additionally, without effective internal controls to ensure UM Missoula is managing federal awards according to federal statutes and regulations, the university is not in compliance with the federal requirement to maintain effective internal control over federal awards. UM Missoula is also at risk for additional enforcement actions by or increased scrutiny from the Department of Education. Cause: The University staff's explanation for the lack of supporting documentation due to staff turnover is understandable. However, it's crucial to note that while current staff were able to provide documents upon request, these did not always align with the reported amounts. This discrepancy raises significant uncertainty about the original intent of these documents, whether they were initially intended to support the reports or were discovered later for the audit. Staff explained that the September 30, 2021, quarterly report was submitted late because the awarding process was incomplete. Staff further stated the annual report was late due to the notifications being sent to an inactive email address. Regarding the new ARPA requirements, staff reported all as lost revenue since their lost revenue amounts exceeded the amount of their grant award, instead of offsetting direct expenditures. For direct outreach costs, staff intended to charge the assistant financial aid director’s time to the HEERF institutional grant fund but did not. Thus, although these expenses were incurred, they were not charged or reported to HEERF funds. For Student Aid public reporting, UM Missoula posted its quarterly reports submitted to the Department of Education on its website. However, as these reports were not designed solely for public reporting, they did not contain all the required information and staff did not post the missing information separately. University staff stated the December 31, 2021, report did not require the student information. However, these requirements were put in place in a federal register notice published on May 13, 2021. Recommendation: We recommend the University of Montana – Missoula: A. Enhance internal controls to ensure the University complies with reporting requirements for any new federal programs received; and B. Comply with reporting federal regulations for future federal programs. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-029: U.S. Department of Education ALN #84.425E and 84.425F, Education Stabilization Fund (ESF) (COVID-19) Grant #P425E200902, P425F202518 Criteria: The Office of Management and Budget 2022 and 2023 Compliance Supplements (Section III, Part L) for the Higher Education Emergency Relief Fund (HEERF) program require three components of reporting: quarterly public reporting on the Student Aid Portion, quarterly public reporting on the Institutional Aid Portion, and annual reporting on all funds. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Internal controls were not sufficient to ensure Montana State University – Bozeman (MSU Bozeman, university) accurately completed all required quarterly reports and maintained documentation of their review of those reports for the HEERF program. We identified multiple instances where MSU Bozeman did not comply with the reporting requirements for the HEERF program. Questioned Costs: No questioned costs identified. Context: The Education Stabilization Fund (ESF) was created in March 2020 to aid educational institutions in their efforts to prevent, prepare for, and respond to the coronavirus and its impact on institutions of higher education. Institutions of higher education received funding under the HEERF program. Most of the funding MSU Bozeman received was in the form of grants to provide emergency student financial aid and grants to defray campus expenses associated with the coronavirus. During the audit period, the MSU Bozeman disbursed $15,918,472 in emergency financial aid grants to students and recorded $11,709,106 of institutional expenses. MSU Bozeman was required to complete quarterly reporting for both the Student Aid and Institutional Aid portions of the HEERF program. This reporting included submitting reports to the Department of Education as well as posting information to the university’s website. We identified the following issues with the publicly posted reports: • The HEERF II report for the quarter ended September 30, 2021, did not include the total number of students who received an Emergency Financial Aid Grant during the quarter. • The HEERF III reports for quarters ended December 31, 2021, and March 31, 2022, did not include the estimated total number of students eligible to receive Emergency Financial Aid Grants. We performed a sample of four out of the eight quarterly reports submitted to the Department of Education. This was not a statistically valid sample. We identified the following issues: • The report for the quarter ended June 30, 2023, contained a $909,000 error in the graduate amount column for the HEERF (a)(1) Institutional Portion Amount Disbursed line item. The amount should have been $101,347 and not $1,010,347. • Internal controls were not sufficient to ensure documentation of the quarterly reporting controls were kept. There was no evidence of review for the quarters ended September 30, 2022, March 31, 2023, and June 30, 2023. MSU Bozeman staff stated the reports were reviewed and confirmed either in person or over the phone. Effect: Without effective internal controls to ensure that MSU Bozeman is managing federal awards according to federal statutes and regulations, MSU Bozeman is not in compliance with federal reporting regulations for the HEERF program. Additionally, without effective internal controls, the university is not in compliance with the federal requirement to maintain effective internal control over federal awards. The potential consequences of noncompliance include but are not limited to, increased scrutiny from the Department of Education and placement on “High Risk Status,” which could impact the university’s ability to receive other grants from the Department of Education. Cause: MSU Bozeman staff stated there was no documentation of the reviews of the quarterly institutional reports because they were done in person or over the phone. Staff stated the guidance for the publicly posted reports was not clear and changed regularly. Additionally, the error in the amount disbursed was a typo that was not caught, and the missing public student aid reporting items were overlooked. Staff also stated the student numbers being reported were very dynamic and constantly changed, which made it difficult to capture the information for the reports. Recommendation: We recommend Montana State University – Bozeman: A. Enhance internal controls to ensure the University complies with reporting requirements for any new federal programs received. B. Comply with federal reporting regulations for any new federal programs. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-030: U.S. Department of Education ALN #84.425F, Education Stabilization Fund (ESF) (COVID-19) Grant #P425F202518 Criteria: Federal regulation, 2 CFR 200.1, defines period of performance as the total estimated time interval between the start of an initial Federal award and the planned end date, which may include one or more funded portions or budget periods. The Office of Management and Budget 2022 and 2023 Compliance Supplements (Section III, Part H) for the Higher Education Emergency Relief Fund (HEERF) program state in the Coronavirus Aid, Relief, and Economic Security Act, Coronavirus Response and Relief Supplemental Appropriations Act, and American Rescue Plan Act Certification and Agreements, all institutions were given one calendar year (12 months) from the date of award in their HEERF Grant Award Notifications (GAN) to complete the performance of their HEERF grants. The Office of Management and Budget 2023 Compliance Supplement (Section III, Part H) for the HEERF program states the performance period was extended to June 30, 2023, as of April 24, 2022, for all HEERF grant awards in an open status (grant awards that had not entered the closeout phase and had a balance of $1,000 or more). Federal regulation, 31 CFR 205.33, requires a state to minimize the time between the drawdown and their disbursement for federal program purposes. The Office of Management and Budget 2022 and 2023 Compliance Supplements (Section III, Part C) for the HEERF program refer to the Certification Supplemental Agreements for the Coronavirus Response and Relief Supplemental Appropriations Act and American Rescue Plan Act signed by grantees. The compliance supplement and the supplemental agreements indicate the Institutional Aid Portion should be disbursed within three calendar days of the drawdown from the grant system. The Office of Management and Budget 2023 Compliance Supplements (Section III, Part L) for the HEERF program requires quarterly budget and expenditure reporting for all HEERF grant funds. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Internal controls were insufficient to ensure Montana State University – Bozeman (MSU Bozeman, university) spent the HEERF institutional funds within the period of performance or that the university only drew and reported actual construction project expenses for the HEERF institutional funds. We identified multiple instances where MSU Bozeman did not comply with the period of performance, cash management, and reporting requirements for the HEERF institutional funds. Questioned Costs: No questioned costs identified. Context: MSU Bozeman reported approximately $27.6 million in HEERF expenditures during fiscal years 2022 and 2023, approximately $11.7 million of which were institutional funds. While there were many allowable uses for these funds, the university chose to allocate $5,000,000 to the renovation of HVAC systems in three buildings: • AJM Johnson Hall data center HVAC upgrades for $2,300,000 • Renne Library data center HVAC upgrades for $2,300,000 • Haynes Hall ventilation upgrades for $400,000 In January and May 2023, MSU Bozeman recorded the full amount discussed above for these projects as transfer expenditures in the HEERF fund, which moved the associated cash to its capital projects funds. The university drew the federal funds for these expenditures and reported them on its quarterly reports for the quarters ended 3/31/23 and 6/30/23. However, there were only $45,293 in project expenses for all three projects during the audit period. MSU Bozeman should have transferred only the amount of project expenses, $45,293, to the capital project fund, made a draw, and reported expenditures for this amount, not the full $5,000,000 of the estimated HVAC project costs. The HEERF program did not allow institutions to obligate funds for expenditure after the June 30, 2023, period of performance end date and required all funds to be spent by that date. By recording the transfer expenditures in the HEERF fund and moving the associated cash to the capital projects funds without the same amount of underlying project expenditures, the university violated the period of performance requirements. The HEERF program allowed institutions to apply for no-cost extensions for up to twelve months, but the university did not apply. Effect: By not spending the HEERF institutional funds by the end of the grant period, the university is not in compliance with the period of performance requirements. It has $4,954,707 of unspent HEERF funds sitting in its capital projects fund earning interest. MSU’s project funds are invested through the Montana Board of Investments. Using the average Short Term Investment Pool return for fiscal year 2024, the unspent funds would have earned approximately $267,000 in interest as of the end of the year. Additionally, by drawing and reporting based on the transfer amounts instead of actual construction project expenses during the period, MSU Bozeman did not comply with cash management and reporting requirements. Without effective internal controls that ensure MSU Bozeman manages federal awards according to federal statutes and regulations, the university is not in compliance with the federal requirement to maintain effective internal control over federal awards. The potential consequences of noncompliance include increased scrutiny from the Department of Education and placement on “High Risk Status,” which could impact the university’s ability to receive other grants from the Department of Education. Cause: MSU Bozeman staff attributed the issue to their unfamiliarity with federal grant requirements, as the office managing the HEERF funds does not typically handle federal grants, and to their desire to spend the funds before the end of the grant period. Additionally, university staff stated the university did not have project expenses during the period due to navigating market conditions related to consultant interest and contractor pricing in the construction industry. Staff further stated that due to the construction delays, the importance of these projects, and the lack of another funding source, they had no choice but to record the transactions they did in order to have the funds available to complete the projects. Recommendation: We recommend Montana State University – Bozeman: A. Enhance internal controls to ensure the university complies with cash management, period of performance, and reporting requirements for any new federal programs received; B. Comply with federal regulations for cash management, period of performance, and reporting for any new federal programs; and C. Work with the Department of Education to resolve the use of the funds, including returning the $4,954,707 of excess HEERF funds and approximately $267,000 of interest to the Department of Education, if required. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-031: U.S. Department of Education ALN #84.425D and #84.425U, Education Stabilization Fund Grant #S425D200006, S010A200026-21A, S425U210006-21A Criteria: The Elementary and Secondary School Emergency Relief Fund (ESSER) is part of the Education Stabilization Fund. The ESSER reporting expectations for fiscal years 2022 and 2023 state that the annual reports provide the public with insight into how ESSER funds have been used, indicating it is important to report by expenditures category. In addition, in fiscal year 2023, the Office of Management & Budget Circular A-133 Compliance Supplement notes the following are ESSER annual report key line items: • Local Education Agency’s (LEA) expenditures by ESSER subgrant fund, expenditure category, and object code • Allocation of ESSER funds to schools and criteria used to allocate funds to schools, and • Full Time Equivalent (FTE) positions Federal regulation, 2 CFR 200.334, requires non-federal entities to retain records related to the federal awards. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) did not accurately report all required elements of the ESSER annual reports submitted during fiscal years 2022 and 2023 contrary to federal requirements. In addition, although the office added some controls to the reporting process, like tying total expenditures reported to the state’s accounting system, they did not have sufficient controls in place to prevent, or detect and correct, material noncompliance related to ESSER annual reports submitted during fiscal years 2022 and 2023. Questioned Costs: No questioned costs identified. Context: The office submitted five spreadsheets each year for their ESSER annual reporting. We tested four spreadsheets each year, three focusing on ESSER I, ESSER II, and ESSER III. The fourth spreadsheet was called the Cross Act, which included total FTE employee information. All eight spreadsheets had inaccuracies as summarized below. • The office did not have the functionality to report ESSER I LEA's expenditures by category in their grants tracking system called E-Grants as required. Because the functionally was not available for ESSER I, all ESSER I expenditures were reported as "other items" for all reports submitted during the audit period. • The ESSER 2021 CARES report submitted to the federal government in July 2022 was not accurate when submitted, because the report did not include ESSER expenditures of $1.2 million spent by co-ops. The purpose of co-ops is for small to medium sized LEAs that pool resources in order to gain specialized services. The office is currently correcting these reports by adding the co-ops that were not included. • ESSER annual reporting requires expenditures to be reported by LEA, category, and type of expenditure. The reported information came from E-Grants, but the backup documentation was not retained to support the ESSER expenditures by category. This applies to ESSER I, II, and III reports provided to the federal government during the audit period. • We were not able to verify the accuracy of the key line items "allocation of ESSER funds to schools and the criteria used to allocate funds to schools" and "FTE". The LEAs reported this information and office personnel indicated there was no way to verify its accuracy. Office staff reported that LEA personnel do certify the data. These are key line items, indicating the federal government believes the items to be important. We also noted some FTEs that were likely inaccurate. For example, a youth correctional facility reported zero FTE. Repeat Finding: This is a repeat finding and was reported as Single Audit finding 2021-037 in the audit for the two fiscal years ended June 30, 2021. Effect: The office did not comply with federal reporting requirements for the ESSER program. As noted above, the federal government says the annual reports provide the public with insight into how ESSER funds have been used. This can’t be accomplished if the information in the report is unsupported. Cause: The office initially did not collect the level of expenditure detail needed to accurately complete the ESSER annual reports because guidance changed from the U. S. Department of Education after awarding ESSER I to the office. The office did not have the ability to amend the data collected in the E-Grants system, which resulted in reporting expenditure activities in the “other” categories. During the audit period, the office used E-Grants reports to compile expenditure data by category for ESSER II and III but did not retain documentation to support the reported data. Current staff members were unable to locate the supporting documents, because the person who ran and formatted the report was no longer with the office. The office can prevent this kind of knowledge loss by making sure multiple employees participate in the reporting process. Documenting internal controls related to the reporting process will also ensure compliance consistency, even when there is turnover. Recommendation: We recommend the Office of Public Instruction: A. Enhance internal controls to ensure annual reports are accurate and supported. B. Correct and resubmit previously submitted annual reports. C. Comply with federal regulations by reporting all required data elements in annual reports and retain support for the information reported. Views of Responsible Officials: The office concurs with this recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-032: U.S. Department of Education ALN #84.425D and #84.425U, Education Stabilization Fund (ESF) (COVID-19) Grant #S425D200006, S425D210006, and S452U210006-21A Criteria: Federal regulation, 2CFR 200.332(d), requires pass through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." The Office of Management and Budget 2022 Compliance Supplement (compliance supplement), ESF Program (Section III, Part F-Equipment /Real Property Management) explains that construction projects using Elementary and Secondary School Emergency Relief Fund (ESSER funds) must meet Davis-Bacon prevailing wage requirements, meaning they must pay wages based on federal requirements. A memo from the Department of Education related to Davis-Bacon released April 2023 further clarified that states should be collecting and monitoring all Local Educational Agencies’ (LEA) wage certifications. The compliance supplement (Section III, Part A Activities Allowed or Unallowed) also requires costs to be consistent with the purpose of the ESF, “to prevent, prepare for, and respond to COVID-19”. Federal regulation, 2 CFR 200.403 (a) and (g), requires allowable costs to be “necessary and reasonable for the performance of the Federal award” and to be “adequately documented”. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: ESSER is part of the ESF. The Office of Public Instruction’s (office) controls were not sufficient to prevent, or detect and correct, noncompliance with federal requirements during the audit period. The office assessed subrecipients risk, reviewed audit reports for LEAs whose audits included ESSER as a major program, and required subrecipients to document their use of ESSER funds on cash requests. However, the office did not comply with federal allowable cost regulations. This is because they did not require documentation beyond the cash requests to ensure those expenditures followed ESSER program requirements. Examples include being related to the COVID-19 pandemic, being reasonable and necessary, and complying with equipment and construction requirements. In addition, the office did not complete any after the award monitoring, including collecting Davis-Bacon wage certifications related to subrecipients’ construction projects as required by federal regulations. Questioned Costs: We question costs of over $52 million. Specifically, $19,748,561 for 84.425D (ESSER I and II) and $32,288,058 for 84.425U (ESSER III). We calculated this amount by summing the payments from the cash draws we tested that lacked sufficient documentation. The potential questioned costs could be higher since our testing was limited to cash requests over $1 million. Context: During the audit period, over $257 million of ESSER grants were paid to LEAs. We tested 27 ESSER cash requests over $1 million each in fiscal years 2022 and 2023. Total payments made to subrecipients from these cash draws exceeded $77 million. We first considered support retained at the office. We also requested further support from LEAs in an attempt to consider all information available. Not all requested support was provided. We reviewed what was provided as part of our testing. This was not a sample as we tested all cash requests above $1 million. Each cash request contained a variety of items on the same request. We noted the following: • Documentation in 12 out of the 27 cash requests tested did not indicate how the expenses related to preventing, preparing for, and responding to COVID-19 pandemic. • 14 out of the 27 cash requests tested did not have enough detail to determine if the costs were reasonable and necessary. • 12 of the cash requests reviewed involved construction and the office did not review any wage certifications during the audit period. In addition, there was no monitoring of LEAs’ compliance related to equipment and real property management requirements beyond compliance certifications by the LEAs. • Descriptions on two cash requests indicated ESSER funds were spent on items we believe are unreasonable or have no clear connection to the pandemic. These costs include t-shirts for a new teacher event and massage chairs for a teacher’s lounge. Overall, the cash requests are more detailed than in the prior audit, but they still are not sufficient to meet the office’s obligation to ensure subrecipients’ compliance with federal regulations. In addition, fiscal year 2023 was the third year of ESSER spending, indicating there has been time to set up an after the award subrecipient monitoring program. Repeat Finding: This is a repeat finding and was reported as Single Audit finding 2021-036 in the audit for the two fiscal years ended June 30, 2021. Effect: The office is not in compliance with federal regulations and subrecipients may have spent ESSER funds on activities not allowed by federal requirements, to prevent, prepare for, and respond to the coronavirus pandemic, or on items that are not necessary and reasonable for the performance of the federal award. Cause: The office believes there was sufficient detail on the cash requests for the office to decide on the reasonableness, necessity, and allowability under ESSER regulations. The office agrees that subrecipient monitoring was not sufficient during the audit period, but since there are three funding sources that all have the same allowable uses, personnel decided they would monitor all phases of the grant using one self-assessment. The office sent out a monitoring survey at the end of the audit period, but no responses had been received during fiscal year 2023. The office noted that they will conduct additional monitoring, particularly for unique activities like construction projects, to ensure ESSER compliance. ESSER is defined in the compliance supplement as a “higher risk” federal program, because of the additional risk associated with certain COVID-19 funding. We believe the office’s decision to monitor three years into the grant is not sufficient for the following reasons: • LEAs spent funds on unusual activity, like construction projects. These projects have different compliance requirements than the other federal grants most LEAs receive. • Less than 20 percent of LEA ESSER subrecipients will receive an audit that requires any federal compliance testing. • If the office finds issues this late in the grant process, it will be difficult to recover funds from LEAs. We believe federal requirements direct the office to use a combination of sufficient documentation at the time of disbursement and strong monitoring procedures to ensure LEAs properly comply with applicable allowable cost requirements. Recommendation: We recommend the Office of Public Instruction: A. Strengthen internal controls to ensure subrecipient grant expenditures comply with federal program requirements. B. Obtain sufficient documentation of subrecipient expenditures to ensure costs are related to the pandemic and are reasonable and necessary for performance of the federal award. C. Monitor subrecipients’ compliance with construction and equipment requirements, including reviewing wage certifications for construction projects. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-033: U.S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026 - 22A, S010A210026 - 21A, and S010A200026 - 20A Criteria: Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Title I of the Elementary and Secondary Education Act of 1965, 20 U.S.C. 6303(a)(1), provides that seven percent of the Title I funds received are spent on school improvement. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) identifies schools that need more assistance because of lower performance indicators and designates a portion of its Title I funds for school improvement activities. School improvement expenditures include subawards made to schools and costs incurred by the office to support these targeted schools on a statewide level. The office refers to these programs as “Targeted Support and Improvement” or “Comprehensive Support and Improvement.” We tested 11 high-dollar office purchases that were charged to the school improvement project codes. For three of these transactions, the office was unable to provide documentation supporting its use of statewide school improvement funds. The office’s controls did not ensure sufficient documentation was retained to support the costs being charged to school improvement funds. Questioned Costs: We identified known questioned costs of $5,885, which is the amount of the three expenditure transactions that were not supported. The office spent a total of $2,401,041 in school improvement funds in fiscal years 2022 and 2023. We reviewed $643,841, of which $5,885 were not supported. Based on this, we estimate likely questioned costs exceed $25,000. Context: The unsupported purchases include purchasing a laptop, docking station, and 175 copies of “Driven by Data 2.0: A practical Guide to Improve Instruction”. Documentation is unclear on who the equipment was purchased for, how the books were used or distributed, and why school improvement funds were most appropriate for the purchases. Repeat Finding: Montana’s prior Single Audit report for the two fiscal years ended June 30, 2021, included a recommendation (#2021-043) to the office to develop internal controls to ensure earmarked funds are spent on allowable activities and improve documentation to support cost allowability, and to comply with earmarking requirements in the prior Single Audit report. Effect: The office is not complying with federal regulations regarding expenses charged to school improvement funds, leading to questioned costs and noncompliance with the requirement to spend seven percent of its funding on school improvement. Cause: Office personnel noted that the laptop and docking station were purchased for the Director of School Improvement and that the books were purchased and distributed to schools identified as Comprehensive Support and Improvement, with only a case of books left at the office for future distribution. However, documentation to support the purpose for purchases was not maintained in sufficient detail to determine is the use of school improvement funds was appropriate. Internal controls for federal programs require documentation of how the funds will be used at the time of purchase. For example, the purchase form for the laptop should explain how the laptop directly benefits schools identified as Targeted or Comprehensive Support and Improvement schools and why the cost is not an administrative or indirect cost. Recommendation: We recommend the Office of Public Instruction: A. Implement internal controls to ensure the office documents the purpose of school improvement fund expenditures. B. Expend school improvement allocations in accordance with federal regulations. Views of Responsible Officials: The office partially concurs with the recommendation. Management agrees that the office did not provide sufficient documentation for the transactions in question but is confident that the use of the funds was appropriate. Rebuttal of Views of Responsible Officials: We considered the office’s partial concurrence. As noted above, internal controls for federal programs require documentation of how the funds will be used at the time of purchase, and therefore an internal control deficiency exists even if the use of funds was appropriate. To be allowable, costs must be necessary, reasonable, and adequately documented. As such, our recommendation stands.

Finding 2023-034: U. S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026 – 22A, S010A210026 – 21A, and S010A200026 – 20A Criteria: Federal regulation, 2 CFR 200.403(a) and (g), states that costs are allowable when necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.430(i), states salaries and wages charged to a federal award must be based on records that accurately reflect the work performed. Paragraph 430(i)(1)(viii)(A) &(B) allows for budgeted estimates if the estimates produce reasonable approximations of the activity actually performed and significant changes are identified and entered into the records in a timely manner. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction’s (office) controls were not adequate to ensure compliance with federal regulations related to personal service costs. Questioned Costs: We question $1,900,796 in Title I costs, which is the amount of unsupported personal service costs. Context: Office personal service costs were allocated to the Title I program based on a budget in the state’s accounting system that was not supported by a time and effort certification. Office staff do not track time and effort to ensure amounts allocated to the Title I program are supported by actual records that reflect the work performed for the program. The office is allowed to use budget estimates but needs to track actual time to determine if those budget estimates are reasonable approximations of the activity performed. Effect: The office does not have controls to ensure that only allowable costs are allocated to Title I because there is not adequate support to demonstrate personal services costs are allocated to the federal program where work is performed. This resulted in questioned costs of over $1.9 million. Cause: Controls are not in place to require employees to track their time, so time and effort certifications are not completed periodically to ensure time is allocated to the correct programs. Office staff notes that the state’s accounting system is the official time record where employees report their time and supervisors approve and that employees have been directed to record their actual time worked by federal grant. However, five Title I employees reported using estimated percentages when recording their time. In addition, there is no documented control procedure instructing staff to record their actual time in the state’s accounting system. Recommendation: We recommend the Office of Public Instruction: A. Implement internal controls to ensure personal services costs are adequately documented and reflect actual time and effort for the Title I program. B. Allocate personal service costs based on support for actual time and effort on the Title I program, in accordance with federal regulations. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-035: U.S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026 - 22A, S010A210026 - 21A, S010A200026 - 20A Criteria: Federal regulation, 2CFR 200.334, requires non-federal entities to retain records related to the federal awards for three years past the submission of the final expenditure report. Federal regulation, 2 CFR 200.332(d), requires pass-through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) uses a spreadsheet to track monitoring reviews for subrecipients of the Title I program. The spreadsheet is designed to track both the schedule and the completion status of all monitoring reviews. The completion status for monitoring reviews scheduled to be performed in fiscal years 2022 and 2023 was not complete by August 2023, which is the month the spreadsheet was provided for audit. Internal controls were not adequate to ensure relevant columns were updated to demonstrate compliance with federal regulations. Further, the office could not demonstrate compliance with monitoring requirements because the documentation of the monitoring reviews, including the completion of a monitoring checklist, was incomplete. Questioned Costs: No questioned costs identified. Context: On average, the office plans to monitor about 29 Local Educational Agencies (LEAs) each year. Checklist forms are used to document monitoring and a spreadsheet is used to track the progress of multiple reviews. The spreadsheet used to track and document all Title I monitoring reviews was not complete and the office could not provide documentation all planned subrecipient monitoring reviews were complete. Of the 60 LEAs sampled, nine were missing a complete monitoring checklist. Therefore, there is no evidence demonstrating that all required monitoring reviews took place. The sample was not statistically valid. Effect: The office did not comply with federal regulations. Also, the risk the office will not detect noncompliance on the part of a subrecipient increases when planned subrecipient monitoring does not occur. Cause: Staff indicated that the upkeep of this spreadsheet was the responsibility of the Title I Administrative Assistant, a position vacant for nearly two years at the time of testing. The office switched the form used to document monitoring reviews. The new form documents exceptions rather than the entire review. Additionally, staff indicated files for two LEAs were missing due to a glitch with the network folder on which they were stored during a software update. Recommendation: We recommend the Office of Public Instruction: A. Improve internal controls by requiring and maintaining documentation related to the Title I subrecipient monitoring process. B. Conduct monitoring of subrecipient activities and retain documentation of monitoring reviews, as required by federal regulations. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-036: U.S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026 - 22A, S010A210026 - 21A, and S010A200026 - 20A Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Internal controls are inadequate to ensure the Office of Public Instruction (office) complies with the federal level of effort requirements. These regulations require the office to reduce a Title I allocation if a Local Educational Agency (LEA) fails to maintain fiscal effort in the prior year and one or more of the five immediately preceding fiscal years. Maintaining fiscal effort means continuing to spend at least 90 percent of what was spent the previous year in state and local funding. Prior to fiscal year 2023, the office used a spreadsheet to track when LEAs failed to maintain effort, so they could reduce allocations if necessary. However, in fiscal year 2023, the office did not track LEAs not meeting fiscal requirements. Questioned Costs: No questioned costs identified. Context: Approximately 400 LEAs receive Title I allocations each year. In fiscal year 2023, six LEAs did not meet level of effort requirements, but their noncompliance was not tracked by the office. Title 1 funds may only be used to supplement, rather than supplant, non-federal sources of funding for the education of participating students. None of the six LEAs were required to have a reduction in their allocation during the audit period because they had maintained fiscal effort during the other five immediately preceding fiscal years. However, per our review of the noncompliant LEAs and their maintenance of effort history documented on the spreadsheet, the office needs to reduce the allocation for one LEA in the future. There is a risk the office will not comply in future years if the tracking spreadsheet is not filled out consistently. Effect: If the office does not reduce allocations, they are not complying with federal regulations and noncompliant LEAs will receiving more federal funds than they are entitled to receive. Cause: Between fiscal years 2022 and 2023, there was turnover in the position that maintained the office’s tracking spreadsheet and the successor to the position was not assigned the task of maintaining the fiscal year 2023 spreadsheet. Recommendation: We recommend the Office of Public Instruction enhance controls to ensure documentation is maintained for Local Educational Agencies’ level of effort to ensure allocation reductions are made when required. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-037: U.S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026– 22A, S010A210026– 21A, and S010A200026– 20A Criteria: The Office of Public Instruction (office) makes an agreement with the federal government that negotiates an indirect cost rate. The office’s indirect cost agreement specifically excludes subgrants from costs the indirect cost rate can be applied to. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Federal grants allow both direct and indirect costs. Direct costs can be identified as benefiting a particular grant, while indirect costs benefit the organization as a whole. The indirect cost rate is a percentage the office can charge federal grants for indirect costs. In fiscal year 2022, office staff incorrectly included subgrant expenditures in their indirect cost recovery calculation. A total of $57,954 was drawn for these unallowed costs. Therefore, the office’s controls are inadequate to ensure compliance with federal regulations related to indirect cost recoveries. Questioned Costs: We question $57,954 in indirect cost recoveries resulting from applying the indirect cost rate of 14.4 percent against $402,457 in subgrant expenditures. Context: In fiscal year 2022, the office applied the indirect cost rate to $1,985,783 of Title I expenditures of which $402,457 were related to subgrants. This resulted in indirect cost recoveries of $78,678, of which $57,954 were unallowed. Effect: The office received reimbursement from the federal government for costs not allowed for indirect cost recovery. Cause: The office’s internal controls were not adequate to prevent or detect the inclusion of unallowed costs in their indirect cost recovery calculation. Office staff agree subawards should not be included in indirect cost recovery but do not know why the error occurred. Recommendation: We recommend the Office of Public Instruction: A. Implement controls to ensure indirect costs are only recovered for allowable costs. B. Apply the indirect cost rate only to expenditures allowed in the approved indirect cost proposal. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-038: U.S. Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #S010A220026 - 22A, S010A210026 - 21A, S010A200026 - 20A ALN #84.367, Supporting Effective Instruction State Grants (Title II) Grant #S367A220025, S367A210025, S367A200025 ALN #84.365, English Language Acquisition State Grants (Title III) Grant #S365A22002, S365A20002 ALN #84.424 Student Support and Academic Enrichment Program (Title IV) Grant #S424A200027 Criteria: Federal regulation, 2 CFR 200.332(d), requires pass-through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) reimbursed Local Educational Agencies (LEAs) without receiving sufficiently detailed documentation to determine whether the LEAs were seeking reimbursement for allowed activities or allowable costs. Internal controls were not adequate to ensure proper documentation is received from the LEAs before making a reimbursement. We also addressed incomplete subrecipient monitoring in finding number 2023-035. Questioned Costs: We question $5,943,419 in Title I payments that were reimbursed without adequate support. This amount represents the errors found in eight out of ten tested sample items. Given a total population of $102,446,866, we estimate likely questioned costs exceed $25 million for the Title I program. Additionally, we question $523,706 in Title II costs, $66,040 in Title III costs, and $73,152 in Title IV costs, as these were part of the same subrecipient cash requests reviewed for the Title I program. Context: The major federal program we tested was Title I. The objective of the program is to improve the teaching and learning of children who are at risk of not meeting challenging state academic standards and who reside in areas with high concentrations of children from low-income families. We designed a sample to test 60 items out of a population of 4,214 reimbursements. This sample was not statistically valid. We tested the first 10 sample items and found inadequate documentation for eight. We considered this material noncompliance and did not test the remaining 50 items. We noted the following exceptions: • One closeout cash request for $62,795 included no documentation to indicate what costs the LEA incurred. • Most cash requests for salary and fringe benefits lacked the names of individuals compensated, the roles/titles of personnel, and the dates associated with the compensation. • Documentation did not provide enough detail to discern whether costs were necessary for or related to the Title I program. • One cash request included supplies of $146,646, including food purchases for pizza, although the office’s own monitoring tool indicates, “Activities offered using Title I funds must provide information to or build the capacity of parents and families to support their child’s academic achievement. Open houses, Muffin/Donut days, BBQs, or other meet-and-greet activities are unacceptable.” We cannot tell how much was spent on pizza because it was combined with other items. Office approval is typically limited to comparing the approved budget categories on the Grant Application Notification (GAN) to the budget categories on the LEA’s cash request. Title I is part of the Elementary and Secondary Education Act (ESEA). Federal regulations allow states to accept consolidated applications for all titles included under ESEA. The office accepts consolidated applications from the school districts. Under the ESEA consolidated application, school districts are able to submit a schoolwide cash request for all federal titles included under their consolidated application. In our review, we identified eight questioned cash requests, six were for schoolwide cash requests. While Title II, Title III and Title IV were not major federal programs, the known questioned costs for these three programs exceeded the federal reporting threshold. Effect: The office reimbursed LEAs for Title I costs that were not adequately supported at the time of reimbursement. This increases the risk that LEAs used Title I funds for unallowable activities or unallowed costs. Finally, subrecipient monitoring procedures were not sufficient to comply with federal regulations. Cause: Office staff believe they are requesting sufficient documentation, and they said the cash requests and applications contain all the information for office staff to be confident in the expenditures. Office staff also note that they can request more information from LEAs if there is something they are not confident about. They point out that LEAs receive annual independent audits and the office must depend on the accuracy and reliability of those audit processes and reports. However, based on office documentation, less than 17 percent of Title I LEAs get an audit with federal compliance testing. In addition, federal regulations require more subrecipient monitoring than reviewing audit reports, and we found noncompliance with the office’s other subrecipient monitoring procedures during the audit period. Recommendation: We recommend the Office of Public Instruction: A. Implement internal controls to require LEAs to submit adequate documentation with reimbursement requests. B. Only reimburse LEAs for expenditures when their documentation is sufficient to determine if the costs are allowable to the program, in accordance with federal regulations. Views of Responsible Officials: The office partially concurs with the recommendation. Management notes that they increased the documentation requirements for cash requests at the end of the first year of the audit period. LEAs are required to maintain all receipts and provide them upon request. Management also notes no request for additional LEA documentation was included as part of this audit process. Rebuttal of Views of Responsible Officials: We considered the office’s partial concurrence. Cash requests from both years of the audit period were tested, and instances of insufficient documentation were found throughout the audit period. While we are not prohibited from requesting subrecipients’ documentation during an audit, we are not required to do so. It is our position that unless the office maintains this documentation or documents their monitoring activities, compliance with the requirements applicable to the office cannot be demonstrated. As such, our recommendation stands.

Finding 2023-039: U. S. Department of Education ALN #84.371 Comprehensive Literacy Development Program Grant #S371C190012, S371C190012-19A, S371C190012-20, S371C190012-21 Criteria: Federal regulation, 2 CFR 200.332(d), requires pass-through entities to “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved.” Federal regulation, 2 CFR Part 200.403(a) and (g), require costs to be necessary and reasonable, as well as adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) subrecipient monitoring process related to the Comprehensive Literacy State Development Program did not include obtaining sufficient documentation on cash requests to ensure funds were used for allowable activities and costs as required by federal regulations. This is also a control deficiency related to activities allowed, allowable costs, and subrecipient monitoring. Questioned Costs: We question $659,331 of the cash requests we reviewed. There may be more questioned costs for items we did not review. Context: We sampled 22 cash requests from 10 Local Educational Agencies (LEAs) out of a population of 120 LEAs. The total amount of cash requested for these sample items was $886,597. The sample was not statistically valid. Twelve cash requests lacked adequate detail to determine if all the costs were for allowable activities and costs. Four of the errors, totaling $254,234 were related to the final cash requests, where there was no documentation on how the LEA spent the remaining funds. The other eight requests did not contain adequate support to ensure the costs were reasonable and necessary. For example, one cash request’s description said, “Lease payments for Literacy van to transport students to afterschool program.” The LEA requested $29,519, split between pre-k, elementary, middle, and high school. We do not believe the support had enough detail for the office to determine the time period covered by the request, if the lease payment was excessive, or if the lease was for more than one van. Effect: Without adequate controls over cash requests, the office has reimbursed subrecipients for expenses that may be unallowable, or unnecessary and unreasonable for performance of the federal award. The office did not comply with federal regulations related to activities allowed, allowable costs, and subrecipient monitoring. Cause: The office agrees that LEAs do not always providing sufficient descriptions in cash requests, but they noted program staff visited LEAs at least bi-monthly to physically review items that the money was spent on at the beginning of the grant, with continued visits as needed during the audit period. However, based on our follow up, the onsite reviews did not include reviewing the support the LEA retains for purchases related to cash requests. Instead, they focused on other subrecipient monitoring activities, such as reviewing evidence of the impact of expenditures, like improved reading scores. While useful, these activities do not address concerns about cash request documentation, because there is no evidence that the office reimbursed the actual amount spent. Recommendation: We recommend the Office of Public Instruction: A. Strengthen subrecipient monitoring internal controls to ensure subrecipient grant expenditures are for allowable costs and activities. B. Obtain sufficient documentation of subrecipient expenditures to ensure compliance with federal awards requirements. Views of Responsible Officials: The office partially concurs with the recommendation. Management notes that they increased the documentation requirements for cash requests at the end of the first year of the audit period. LEAs are required to maintain all receipts and provide them upon request. Management also notes no request for additional LEA documentation was included as part of this audit process. Rebuttal of Views of Responsible Officials: We considered the office’s partial concurrence. Cash requests from both years of the audit period were tested, and instances of insufficient documentation were found throughout the audit period. While we are not prohibited from requesting subrecipients’ documentation during an audit, we are not required to do so. It is our position that unless the office maintains documentation, or documents their monitoring activities, compliance with the requirements applicable to the office cannot be demonstrated. As such, our recommendation stands.

Finding 2023-040: U. S. Department of Education ALN #84.371 Comprehensive Literacy Development Program (Literacy) Grant #S371C190012 – 19A, S371C190012 – 20, S371C190012, and S371C190012– 21 Criteria: Federal regulation, 2 CFR 200.332(b), requires non-federal entities to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) subgrants funds to Local Educational Agencies (LEAs) for various federal programs. The office maintains one overall risk assessment spreadsheet for subrecipients for all programs (spreadsheet). The office does not have adequate controls to ensure Literacy program staff complete the Literacy Federal Program column of the risk assessment for all Literacy subrecipients. We identified four LEAs that did not have a risk evaluation during fiscal year 2022, as required by federal subrecipient monitoring requirements. Questioned Costs: No questioned costs identified. Context: In state fiscal years 2022 and 2023, 33 LEAs were allocated funds by the office for the Literacy Grant. The four LEAs not receiving a risk evaluation in fiscal year 2022 were allocated $854,412. Risk evaluations are important because they are used to determine the appropriate subrecipient monitoring. Our review included all 33 LEAs. In addition, the spreadsheet did not have documented risk levels for two LEAs in fiscal year 2023. The Literacy program personnel evaluated risk on a separate document and said they entered a risk level on the spreadsheet as well. However, the spreadsheet provided contained “NA” for the two LEAs. Internal audit staff use the risk levels on the spreadsheet, along with other information, to determine a LEA’s overall risk for the office and appropriate subrecipient monitoring procedures. Effect: The office does not have adequate controls in place to ensure all LEAs have a documented risk level on the final spreadsheet and the office was not in compliance with federal regulations during fiscal year 2022. When the spreadsheet is incomplete, subrecipient monitoring procedures may be inadequate and misspent funds may not be identified through subrecipient monitoring procedures. Cause: Department personnel agree there were subrecipients missed during fiscal year 2022 but are not sure why. The program staff and internal auditor were not involved in the risk assessment process at that time. In fiscal year 2023, program staff reported completing a risk level on the spreadsheet, but on the final spreadsheet line items in error said “NA”. This indicates the spreadsheet may have accidently gotten changed during the risk assessment process. Recommendation: We recommend the Office of Public Instruction: A. Enhance internal controls to ensure the overall risk assessment spreadsheet contains a risk level for all LEAs for the Comprehensive Literacy State Development program. B. Assess risk for all subrecipients receiving Comprehensive Literacy State Development funds, as required by federal regulations. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-041: U. S. Department of Education ALN #84.371 Comprehensive Literacy Development Program (Literacy) Grant #S371C190012, S371C190012-19A, S371C190012-20, and S371C190012-21 Criteria: The Elementary and Secondary Education Act of 1965 Section 2221 (b) (2) defines an eligible entity as one or more local educational agencies (LEAs) that serve a high percentage of high-needs schools and meets other criteria, such as having a high percentage of children reading below grade level or a high proportion of students with special needs codified at 20 U.S.C. 6301 et. Seq. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) awarded Literacy funds to LEAs that were not eligible per federal regulations. Internal controls were not in place to prevent and/or detect the noncompliance. Questioned Costs: We estimate known questioned costs of $6,953,818 using actual payments to LEAs out of the office’s grant system. Context: We tested all 43 LEAs receiving allocations during fiscal years 2022 and 2023. The office had a tab on their allocation spreadsheet labeled “qualifying schools.” Office staff indicated they believed all eligible LEAs came from that tab but were not sure as they were not involved in the final eligibility determinations. We found five LEAs receiving allocations were not on the qualifying schools tab, indicating the spreadsheet was not used as an effective control to determine eligibility. In addition, we identified nine LEAs that did not qualify under federal regulations because they were not LEAs serving a high percentage of high needs schools and a LEA with the highest percentage of students reading or writing below grade level. The five LEAs excluded from the spreadsheet were part of the nine ineligible LEAs. We considered further support provided by the office, but it was not sufficient to demonstrate that any of the nine LEAs we identified were eligible. Effect: The office did not comply with federal regulations, so we questioned approximately $6.95 million of Literacy LEA costs. This also indicates the office’s internal controls were not in place and working as intended during fiscal years 2022 and 2023. In addition, LEAs that did not receive funding might have been chosen for the grant if the office had not used the less restrictive criteria. Cause: The office submitted information to the federal government during the application process that included conflicting eligibility requirements: one version had an “and” indicating an LEA needed to meet two eligibility elements, and the other information included an ”or,” considering LEAs eligible if they met either requirement. The office submitted both versions of the eligibility requirements with their federal application. They believe the federal government approved the less restrictive version and that all LEAs given funds qualify under that criterion. Final eligibility determinations were not documented, indicating controls were not in place and designed to be effective. We tested against the more restrictive version because it aligns with the Elementary and Secondary Education Act (ESEA) criteria which requires meeting high-needs school percentages and another condition, such as a high percentage of children reading below grade level. Recommendation: We recommend the Office of Public Instruction: A. Implement eligibility internal controls to ensure only eligible subrecipients are allocated funding. B. Comply with federal eligibility regulations. Views of Responsible Officials: The office does not concur with the recommendation. Management notes that the U.S. Department of Education approved the application eligibility requirements. Rebuttal of Views of Responsible Officials: We considered the office’s nonconcurrence. As noted above, two conflicting sets of application eligibility requirements were submitted for approval to the U.S. Department of Education, and it is unclear which set was approved. The criteria in the Elementary and Secondary Education Act requires two conditions be met for eligibility. It is our position that both conditions should have been used to make eligibility determinations. As such, our recommendation stands.

Finding 2023-042: U.S. Department of Education ALN #84.371 Comprehensive Literacy Development Program Grant #S371C190012, S371C190012-19A, S371C190012-20, and S371C190012-21 Criteria: Federal regulation, 34 CFR 75.118, requires a recipient wanting to receive a continuation award to submit a performance report that provides the most current performance and financial expenditure information. Federal regulation, 34 CFR 75.720, requires these reports to be submitted annually unless the Secretary allows less frequent reporting. Federal regulation, 2 CFR 200.334, requires retaining supporting documents related to a federal award for three years from the date of the final expenditure report. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) submitted a performance report to receive a Comprehensive Literacy State Development Program grant continuation award. The office’s internal controls were not adequate to ensure the amounts submitted were accurate and supported. We could not verify the accuracy of the “Other” line amounts in the third annual report (year three) Comprehensive Literacy Grant Annual Performance Report submitted during fiscal year 2023 because documentation was not retained. Questioned Costs: No questioned costs identified. Context: The year three report includes total expenditures of $8,715,409, of which $8,265,108 is not supported. The unsupported amount is related to expenditures reported on the “Other” line, primarily subrecipient allocations. Effect: Per federal regulations, if the office submits an inaccurate performance report, continued funding for the grant can be denied. The office did not submit a report that complied with federal regulations. Cause: Program staff indicated that the "Other" line amount mainly includes subrecipient information and should reflect actual expenditures plus subrecipient allocations. Due to staff turnover, supporting documentation was not retained. The state's accounting system reports actual expenditures, not allocations so it cannot be used to support the “Other” line item. Additionally, a new report cannot be generated from their grant system to support the report, as the allocations were point in time information that cannot be recreated. Recommendation: We recommend the Office of Public Instruction: A. Implement internal controls to ensure the report is supported before submission in accordance with federal regulations. B. Maintain support for amounts reported on the annual performance report as required by federal regulation in order to demonstrate accurate reporting. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-043: U.S. Department of Education ALN #84.027, 84.027A, 84.027X, 84.173, 84.173A, and 84.173X, Special Education Cluster (IDEA) (COVID-19) Grant #H027A200096-20A, H027A210096-21A, H027A220096, H027A220096-22A, H027X210096, H173A210099, H173A220099, H173X21099 Criteria: Federal regulation, 34 CFR 300.705(b)(3), requires that the state allocate certain percentages of funding to schools based on the number of children enrolled in those schools. It also requires that a portion of funds be allocated based on the number of children living in poverty in each school. The Office of Public Instruction (office) performs these allocations for the state. Federal regulation, 2 CFR 200.303, requires non-federal entities to, among other things, establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: Two schools' poverty information was missing when the office performed the allocations in fiscal year 2022, resulting in misallocations for all schools. In addition, controls were not working as intended. Questioned Costs: No questioned costs identified. Context: During fiscal year 2022, the office had to perform four calculations in order to determine allocations of special education funds to schools. These included the special education funds, special education preschool funds, and the pandemic funds associated with both of these. While performing these allocations, the office incorrectly documented zero students living in poverty for two schools. Both schools were under-allocated funds, while all other schools received over-allocations. Those two schools were under-allocated approximately $290,000 and $470,000. The over-allocations ranged from approximately $1 to $30,000. The average over allocation was approximately 3 percent of each school’s total allocation. While the office does perform various checks and reviews of data, controls were not sufficient to identify these errors. Effect: As a result of these issues, school districts in Montana initially received incorrect amounts of special education funding from the office. The office reports they have corrected the errors, but they were not in compliance with federal regulations and did not have effective controls in place to prevent material noncompliance during the audit period. Cause: The office staff indicated that they do perform various reviews of the data used in the allocation but did not identify this issue. When the data was submitted by the schools it contained commas, that the computer system could not read and defaulted to zero. The office staff did not identify this while performing the required allocations. Recommendation: We recommend the Office of Public Instruction: A. Enhance internal controls to ensure allocations of special education funds comply with federal regulations, and B. Comply with federal regulations regarding allocations to schools. Views of Responsible Officials: The office concurs with this recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-044: U. S. Department of Education ALN #84.027, 84.027A, 84.0247X, 84.173, 84.173A, and 84.173X Special Education Cluster (IDEA) (COVID-19) Grant #H027A200096-20A, H027A210096-21A, H027A220096, H027A220096-22A, H027X210096, H173A210099, H173A220099, and H173X21099 Criteria: Federal regulation, 34 CFR 300.163(a), states, “A State must not reduce the amount of State financial support for special education and related services for children with disabilities, or otherwise made available because of the excess costs of educating those children, below the amount of that support for the preceding fiscal year.” An Office of Special Education Programs (OSEP) 10-5 memo also states, “…a State needs to include in its calculation of ‘State financial support for special education and related services’ funds other agencies provide to the SEA for such services, funds other agencies provide directly to LEAs for the services, and funds other agencies directly pay to staff or contractors for the delivery of the services…”. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (office) does not have adequate controls in place to ensure they are capturing all state support for special education to monitor and document compliance with federal maintenance of state fiscal support requirements. In state fiscal years 2022 and 2023, the office did not provide appropriation information for two other state agencies, the Department of Corrections and the Department of Public Health and Human Services, that spend state funds on special education. Additionally, several staff members maintained different versions of the worksheet used to track this requirement, and some of their own information could not be reconciled with supporting documentation. It was unclear which was the official version. We could not determine if the office complied with the state financial support requirement without appropriation information from all agencies involved. Questioned Costs: No questioned costs identified. Context: Federal regulations require the office to make state funds available at least at the level of the prior year. The federal government followed-up on the prior audit recommendation and noted that using a budget or appropriation to measure “state funds available” is appropriate. The state legislature appropriates funds of the office for the special education program. The state legislative house bill that appropriates funding shows the special education funding for the office and the School of the Deaf and Blind; however, it does not show the details for the Department of Corrections (Corrections) and the Department of Public Health and Human Services (DPHHS). The office did not obtain support for the amount appropriated for special education from Corrections or DPHHS. Additionally, the different versions of the tracking spreadsheet used by the office include both actual expenditures and budgeted amounts. The initial version provided did not include support from the other state agencies. The second version provided only included state fiscal year 2023 and was missing support for one of the state agencies. The third version included budget and actual amounts and lacked support for two state agencies. Additionally, amounts for one of the state agencies were different from that on version two. Repeat Finding: Montana’s prior Single Audit for the two fiscal years ended June 30, 2021, included a recommendation (#2021-041) to the office regarding maintenance of state financial support requirements. Effect: Without adequate controls or an accurate method for tracking efforts, the office risks not meeting federally required maintenance of state financial support requirements, which could result in fewer federal fund allocations of special education funding. Additionally, the office is not in compliance with federal regulations regarding what activity should be included in their calculation. Cause: During the audit period, in response to the prior audit recommendation, the office used both expenditures and budgeted amounts in their spreadsheets. Internal controls are inadequate, because they did not identify the right basis to use. In addition, there are not controls documented to identify the staff member responsible for ensuring the state maintains financial support and that all state agencies have an appropriation for their state special education funding. Recommendation: We recommend the Office of Public Instruction: A. Document controls over the maintenance of state financial support, which includes the basis to use, the staff responsible, and data to use. B. Accurately and completely track maintenance of state financial support to ensure federal requirements are met. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-045: U.S. Department of Education ALN #84.425D and #84.425U, Education Stabilization Fund (ESF) (COVID-19) Grant #S425D210006 and S425U210006 Criteria: Federal regulation, 2 CFR 170, Appendix A(I)(a) and (a)(2)(ii), requires non-federal entities to report to the Federal Funding Accountability and Transparency Act (FFATA) reporting system each action that equals or exceeds $30,000 in federal funds for a subaward to a non-Federal entity. The report should be submitted no later than the end of the month following the month in which the obligation was made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal years 2022 and 2023, the Office of Public Instruction (office) did not file all the required FFATA reports for its subrecipients of the Elementary and Secondary School Emergency Relief (ESSER) funds, as required by federal regulations. Additionally, those filed were not always accurate. The office’s controls were not sufficient to ensure they were reporting complete and accurate information. Questioned Costs: No questioned costs identified. Context: The ESSER fund is part of the Education Stabilization Fund. There were three phases of ESSER. Phases II and III were allocated to Local Educational Agencies (LEAs) during the audit period. The following allocations should have been reported: • ESSER II: 352 subrecipients totaling $158,087,579 • ESSER III: 364 subrecipients totaling $346,846,641 The office reported: • ESSER II: 254 totaling $166,384,288 • ESSER III: 266 totaling $330,373,603 We also tested 5 LEAs, each with 2 subawards as the office thought some of the subawards reported were correct. We found 6 errors out of 10 subawards tested, indicating there is a systematic issue in how the office reported each LEA’s information. In the table below, we note the number of transactions tested in total, which is the sum of the allocations that should have been reported for ESSER II plus ESSER III. The total in the “Subaward not reported” is the total transactions tested less the amounts the office did report. The “Subaward amount incorrect” summarizes the 6 out of 10 errors we found when we tested amounts the office reported for each LEA in the federal reporting system as compared to the actual final allocations. See the Schedule of Findings and Questioned Costs for chart/table. *Items not tested as we had already found material noncompliance. Repeat Finding: Montana’s Single Audit report for the two fiscal years ended June 30, 2021, included a recommendation (#2021-038) related to FFATA reporting. Effect: The office is not in compliance with FFAFTA reporting requirements, limiting the federal grantor agency’s ability to transparently report program activity. Cause: The office provided support for its FFATA reporting. However, the support did not tie to the allocation spreadsheets for ESSER II and III or to what was in the federal website for ESSER. Office staff noted they had trouble getting access to review our questions after a staff member left the office. They noted they had tried to update the FFATA information during fiscal year 2023 when allocations were updated but had further issues with the reporting system. Per our review of the ten allocation amounts noted above, office staff discovered the spreadsheet uploaded into the FFATA system had filtering errors. Therefore, if they had been able to update the allocations, the amounts would have been incorrect even if they had only updated for reallocations. The controls during the audit period included reconciling between the spreadsheet and the FFATA system but did not include reconciling reported allocations to allocations in the office’s grant system. The second reconciliation would have detected the filtering errors. Recommendation: We recommend the Office of Public Instruction: A. Enhance internal controls to ensure complete and accurate submission of FFATA reports. B. Submit FFATA reports in accordance with federal regulations, including correcting prior reports as needed. Views of Responsible Officials: The office partially concurs with the recommendation. Management believes that many of the issues noted in this finding were the result of communication issues with the FFATA submission system and the USAspending application, which are maintained by the federal government. Rebuttal of Views of Responsible Officials: We considered the office’s partial concurrence. As noted above, although the office had issues with accessing and inputting information into the federal systems, the information they intended to input was incorrect. It is our position that errors in the office’s FFATA reports would still be present even if there were no communication issues. As such, our recommendation stands.

Finding 2023-046: U.S. Department of Education ALN #84.371, Comprehensive Literacy Development Program Grant #S371C190012 Criteria: Federal regulation, 2 CFR 170, Appendix A(I)(a) and (a)(2)(ii), requires non-federal entities to report to the Federal Funding Accountability and Transparency Act (FFATA) reporting system each action that equals or exceeds $30,000 in federal funds for a subaward to a non-Federal entity. The report should be submitted no later than the end of the month following the month in which the obligation was made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal years 2022 and 2023, the Office of Public Instruction (office) did not file the required FFATA reports for its subrecipients of the Comprehensive Literacy State Development program, because personnel had issues with the federal reporting system. They completed one help ticket in order to resolve the issues with the federal system, but their internal control process during the audit period did not require any further follow-up necessary to comply with federal regulations. Questioned Costs: No questioned costs identified. Context: Thirty-three LEAs received subgrants under the program, with allocations each fiscal year. Therefore, the office should have reported at least 66 FFATA reports during the audit period. This was not a sample, as there was nothing reported to test. The following table summarizes the extent of noncompliance. See the Schedule of Findings and Questioned Costs for chart/table. Effect: The office is not in compliance with federal reporting requirements, limiting the federal grantor agency’s ability to transparently report program activity. Cause: The office provided support for their intended submission, but the system rejected it due to an incorrect Federal Award Identification Number (FAIN) for fiscal year 2023. The office submitted one help ticket to resolve the issue, but office personnel report they did not get a response. The office’s internal control process during the audit period did not require further follow-up to comply with federal FFATA regulations, so the office did nothing further. The office could not provide information on any attempted fiscal year 2022 FFATA reports. Recommendation: We recommend the Office of Public Instruction: A. Enhance internal controls to ensure the timely and accurate submission of FFATA reports, including a follow-up plan when errors occur. B. Submit FFATA reports in accordance with federal regulations, including submitting prior year reports. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-047: U.S Department of Education ALN #84.010, Title I Grants to Local Educational Agencies (Title I) Grant #A010A210026 and S010A220026 Criteria: Federal regulation, 2 CFR 170, Appendix A(I)(a) and (a)(2)(ii), requires non-federal entities to report to the Federal Funding Accountability and Transparency Act (FFATA) reporting system each action that equals or exceeds $30,000 in federal funds for a subaward to a non-Federal entity. The report should be submitted no later than the end of the month following the month in which the obligation was made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal year 2022 and 2023, the Office of Public Instruction (office) did not accurately file all the required FFATA reports for its subrecipients, Local Educational Agencies (LEAs), for the Title 1 program, as required by federal requirements. The subawards were not reported for fiscal year 2022 or 2023. The office’s internal controls did not detect the missing reports. Questioned Costs: No questioned costs identified. Context: The office allocated $44,893,490 to 211 LEAs for fiscal year 2022 and $47,975,343 to 214 LEAs for fiscal year 2023. Review of the federal reporting system showed reports for the fiscal year 2024 grant only, but not for fiscal years 2022 or 2023. We did identify some controls in place for FFATA reporting for Title I. However, the controls were not adequate to prevent noncompliance. The table below summarizes the noncompliance we identified. See the Schedule of Findings and Questioned Costs for chart/table. No subawards were reported in either fiscal year 2022 or 2023, so the transactions tested and reported are the same. Repeat Finding: Montana’s Single Audit for the two fiscal years ended June 30, 2021, included a recommendation (#2021-038) to the office regarding FFATA controls. Effect: The office is not in compliance with FFATA reporting requirements, limiting the federal grantor agency’s ability to transparently report program activity. Cause: The office provided support for what they intended to report but did not know that the reports never got submitted until the audit process. After office staff researched the issue, they said that the federal government told them to move the reports to reopen status for a system update but that the federal government never told them when to resubmit. Recommendation: We recommend the Office of Public Instruction: A. Enhance internal controls to ensure complete and accurate submission of FFATA reports, including a review of the FFATA information after it is submitted. B. Submit FFATA reports in accordance with federal regulations. Views of Responsible Officials: The office partially concurs with the recommendation. Management believes that many of the issues noted in this finding were the result of communication issues with the FFATA submission system and the USAspending application, which are maintained by the federal government. Rebuttal of Views of Responsible Officials: We considered the office’s partial concurrence. As noted above, the reports were reopened in the federal FFATA submission system at the direction of the federal government. Responsibility for resubmission of the reports rests with the office and is not the result of communication issues. As such, our recommendation stands.

Finding 2023-048: U.S. Department of Health and Human Services ALN #93.423, 1332 State Innovation Waivers Grant #SIWIW200014 Criteria: Federal regulations, 2 CFR 200.214 and 2 CFR 180.300, require the State Auditor’s Office (office) to restrict subawards to parties not suspended or debarred from receiving federal funds. The 1332 State Innovation Waivers (waiver program) compliance supplement further requires the office to review the office to review the System for Award Management (SAM) website annually for its subrecipients. Federal regulation, 2 CFR 25.300, specifies subwards may not be made unless the subrecipient has obtained and provides its Unique Entity Identified (UEI) to the Federal grant recipient. Federal regulation, 2 CFR 170 Appendix A, states the Federal grant recipient must report each action that obligates federal funds to a subrecipient that equals or exceeds $30,000. Each obligating action must be reported to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS) by the end of the month following the month in which the decision was made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office did not have adequate controls to identify all requirements related to its subaward under the waiver program, including the requirement to communicate specific information to its subrecipient, the Montana Reinsurance Association. Additionally, the office did not comply with suspension and debarment and reporting requirements applicable to the waiver program, as follows: • The office did not check the SAM excluded party list for suspensions and debarments and retain evidence of its review before issuing any subaward payments. Additionally, contrary to federal regulations, the office made subaward payments to the MRA prior to receiving its UEI. • The office did not submit reports for subaward information as required under FFATA. Questioned Costs: No questioned costs identified. Context: There is a single subrecipient for the waiver program. The office did not check the suspended or debarred status of the subrecipient during the audit period. Additionally, the office did not submit the required FFATA reports for $47.5 million in subwards made during fiscal years 2022 and 2023. We brought the internal control and compliance issues to the office’s attention in April 2023. As of June 14, 2023, the office updated its Annual Calendar used to track reporting and monitoring requirements. On this version of its Annual Calendar, the office scheduled an annual check of the SAM site for October 2023, but FFATA reporting was not yet incorporated into the calendar. On July 13, 2023, the office added FFATA reports to its Annual Calendar. Additionally, as of June 30, 2023, the office had neither checked the SAM excluded party listing nor obtained the MRA’s UEI. Between May and June 2023, the office incurred costs associated with the MRA totaling $283,334 in federal funds. Effect: The office has not complied with all elements of the Suspension and Debarment and Reporting compliance requirements. Internal control weaknesses also put the office at risk of additional noncompliance. Cause: While the office treated the MRA as its subrecipient in some respects, the office did not identify the need to treat the MRA as a subrecipient for all related requirements. The office relied on federal guidance provided when the state’s waiver was approved in 2019, which included the Specific Terms and Conditions. However, the office did not consider other requirements outlined in the federal Compliance Supplement for the waiver program, available as of August 2019 and at recurring intervals since that time, when determining procedures necessary to comply with all federal compliance requirements. Recommendation: We recommend the State Auditor’s Office: A. Enhance internal controls to monitor the excluded parties list, disclose all required information to its subrecipient, and complete required Federal Funding Accountability and Transparency Act reports. B. Comply with federal suspension and debarment requirements to review the SAM website prior to making subaward payments and to make subawards only to entities with a Unique Entity Identifier. C. Submit required Federal Funding Accountability and Transparency Act reports. Views of Responsible Officials: The office concurs with this recommendation. For more information on the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-049: U.S. Department of Health and Human Services ALN #93.423, 1332 State Innovation Waivers Grant #SIWIW200014 Criteria: Federal Health and Human Services (HHS) Grants Policy Statement specifies actions to manage the day-to-day operations of federal programs should include written policies and procedures. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The State Auditor’s Office (office) does not have written policies and procedures to minimize the time elapsing between the transfer of funds from the federal cash draw system and the disbursement of those funds by the recipient, as required by the HHS Grants Policy Statement. Additionally, office internal controls did not identify that written policies and procedures were required. As part of our audit, we did not identify instances where the office held federal funds in the treasury longer than permitted by federal regulations. Questioned Costs: No questioned costs identified. Context: The1332 State Innovation Waivers (waiver) program was authorized in August 2019. Guidance to establish written policies and procedures is include in the HHS Grants policy as early as 2007. The waiver program’s compliance supplement specified this requirement as early as August 2019. As such, guidance outlining the requirement for written policies and procedures was available to the office at the time the program was authorized by the Federal government. As of June 16, 2023, the office provided written policies and procedures in draft form. The SAO Cash Management procedure was approved on August 3, 2023. Effect: By not identifying the need to establish and maintain written policies and procedures over federal cash management requirements, the office had not complied with federal regulations applicable to the award. Additionally, the absence of documented policies and procedures puts the office at risk for noncompliance by drawing an incorrect amount from the Federal government or holding federal cash in the state treasury for too long. Cause: When developing policies and procedures for the waiver program, office personnel overlooked the need to establish written policies and Procedures for federal cash management requirements. Recommendation: We recommend the State Auditor’s Office: A. Enhance internal controls by ensuring written policies and procedures are developed for all aspects of the federal waiver program. B. Maintain written policies and procedures to minimize the time elapsing between the transfer of funds from the Federal cash draw system and the disbursement of funds, as required by federal health and Human Services Grants Policy. Views of Responsible Officials: The office concurs with this recommendation. For more information on the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-050: U.S. Department of Health and Human Services ALN #93.423, 1332 State Innovation Waivers Grant #SIWIW200014 Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The State Auditor’s Office (office) did not document its review of the SF-425 Annual Report, a Federal financial report used to provide the Federal grantor agency with information about individual grant awards, prior to submission. Questioned Costs: No questioned costs identified. Context: There were two annual reports due during the audit period. Neither report contained documentary evidence of a review before submission. Our audit did not identify errors in information included in the Federal SF-245 reports. Effect: The absence of internal controls can result in incomplete, inaccurate, or late reporting to the Federal government. The office risks noncompliance with Federal reporting requirements without adequate internal controls. Cause: The office overlooked the need to retain documentary evidence of its review of the SF-425 report prior to submission. Recommendation: We recommend the State Auditor’s Office enhance internal controls to include a review for accuracy and completeness of the SF-425 report is documented before submission. Views of Responsible Officials: The office concurs with this recommendation. For more information on the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-051: U.S. Department of Health & Human Services ALN #93.659, Adoption Assistance – Title IV-E (COVID-19) Grant #2101MTADPT, 2201MTADPT, 2301MTADPT Criteria: Federal regulation, 45 CFR 75.302(a), requires that the “… non-Federal entity’s financial management systems, including records documenting compliance with Federal statutes, regulations, and terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award.” Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The federal fiscal year 2021 CB-496 report, part 4, Annual Adoption Savings Calculation and Accounting report submitted by the Department of Public Health and Human Services (department) was inaccurate. The department’s internal controls were ineffective in detecting or preventing errors in the report. Questioned Costs: No questioned costs identified. Context: The department uses a spreadsheet template similar to the required report to ensure that the amounts in the report are supported and accurate. This template calculates required report amounts based on department inputs. We reviewed the federal fiscal year 2021 (FFY21) and federal fiscal year 2022 (FFY22) CB-496, part 4, reports submitted by the department. We noted instances in FFY21 where the amounts on the report did not tie to the support prepared and calculated by the department. The report has 44 required lines. In the submitted FFY21 report, 23 lines did not tie to support within 10%. The differences between the support and the submitted report ranged from $13,274 to $1,830,415. All amounts on the FFY22 report tied to support. Based on our work, we determined that controls were in place for the FFY22 report as it tied to support, but controls did not identify errors on the FFY21 report. Effect: The department reported incorrect adoption savings amounts to the federal government. Additionally, since the amounts reported are unsupported, the department did not comply with Federal regulations regarding adoption savings reporting requirements. This incorrect reporting could lead to the department spending more money on eligible children from the state’s general fund or overspending federal money on eligible children. Cause: The report template was a new process and department staff were not trained on how to use the template. Department staff also utilized the incorrect Federal Medical Assistance Percentage or FMAP rate. Recommendation: We recommend the Department of Public Health and Human Services: A. Develop internal controls to ensure the amounts reported in the CB-496, part 4, Annual Adoption Savings Calculation and Accounting report are supported and accurate, and B. Report complete and accurate information on the CB-496, Part 4, Annual Adoption Savings Calculation and Accounting report as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-052: U.S. Department of Health and Human Services ALN #93.323, Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Grant #Various ALN #93.659, Adoption Assistance – Title IV-E (COVID-19) Grant #2101MTADPT, 2201MTADPT, 2301MTADPT Criteria: Federal regulation, 31 CFR 205.33, requires the Department of Public Health and Human Services (department) minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. The timing and amount of funds transferred must be as close as administratively feasible to the department’s cash outlay for direct and indirect program costs. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department does not have sufficient controls over cash draws and cash management to prevent the ELC and Adoption Assistance programs from maintaining an excess cash balance. For the ELC and Adoption programs, the department was not compliant federal regulations regarding cash management. Questioned Costs: No questioned costs identified. Context: We analyzed all cash draws for the ELC and Adoption Assistance programs in fiscal years 2022 and 2023. The analysis identified instances where cash was positive for two or more days and considered an instance of noncompliance. For each of the programs, we identified the following instances where there were excess cash balances: See the Schedule of Findings and Questioned Costs for chart/table. Repeat Finding: These two programs do not have previous cash management findings. However, the department has had related cash management findings in other federal programs in the past. A central group of personnel is responsible for managing cash draws for federal programs. The original recommendation was recommendation 2019-024 in Montana’s Single Audit for the two fiscal years ended June 30, 2019. Effect: The department draws federal cash prior to the department’s disbursements, resulting in a positive cash balance at the department. This results in noncompliance as the department is not minimizing the time between the drawdown of federal funds and their disbursement of the funds. In response to these cash management issues, the federal government could require draws only on a reimbursement basis, rather than in advance. Cause: The department’s controls are insufficient to prevent excess cash balances for the ELC and Adoption Assistance programs. The department uses templates to assist with draws and to help staff determine if there are excess cash balances. However, each program has some unique cash management requirements that call for changes to the templates. Even with these tools there were still times of excess cash, indicating these controls are not sufficient to comply with cash management requirements. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls over cash draws to minimize the number of instances of excess cash. B. Comply with federal requirements and minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-053: U.S. Department of Health and Human Services ALN #93.323, Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Grant #Various Criteria: Federal regulation, 45 CFR 75.352(b), requires the Department of Public Health and Human Services (department) to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and terms and conditions of the subaward for the purpose of determining the appropriate subrecipient monitoring. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Department procedures did not include consideration or documentation of risk associated with subrecipients of federal ELC funds, and the department did not comply with federal requirements. Questioned Costs: No questioned costs identified. Context: During the audit period, the department distributed federal ELC funds to 45 county or local governments and to schools in 42 counties. County and local government distributions, supporting localized preparedness for adequate staffing, totaled approximately $4.8 million and were supported by subaward agreements. School distributions, supporting efforts to safely re-open schools around the state during the public health emergency, totaled approximately $9.1 million. Schools were new subrecipients during the audit period. We conducted a sample of 40 distributions, 20 to county governments and 20 to schools. The sample was not statistically valid. For all subrecipients sampled, the department did not complete and document a risk assessment, as required by federal regulations. Effect: The department is not in compliance with federal requirements related to risk assessments for subrecipients of federal ELC funds. This could result in the department awarding funds to high-risk entities without also establishing increased monitoring procedures to ensure subrecipients spend funds in accordance with federal regulations. Cause: The department implemented a checklist that guides department staff to document their consideration of subrecipient disclosures, risk assessment, and monitoring activities. However, the department staff indicated they did not consistently use the checklist for county subaward agreements until fiscal year 2024. The checklist was developed in response to the prior audit recommendations related to the department’s overall responsibilities for subrecipient monitoring. Additionally, as discussed in Finding #2023-064, the department did not consider schools to be subrecipients when the awards were made. As a result, department staff did not use the checklist to document the risk associated with school subrecipients. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to ensure a risk assessment is completed and documented for each subrecipient of federal Epidemiology and Laboratory Capacity for Infectious Diseases funds. B. Conduct risk assessments for all subrecipients, as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-054: U.S. Department of Health and Human Services ALN #93.323, Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Grant #Various Criteria: Federal regulation, 45 CFR 75.351, requires the Department of Public Health and Human Services (department) to make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. This regulation also outlines the characteristics of each a subrecipient and a contractor. Most notably, a subrecipient is responsible for adhering to applicable federal program requirements and must use federal funds to carry out a federal program for the purpose of the award, whereas a contractor provides goods or services that are ancillary to the operation of the federal program. Federal regulation, 45 CFR 75.352, lays out the thirteen required elements to communicate to subrecipients to properly identify the federal award. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department did not fully communicate required subrecipient disclosures to its school, county, and local government subrecipients for the period under audit. Department internal controls were ineffective in determining the appropriate subrecipient classification of its relationship with schools under federal regulations and in ensuring all required disclosures were communicated to school, county, and local government subrecipients. Questioned Costs: No questioned costs identified. Context: During the audit period, the department distributed federal ELC funds to 45 county or local governments and to schools in 42 counties. County and local government distributions, which supported localized preparedness for adequate staffing, totaled approximately $4.8 million and were supported by subaward agreements. School distributions, which supported efforts to safely re-open schools around the state after the public health emergency, totaled approximately $9.1 million. From a population of 388 payments to schools and counties, we conducted a sample of 40 distributions, 20 to county governments and 20 to schools, and reviewed documentation related to subaward disclosures. The sample was not statistically valid. For all subrecipients sampled, subaward disclosures either did not exist or were incomplete. In response to the prior audit recommendation regarding missing subaward disclosures for county and local government agreements, the department implemented the use of a checklist to properly evaluate whether they qualified as subrecipient or contractor agreements. Additionally, the department sent letters to all county and local governments with the required subrecipient disclosure information. Our sample identified 19 letters where they omitted the subaward period of performance start and end date and/or the total amount of federal funds obligated to the subrecipient. The department did not provide documentation to demonstrate any subaward disclosures for one of the counties in our sample. Schools requested funding from the department through an application process. The department did not consider schools to be subrecipients. Therefore, no formal written agreement was made with the schools, and the department did not communicate the award information required by federal regulations. Repeat Finding: Montana’s Single Audit report for the two fiscal years ended June 30, 2021, included two related recommendations. Recommendation #2021-052 discussed internal control and compliance over subrecipient disclosures for the ELC program. Recommendation #2021-055 addressed the need to enhance internal control review procedures and to properly classify agreements as either subrecipient or contractor relationships. Effect: The department has not complied with federal regulations regarding required subrecipient disclosures. Failure to provide subrecipients with the required federal award information increases risk of subrecipient noncompliance with Federal requirements. Cause: The department did not use its checklist to evaluate whether schools should be considered subrecipients or contractors when the school reopening program was established. Without use of the checklist, program staff did not properly identify the recipients as subrecipients and therefore, did not ensure federal award information was communicated as required by federal regulations. Additionally, program staff overlooked the need to communicate certain required elements in letters sent to county and local governments in response to the prior audit recommendation. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls over the Epidemiology and Laboratory Capacity for Infectious Diseases program to ensure subrecipient relationships are properly identified and to ensure all federal award identification information is communicated to program subrecipients. B. Properly classify relationships as subrecipient or contractor relationships for the Epidemiology and Laboratory Capacity for Infectious Diseases federal award, as required by federal regulations. C. Communicate all federal award identification information to Epidemiology and Laboratory Capacity for Infectious Diseases program subrecipients, as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-055: U.S. Department of Health and Human Services ALN #93.323, Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Grant #Various Criteria: Federal regulation, 2 CFR 200.403(a) and (g), specify costs must be necessary and reasonable for the performance of the federal award and adequately documented to be allowable under federal awards. Federal regulation, 45 CFR 75.352(d), requires the Department of Public Health and Human Services (department) to monitor the activities of its subrecipients as necessary to ensure the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and terms and conditions of the subaward, and subaward performance goals are achieved. Federal guidance from the Centers for Disease Control and Prevention, ELC Reopening Schools: Support for Screening Testing to Reopen & Keep Schools Operating Safely, and related Frequently Asked Questions documents specify allowable costs related to reopening schools. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department’s internal controls were not adequate to ensure subawards of federal ELC funds were expended on allowable costs, as required by federal regulations. Questioned Costs: We question $163,158, which represents the amount of federal funds distributed to counties in fiscal year 2022 that were not supported by actual county expenditures as of June 2024. Additionally, for school subrecipients, we project likely questioned costs of $3,194,292 in federal funds. Questioned costs related to school subrecipients were calculated by applying the percentage of unallowed or unsupported costs identified in our sample to the total amount distributed to schools in the audit period. Context: During the audit period, the department distributed federal ELC funds to 45 county or local governments (county) and to schools in 42 counties. County distributions, supporting localized preparedness for adequate staffing, totaled approximately $4.8 million and were supported by subaward agreements. School distributions, supporting efforts to safely re-open schools around the state during the public health emergency, totaled approximately $9.1 million. We conducted a sample of distributions to subrecipients. Of the 388 distributions, we reviewed 20 to county governments and 20 to schools to determine if the department’s post-award monitoring procedures were effective. The sample was not statistically valid. For 20 of the distributions tested, we determined the department’s monitoring procedures insufficient due to lack of supporting documentation or due to our identification of unallowed costs not identified in the department’s review. Additional details for each county and school distributions follows: Distributions to Counties In fiscal years 2021 and 2022, the department distributed funds to counties as advanced payments. During the prior audit, we reported fiscal year 2021 distributions as questioned costs. In response to our prior audit recommendation, in fiscal year 2023 the department implemented procedures to distribute funds to counties quarterly after the county attested the funds were used in accordance with federal regulations and provided receipts and other documentation for the department’s review and approval. The department also retroactively requested, received, and reviewed support for distributions to counties made in fiscal years 2021 and 2022. As part of our sample, we reviewed four county distributions from fiscal year 2023 and noted department procedures ensured costs incurred were for allowable purposes before distributing federal funds to the county. For the 16 county distributions from fiscal year 2022, we reviewed the department’s tracking spreadsheet and underlying support for four county agreements to determine whether advanced payments from fiscal years 2021 and 2022 were fully utilized. One of the 16 counties had a remaining balance of $54,378 in federal ELC funds for which the county had not incurred or reported expenses against as of June 2024, the month when we reviewed the report. We also considered all data on the department’s tracking spreadsheet and determined as of fiscal year end 2023 eight additional counties had not fully exhausted advanced distributions of federal ELC funds from fiscal year 2022. Of these counties, three had a remaining advanced balance as of June 2024. We consider these outstanding balances totaling $108,800 questioned costs, which is in addition to the $54,378 discussed above. Distributions to Schools School re-opening grants were distributed to schools as lump-sum payments at three different intervals during the audit period. The purpose for these grants was to support school testing, prevention, and mitigation activities intended to support open, in-person school environments during the COVID-19 pandemic. Subsequent to distributing funds to schools, at six-month intervals for fiscal year 2022 awards and at grant close-out for fiscal year 2023 awards, the department required the school to provide support for the use of federal ELC funds. This was documented on a School Budget Expenditure Report. The department required the school to list expenditures by category. Per department guidance, supporting invoices or payroll reports were required only when an individual expense exceeded $5,000. We reviewed documentation provided by the department for the 20 school distributions selected in our sample. In many cases, the documentation provided was intended to support multiple distributions to the schools, not only the distribution selected for sample testing. We identified only one school where supporting documentation was sufficient to conclude federal ELC funds had been fully used for allowable purposes. For the remaining 19 schools, we found: • Supporting documentation for nine schools either did not include support for payroll costs or lacked sufficient detail to support expenditures incurred by the school were for the purpose of the ELC federal program. For seven schools, the payroll reports were dated between November 2023 and April 2024, well after the department’s July 2023 subaward closeout deadline. • One school claimed costs for a school superintendent and a cook, while another school shifted 25% of regular custodial costs to the ELC award for June 2023 salaries. We consider these costs unallowable as they are regular costs associated with school operations and not temporary staff hired or redirected for purposes of school reopening efforts. • Support from schools showed federal ELC funds were spent on items such as ice melt, a kitchen warmer oven, drinking fountains, cameras, printers, paper, toner, and ink. We consider these costs unallowable as they do not align with an allowable cost in the federal school reopening guidance. • One school reported costs totaling $42,761 for Covid-19 testing supplies. Based on our review, the underlying costs were mainly related to purchasing $10 gift cards used to incentivize Covid testing. The school’s incentive plan specified 300 $10 gift cards would be purchased, and distributions of gift cards would be tracked, signed for, and subjected to data analysis to ensure incentives distributed did not outnumber the tests performed. The department did not provide documentation to support its consideration of the discrepancy between expected and actual incentives for the school. Absent additional documentation, we consider the approximately $39,000 unallowable as they are not reasonable or necessary for the performance of the federal award. Per discussion with department personnel, as questions came up in the review of school Budget Expenditures Reports they would reach out to schools for additional documentation or clarification. Turnover in the position responsible for following up with schools contributed to the level of documentation available at the time of audit. Repeat Finding: Montana’s Single Audit report for the two fiscal years ended June 30, 2021, included two findings related to this issue. Finding #2021-062 recommended the department implement internal controls over federal ELC contractor and subrecipient payments and to reimburse those entities only for activities allowed by federal regulations. Finding #2021-054 recommended the department establish and document internal controls for and to conduct monitoring of subrecipients of federal ELC funds. Effect: The department has not complied with federal regulations requiring post-award monitoring of its subrecipients, which means risk exists that federal funds were not expended in accordance with federal award requirements. As part of resolving the issue, the federal government may require the department to repay unallowed or unsupported costs. Cause: Department internal controls in place during the audit period did not consistently include a review and follow-up on subrecipient documentation to support the use of federal ELC funds. • Prior audit findings related to county subrecipients were identified more than half-way through fiscal year 2022. At that time department staff were unaware of the degree of subrecipient monitoring required for subaward agreements. • As discussed in Finding #2023-054, the program staff did not properly identify schools as subrecipients during the audit period. While the department had procedures in place to review subaward close-out documentation submitted by schools, staff turnover contributed to limited follow-up. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls for its Epidemiology and Laboratory Capacity for Infectious Diseases federal award to ensure adequate documentation for subrecipient payments is consistently obtained and reviewed to ensure funds were used for authorized purposes, and documentation of department decisions is maintained. B. Disburse funds to subrecipients for the ELC federal award only for activities allowed by federal regulations. C. Conduct post-award monitoring of subrecipients of federal ELC funds, as required by federal regulations. Views of Responsible Officials: The department conditionally concurs with this recommendation. The department disagrees that funds were not paid to subrecipients for allowable activities. The department acknowledges documentation of their review of costs could be enhanced. However, they believe a large portion of the costs are allowable based on discussions with their federal partners and subrecipients and are confident that additional documentation obtained from the subrecipients would support the questioned costs. Rebuttal of Views of Responsible Officials: We considered the department’s conditional concurrence. It is our position documentation available during the audit period or at the time of audit was not adequate to support that costs were allowable under the program. As such, our recommendation stands.

Finding 2023-056: U.S. Department of Health and Human Services ALN #93.658, Foster Care – Title IV-E (COVID-19) Grant #2101MTFOST, 2201MTFOST, 2301MTFOST Criteria: Federal regulation, 45 CFR 75.352(a)(1), requires the Department of Public Health and Human Services (department) to ensure that every subaward is clearly identified to the subrecipient as a subaward and lays out the thirteen elements required to be communicated to subrecipients. Federal regulation, 45 CFR 75.352(b), requires the department to evaluate the subrecipient’s risk of noncompliance with federal statutes. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Department controls did not identify certain required disclosures that were omitted from the Foster Care subrecipient agreements, resulting in noncompliance with federal regulations. Additionally, the department does not have a system in place to assess risk related to its subrecipients as required by federal regulations and did not assess risk for the audit period. Questioned Costs: No questioned costs identified. Context: Subrecipients of the department’s Foster Care program include tribal governments and institutions of higher education. In response to the prior audit recommendation, the division administering the Foster Care program developed a policy that lists the required disclosures to include in subrecipient agreements. From review of the policy and agreements, the name of the federal awarding agency was not included in the subrecipient disclosures. Additionally, the department does not have a process in place and does not perform an assessment of these subrecipient’s risk to determine the amount of monitoring required for each subrecipient. Repeat Finding: Three of Montana’s past Single Audits included findings (#2015-014, #2019-016, and #2021-051) related to subrecipient disclosures for the Foster Care program. In the most recent prior audit, new or amended contracts were executed to include subrecipient disclosures. However, required items were still omitted or information disclosed was inaccurate. Effect: The department has not complied with federal regulations regarding required subrecipient disclosures and risk assessments. Failure to provide subrecipients with the required federal award information increases the risk of subrecipient noncompliance with federal requirements. Additionally, performing risk assessments is an important element of internal controls over subrecipient monitoring compliance. Without risk assessment procedures, the department may not appropriately monitor the activities of its subrecipients. As noted in Finding #2023-057 we do not believe the department currently obtains adequate evidence to support payments to is subrecipients. By performing risk assessments, the department may be able to support a different level of payment monitoring and review for lower risk subrecipients. Cause: The department acknowledged it did not have a procedure in place to perform risk assessments of Foster Care subrecipients. Regarding subrecipient disclosures, the department represented policy instructions included all required disclosures. However, the division administering the Foster Care program developed its own internal policies, which were used during the audit period and incorrectly omitted some required disclosures. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls over subrecipient monitoring for the Foster Care program, to ensure subrecipient risk assessments are completed and all required subrecipient disclosures are included in subrecipient agreements. B. Comply with federal regulations by completing risk assessments and ensuring the required subrecipient disclosures are included in Foster Care subrecipient agreements. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-057: U.S. Department of Health and Human Services ALN #93.658, Foster Care – Title IV-E (COVID-19) Grant #2101MTFOST, 2201MTFOST, 2301MTFOST Criteria: Federal regulation, 2 CFR 200.403(a), specifies costs must be necessary and reasonable for the performance of the award. Federal regulation, 2 CFR 200.403(g), specifies costs must be adequately documented to be allowable under the award. Federal regulation, 45 CFR 1356.60(b)(2), requires all training activities and costs funded under Title IV-E be included in the department’s training plan for Title IV-B. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Department of Public Health and Human Services (department) staff did not obtain and review appropriate supporting documentation for payments to subrecipients to ensure costs were necessary and adequately documented as required by federal regulations, indicating internal controls are ineffective. Questioned Costs: Based on transactions reviewed in our sample, we question costs in the amounts of $17,167 as summarized in the table below. The department paid approximately $2.7 million to tribes and universities in fiscal years 2022 and 2023 combined. Based on overall level of activity, likely questioned costs exceed $25,000. See the Schedule of Findings and Questioned Costs for chart/table. Context: The department maintains subrecipient agreements with the seven tribes located within the state and two college/universities (colleges). The department provides federal funds to these entities to either help administer the Foster Care program, provide stipends to college students studying social work, or provide training to department staff. From a sample of 12 invoices from 115 invoices submitted by tribes or colleges, we identified nine cases of unsupported operating expenses and two items lacking wage support. Five of the invoices were related to training costs. The sample was not statistically valid. Inadequate supporting documentation from colleges hindered our ability to determine whether training costs were specified or allowable in the department’s training plan. Our observations of inadequate documentation include: • One college invoice submitted for reimbursement was for $42,344. A general ledger listing the expenses was provided including operating expenses totaling $3,237. These expenses were only listed in the general ledger and not supported by receipts. Without receipts or other support, we were unable to verify whether costs were properly classified as operating expenses on the general ledger and were allowable for reimbursement from federal funds. • Tribal invoices were supported by a general ledger and the department’s standardized billing invoices. The department uses time studies to support the allocation of wages for time spent on a project. Time studies were incomplete or inconsistent with the allocation of wages used in payment to the tribes. Similar to the operating expenses for the colleges, there were no receipts to support the operating expenses from the request for reimbursement. Additionally, from the work performed, we identified nine instances where the IV-E Indirect Costs that subrecipients requested reimbursement for were not properly calculated due to unsupported expenses mentioned above. Also, there was one instance where indirect costs were calculated incorrectly from total expenses, not IV-E allowable expenses. Repeat Finding: Montana’s Single Audit reports for the two fiscal years ended June 30, 2019, and the two fiscal years ended June 30, 2021, included related findings (#2019-017 and #2021-061). These findings recommended the department reimburse subrecipients only for activities allowed by federal regulations and to design and implement internal controls to ensure adequate documentation is obtained, reviewed, and approved prior to payment. Effect: Without adequate supporting documentation, the department cannot demonstrate compliance with internal control requirements in federal regulation. Additionally, for payments that lack adequate support, the department may have incurred costs for unallowable activities under the federal award or for costs that were not reasonable or necessary. Without adequate documentation for training costs, the department cannot demonstrate the activity was in the training plan. As noted in Finding #2023-056, the department does not complete risk assessments of its subrecipients as required. By performing risk assessments, the department may be able to support a different level of payment monitoring and review for lower risk subrecipients. Cause: Overall, the department believes its controls for review of supporting documentation are effective for subrecipient payment activities. Department personnel also noted the federal government only partially sustained the last two audit findings, indicating the department provided additional support to the federal government to support the payments we previously questioned. However, it is unclear to us what additional information was provided and when it was obtained by the department, and the federal grantor agency communicated the importance of retaining adequate documentation. Because we are not responsible for resolving federal findings, we did not review any additional documentation the department provided to the federal government. The support the department provided to us for payments during the current audit does not contain enough detail to confirm the payments were appropriate and necessary for the grant at the time the reimbursements were made. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls for its Foster Care federal awards to ensure adequate documentation for subrecipient payments is obtained, reviewed, and approved prior to payment. B. Reimburse Foster Care federal award subrecipients only for activities allowed by federal regulations. Views of Responsible Officials: The department partially concurs with this recommendation. The department represented they enhanced internal controls in fiscal year 2023. They also indicated they started completing risk assessments of subrecipients and believe the subrecipients that have the questioned costs are low risk. Additionally, in fiscal year 2024, the department has requested receipt-level documentation of all questioned costs and believe this documentation indicates costs are allowable activities. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. Based on the documentation reviewed and obtained during the audit period and at the time of audit, it is our position documentation was not adequate to support that costs were allowable under the federal program. As such, our recommendation stands.

Finding 2023-058: U.S. Department of Health and Human Services ALN #93.558, Temporary Assistance for Needy Families (TANF) (COVID-19) Grant #2101MTTANF, 2201MTTANF, 2301MTTANF Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During the audit period, there were no Department of Public Health and Human Services (department) level controls over the accuracy and completeness of the ACF-199 TANF Data Report before its submission to the federal government. Questioned Costs: No questioned costs identified. Context: The department uses its Combined Healthcare Information and Montana Eligibility System-Enterprise Architecture (CHIMES) system to determine TANF eligibility and benefit amounts. The ACF-199 TANF Data Report is prepared and submitted directly from the CHIMES system by the department’s contractor. While the department represents it tested ACF-199 report functionality with CHIMES implementation in approximately 2012, there is no current system assurance available for report accuracy and completeness. Errors are only determined if the federal government notifies the contractor of an error in the data. During the audit period, the department had developed new procedures for the review of the ACF-199 report. However, we were not able to observe the new procedure before the end of the audit period. Repeat Finding: Montana’s Single Audit report for the two fiscal years ended June 30, 2021, contained a finding (#2021-056) related to this issue. Effect: Without reviewing the file for accuracy and completeness prior to submission and in the absence of documentation of initial and ongoing testing of the CHIMES system, the department is unable to demonstrate adequate internal control over its ACF-199 reports. Cause: Prior to implementing new procedures, the department believed its up-front data collection procedures within the eligibility system and validation of the data file in the state/federal exchange were sufficient controls for its ACF-199 reports. The department developed internal controls it believes will ensure the completeness and accuracy of the report prior to submission. However, the procedures were not finalized and implemented until after the audit period. Recommendation: We recommend that the Department of Public Health and Human Services implement and document internal controls developed to ensure complete and accurate reporting of Temporary Assistance for Needy Families ACF-199 reports. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-059: U.S. Department of Health and Human Services ALN #93.575 and 93.596, Child Care Development Fund Cluster (CCDF) (COVID-19) Grant #2101MTCCDF, 2201MTCCDD, 2201MTCCDF, 2301MTCCDD, 2301MTCCDF, 2101MTCC5 Criteria: Federal regulation, 2 CFR 200.332(a)(1), lays out the fourteen required elements to be communicated to subrecipients to identify the federal award properly. Federal regulation, 2 CFR 200.332(b), requires non-federal entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward to determine the appropriate level of subrecipient monitoring. Federal regulation, 2 CFR 200.332(d), requires non-federal entities to monitor the subrecipient’s activities, including reviewing reports and resolving Single Audit findings related to the subaward. Federal regulation, 2 CFR 200.334, requires financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award be retained for three years. Federal regulation, 45 CFR 98.68(a), requires lead agencies, such as the Department of Public Health and Human Services (department), to describe in their state plan the effective internal controls in place to ensure program integrity and accountability. The department’s State Plan outlines the department’s processes for regularly evaluating internal control activities, including reviews of the Child Care Resource and Referral (CCR&R) agency audits to evaluate performance. The State Plan also indicates that prior to each contract year with the CCR&R agencies, the contract manager and fiscal analyst conduct a risk assessment on each agency, and that the risk assessment draws on the agency’s Single Audit (amongst other factors). Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: We noted the following instances where controls were ineffective in complying with federal regulations governing subrecipient monitoring, related to the CCR&R agencies. (1) The department’s internal controls were ineffective in ensuring that all of the federal award identification items required by 2 CFR 200.332(a)(1) were included in its subaward agreements with the CCR&R agencies in fiscal years 2022 and 23. The 2022 agreements do not include federal award identification number, award date, period of performance start and end date, budget period start and end date, identification of whether the award is research and development related, and the required information on indirect costs. The 2023 agreements contain all required elements other than the budget period start and end date. While the 2023 agreements include most of the required federal award identification information, the disclosed information is for the department’s most recent federal awards received. As part of our audit, we noted the department’s processes include moving expenditures between grant awards, to maximize grant funds as grants are nearing close-out. If similar practices to those we observed in the current audit period continue, it is possible the federal awards disclosed in the 2023 agreements will not be those to which the department ultimately attributes all the subaward expenditures. (2) The department's internal controls were ineffective in ensuring compliance with State Plan procedures related to program integrity and accountability. The department could not provide evidence risk assessments were completed because associated documentation was not retained for the CCR&R agencies for federal fiscal year 2022. Additionally, the department uses the risk assessments to document its review and consideration of audit reports, including Single Audit reports, so they could not demonstrate reviews occurred as part of the risk assessment process. Federal regulations require these risk assessments and audit report reviews. Questioned Costs: No questioned costs identified. Context: There are six CCR&R agencies, covering seven regions throughout the state. For risk assessment purposes, there are only six entities over which risk should be assessed. The department enters into separate agreements by region for contracting purposes, so there are seven contracts. As discussed in the condition above, we found issues in both years of the audit period. In total, the department paid the CCR&R agencies approximately $29.2 million during fiscal years 2022 and 2023, or 18 percent of the total program expenditures for the audit period. Effect: The department is not in compliance with federal subrecipient monitoring requirements and did not follow the procedures in the State Plan. The CCR&R agencies were not provided all the information required to identify their subawards. In addition, the CCR&R agencies may not have all of the information necessary to comply with the terms of the award and to meet all federal compliance requirements, which may limit the ability of subrecipients to comply. Subrecipients subject to Single Audits will also need this information for their audit. Additionally, the risk assessment process is an important element of internal controls over the compliance requirements carried out by the CCR&Rs. There is risk that the department may not appropriately monitor the activities of the subrecipients. Cause: The department’ standard contract template did not contain all required elements. In addressing prior audit findings 2021-051, 2021-052, and 2021-053 related to contract disclosures in other federal programs, the department centrally worked on an update to the contract templates. However, per department personnel, this update occurred too late for changes to be implemented for the 2022 contracts. Regarding the budget period information’s exclusion from the 2023 contracts, department personnel indicated the intent in the contract template is for the contract term to be the budget period, as communicated through the budget attachment. For these specific contracts, however, the budget attachment does not include the budget period. Regarding the risk assessments, program personnel indicated they believe the 2022 risk assessment were completed but saved over when the 2023 risk assessments were started. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls over subrecipient monitoring for the Child Care Development Fund Cluster to ensure all award identification information is communicated to subrecipients, subrecipient risk assessments and associated audit report reviews are completed, and documentation is retained. B. Comply with federal subrecipient monitoring regulations and State Plan requirements by communicating all award identification information to subrecipients and by completing and retaining documentation of risk assessments and audit report reviews for subrecipients. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-060: U.S. Department of Health and Human Services ALN #93.575 and 93.596, Child Care Development Fund Cluster (CCDF) (COVID-19) Grant #2101MTCCDF, 2201MTCCDD, 2201MTCCDF, 2301MTCCDD, 2301MTCCDF, 2101MTCCC5 Criteria: Federal regulation, 45 CFR 98.11(b)(4), states that in retaining overall responsibility for the administration of the program, lead agencies such as the Department of Public Health and Human Services (department) shall ensure the program complies with the approved state plan. Note that federal regulation 45 CFR 98.68(b) requires the state plan to (1) include a description of the processes in place to identify fraud and (2) recover fraudulent overpayments. Federal regulation, 45 CFR 98.68(a), requires lead agencies, such as the department, to describe in their state plan the effective internal controls that are in place to ensure program integrity and accountability. Section 8.1.2 of the State Plan indicates that part of the department’s process to identify risk in the CCDF program include Child Care Resource and Referral (CCR&R) agency eligibility supervisors conducting a review of 10 percent of cases monthly, with the department reviewing the results. Section 8.1.5 of the State Plan further indicates the monthly CCR&R agency eligibility supervisor reviews, discussed above, are part of the department’s procedures to identify and prevent fraud or intentional program violations. The State Plan specifies these reviews: (1) aid in the identification and prevention of fraud and intentional program violations because they allow for a review of more eligibility cases where potential fraud can be identified; and (2) aid the state in identifying areas of concern that should be addressed in training, with the intent of helping CCR&R staff identify situations that could be instances of intentional program violations and fraud. Federal regulation, 2 CFR 200.334, requires the retention of financial records, supporting documents, statistical records, and all other non-federal records pertinent to a federal award for three years. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: As part of the audit, we noted the following monitoring tools that the department intended to have in place over the activities of the CCR&Rs were not consistently used during fiscal years 2022 and 2023: • The department intended to perform quarterly desk monitoring of the CCR&Rs for fiscal year 2023, using quarterly reports submitted by the CCR&Rs, instead of on-site monitoring at the start of the fiscal year. While the department intended to do these reviews, no desk reviews were fully completed and documented other than those for the year’s first quarter. • Monthly CCR&R agency supervisor reviews of eligibility determinations made by CCR&R staff did not occur for October 2021-August 2022, and December 2022-February 2023. Department staff indicated they use the desk monitoring and supervisor reviews to monitor the activities of the CCR&Rs, to mitigate risk, and to remain in a low error rate classification related to improper payments. As such, these monitoring tools are important controls over compliance requirements associated with eligibility for participation in the Best Beginnings Child Care Scholarship program (BBCCS) and monitoring the activities of the CCR&R agencies as subrecipients. Additionally, the State Plan describes the supervisor reviews as elements of the department’s internal controls to ensure program integrity and accountability. Questioned Costs: No questioned costs identified. Context: There are six CCR&R entities, covering seven regions throughout the state. The CCR&Rs perform various tasks to help the department administer the program, including determining eligibility for families to participate in the BBCCS. The department offers this program to qualified low-income families whose child or children receive care from approved providers. Payments issued to childcare providers for the BBCCS program, based in part on the eligibility determinations made by the CCR&R staff, totaled approximately $48 million in fiscal years 2022 and 2023 combined. Effect: Without effective internal controls, including those over retaining documentation, the department cannot demonstrate the steps they have taken to mitigate risk. There is also risk that absent this type of monitoring, program personnel will not timely become aware of challenges the CCR&Rs are facing related to implementing program requirements. Furthermore, the State Plan indicates the monthly CCR&R supervisor reviews are to be completed as part of the state’s procedures to ensure program integrity and accountability, including identifying risks within the program and identifying and preventing fraud or intentional program violations. However, the department has not complied with the State Plan regarding these reviews. These reviews are a State Plan certified tool to aid in identifying fraudulent overpayments, as mandated by federal regulations. Consequently, the department cannot fully demonstrate compliance with federal regulations regarding the identification and collection of fraudulent overpayments. Department personnel represented there were no fraudulent payments identified through other means in fiscal year 2022, and that one fraudulent payment was identified in fiscal year 2023. Based on our review, collection procedures were initiated on this payment in fiscal year 2024. Cause: Department personnel indicated there were staff capacity issues and turnover during the audit period, which impacted their ability to perform the CCR&R quarterly monitoring as initially intended. Additionally, the CCDF cluster received a significant influx in federal funding during the audit period, in response to the COVID-19 public health emergency. Administering these funds created more work for the department, and department personnel indicated this increased workload impacted their capacity to facilitate the monthly supervisor review process. Department personnel also asserted they undertook a project to re-work the supervisor review process with input from CCR&R supervisors, and that the new process was implemented in March of 2023. In September 2023, the department was facilitating the supervisor reviews for April 2023. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls over monitoring the activities of the Child Care Resource and Referral agencies helping to carry out the objectives of the Child Care Development Fund Cluster, including following the monitoring procedures described in the State Plan. B. Comply with federal regulations regarding fraudulent payment detection. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-061: U.S. Department of Health and Human Services ALN #93.575 and 93.596, Child Care Development Fund Cluster (CCDF) (COVID-19) Grant #1901MTCCDD, 2001MTCCDF, 2101MTCCDF, 2201MTCCDD, 2201MTCCDF, 2301MTCCDF, 2301MTCCDD, 2001MTCCC3, 2101MTCCC5, 2101MTCDC6, 2101MTCSC6 Criteria: Federal regulation, 45 CFR 98.65(g), requires lead agencies such as the Department of Public Health and Human Services (department) to submit financial reports, in a manner specified by the Administration for Children and Families (ACF), quarterly for each fiscal year until the funds are expended. ACF’s Instructions for Completion of Form ACF-696 Financial Reporting Form for the Child Care and Development Fund (CCDF) State & Territory Lead Agencies (OMB #0970-0510) indicates that pursuant to 45 CFR 98.65(g), states are required to complete and submit a quarterly financial status report (ACF-696). This reporting guidance also indicates how activity should be reported, by category. Federal regulation, 45 CFR 98.50), describes the earmarking requirements for CCDF funds, including those for administrative costs maximums, direct services, and quality. Federal regulation, 45 CFR 98.68(a), requires lead agencies, such as the department, to describe in their state plan the effective internal controls that are in place to ensure program integrity and accountability. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: To facilitate quarterly ACF-696 financial reporting and overall monitoring of CCDF program compliance requirements related to financial grant management, such as earmarking and period of performance requirements, the department uses a variety of funds, accounts, and project codes in the state’s accounting system to record program expenditures. During the audit period, the department used the ACF-696 financial reporting process, which summarizes the financial activity in the accounting records and reports it to the federal government, as one of its main controls over monitoring whether the CCDF program was meeting specific financial management compliance requirements. As part of our audit work, we identified multiple errors in the ACF-696 financial reports for the program, indicating controls should be enhanced over the reporting process. The errors in the ACF-696 reports indicate there is also room for improvement in expenditure coding on the accounting records, to help facilitate more accurate reporting. For the audit period, based on the errors we identified, the controls built around the reporting process, including the use of specific funds, accounting, and project codes in the accounting records, were not effective controls to ensure compliance with other financial management aspects of the program, including matching, level of effort, earmarking, and period of performance. Additionally, the department’s accounting records and ACF-696 financial reports do not allow the department to demonstrate full compliance with earmarking requirements during the audit period, and we were unable to determine compliance with all those requirements for grants that closed during the audit period. Questioned Costs: No questioned costs identified. Context: The state receives CCDF funding through a variety of federal sources, including Federal Mandatory Funds, Federal Matching Funds, and Federal Discretionary Funds. Additionally, during the audit period, the state received an influx of funds in response to the COVID-19 public health emergency. The ACF-696 report is used to report on the state’s expenditure activities for each grant year, by expenditure category and funding source, including the state’s required state source contributions for the program. As part of the audit, we intended to complete a sample of 5 of the 24 quarterly ACF-696 reports due during the audit period. We selected reports from across grant years and quarter end dates. The sample was not statistically valid. After testing two of the five selected reports, we identified multiple errors in the reported information. Additionally, we noted that for one of the remaining three reports we intended to sample, the department continued to adjust and resubmit the report through March of 2024. We performed limited audit work over that report and identified additional errors. Based on the prevalence of errors in the three reports we reviewed, and department personnel’s overall acknowledgement and agreement that there were errors in the ACF-696 reporting during the audit period, we did not test the remaining sample items. The table below summarizes the errors in the three reports reviewed: See the Schedule of Findings and Questioned Costs for chart/table. For item #6 in the table above, the error was the result of a manual adjustment to the report. Records indicate this adjustment was because grant funds available for the period being reported on were fully exhausted. The manual adjustment brought actual expenditures down to match the grant funds received. As a result, the reported expenditures don’t match what is on the state’s accounting records. Additionally, the amount of the manual adjustment was more than what the department reported as its request for funds for the next quarter. This indicates the department reported requesting fewer funds than it knew it had already spent. Department personnel represented they included the expenditures in the next quarterly report, after additional grant funds were received. In addition to the items in the table, for the 2021 Grant Year report, we noted the department hard-coded three amounts in the report, ranging from $1,311,504 to $7,826,332, that we could not tie back to the accounting records. These amounts were in the Discretionary Fund and Matching Fund grant columns. In addition to our ACF-696 report testing, as part of our audit we attempted to test compliance with earmarking requirements for the CCDF grants that closed during the audit period. While reviewing earmarking requirements for the 2019 Discretionary Grant, we observed the department recording multiple journal entries in the accounting records to move expenditures between various 2019 and 2020 grant funds. In January 2022, a journal entry moved $1.36 million of expenditures from the 2019 Discretionary Grant to the 2019 Matching Grant. Then, in March 2022, another journal entry moved $1.36 million of expenditures from the 2019 Matching Grant to the 2020 Discretionary Grant. The March 2022 journal entry does not contain support detailing what activity was being moved but appears to be moving the same activity that was initially moved in the January 2022 entry. As part of closing out the 2019 Discretionary Grant, the department also recorded a journal entry in April 2022 to further reduce the expenditures attributed to the 2019 Discretionary Grant by approximately $1.36 million, moving them to the 2020 grant instead. Based on our review of the department’s support for the April 2022 entry, the underlying expenditures moved were the same as those already moved in the January 2022 entry. Thus, the accounting records and support indicate the department moved the same expenditures twice from the 2019 Discretionary Grant to the 2020 Discretionary Grant, as part of closing out the 2019 grant. We were unable to test all the earmarking requirements for the 2019 Discretionary Grant as a result of these entries and the concerns we have with the accuracy of the accounting records as previously described. The department has an opportunity to enhance the support included in their journal entries recorded as part of the grant close-out process. This should help allow them to demonstrate what activities are being paid from which grant funds, which will facilitate their ability to demonstrate compliance with earmarking requirements. Given the concerns with the 2019 grant entries and their impact on the 2020 grant, we were also unable to test compliance with earmarking requirements for the 2020 grants. Additionally, when we reviewed support for the January 2022 entry, we noted a portion of the expenditures it moved to the 2020 Discretionary Grant were for activities incurred before the start of the period of performance for that grant. We have reported these as questioned costs in finding 2023-062. Given the April 2022 journal entry was for the same underlying expenditures, additional questioned costs may exist. However, additional adjusting entries may have occurred. Repeat Finding: Montana’s Single Audit report for the two fiscal years ended June 30, 2021, included a finding (#2021-058) related to implementing internal controls over requirements related to period of performance, matching, level of effort, and earmarking. That finding also referred to a related finding (#2019-019) in Montana’s Single Audit for the two fiscal years ended June 30, 2019. Effect: The department misrepresented CCDF program expenditure activities during the audit period in its ACF-696 financial reporting. Absent effective internal controls, the department is at heightened risk of not meeting its federal grant management requirements related to period of performance, earmarking, level of effort, and matching. Based on our review, the department cannot demonstrate full compliance with earmarking requirements, and we were unable to reasonably determine compliance with all those requirements for grants that closed during the audit period. Additionally, as noted in finding #2023-0xx, we also identified some instances in which the department did not comply with period of performance requirements, resulting in questioned costs. Cause: The ACF-696 reports are prepared by accounting and financial reporting staff outside of the division responsible for managing the CCDF program and are reviewed by program personnel prior to submission. The ACF-696 reporting template is used to pull expenditure data from the state’s accounting system and incorporate it in the ACF-696 report based on the fund and project attached to the data. Based on our work, a portion of the errors we identified were caused by the initial expenditures recorded to incorrect projects in the state’s accounting system. A portion of the errors also appear to be related to incorrect or incomplete analysis of the financial activity and reporting requirements. Department personnel indicated program staff caught some errors in their review, but the errors were not corrected prior to the submission of the report. Additionally, department personnel indicated there was turnover in both the program staff and division responsible for compiling the ACF-696 report. Overall, the department has an opportunity to enhance internal controls over the ACF-696 report process, including ensuring data is appropriately recorded on the state’s accounting system, to facilitate accurate financial reporting as a mechanism to not only comply with reporting requirements but to monitor other financial grant management requirements. As part of the audit process, department personnel agreed there were errors in the reports and that some expenditures were coded incorrectly in the accounting records. They also recognized the need to include more support in their journal entries moving activities between grant funds, to ensure they could demonstrate what was being moved and why. They indicated they began to make changes to accounting procedures and reporting processes towards the end of the audit period. Based on timing, and the cumulative nature of the reports, these changes in procedures did not have a significant impact on controls and compliance for our audit period but will be considered in future audits. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls over the ACF-696 quarterly financial reporting process for the Child Care Development Fund Cluster program. B. Enhance internal controls over financial management of grant funds, to facilitate compliance with requirements related to period of performance, matching, level of effort, and earmarking for the Child Care Development Fund Cluster program. C. Enhance documentation to demonstrate compliance with earmarking requirements for the Child Care Development Fund Cluster program. D. Accurately report Child Care Development Fund Cluster program expenditure activity in the ACF-696 quarterly financial reports. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-062: U.S. Department of Health and Human Services ALN #93.575 and 93.596, Child Care Development Fund Cluster (CCDF) (COVID-19) Grant #2001MTCCDF, 2101MTCCDF Criteria: Federal regulation, 45 CFR 98.60(d)(1), indicates discretionary CCDF funds must be obligated in the fiscal year in which the funds are awarded or in the succeeding fiscal year. Additionally, the Notice of Award provided by the Department of Health and Human Services stipulates that the budget period for the 2020 Discretionary Grant begins October 1, 2019. Per federal regulation, 45 CFR 98.64, unobligated discretionary funds are subject to reallotment and redistribution to other states. Federal regulation, 45 CFR 98.60(d)(4), indicates the determination of whether CCDF funds have been obligated or liquidated will be based on either governing state or local law or, in the absence of applicable state or local law, information in 45 CFR 75.2. This regulation states, “when used in connection with a non-Federal entity’s utilization of funds under a Federal award, obligations mean orders placed for property and services, contracts and subawards made, and similar transactions during a given period that require payment by the non-Federal entity during the same or a future period of time.” Federal regulation, 45 CFR 98.60(d)(5), indicates obligations may include subgrants or contracts that require payment of funds to a third party, and stipulates that lead agencies, such as the Department of Public Health and Human Services (department), or another entity at the same level of government as the lead agency are not considered third party subgrantees or contractors. Condition: During the audit period, the department charged salary, print, and mail expenditures to its discretionary CCDF grant funds for costs incurred after the obligation deadline for the funds. These expenditures did not result from orders placed for property and services, contracts, or subawards to third parties. Additionally, for one discretionary grant the department incurred some costs before the start of the period of performance. Questioned Costs: For the 2020 Discretionary Grant, we identified known questioned costs for the $44,978 of salary expenditures discussed in the context section that were charged to the grant. Additionally, we consider the $22,330 of related personal services expenditures charged to the grant, and discussed in the context section, to be likely questioned costs. We also question $808,345 of expenditures charged to the 2020 Discretionary Grant, for expenditures associated with payments issued for activities occurring before the start of the period of performance. These known and likely questioned costs are related to ALN #93.575. For the 2021 Discretionary Grant, the $16,028 of printing, postage, and mailing costs charged to the grant after the obligation deadline, discussed in the context section, are known questioned costs. These questioned costs are related to ALN #93.575. Context: The department’s 2020 and 2021 Discretionary Grant awards were $16,183,100 and $16,030,772, respectively. We reviewed the expenditures charged to these grant funds during our audit period to determine whether they were obligated by the required deadlines. As part of our review, we noted the following instances in which expenditures either were, or likely were, incurred and paid after the applicable obligation deadlines. • Fiscal 2020 Discretionary Grant Funds – the obligation deadline for these grant funds was September 30, 2021. Based on our review, the department recorded normal bi-weekly payroll costs for pay periods ending after the obligation deadline to the grant funds. Given the state’s bi-weekly payroll process, employees do not earn their compensation until time has been worked or leave has been charged. We reviewed all of the journal entries for the $44,978 of salary expenditures charged to the grant funds after the obligation deadline. We confirmed all were recorded as part of the normal bi-weekly pay process, after payroll processing for periods occurring before September 30, 2021, would have been recorded. The department also recorded other associated personal services costs, such as those for benefits, totaling $22,330 in the same period of time when the salary expenditures were charged to the grant funds. Based on our review of the accounting records, these expenditures were likely also associated with pay periods that ended after the September 30, 2021, obligation deadline. • Fiscal 2021 Discretionary Grant Funds – the obligation deadline for these grant funds was September 30, 2022. The department charged certain types of general operating expenditures, such as costs for print, mail, and postage, totaling $16,028, to the grant funds after the obligation deadline. The nature of these types of expenditures are largely for services that the department receives from other state agencies, such as mailing items. Based on our review of the accounting records and inquiries with department personnel, these expenditures were not obligated by the obligation deadline. Additionally, we identified expenditures charged to the 2020 Discretionary Grant funds that were incurred before the start of the period of performance for the grant. The period of performance start date for these funds was October 1, 2019. The department recorded journal entries in state fiscal year 2022 to move $1.36 million of expenditures from the 2019 discretionary grant funds to the 2020 Discretionary Grant funds. While their support shows an analysis of the accounting transactions recorded after October 1, 2019, two of the journal entries included in their support were transactions to re-record expenditures for payments issued in fiscal year 2019. These expenditures were temporarily reduced while Budget Change Documents were processed for the department’s reorganization. Based on our review, a majority of the initial expenditures underlying the re-recorded total amount were for payments to the department’s Child Care Resource and Referral (CCR&R) agencies for time periods before October 1, 2019. In total, we identified $808,345 of payments included in the re-recorded expenditures, that were issued for activity occurring before October 1, 2019. Effect: The department did not comply with federal regulations, resulting in the known questioned costs discussed above. For the known and likely questioned costs, there is risk the department will have to repay the federal government for the costs. Cause: As noted in Finding #2023-061, the department has an opportunity to improve its internal controls over compliance with period of performance requirements, which include the requirements discussed in this section. For the personal services expenditures specifically, department personnel indicated in fiscal year 2023, one individual employee’s time charging code was inadvertently not updated in the state’s human resources system, resulting in approximately $7,000 of salary expenditures and associated benefits being incorrectly charged to the 2020 Discretionary Grant instead of newer grant funds. For the remaining salary and benefit expenditures, department personnel believe it was appropriate to charge the activity to the 2020 Discretionary Grant, even though it was for pay periods ending after the September 30, 2021, obligation date. Personnel indicated the staff whose costs were being paid were employed by the department before September 30, 2021, and that the salary and benefit expenditures charged to the 2020 Discretionary Grant for them in fiscal year 2022 were reasonable to charge to the grant during the grant liquidation period. As previously noted, state employees do not earn their compensation until time has been worked or leave has been charged, so we do not believe the personal services expenditures recorded in fiscal year 2022 for pay periods ending after September 30, 2021, were obligated by the September 30, 2021, deadline. For the CCR&R expenditures charged to the 2020 grant that were for activities that occurred before the start of the period of performance, the department’s analysis appears to have overlooked the nature of the entries and that consideration should have been given to the underlying actual payments. Recommendation: We recommend the Department of Public Health and Human Services only charge expenditures to federal Child Care Development Fund Discretionary funds for activities occurring during the obligation period. Views of Responsible Officials: The department conditionally concurs with this recommendation. The department stated that significant improvement occurred in fiscal year 2023, including additional controls to ensure inactivation of costs centers to prevent payroll or other expenses to post beyond the first year of the CCDF Discretionary Grant. The department noted that several of the observations discussed in the finding occurred during a department reorganization, which is rare. Per the department, they have identified set-aside costs for grant funds that are allowable and offset portions of the questioned costs. Rebuttal of Views of Responsible Officials: We considered the department’s conditional concurrence. It is our position that internal controls in place during the audit period or at the time of audit were not adequate to ensure costs charged to the CCDF grants were incurred during the appropriate period of performance. As such, our recommendation stands.

Finding 2023-063: U.S. Department of Health and Human Services ALN #93.575 and 93.596, Child Care Development Fund Cluster (CCDF) (COVID-19) Grant #2101MTCSC6 Criteria: Federal regulation, 45 CFR 98.60(d)(1), indicates discretionary CCDF funds must be obligated in the fiscal year in which the funds are awarded or in the succeeding fiscal year. Federal regulation, 45 CFR 98.64, specifies unobligated discretionary funds are subject to reallotment and redistribution to other states. Federal regulation, 45 CFR 98.60(d)(4), indicates the determination of whether CCDF funds have been obligated or liquidated will be based on either governing state or local law or, in the absence of applicable state or local law, information in federal regulation 45 CFR 75.2. This regulation states, “when used in connection with a non-Federal entity’s utilization of funds under a Federal award, obligations means orders placed for property and services, contracts and subawards made, and similar transactions during a given period that require payment by the non-Federal entity during the same or a future period of time.” Federal American Rescue Plan Act (ARPA) Stabilization guidance specifies CCDF Discretionary obligation and liquidation periods at 45 CFR 98.60(d)(1) apply to ARPA Stabilization funds. Lead agencies, such as the Department of Public Health and Human Services (department) had until September 30, 2022, to obligate ARPA Stabilization Grants funds. Federal regulation, 45 CFR 98.68(a), requires lead agencies such as the department to describe in their state plan the effective internal controls that are in place to ensure program integrity and accountability. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department’s internal controls were not effective in ensuring all ARPA Stabilization funds were obligated by the required September 30, 2022, deadline. The department did not obligate all funds by the deadline, and subsequently issued payments to providers from the unobligated funds. Questioned Costs: We question approximately $3.5 million in payments issued to providers from funds that were not obligated by September 30, 2022. These payments were issued under ALN #93.575. Context: The department received $68,075,745 in ARPA Stabilization funds. Federal guidance stipulated a majority of the funds were to be issued as grants to qualified childcare providers to support the stability of the childcare sector during and after the COVID-19 public health emergency. Initially, the department partnered with childcare providers to support their operational expenses. Four funding cycles took place through August 2022. By the end of these cycles, there were surplus funds available for providers. To distribute these, a fifth payment cycle was introduced for providers willing to accept additional funds. Contract amendments reflecting these payments were initiated in October 2022, and notices of awards detailing the dollar amounts to be awarded through contract amendments were sent to providers before the September 30, 2022, deadline. While these notices of awards were not official contracts or subaward documents, we believe they were sufficient to constitute an obligation, given they were formal notifications signed by the department stating the dollar amount by which the existing contracts would be amended. The department's records show that contracts with providers through the fifth funding round totaled approximately $58.6 million, all of which were obligated by the deadline. In addition to the fifth payment cycle, the department also allocated a portion of the surplus funds available after the four initial funding cycles to providers in childcare deserts – areas in which there is a small supply of childcare providers. The department worked with these providers to determine if they were willing to accept additional funds, separate from the fifth round of funding. Prior to September 30, 2022, the department received email confirmation from providers agreeing to accept more funds. This correspondence did not indicate the amount of funding that would be provided or otherwise commit the department to make payments of specified dollar amounts to the providers. Therefore, the department cannot demonstrate that as of September 30, 2022, they had an enforceable commitment to issue payments totaling the $3.5 million that was later paid to the childcare desert providers. Therefore, according to federal regulation 45 CFR 75.5, these funds were not considered obligated. In November 2022, the department sent letters to providers detailing their award amounts and the terms and conditions. Department records show in total, approximately $3.5 million in payments were made to providers for these desert payments. Effect: Not having effective internal controls to ensure all funds were appropriately obligated by the September 30, 2022, deadline put the department at risk of non-compliance with federal regulations. By subsequently issuing payments to providers from the unobligated funds, the department did not comply with federal regulations, resulting in the approximate $3.5 million in questioned costs disclosed above. Cause: The CCDF program received a significant influx in federal funding during the audit period, in response to the COVID-19 public health emergency. Administering these funds increased the department’s workload. Department personnel worked closely with providers to allocate the ARPA Stabilization funds, including the extra funding that existed after initial contracts were paid. Per department personnel, some factors, such as tax implications, impacted whether providers were willing to accept additional funds and when they were willing to accept them. Working through this took time. While the department ensured they received agreement from providers to accept additional payments and had an internal plan for how to allocate the remaining available funds across providers by the September 30, 2022, deadline, they had not externally committed themselves to making payments of any set dollar amount. Simply having a plan and receiving providers’ agreement to accept more funds is not enough to support the department had obligated the funds. Department personnel believe the definition of an obligation in federal regulations is vague and does not require a stated dollar amount. While we agree the federal regulation does not require a stated dollar amount, the department did not have an enforceable contract or subaward agreement, committing them to issue payments by the deadline. Recommendation: We recommend the Department of Public Health and Human Services: A. Implement internal controls to ensure federal Child Care Development Fund Cluster funds are obligated by established deadlines. B. Comply with federal regulations by ensuring Child Care Development Fund Cluster obligations are supported by orders placed, contracts and subawards made, or similar transactions. Views of Responsible Officials: The department does not concur with this recommendation. The department’s position is they obligated all funds and then reallocated the surplus to providers that had not received prior stabilization funds. Providers that received reallocated funds were required to provide email confirmation of their express intent to receive unliquidated funds prior to September 30, 2022. The department’s position is that once providers confirmed they agreed to accept the funds, the department had a valid obligation and did not request the waiver offered by their federal cognizant to extend the obligation period. Rebuttal of Views of Responsible Officials: We considered the department’s nonconcurrence with the recommendation. While the department ensured they received agreement from providers to accept additional payments by September 30, 2022, they had not externally committed to making payments of any set dollar amount. It is our position that receiving provider’s agreement to accept more funds is not enough to support obligation of the funds. The department did not have an enforceable agreement committing them to issue payments by the deadline.

Finding 2023-064: U.S. Department Health and Human Services ALN #93.375 and 93.596, Child Care Development Fund Cluster (CCDF) (COVID-19) Grant #2101MTCCC5 Criteria: Federal regulation, 45 CFR 98.20(a)(2)(i), indicates a child’s eligibility for childcare services under the CCDF program is dependent on the child residing with a family whose income does not exceed 85% of the state’s median income. The Coronavirus Response and Relief Supplemental Appropriations (CRRSA) Act, Public Law 116-260, authorizes states to use funds appropriated under the Act to provide childcare assistance, without regard to income eligibility requirements, to health care sector employees, emergency responders, sanitation workers, farmworkers, and other workers deemed essential by public officials during the response to the coronavirus. Regular income eligibility requirements in federal regulation, 45 CFR 98.20, apply to all other individuals. Federal regulations, 45 CFR 98.41 and 45 CFR 98.42, establish health and safety requirements for providers, and require lead agencies, such as the Department of Public Health and Human Services (department), to require inspections of childcare providers and facilities to determine compliance with the health and safety requirements. These requirements apply to all providers, other than those classified as relative care exempt, meaning a relative provides the care. Federal regulation, 45 CFR 98.68(a), requires the department to describe in their state plan the effective internal controls that are in place to ensure program integrity and accountability. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department established the Best Beginnings Child Care Scholarship Program to subsidize the cost of childcare for families meeting federal eligibility requirements, including income requirements noted above. The department used a portion of the state’s CRRSA federal funds to establish the “Elementary Out of School Time Scholarship” program (summertime program). Through the summertime program, the department reimbursed families who did not meet the eligibility requirements of the Best Beginnings Child Care Scholarship Program for the cost of summertime care for elementary students. The department’s internal controls were not effective in ensuring that the summertime program was set-up to comply with federal regulations governing eligibility and health and safety requirements or with the CRRSA Act requirements. Contrary to federal regulations, reimbursements for the summertime program were provided to families without regard to income and to a broad set of provider types, including those not subject to the department’s health and safety monitoring and inspections. Questioned Costs: In total, the department paid approximately $17.1 million to families through the summertime program. While the department may be able to retroactively analyze the payments and support that a portion of them would have been allowable, at the time the payments were made, they did not have a procedure in place to ensure eligibility requirements were met. As such, we question the total $17.1 million payments issued under ALN #93.575. Context: The department offered the summertime program in the summers of 2021 and 2022. The department reimbursed families for summertime care totaling approximately $17.1 million for the two years. As part of the audit, we interviewed department personnel and reviewed the department’s program guidance, federal regulations, federal CRRSA guidance, and the department’s 60-day report provided to the federal government detailing the department’s intended use of CRRSA funds. We noted the following: • The Summer 2021 program provided reimbursements of up to $2,000 per child. For the Summer 2022 program, families could choose to receive either $1,500 or $2,000 per child. • The department allowed families to seek reimbursement for a wide variety of provider types, including programs offered by schools and non-profit organizations, nannies, summer camps, licensed and unlicensed childcare providers, and family/friend/neighbor providers. Not all of these provider types are routinely monitored by the department or included in the health and safety inspections required for providers participating in the CCDF program. • The department accepted self-attested employment information at the time of application. Program procedures did not indicate this employment information was considered when determining eligibility for the program. Additionally, while program procedures indicate the department intended to sample applicants to verify the self-attested employment status, department personnel indicated they did not have the staff capacity to complete the samples. • In its 60-day report to the federal government, the department indicated it intended to provide assistance to families for school-aged care. The report states the department would dedicate funding to families who may not qualify for the subsidy program (Best Beginnings Child Care Scholarship Program) but have demonstrated a need for assistance. Per department personnel, they determined families had demonstrated a need for assistance if the application process showed the family was engaged in the workforce and had a child or children in need of summertime care. They defined engaged in the workforce as either employed, or in certain circumstances, seeking employment. After reviewing the 60-day report, we do not believe the level of detail in the report alone was sufficient to understand how the summertime program actually operated and who received support through it. Given this information, we had concerns about the program’s allowability. Before communicating our concerns to the department, we spoke with U.S. Department of Health and Human Services (HHS) Administration for Children and Families Office of Child Care (OCC) personnel for more perspective. Following our communication of concerns to the department in November 2023, department personnel reached out to their federal partners to seek clarification on whether their implementation of the summertime program was appropriate in the context of governing regulations. In response, the department received preliminary information from the HHS Administration for Children and Families OCC, Division of Policy and Accountability. This feedback indicated that the state’s description of how it utilized the CRRSA funds for the summertime program appeared to be inconsistent with CCDF rules regarding income eligibility and provider health and safety requirements. Additionally, the information indicated that although the department submitted a 60-day report, the OCC did not approve the activities outlined in the report. Moreover, it was noted that the website where the 60-day reports were posted stated that “the CRRSA Act did not call for OCC to approve these reports, so OCC has not determined that all planned uses of the funds comply with CCDF and CRRSA requirements. Compliance with CCDF and CRRSA Act requirements will be determined through other OCC reporting mechanisms.” After receiving this information, department personnel considered alternative approaches to retroactively demonstrate the summertime program’s compliance with governing regulations. They offered up that the March 2020 Governor’s stay-at-home directive defined essential activities, businesses, and operations, and broadened the definition of essential worker, and indicated there was not a need to expand upon income eligibility because a large portion of the state’s population had already been categorized as essential according to the stay-at-home directive. They noted that CRRSA funds could be utilized to offer childcare assistance to essential workers regardless of their income levels. However, February 2024 correspondence from the HHS Administration for Children and Families OCC, Division of Policy and Accountability, indicates that this additional information did not alter their understanding of the situation. The OCC recommended the department take steps to: • Document the extent to which families receiving the CRRSA-funded payments for the summertime program were in fact CCDF-eligible, including being income-eligible or essential workers. • Document the extent to which providers who served the families met CCDF health and safety requirements. By taking this approach, the department may be able to retroactively determine that a portion of the summertime program payments were made to CCDF-eligible families and that the providers who served the families met the CCDF health and safety requirements. However, this was not determined when payment was made, so the payments were not reasonable and supported at that time. Furthermore, given that the department initially accepted self-attested employment information without conducting the intended sampling to verify that information, there is risk that the current information available is not a reasonable or accurate basis for a retroactive evaluation. Effect: The department cannot demonstrate that when the summertime program was established, appropriate factors and circumstances were considered concerning federal regulations governing the CCDF program and with the CRRSA Act and associated guidance. As a result, when payments were made for the summertime program, the department could not demonstrate that they were made to families who were eligible for the funds and that the families used providers meeting the CCDF health and safety requirements. As a result, we question the $17.1 million of expenditures for the summertime program. As is the case with all questioned costs, there is a potential for the federal government to seek recovery of the questioned costs from the department as part of resolving this audit finding. Cause: The department experienced turnover in the division responsible for administering the CCDF program, and current program personnel could not speak to all the decisions and considerations that went into creating the summertime program. However, current department personnel indicated the department was transparent in its 60-day report provided to the federal government, and that they believed the federal government intended to review those reports and follow-up if there were concerns over the use of the funds. They further indicated the department provided updates on the use of the funds in monthly calls with their federal partners, and they received no indication the summertime program would not be an allowable use of the CRRSA funds. Current department personnel indicated that because of the state’s broad definition of essential workers in the March 2020 Governor’s stay-at-home directive, a large portion of the state’s population had already been defined as essential workers. They believed the definition of an essential worker from the stay-at-home directive could be applied to the summertime program. However, they cannot confirm there was consideration of this definition, or a management decision to use it, when the summertime program was established, and program guidance does not refer to the stay-at-home directive as part of determining eligibility for the summertime program. Current personnel further indicated that employment data was collected at the time of application, and they believe the intent was for the department to be able to tie that information into the definition of essential worker. While this data was collected, it was not verified, and program procedures did not require it to be considered as part of determining eligibility. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to ensure programmatic decisions and factors considered in establishing new programs or implementing changes to existing programs within the Child Care Development Fund Cluster are documented and consistent with all federal regulations. B. Comply with federal regulations governing eligibility and health and safety requirements for the Child Care Development Fund Cluster. Views of Responsible Officials: The department conditionally concurs with this recommendation. The department’s position is that they were operating a program that was communicated to their federal partners based on the intent, with limited program instruction, and was thus an allowable use of the funding. They believe they were transparent in their use of the funds for the scholarship program. The department has commenced documenting all payments per the Office of Child Care request. The department represents they have documented that $8.8 million of the questioned costs were allowable and 93% of payments went to workers identified as essential. Rebuttal of Views of Responsible Officials: We considered the department’s conditional concurrence. Our finding is based on documentation available during the audit period and discussions with the federal Office of Child Care about program eligibility and health and safety requirements. As such, our recommendation stands.

Finding 2023-065: U.S. Department of Health and Human Services ALN #93.767, Children’s Health Insurance Program (CHIP) (COVID-19) Grant #210 5MT5021, 2205MT5021, 2305MT3002 Criteria: Federal regulations, 42 CFR 455.410 and 455.412, require the Department of Public Health and Human Services (department) to ensure CHIP providers are licensed, screened, and enrolled in accordance with the State Plan requirements. These activities are required in order for a provider to receive CHIP payments. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department does not have agency-level controls to ensure CHIP providers not enrolled to provide services under the Medicaid program are properly licensed, screened, and enrolled, as required by federal regulations. Absent these procedures, the department cannot demonstrate it has complied with provider eligibility screening and enrollment requirements for the audit period. Questioned Costs: Because the department pays benefits in a lump sum to its contractor for all provider claims processed within a given timeframe, it is not practicable to determine the amount of claims paid for only the 782 providers for which the department cannot demonstrate compliance. However, we believe likely questioned costs exceed the $25,000 threshold as a result of the noncompliance. Context: The department uses two processes to conduct provider eligibility screening and enrollment for the federal CHIP program. The department conducts the eligibility screening and enrollment processes for providers that provide services under the state’s Medicaid program. However, other providers are screened and enrolled by a contractor. The department has no controls in place ensure providers enrolled by the contractor are screened and enrolled as required by federal regulations. The federal requirement for provider eligibility is not new, and the department’s use of a contractor for CHIP provider enrollment is also not a new process. Our prior audits of the department have not identified this issue. Benefits and claims expenditures for the CHIP program for the audit period were $168.7 million. Of these expenditures, approximately 55% were paid to providers whom the department’s contractor enrolled. We analyzed the make-up of CHIP providers for the audit period and noted a total of 36,552 providers. Of these, 10,862 were included on both provider listings for department enrollment procedures and contractor-determined enrollment procedures. There were 782 providers subject only to contractor-determined enrollment procedures, therefore, the department cannot demonstrate compliance for the audit period. Effect: Without department-level controls over provider enrollment decisions made by a contractor, the department is not compliant with federal regulations for the CHIP program. Payments made to providers who have not been properly subjected to provider eligibility screening and enrollment requirements are not allowable, putting the department at risk of incurring unallowed costs. Questioned costs were identified for the audit period. Cause: Department control processes did not identify the need to review and monitor the enrollment determinations being made by its contractor. Recommendation: We recommend the Department of Public Health and Human Services: A. Develop and maintain internal controls to review and monitor provider eligibility screening and enrollment determinations made by the department’s contractor. B. Ensure providers enrolled by the department’s contractor are licensed, screened, and enrolled prior to making payment to the provider, as required by federal regulations. Views of Responsible Officials: The department partially concurs with this recommendation. The department has a contract with a third party to ensure CHIP providers are screened and enrolled in accordance with federal regulations. The contractor has policies and procedures on screening and enrolling providers and also obtains an annual service organization controls (SOC) audit. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. The SOC report does not specifically address provider eligibility and does not provide evidence of their compliance with the contract requirements. As such, our recommendation stands.

Finding 2023-066: U.S. Department of Health and Human Services (HHS) ALN #93.775, 93.777, and 93.778, Medicaid Cluster Grant #Various Criteria: Federal regulation, 45 CFR 95.621(f)(3), requires state agencies to review the automated data processing (ADP) system security of installations involved in the administration of Medicaid biennially. Federal regulation, 45 CFR 95.621(f)(6), requires state agencies to maintain reports of their biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site review. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Public Health and Human Services’ (department) controls were ineffective to conduct and document biennial ADP system security reviews as required by federal regulation. The department was not able to provide evidence that it performed all required ADP security reviews of internally hosted systems and did not maintain documentation of the security reviews. Questioned Costs: No questioned costs identified. Context: ADP systems involved in the administration of Medicaid include systems for eligibility determination, claims processing and management, and a data warehouse. Due to the nature of information needed for the Medicaid program, it is critical that security of these systems be maintained and reviewed often for weaknesses that could expose personal or health information to unauthorized users. Various ADP systems are used, including internally hosted systems and vendor systems hosted elsewhere, which requires a method for tracking progress of the multiple reviews. One of the department’s key controls for ensuring that ADP system security reviews are completed biennially is the use of a spreadsheet to track review completion. The spreadsheets do not contain the appropriate level of detail necessary for the department to ensure compliance with ADP system security review requirements. Additionally, they do not include the date of review completion. The department has 19 ADP systems that require biennial security reviews. We completed a sample of five of these systems to determine whether security reviews were completed. The sample was not statistically valid. The department was unable to provide complete documentation of security review for four of the five systems tested. Effect: Without adequate internal controls in place, the department is unable to demonstrate compliance with federal regulation over ADP systems, and systems may not be reviewed for security as required. Without security reviews, the department may not detect security weaknesses within ADP systems. Cause: The department experienced turnover in the division responsible for tracking the required reviews of ADP systems for Medicaid. Current staff no longer had access to reports and memos since the reports had been stored on a former employee’s personal drive. Recommendation: We recommend the Department of Public Health and Human Services: A. Develop internal controls to complete reviews of systems biennially as required by federal regulation. B. Complete a security review of each ADP system at least biennially as required by federal regulation. C. Maintain reports of its biennial automated data processing system security reviews and pertinent supporting documentation as required by federal regulation. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-067: U.S. Department of Agriculture ALN #10.551 and 10.561, SNAP Cluster Grant #Various U.S. Department of Education ALN #84.126, Rehabilitation Services – Vocational Rehabilitation Grants to States Grant #H126A210038, H126A220038, H126A230038 U.S. Department of Health and Human Services ALN #93.268, Immunization Cooperative Agreements (COVID-19) Grant #Various ALN #93.323, Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Grant #Various ALN #93.558, Temporary Assistance for Needy Families (TANF) (COVID-19) Grant #2101MTTANF, 2201MTTANF, 2301MTTANF ALN #93.563, Child Support Services Grant #2101MTCSES, 2201MTCSES, 2301MTCSES, 2101MTCEST, 2201MTCEST, 2301MTCEST ALN #93.566, Refugee and Entrant Assistance State/Replacement Designee Administered Programs Grant #2101MTRCMA, 2201MTRCMA, 2301MTRCMA ALN #93.575 and 93.596, Child Care Development Fund Cluster (CCDF) (COVID-19) Grant #2101MTCCDF, 2201MTCCDD, 2201MTCCDF, 2301MTCCDD, 2301MTCCDF ALN #93.658, Foster Care – Title IV-E (COVID-19) Grant #2101MTFOST, 2201MTFOST, 2301MTFOST ALN #93.659, Adoption Assistance – Title IV-E (COVID-19) Grant #2101MTADPT, 2201MTADPT, 2301MTADPT ALN #93.767, Children’s Health Insurance Program (CHIP) (COVID-19) Grant #2105MT5021, 2205MT5021, 2305MT3002 ALN #93.775, 93.777, 93.778, Medicaid Cluster (COVID-19) Grant #1205MT5ADM, 2205MT5ADM, 2305MT5ADM Criteria: Federal regulation, 2 CFR Appendix VI, in part, requires the state public assistance agency to develop, document, and implement a public assistance cost allocation plan in accordance with federal regulations. This section and federal regulation, 45 CFR 95.509, require the state agency promptly amend the cost allocation plan and submit the amended plan if certain events occur. Federal regulation, 45 CFR 200.416, requires a process for central services costs to be identified and assigned to benefitted activities on a reasonable and consistent basis. Federal regulation, 45 CFR 95.515, specifies the effective date of the cost allocation plan amendment is the first day of the calendar quarter following the date of the event requiring the amendment. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: For the fourth audit in a row, the Department of Public Health and Human Services (department) did not follow its federally approved plan to allocate costs among state and federal programs. Additionally, department internal controls did not prevent these inconsistencies. Questioned Costs: Using the “PACAP Impact Statement” sections of Public Assistance Cost Allocation Plan (PACAP) amendments for 2021, 2022, and 2023, which were submitted between May and November 2023, we estimated likely questioned costs. The following table summarizes questioned costs for major federal programs with material noncompliance or other federal programs where questioned costs are projected to exceed $25,000. See the Schedule of Findings and Questioned Costs for chart/table. Context: For the majority of the period under audit, the cost allocation plan in effect was submitted to the federal government in March 2020 and was effective as of January 1, 2020. The plan amendment for fiscal year 2021 was not submitted until May 2023, and plan amendments for fiscal years 2022 and 2023 were submitted after the end of the period under audit. Costs allocated to state and Federal programs totaled $173,808,149 and $184,493,577 for fiscal years 2022 and 2023, respectively. The table below depicts the total indirect costs allocated to each of the federal programs where we identified material noncompliance or questioned costs required to be reported. See the Schedule of Findings and Questioned Costs for chart/table. The internal control deficiency applies to all federal programs regardless of our identification of material noncompliance or reportable questioned costs. Repeat Finding: Montana’s prior Single Audit reports provided several recommendations to the department regarding its cost allocation plan. The report for the fiscal years ending June 30, 2017, recommended improving internal controls over the cost allocation plan (recommendation #2017-014). The report for the fiscal years ending June 30, 2019, advised the department to review and document all cost pools to ensure they align with the approved plan, obtain federal approval for changes, develop internal controls to detect variances, and allocate costs accordingly (#2019-022). The report for the fiscal years ending June 30, 2021, recommended enhancing internal controls, thoroughly reviewing cost allocation procedures, and obtaining federal approval before implementing changes (#2021-063). Effect: The department has not complied with federal compliance requirements by not following its submitted cost allocation plan. Cause: Since the previous audit, the department contracted with an external entity to review its cost allocation process and assist the department in making changes to cost pools and implementing new tools to facilitate the allocation processes. However, all work to review and modify the cost allocation processes was not completed during the audit period. During the audit period, the department continued implementing changes to cost pools and allocation methodologies outside the approved cost allocation plan. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls over cost allocation to ensure compliance with federal regulations. B. Continue and complete its in-depth review of its cost allocation procedures and plan. C. Allocate costs as specified in the cost allocation plan, as required by federal regulations. D. Implement changes to the cost allocation process only after receiving approval from, or submitting a plan revision to, the federal government. Views of Responsible Officials: The department conditionally concurs with this recommendation. The department represented it was unable to comply with federal requirements to only implement changes to the cost allocation process after receiving approval or submitting a plan revision. The department has been in ongoing discussions with the federal government since March 2020 regarding the amendment effective 07/01/2018. This amendment was approved after 5 years on 09/12/2023. The department has implemented a two-year long business process improvement, and amendments are now submitted quarterly. It is the department’s position that the use of the impact statement from the department’s cost allocation plan is not a reasonable method for developing questioned costs as the impact statement includes estimates and does not delineate between actual increases in claiming costs and changes to allocation. Rebuttal of Views of Responsible Officials: We considered the department’s conditional concurrence. Since the department was not following its approved plan, it is our position that all changes captured in the impact statement represent questioned costs as they would not have been allocated in that manner under the approved plan. As such, our recommendation stands.

Finding 2023-068: U.S. Department of Health and Human Services ALN #93.575 and 93.596, Child Care Development Fund Cluster (CCDF) (COVID-19) Grant #2101MTCCDF, 2101MTCCC5, 2201MTCCDD, 2201MTCCDF, 2301MTCCDD, 2301MTCCDF Criteria: Federal regulation, 2 CFR Part 170, Appendix A(I)(a) and (a)(2)(ii), requires non-federal entities to report to the Federal Funding Accountability and Transparency Act (FFATA) reporting system each action that equals or exceeds $30,000 in federal funds for a subaward to a non-federal entity. The report should be submitted no later than the end of the month following the month in which the obligation was made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal years 2022 and 2023, the Department of Public Health and Human Services’ (PHHS or department) internal controls were not sufficient to ensure all CCDF actions equal to or greater than $30,000 were accurately, completely, and timely reported to the FFATA reporting system. Actions for CCDF occur when funds are obligated to subrecipients, Child Care Resources and Referral agencies. Questioned Costs: No questioned costs identified. Context: To complete our audit testing, we started by using data available at usaspending.gov and reviewed all obligations reported during the audit period as compared to obligations made through contracts to subrecipients. The CCDF program awarded approximately $37 million to eight subrecipients through six federal awards during the audit period. Based on our audit work, PHHS should have reported at least 43 actions, while the department only filed four actions. Of the four actions filed, two were inaccurate in amount and untimely. Additionally, the department reported actions for two entities that were not subrecipients totaling approximately $1.7 million. The number of instances and corresponding dollar amounts are summarized below. See the Schedule of Findings and Questioned Costs for chart/table. Repeat Finding: The CCDF program has not had previous FFATA findings. However, the department had FFATA findings in the prior audit for other programs. These findings included #2021-064, #2021-065, and #2021-066 in Montana’s Single Audit for the two fiscal years ended June 30, 2021. Effect: The department is not in compliance with FFATA reporting requirements. A lack of internal controls resulted in required reporting of actions not occurring, untimely reporting, and inaccurate reporting of subawards. The purpose of FFATA reporting is to provide transparency to the federal grantor agencies and the public. The errors identified during the audit could mislead a user of the data provided through FFATA reporting. Cause: The department uses a central contracting system to capture contract actions that require FFATA reporting. However, the CCDF program uses a separate contracting system that was not considered for FFATA reporting. As a result, the central contracting system did not contain accurate or complete CCDF contract information. Overall, FFATA reporting is done centrally for a large number of federal programs and awards. Based on our testing for other federal programs that use the central contracting system, the information captured in the central system still resulted in inaccurate FFATA reporting for those programs. Per the department, they do not have a good system or process that allows for tracking and compiling some of the specific required data. Additionally, implementing tracking mechanisms could be costly and burdensome on the department. This could involve developing a new system and the department currently does not have the resources to take on this type of project. We were unable to estimate the potential cost of developing a new system. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to ensure timely, accurate, and complete submission of FFATA reports for the Child Care Development Fund program. B. Submit FFATA reports for the Child Care Development Fund program in accordance with federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-069: U.S. Department of Health and Human Services ALN #93.323, Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Grant #Various Criteria: Federal regulation, 2 CFR Part 170, Appendix A(I)(a) and (a)(2)(ii), requires non-federal entities to report to the Federal Funding Accountability and Transparency Act (FFATA) reporting system each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity. The report should be submitted no later than the end of the month following the month in which the obligation was made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal years 2022 and 2023, the Department of Public Health and Human Services’ (PHHS or department) internal controls were not sufficient to ensure all ELC actions equal to or greater than $30,000 were accurately, completely, and timely reported to the FFATA reporting system. Actions for ELC occur when funds are obligated to subrecipients, including counties and schools. Questioned Costs: No questioned costs identified. Context: To complete our audit testing, we started by using data available at usaspending.gov and reviewed all obligations reported during the audit period as compared to obligations made through contracts to subrecipients. The department awarded approximately $18 million in ELC funding to 45 county subrecipients during the audit period. Based on our audit work, PHHS should have reported at least 84 actions, while the department filed 281 actions. Of the actions filed, 79 actions were reported untimely, and 45 actions reported included incorrect amounts. Additionally, 12 expected actions were not reported. As a result of overreporting and duplication of transactions, a much larger dollar amount was reported in the system as compared to the amount actually granted. The number of instances and corresponding dollar amounts are summarized below. See the Schedule of Findings and Questioned Costs for chart/table. In addition to the non-compliance discussed above, we also identified instances where actions were reported for entities that were not subrecipients. Further, we identified duplicative transactions overreporting the amount awarded to subrecipients. These additional items are summarized in the table below. See the Schedule of Findings and Questioned Costs for chart/table. The department also made ELC subrecipient payments to schools during the audit period. As discussed in Finding #2023-054, the department did not initially classify its relationship with schools as a subrecipient. As a result, no FFATA reporting was completed for any obligations made to schools. The department made distributions to schools in 42 counties totaling approximately $9.1 million. Repeat Finding: Montana’s Single Audit for the two fiscal years ended June 30, 2021, included a finding (#2021-066) to enhance internal controls over FFATA reporting and submit accurate and complete FFATA reports for the ELC program. Effect: The department is not in compliance with FFATA reporting requirements. A lack of internal controls resulted in required reporting of actions not occurring, inaccurate reporting of subawards, and duplicate subawards. The purpose of FFATA reporting is to provide transparency to the federal grantor agencies and the public. The errors identified during the audit could mislead a user of the data provided through FFATA reporting. Cause: Overall, FFATA reporting is done centrally for a large number of federal programs and awards. Reportable actions are determined through information entered into the department’s central contracting system. However, the information entered into the system was not consistently updated with accurate information to ensure the correct information was reported. According to the department, they do not have a singular system or process that allows for tracking and compiling some of the specific required data. Implementing tracking mechanisms could be costly and burdensome for the department. This could involve developing a new system and the department currently does not have the resources to take on this type of project. We were unable to estimate the potential cost of developing a new system. The department does not have adequate internal controls for review of the data prior to submission due to the time commitment involved and an overall lack of resources. Per the department, the duplication of transactions appears to be due to each monthly submission being transferred into the federal system as a new action rather than an update to an existing action. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to ensure timely, accurate, and complete submission of FFATA reports for the Epidemiology and Laboratory Capacity program. B. Submit FFATA reports for the Epidemiology and Laboratory Capacity program in accordance with federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-070: U.S. Department of Health and Human Services ALN #93.658, Foster Care – Title IV-E (COVID-19) Grant #1801MTCAN, 2101MTFOST, 2201MTFOST, 2301MTFOST Criteria: Federal regulation, 2 CFR Part 170, Appendix A(I)(a) and (a)(2)(ii), requires non-federal entities to report to the Federal Funding Accountability and Transparency Act (FFATA) reporting system each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity. The report should be submitted no later than the end of the month following the month in which the obligation was made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal years 2022 and 2023, the Department of Public Health and Human Services’ (PHHS or department) internal controls were not sufficient to ensure all Foster Care actions equal to or greater than $30,000 were accurately, completely, and timely reported to the FFATA reporting system. Actions for Foster Care occur when funds are obligated to subrecipients, including tribes. Questioned Costs: No questioned costs identified. Context: To complete our audit testing, we started by using data available at usaspending.gov and reviewed all obligations reported during the audit period as compared to obligations made through contracts to subrecipients. The department awarded approximately $4 million in Foster Care funding to seven subrecipients during the audit period. Based on our audit work, PHHS should have reported at least 28 actions, while the department filed 33 actions. Of the actions filed, 13 actions were untimely reported, and 15 actions reported included incorrect amounts. Additionally, 15 expected actions were not reported. As a result of overreporting and duplication of transactions a much larger dollar amount was reported in the system as compared to the amount actually granted. The number of instances and corresponding dollar amounts are summarized below. See the Schedule of Findings and Questioned Costs for chart/table. In addition to the noncompliance discussed above, we also identified instances where actions were reported for entities that were not subrecipients and transactions reported for actions under the $30,000 reporting threshold. Further, we identified duplicative transactions overreporting the amount awarded to subrecipients. These additional items are summarized in the table below. See the Schedule of Findings and Questioned Costs for chart/table. Repeat Finding: Montana’s Single Audit for the two fiscal years ended June 30, 2021, included a finding (#2021-065) to enhance internal controls over FFATA reporting and submit accurate and complete FFATA reports for the Foster Care program. Effect: The department is not in compliance with FFATA reporting requirements. A lack of internal controls resulted in required reporting of actions not occurring, inaccurate reporting of subawards, untimely reporting, and duplicate subawards. The purpose of FFATA reporting is to provide transparency to the federal grantor agencies and the public. The errors identified during the audit could mislead a user of the data provided through FFATA reporting. Cause: Overall, FFATA reporting is done centrally for a large number of federal programs and awards. Reportable actions are determined through information entered into the department’s central contracting system. However, the information entered into the system was not consistently updated with accurate information to ensure the correct information was reported. According to the department, they do not have a singular system or process that allows for tracking and compiling some of the specific required data. Implementing tracking mechanisms could be costly and burdensome for the department. This could involve developing a new system and the department currently does not have the resources to take on this type of project. We were unable to estimate the potential cost of developing a new system. The department does not have adequate internal controls for review of the data prior to submission due to the time commitment involved and an overall lack of resources. Per the department, the duplication of transactions appears to be due to each monthly submission being transferred into the federal system as a new action rather than an update to an existing action. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to ensure timely, accurate, and complete submission of FFATA reports for the Foster Care program. B. Submit FFATA reports for the Foster Care program in accordance with federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-071: U.S. Department of Health and Human Services ALN #93.558, Temporary Assistance for Needy Families (TANF) (COVID-19) Grant #101MTTANF, 2201MTTANF, 2301MTTANF Criteria: Federal regulation, 2 CFR Part 170, Appendix A(I)(a) and (a)(2)(ii), requires non-federal entities to report to the Federal Funding Accountability and Transparency Act (FFATA) reporting system each action that equals or exceeds $30,000 in federal funds for a subaward to a non-federal entity. The report should be submitted no later than the end of the month following the month in which the obligation was made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal years 2022 and 2023, the Department of Public Health and Human Services’ (PHHS or department) internal controls were not sufficient to ensure all TANF actions equal to or greater than $30,000 were accurately, completely, and timely reported to the FFATA reporting system. Actions for TANF occur when funds are obligated to subrecipients, including tribes and universities. Questioned Costs: No questioned costs identified. Context: To complete our audit testing, we started by using data available at usaspending.gov and reviewed all obligations reported during the audit period as compared to obligations made through contracts to subrecipients. The department awarded approximately $5.5 million in TANF funding to 12 subrecipients during the audit period. Based on our audit work, PHHS should have reported at least 51 actions, while the department filed 57 actions. Of the actions reported, nine actions expected to be reported were not, 42 were not timely, and 42 had incorrect amounts reported. As a result of overreporting and duplication of transactions a much larger dollar amount was reported in the system as compared to the amount actually granted. The number of instances and corresponding dollar amounts are summarized below for the elements of non-compliance. See the Schedule of Findings and Questioned Costs for chart/table. In addition to the noncompliance discussed above, we also identified instances where actions were reported for entities that were not subrecipients and transactions reported for actions under the $30,000 reporting threshold. Further, we identified duplicative transactions overreporting the amount awarded to subrecipients. These additional items are summarized in the table below. See the Schedule of Findings and Questioned Costs for chart/table. Repeat Finding: Montana’s Single Audit for the two fiscal years ended June 30, 2021, included a finding (#2021-064) to enhance internal controls over FFATA reporting and submit accurate and complete FFATA reports for the TANF program. Effect: The department is not in compliance with FFATA reporting requirements. A lack of internal controls resulted in required reporting of actions not occurring, inaccurate reporting of subawards, untimely reporting, and duplicate subawards. The purpose of FFATA reporting is to provide transparency to the federal grantor agencies and the public. The errors identified during the audit could mislead a user of the data provided through FFATA reporting. Cause: Overall, FFATA reporting is done centrally for a large number of federal programs and awards. Reportable actions are determined through information entered into the department’s central contracting system. However, the information entered into the system was not consistently updated with new information to ensure the correct information was reported. Additionally, the department’s contracts for continuing subawards under TANF do not identify obligations by federal award, making it difficult to identify and report accurate obligation actions. According to the department, they do not have a singular system or process that allows for tracking and compiling some of the specific required data. Implementing tracking mechanisms could be costly and burdensome for the department. This could involve developing a new system and the department currently does not have the resources to take on this type of project. We were unable to estimate the potential cost of developing a new system. The department does not have adequate internal controls for review of the data prior to submission due to the time commitment involved and an overall lack of resources. Per the department, the duplication of transactions appears to be due to each monthly submission being transferred into the federal system as a new action rather than an update to an existing action. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to ensure timely, accurate, and complete submission of FFATA reports for the TANF program. B. Submit FFATA reports for the TANF program in accordance with federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-072: U.S. Department of Health and Human Services ALN #93.268, Immunization Cooperative Agreements (COVID-19) Grant #NH23IP922574 Criteria: Federal regulation, 2 CFR Part 170, Appendix A(I)(a) and (a)(2)(ii), requires non-federal entities to report to the Federal Funding Accountability and Transparency Act (FFATA) reporting system each action that equals or exceeds $30,000 in federal funds for a subaward to a non-federal entity. The report should be submitted no later than the end of the month following the month in which the obligation was made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal years 2022 and 2023, the Department of Public Health and Human Services’ (PHHS or department) internal controls were not sufficient to ensure all Immunization actions equal to or greater than $30,000 were accurately, completely, and timely reported to the FFATA reporting system. Actions for Immunization occur when funds are obligated to subrecipients, including counties. Questioned Costs: No questioned costs identified. Context: To complete our audit testing, we started by using data available at usaspending.gov and reviewed all obligations reported during the audit period as compared to obligations made through contracts to subrecipients. The department awarded approximately $17 million in Immunization funding to 42 subrecipients during the audit period. Based on our audit work, we identified 75 original actions expected to be reported and 68 amendments resulting in additional expected reported actions. However, PHHS reported 70 actions that were not accurate and complete. Of the actions filed, 53 actions were reported untimely and 46 actions reported included incorrect amounts. Additionally, 22 expected actions were not reported. As a result of overreporting and duplication of transactions a much larger dollar amount was reported in the system as compared to the amount actually granted. The number of instances and corresponding dollar amounts are summarized below. See the Schedule of Findings and Questioned Costs for chart/table. In addition to the noncompliance discussed above, we also identified instances where actions were reported for entities that were not subrecipients and transactions reported for actions under the $30,000 reporting threshold. Further, we identified duplicative transactions overreporting the amount awarded to subrecipients. These additional items are summarized in the table below. See the Schedule of Findings and Questioned Costs for chart/table. Repeat Finding: The Immunization program has not had previous FFATA findings. However, the department had FFATA findings in the prior audit for other programs. These findings included #2021-064, #2021-065, and #2021-066 in Montana’s Single Audit for the two fiscal years ended June 30, 2021. Effect: The department is not in compliance with FFATA reporting requirements. A lack of internal controls resulted in required reporting of actions not occurring, inaccurate reporting of subawards, untimely reporting, and duplicate subawards. The purpose of FFATA reporting is to provide transparency to the federal grantor agencies and the public. The errors identified during the audit could mislead a user of the data provided through FFATA reporting. Cause: Overall, FFATA reporting is done centrally for a large number of federal programs and awards. Reportable actions are determined through information entered into the department’s central contracting system. However, the information entered into the system was not consistently updated with accurate information to ensure the correct information was reported. According to the department, they do not have a singular system or process that allows for tracking and compiling some of the specific required data. Implementing tracking mechanisms could be costly and burdensome for the department. This could involve developing a new system and the department currently does not have the resources to take on this type of project. We were unable to estimate the potential cost of developing a new system. The department does not have adequate internal controls for review of the data prior to submission due to the time commitment involved and an overall lack of resources. Per the department, the duplication of transactions appears to be due to each monthly submission being transferred into the federal system as a new action rather than an update to an existing action. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to ensure timely, accurate, and complete submission of FFATA reports for the Immunization program. B. Submit FFATA reports for the Immunization program in accordance with federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-073: U.S. Department of Homeland Security ALN #97.036, Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Grant #4508DRMTP00000001, 4608DRMTP00000001, 4623DRMTP00000001, 4655DRMTP00000001 Criteria: Federal regulation, 2 CFR 170.330, Appendix A(I)(a) and (a)(2)(ii), requires non-federal entities to report to the Federal Funding Accountability and Transparency Act (FFATA) reporting system each action that equals or exceeds $30,000 in federal funds for a subaward to a non-federal entity. The report should be submitted no later than the end of the month following the month in which the obligation was made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Military Affairs (department) awarded over $25 million to 32 subrecipients during state fiscal years 2022 and 2023 related to four disasters. We reviewed all the obligations made to each of these entities over the audit period. We noted the department did not have controls in place to prevent or detect various errors, omissions, or duplications in submitted FFATA reports. We identified six types of errors, which include: • The wrong amount was reported. • A required obligation was not reported. • The reporting was late. • The wrong entity was reported. • The amount reported was not supported by department records. • The same obligation was reported more than once. Questioned Costs: No questioned costs identified. Context: The department was initially unable to provide copies of the FFATA reports due to the federal reporting system only allowing the employee who submitted the report to access the reports. As that employee is no longer with the department, the department had to merge accounts to get access. We attempted to get access to the reports directly from the federal reporting system, however instructions provided would have registered our office as the principle for the department. As an alternative, we started by using data available at usaspending.gov and reviewed all obligations related to four presidentially declared disasters during the audit period. This totaled 260 obligations, of which 155 were individually over $30,000. Additional audit procedures were performed after the department successfully merged accounts and actual reports were available. Examples of the noncompliance with federal regulations over FFATA reporting noted include: • 62 instances where the amount reported was the full grant amount rather than the amount of the federal share. • 9 instances where an obligation over $30,000 was made, but not reported. • 54 instances where the reporting of the obligation over $30,000 occurred later than the month following the month in which the obligation was made. • 1 instance where the department keyed in the wrong dollar amount. • 3 instances where the department reported the obligation for the wrong entity. • 13 instances where department records did not support the amount reported. • 57 instances where the department reported the same obligation over $30,000 more than once. While the department awarded around $25 million to subrecipients, errors bulleted above including reporting the full grant amount and duplicate reporting resulted in errors summarized in the table below in excess of $25 million. See the Schedule of Findings and Questioned Costs for chart/table. Repeat Finding: This was first reported as finding 2021-014 in the Montana Single Audit report for the two fiscal years ended June 30, 2021. Effect: A lack of documented internal controls led to the late submission of required FFATA reports and noncompliance with federal regulations. Additionally, a lack of documented internal controls resulted in inaccurate reporting of subawards, including incorrect amounts, omissions, and duplications. Cause: The department experienced turnover in the position that completed the FFATA reporting. Adequate internal controls were not in place to allow the employees taking over the completion of the FFATA reporting to prepare the reports accurately and completely. Three employees completed reporting resulting in reporting three different ways and duplication of reported data. Additionally, staff could pull up a previously submitted report as a starting point. While unable to confirm, it appears this resulted in a second submission of the same report, rather than a new submission with updates. This further duplicated reporting. Lastly, for one of the disasters, the match rate changed during the disaster period of performance. This resulted in reporting the original amount, the match amount, and in some cases the original and match amounts combined causing additional duplication of reported amounts. Procedures to ensure the report’s accuracy included running a query to obtain the data needed to determine when reporting was necessary. However, the department did not retain the query to support the information reported. The department also implemented a reminder for timely reporting; however, it was only in place for the last month of the audit period. Recommendation: We recommend the Department of Military Affairs: A. Document and implement internal controls to ensure the timely and accurate submission of Federal Funding Accountability and Transparency Act reports. B. Submit Federal Funding Accountability and Transparency Act reports in accordance with federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-074: U.S. Department of Homeland Security ALN #97.036, Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Grant #4508DRMTP00000001, 4608DRMTP00000001, 4623DRMTP00000001, 4655DRMTP00000001 Criteria: Federal regulation, 2 CFR 200.332(a)(1), lays out the fourteen required elements to communicate to subrecipients to properly identify the federal award. Federal regulation, 2 CFR 200.332(d), requires the Department of Military Affairs (department) to monitor the subrecipient’s activities, including reviewing reports and resolving Single Audit findings related to the subaward. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department communicated the Agency Listing Number (ALN) for the disaster grant to some, but not all, of the subrecipients through an award letter. Additionally, the department did not review subrecipient audit reports as required by federal regulations. The department does not have adequate controls in place to ensure that either of these two things occurred. Questioned Costs: No questioned costs identified. Context: The department subgrants funds to cities, counties, and non-profit entities. During the audit, we reviewed expenditures related to four disasters, awarded to 32 entities. We judgmentally sampled payments made to 14 of these entities and found eight were not provided the ALN. This sample was not statistically valid. We did not complete a sample related to subrecipient monitoring as the department does not have procedures in place to review audit reports for any entity. Effect: Subrecipients may not be fully aware or adhere to all relevant federal regulations related to the grant if they do not receive the correct ALN, increasing the risk of non-compliance. Furthermore, subrecipients lack essential data to accurately report their federal awards on their Schedule of Expenditures of Federal Awards. Additionally, the department's failure to review audit reports from subrecipients has led to a lack of awareness of findings related to department grants or other federal grants with similar requirements. Consequently, the department has not issued management letters or requested corrective action plans as required. This deficiency has left the department without the necessary information to implement proper monitoring procedures for federal compliance at the subrecipient level, which increases the risk of misallocation of federal funds by subrecipients. Cause: During the audit period, department turnover resulted in the omission of the ALN in some award letters. The department and subrecipient meet prior to a grant award to determine if there are any risks at the entity applying for a grant. The department was unaware of the federal requirement to review audit reports as part of its monitoring procedures. Recommendation: We recommend the Department of Military Affairs: A. Implement controls to ensure the ALN is communicated to subrecipients when awarding grants and subrecipient audit reports are obtained and reviewed. B. Communicate the ALN to all subrecipients awarded disaster funds. C. Obtain and review audit reports of entities receiving grants. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-075: U.S. Department of Homeland Security ALN #97.042 Emergency Management Performance Grants (EMPG) Grant #EMD-2020-EP-00003 ALN #97.047 Pre-Disaster Mitigation (PDM) Grant #EMD-2017-PC-0003 Criteria: Federal regulation, 2 CFR 200.403(g), states costs must be adequately documented in order to be allowable under Federal awards. Condition: The Department of Military Affairs’ (department’s) internal controls were insufficient to obtain and maintain adequate documentation to determine the allowability of sub-recipient expenditures reimbursed as part of its Disaster & Emergency Services (DES) grant programs. We noted the following errors: • Emergency Management Performance Grants (EMPG) o Salaries and benefits were approved without adequate documentation to indicate which employee’s time was being reimbursed. • Pre-Disaster Mitigation (PDM) o Documentation was missing from the Federal Emergency Management Assistance (FEMA) for the approval of the purchase of unimproved property and first responder training. o Volunteer rates were used rather than actual employee salary costs. o The use of equipment without documentation of what the equipment was used for or the basis for the rate charged. Questioned Costs: For the errors outlined above, we identified the following questioned costs: • 97.042 Emergency Management Performance Grants (EMPG) o Identified Questioned Costs: $32,702.15 • 97.047 Pre-Disaster Mitigation (PDM) o Identified Questioned Costs: $58,056.12 Context: We completed a sample over four types of grants. The chart below indicates the grant, population, number tested, number of errors, and type of sample for the grant types where we found questioned costs greater than $25,000. The sample was not statistically valid. See the Schedule of Findings and Questioned Costs for chart/table. Repeat Finding: This is a repeat finding, initially reported as 2017-011 in the Single Audit report for the two fiscal years ended June 30, 2017. It was reported as finding 2019-028 in the Single Audit report for the two fiscal years ended June 30, 2019. It was reported as finding 2021-015 in the Single Audit report for the two fiscal years ended June 30, 2021, but was limited to EMPG grants only. While the current audit identified actual or projected questioned costs in excessive of $25,000, the number of instances we found was considerably less than found in prior audits. Given neither the EMPG nor PDM programs are major federal programs, our reporting this Single Audit is only driven by the questioned costs outlined above, and we have not made internal controls an element of the finding in the current audit. Effect: Without sufficient internal controls to obtain and maintain adequate documentation of subrecipient expenditures, the department may not comply with federal regulations and could reimburse unallowable expenditures. As noted above, we identified questioned costs in excess of $25,000 for two grant programs. Cause: The department required documentation from the subrecipients to support the expenditures, but internal controls were not adequate to ensure those documents contained adequate details required to make allowability determinations. Additionally, the department indicated that the federal government approved certain costs, but the documentation was not obtained or retained to demonstrate that approval. The questioned costs for EMPG were for the time period prior to new procedures that were put in place to address a prior audit recommendation. Recommendation: We recommend the Department of Military Affairs comply with federal requirements by ensuring subrecipient reimbursements are supported and allowable under the grant awards at the time the reimbursement is made. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-076: Various Federal Agencies* ALN #Various*, Research & Development Cluster (COVID-19) Grant #Not Applicable Criteria: Federal regulation, 2 CFR 200.302(b)(4), requires the non-federal entity’s financial management system to provide effective control over and accountability for all funds, property, and other assets. The non-federal entity must also adequately safeguard all assets and assure that they are used solely for authorized purposes. Federal regulation, 2 CFR 200.313(b), requires a state to use, manage, and dispose of equipment acquired under a Federal award by the state in accordance with state laws and procedures. Section 335(XIV), Montana Operations Manual (MOM policy) requires agencies to perform a complete physical inventory of all capital assets no less than every two years. MOM policy 335(V)(A)(3) requires agencies to identify all major equipment in a manner that promotes easy identification and requires property tags to be placed in plain sight on the equipment. While state policy does allow some discretion based on the physical nature of some equipment for situations where property tags may not be feasible, it does require that “whenever possible, the tag number will still be identified on the item by some means such as etching, decal, indelible ink, etc.” Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Internal controls were not sufficient to ensure Montana State University – Bozeman (MSU Bozeman, university) performed a complete physical inventory of equipment every two-year period or that equipment purchased with federal Research and Development funds were tagged as required by federal regulations and state policy during fiscal years 2022 and 2023. Questioned Costs: No questioned costs identified. Context: MSU Bozeman routinely purchases capital assets with federal Research and Development grant funds. During fiscal years 2022 and 2023, MSU Bozeman spent approximately $12.74 million on these purchases. The assets purchased with these funds are added to a central inventory listing at the university. Our testing found MSU Bozeman only inventoried 1,055 of their 4,551 assets during the audit period. We examined equipment purchases at the university to determine whether the assets were tagged and easily identifiable, as required by state policy. We selected 18 high dollar items from the asset listing. We identified four items that were untagged. The cost of these items ranged from $584,579 to $1,344,023. All of these items were scientific equipment, for example a mass spectrometer. For each of the untagged items identified, there were no property tags or other permanent identification affixed to the assets that corresponded to university property records. Additionally, the asset listing does not consistently have other identifiable information, such as serial numbers, for the items. As such, the assets were not easily identifiable as required by state policy, and we were unable to confirm the assets we observed were those purchased by the federal grant funds. For all items, we believe it was feasible to tag or label the assets. Effect: By not performing physical inventories or tagging capital assets, MSU Bozeman is not in compliance with federal requirements to use and manage equipment acquired under federal awards in accordance with state laws and policies. Cause: MSU Bozeman personnel cite staff turnover as the reason physical inventories could not be completed. The university attempted alternative procedures, but without dedicated staff overseeing the process, complete physical inventories and asset tagging could not be performed. While we agree staffing contributed to the noncompliance, even if there were adequate staff, the untagged items would make it difficult to complete a full inventory. Recommendation: We recommend Montana State University – Bozeman: A. Enhance internal controls to ensure compliance with the federal and state requirements governing equipment for the Research and Development Program, B. Perform a complete physical inventory of capital assets at least every two years, and C. Tag all capital assets when feasible. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-077: Various Federal Agencies* ALN #Various*, Research & Development Cluster Grant #Not Applicable Criteria: Federal regulation, 2 CFR 200.302(b)(4), requires the non-federal entity’s financial management system to provide effective control over and accountability for all funds, property, and other assets. The non-federal entity must also adequately safeguard all assets and assure that they are used solely for authorized purposes. Federal regulation, 2 CFR 200.313(b), requires a state to use, manage, and dispose of equipment acquired under a federal award by the state in accordance with state laws and procedures. Section 335(XIV), Montana Operations Manual (MOM policy) requires agencies to perform a complete physical inventory of all capital assets no less than every two years. MOM policy 335(V)(A)(3) requires agencies to identify all major equipment in a manner that promotes easy identification and requires property tags to be placed in plain sight on the equipment. While state policy does allow some discretion based on the physical nature of some equipment for situations where property tags may not be feasible, it does require that “whenever possible, the tag number will still be identified on the item by some means such as etching, decal, indelible ink, etc.”. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Internal controls were not sufficient to ensure the University of Montana – Missoula (UM Missoula, university) performed a complete physical inventory of equipment every two-year period or that equipment purchased with federal Research and Development funds were tagged as required by federal regulations and state policy during fiscal years 2022 and 2023. Additionally, UM Missoula could not provide information or documentation on the disposition of assets purchased with federal Research and Development funds once they were no longer needed. Questioned Costs: No questioned costs identified. Context: UM Missoula routinely purchases capital assets with federal Research and Development grant funds. During fiscal years 2022 and 2023, UM Missoula spent approximately $4.88 million on these purchases. The assets purchased with these funds are added to a central listing at the university. Our testing found UM Missoula only completed a physical inventory at 91 of the 200 locations with assets during the audit period and at an additional 27 locations after the audit period ended. We examined equipment purchases at the university to determine whether the assets were tagged and easily identifiable, as required by state policy. We sampled 8 of the 106 equipment purchases over the capitalization threshold of $5,000 during the audit period. This was not a statistically valid sample. We identified four items that were untagged. The cost of these items ranged from $13,678 to $154,470. These items were primarily scientific equipment, for example, a chromatography system. For each of the untagged items identified, there were no property tags or other permanent identification affixed to the assets that corresponded to university property records. As such, the assets were not easily identifiable as required by state policy, and we were unable to confirm the assets we observed were those purchased by the federal grant funds. For all items, we believe it was feasible to tag or label the assets. UM Missoula also logged 32 assets acquired with federal funds as no longer needed and ready for disposal during the audit period. We selected a sample of four of these items to determine whether they had been disposed of appropriately in accordance with university policy and the terms and conditions of each grant award. While these items were fully depreciated on the accounting records, the assets were initially valued at $69,531 in total. This was not a statistically valid sample. University staff could not provide documentation related to the disposal or what the final disposition of the equipment was for any of the items selected. Additionally, attempts to locate the items during testing were unsuccessful. As a result, we cannot determine whether the university truly disposed of the assets, and followed federal regulations while doing so, or if the assets are still in service at an unknown location. Repeat Finding: Montana’s Single Audit report for the two fiscal years ended June 30, 2021, included a recommendation (#2021-034) to UM Missoula regarding tagging equipment. Effect: By not performing physical inventories or tagging capital assets, UM Missoula is not in compliance with federal requirements to use and manage equipment acquired under federal awards in accordance with state laws and policies. Additionally, the university is at risk of not following federal regulations related to asset disposal. Collectively, these issues could result in UM Missoula failing in their responsibilities as a steward of public resources. Cause: UM Missoula personnel cite staff turnover as the reason physical inventories could not be completed. The university attempted alternative procedures, but without dedicated staff overseeing the process, complete physical inventories and asset tagging could not be performed. UM Missoula staff also attributed the disposal issue to employee turnover. They had a staff member dedicated to performing and accounting for asset disposals. When that employee left the position, other employees stepped in, but asset disposals were not adequately tracked and accounted for without a staff member dedicated to overseeing the process. Recommendation: We recommend the University of Montana – Missoula: A. Enhance internal controls to ensure compliance with the federal and state requirements governing equipment for the Research and Development Program, B. Perform a complete physical inventory of capital assets at least every two years, and C. Tag all capital assets when feasible. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-078: Various Federal Agencies* ALN #Various*, Research & Development Cluster Grant #Not Applicable Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: We observed multiple internal control deficiencies in the University of Montana – Missoula’s (UM Missoula, university) administration of the Research & Development program (R&D). Questioned Costs: We identified $23,865 in questioned costs. Of this amount, $23,718 is from ALN #47.083 and $147 is from ALN #93.970. Context: The university manages R&D grant awards in three stages: • Pre-Award: A principal investigator (PI) identifies a funding opportunity and works with the Office of Sponsored Programs (OSP) to begin recording details of the proposed funding, including salaries, budget, and subawards. • Award: OSP staff record detailed award information and begin regular reviews of financial activity. These reviews look for whether: o Expenses charged to the award are for allowed costs and were incurred during the award period, o Activities performed under the award are consistent with the award’s purpose, and o Subrecipients also follow award terms and conditions. An accurate record of award terms and conditions and regular reviews throughout the award period are important steps to ensuring compliance with federal regulations. • Post-Award: When a federal award comes to an end, OSP staff use a checklist to complete close-out procedures, such as: o Reconciling expenses and revenues, o Verifying costs and activities were allowed, or changes were approved, o Performing final billing, and o Ensuring the file is complete and ready for archiving. During fiscal years 2022 and 2023, UM Missoula managed a total of 1,590 individual grant awards. This included receiving and opening 634 new grant awards, closing 524 grant awards, and both opening and closing 76 of those awards. We completed three samples over the university’s grant activity, including: • 24 of the 236 subawards made, • 40 of the 1,590 grant awards managed, and • 30 out of 359,678 grant expenses transactions incurred. These samples were not statistically valid. The table below summarizes the items we identified in our testing, which indicate a need to enhance internal controls over managing the R&D program: See the Schedule of Findings and Questioned Costs for chart/table. In addition to the items in the table above, OSP staff could not locate two grant files during testing, and as such, we were unable to test the grants. Collectively, these items aggregate to a significant deficiency in the university’s internal control. While we identified some instances of noncompliance associated with these items, they did not rise to material noncompliance. Effect: Without effective internal controls to ensure the UM – Missoula manages federal awards according to federal statutes and regulations, the university is not in compliance with the federal requirement to maintain effective internal control over federal awards. Additionally, without effective internal controls over managing federal awards, the university is at risk of additional non-compliance, such as charging unallowed costs or inadequate record retention. This could result in repayment of unallowed amounts, suspension or termination of federal awards, or heightened monitoring by federal awarding agencies. Cause: University staff attributed the issues to the challenges of managing an increasing workload during transition periods associated with employee turnover or simply human error. Total research expenditures have grown from $166,647,194 to $231,722,301 between the 2016-17 and 2022-23 audit periods – an increase of 39%. The university expects research activity to continue to grow in coming years. Recommendation: We recommend the University of Montana – Missoula follow established internal controls to provide reasonable assurance the university is managing federal Research and Development Program awards in compliance with all applicable federal statutes and regulations. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2023-079: U.S. Department of Agriculture ALN #10.551 and 10.561, SNAP Cluster Grant #Various Criteria: Federal regulation, 7 CFR 274.8(b)(3), requires the state to maintain adequate security over, and documentation for EBT cards, to prevent their theft, loss, or damage. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Public Health and Human Services (department) does not have a process for obtaining and reviewing the System and Organization Controls (SOC) report for the subcontractor responsible for Electronic Benefits Transactions (EBT) card storage and security. It is the department’s responsibility to review the SOC report to obtain assurance over the security and documentation of SNAP EBT cards. Questioned Costs: No questioned costs identified. Context: The department contracts with an EBT service provider for its SNAP program. The contractor subcontracts out the responsibility of EBT card security and processing. The subcontractor receives a SOC examination that provides assurance over control objectives related to EBT card security and card processing. When requested during the audit, the department obtained the correct SOC report for 2023. While the SOC report did not contain any relevant control deviations, the department had not requested or reviewed the report prior to the audit making the request. However, for 2022, the SOC report did not contain control objectives related to EBT card security and card processing. The department had not reviewed the SOC reports in enough detail to realize they had not received the necessary assurances. The department tried to obtain the correct SOC report from the contractor but was unable to by the completion of this report. Without the proper SOC report, we were unable to test compliance with requirements in federal regulation for 2022, resulting in a scope limitation. Effect: By not obtaining and reviewing the SOC report, the department is unaware of issues affecting the EBT card security and card processing services it receives from the subcontractor. Without assurance from the subcontractor over EBT card security and card processing services, the department does not have controls in place to meet its responsibility under federal regulations. Cause: The department did not obtain SOC reports from the subcontractor prior to the audit period. For the SOC reports obtained, the department did not review them in enough detail to ensure they included assurances over EBT card security and documentation, which the department is responsible for. The department communicated multiple times with the contractor to try to get the correct SOC report for 2022, but was unable to obtain it by the completion of this report. Recommendation: We recommend the Department of Public Health and Human Services implement internal controls to obtain and review the SOC report for the subcontractor responsible for EBT card security and card processing as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-001: U.S. Department of Defense ALN # 12.401, National Guard Military Operations and Maintenance (O&M) Projects Grant # W9124V-18-2 and W9124V-21-2 Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. National Guard Regulations (NGR) 5-1 states in section 5-3, that in order for costs to be allowable, they must be allocable, allowable, and reasonable. Allocable means the costs must have been incurred by the grantee and allocable to the cooperative agreement (CA) supported program, project, or facility. Condition: A Post Engineer split is calculated every six months to allocate costs of certain workers, such as carpenters, between the General Fund and the O&M grant based on actual hours worked on buildings or projects for the previous six months. Based on the actual hours worked a ratio is calculated for charging either federal or state funds. The splits are entered into the state?s accounting system so that when applicable employees input their time, their salaries are appropriately allocated between the federal and state funds. Through our sample testing, we found that splits effective for January 1, 2020, through June 30, 2020, were not updated in the state?s accounting system. The splits from the previous six-month time frame continued to be used. While the splits do not typically change substantially each period, using the incorrect splits for a six-month time period resulted in a $6,179 overallocation to the federal fund and under allocation to the General Fund for the same amount. Questioned Costs: We identified $6,179 in questioned costs. Context: During our audit, we sampled 40 expenditure transactions from a population of 23,472 and found two instances where payroll charges were not properly allocated between the federal grant and the General Fund. The two instances allowed us to identify a systematic problem that extended to all applicable employees during the affected time frame. This was not a statistically valid sample. Effect: Internal controls did not ensure the recalculated payroll split was input into the state?s accounting system which resulted in $6,179 in overcharges to the federal grant. Cause: Adequate controls, such as a checklist or calendar reminder, were not in place to ensure that the payroll splits were updated in the state?s accounting system. Recommendation: We recommend the Department of Military Affairs: A. Comply with federal requirements to allocate the correct amount of salaries for employees whose time is split between federal and state projects. B. Establish internal controls to ensure the state?s accounting system is updated when the splits are recalculated, and C. Reimburse the federal government for the amount of payroll costs it was overallocated. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-002: U.S. Department of Transportation ALN # 20.205, 20.219 and 20.224, Highway Planning and Construction Cluster Grant # Not Applicable Criteria: Federal regulation, 29 CFR 5.5, requires certified payrolls be submitted for each week in which any contract work is performed. Federal regulation, 29 CFR 5.6, indicates no payment be made if the contractor and its subcontractors are not in compliance with the provisions of 29 CFR 5.5. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. This establishes an expectation that the Montana Department of Transportation (department) will have internal controls in place to ensure contractors and subcontractors are compliant with wage rate requirements. Condition: The department?s internal controls were ineffective in ensuring all certified payrolls for highway construction projects were submitted in a timely manner. Questioned Costs: None. Context: In the prior audit of the department, we determined the department did not ensure all payrolls were received prior to issuing payments to contractors. We also identified multiple projects for which the department did not receive all payrolls. In the current audit, we noted the department took steps to address this situation, including continuing to use the new electronic payroll submission module within AASHTOWare?s Construction and Materials System. The new module has built in flags designed to identify instances of missing payrolls when contractor pay estimates are generated in the system. This system was implemented for all new projects let from October 2019 forward. Older projects not migrated to the new system use procedures and paper payrolls which have not changed since the last audit. The older system is expected to still be in use through the next biennium and accounts for 187 of the 546 projects. We sampled 36 projects and identified: ? Seven projects using paper payrolls, that were certified by department personnel as having submitted all payrolls at project close, where 27 payrolls were missing. This is across four department districts and 12 contractors. ? Five projects, three using paper and two using electronic submission, having 16 overdue payrolls. The overdue payrolls were across three department districts and seven contractors. ? Two projects were missing four subcontractor approval checklists which are used to determine which subcontractors are held to certified payroll submission requirements. Without these checklists, the contractor was not notified of the reporting requirements. These samples were not statistically valid. Given the number of active projects during the audit period and the control deficiency, we believe there are likely other instances of non-compliance. Effect: These untimely or incomplete certified payroll submissions constitute noncompliance with federal regulations. Further, the department is in noncompliance with federal regulations requiring the withholding of payment until certified payrolls are submitted. Additionally, there is risk the department will not identify instances where contractors or subcontractors are not paying prevailing wages. Cause: While the new system was implemented for all new projects let from October 2019 forward, the use of the system features is not consistent across all project managers or districts. For the project flags to work, the department personnel must complete daily work reports and fill in the contractor and subcontract performing on the day reported. Of the 25 projects tested that use the new system, 9 projects did not have the contractor section completed. Projects in the old system are tracked manually and the department?s internal controls have not been sufficient to ensure the certified payrolls are received. As the department implemented a new system, the department has no plans to improve the manual process. Repeat Finding: This is a repeat finding and has been reported as Single Audit findings 2017-028 and 2019-026 in the audits for the two fiscal years ending June 30, 2017, and June 30, 2019, respectively. Recommendation: We recommend the Montana Department of Transportation: A. Enhance internal controls to ensure all required payrolls are received. B. Obtain and review all required certified payrolls weekly from contractors and subcontractors for all active construction projects under the Highway Planning and Construction program to ensure compliance with federal prevailing wage requirements. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-003: U.S. Department of Transportation ALN # 20.509, Formula Grants for Rural Areas Grant # MT-18-X064-00, MT-2016-005, MT-2017-002, MT-2017-022, MT-2018-011, MT-2020-003, MT-2020-013 Criteria: Federal regulation, 2 CFR 200.317, requires the state to follow state procurement policy to procure federally funded procurements. Montana Operation Manual Procurement Policy 335 (VII)(D) lays out strict requirements for the use of sole source procurements, where this procurement method may only be used if the item is only available from a single vendor. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. For vehicle purchases, Montana Department of Transportation (department) policy requires Post-Delivery Certifications to be filed with the department?s procurement section within 30 days of final vehicle acceptance. Condition: The department?s internal controls did not ensure vehicles procured using the Formula Grants for Rural Areas program followed state policy and procedures. Questioned Costs: We question $75,825 of costs charged to the program. Context: From a population of nine purchase orders, we tested three and identified instances in all three where the department did not follow state policy and procedures for vehicles purchased under the program, as outlined below. This was not a statistically valid sample. ? The first instance was a sole source procurement used to replace an existing purchase order for vans. The vans are available from more than one vendor. As such, the two vans costing $75,825 were improperly purchased as a sole source procurement. ? The second and third instances, totaling $680,740, were procurements where the department did not complete and file Post-Delivery Certifications in accordance with department policy. Department policy requires the certifications be filed with the department?s procurement sections within 30 days of final vehicle acceptance. The certifications are evidence the vehicles met specifications and were received as agreed upon within the procurement. Effect: The department is not in compliance with state procurement policies and procedures. As a result of the first instance of non-compliance, there are questioned costs. Cause: For the sole source procurement, department staff incorrectly interpreted federal procurement best practices as requiring significant deviations from an initial invitation to bid be considered a sole source procurement. The department thought a new procurement using sole source was required instead of using a change order to accommodate the significant deviation. For the Post-Delivery Certifications, department staff overlooked the need to complete the certifications at the time of vehicle inspection. The department?s internal controls were insufficient to ensure the certifications were completed and submitted in the time frame required by department policy. Recommendation: We recommend the Montana Department of Transportation: A. Enhance internal controls to ensure all procurement follow state policy to comply with federal requirements. B. Comply with state procurement policy for all vehicle purchases. C. Complete and submit the Post-Delivery Certifications as required by department policy. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-004: U.S. Department of Transportation ALN # 20.509, Formula Grants for Rural Areas Grant # MT-18-X064-00, MT-2016-005, MT-2017-002, MT-2017-022, MT-2018-011, MT-2020-003, MT-2020-013 Criteria: Federal regulation, 2 CFR 200.1, defines a subaward and requires a legal agreement. Federal regulation, 2 CFR 200.331, lays out the fourteen required elements to communicate to subrecipients, the requirements for risk assessments, and monitoring during and after the award to ensure subrecipient compliance. This federal regulation was renumbered to 2 CFR 200.332 during the audit period. Federal regulation, 2 CFR 200.334, requires the retention of records for audit review. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Montana Department of Transportation?s (department) monitoring of subrecipients of the Formula Grants for Rural Areas program can be enhanced. Questioned Costs: None Context: Under this program, the department provides operating and capital grant awards to subrecipients. The subrecipients include local government transit authorities, nonprofit organizations or an operator of public transportation, or intercity bus services. We identified several discrepancies relating to the subrecipient monitoring requirements, as summarized below: ? In our sample of eight of the 39 subrecipients, we looked at 13 grant agreements. This was not a statistically valid sample. A subrecipient receives separate grant agreements based on the type of award: operating, capital, or intercity bus grants. Of the 13 grant agreements, seven did not contain the total amount of federal funds obligated to the subrecipient including the current obligation. As the different types of awards are not awarded at the same time, each grant should include the awards provided to the subrecipient prior to the current award in the total obligation under the current year?s Formula Grants for Rural Areas program. ? The risk assessment performed on a new subrecipient receiving federal funds from the department in fiscal year 2021 was completed without all elements of risk being assessed. ? The department performs detailed financial reviews on the first year?s submission of quarterly reports for new subrecipients. During fiscal year 2021, the third quarter detail review was not performed for the new subrecipient. After we communicated the issue, the department initiated the review. ? One of eight subrecipient compliance reviews was not documented. The compliance reviews for the remaining seven were not performed following department policy. The department reviewer only looked at one vehicle to check compliance instead of the required two. ? The department?s review of quarterly reports from the subrecipients did not address vehicle disposals during their reviews, which require additional procedures. This resulted in one vehicle being maintained on the subrecipients records for an additional year. In addition, the department?s record retention policies were not followed for several vehicle disposals. Two of eight sales forms and four of eight lien releases were unaccounted for as of when we completed our procedures. Effect: Without efficient internal controls over compliance to ensure all elements of subrecipient monitoring are followed, the department is noncompliant with federal regulations. Additionally, noncompliance with subrecipient monitoring could result in undetected noncompliance on the part of the subrecipient and potentially unidentified questioned costs. Cause: Department personnel indicated the myriad of errors relating to subrecipient monitoring were due to staff turnover, incomplete archiving of documentation, an office remodel resulting in missing or misplaced documentation, and one file was unintentionally shredded/destroyed instead of archived. Recommendation: We recommend the Montana Department of Transportation comply with federal subrecipient monitoring requirements by: A. Performing and documenting risk assessments, B. Including required elements in grant agreements, C. Performing subrecipient monitoring, and D. Maintaining associated documentation. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-005: U.S. Department of Transportation ALN # 20.509, Formula Grants for Rural Areas Grant # MT-18-X064-00, MT-2016-005, MT-2017-002, MT-2017-022, MT-2018-011, MT-2020-003, MT-2020-013 Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal regulation, 2 CFR 200.332(d)(3), requires the state to issue a management decision for applicable audit findings pertaining to federal awards. Condition: The Montana Department of Transportation (department) did not collect identified unallowable costs of the Formula Grants for Rural Areas program that were identified as part of the internal audit function?s audits of completed grants. The length of time that transpired between identification and recovery of questioned costs indicates internal controls are not effective. Questioned Costs: We question $13,237 of costs charged to the program. Context: The department?s Audit Services office conducted three audits of transit grant recipients during fiscal year 2020 as part of monitoring subrecipients of the program. Each of these audits identified questioned costs that needed to be recovered by the state and then remitted to the Federal Transit Authority (FTA). These audits were published in September 2019, December 2019, and April 2020, with a total of $13,237 in questioned costs. The department?s procedures are to reduce the next quarterly payment to the grant recipient by the amount of the questioned costs. In fiscal year 2021, the quarterly payments were disrupted due to additional funding received under the Coronavirus Aid, Relief, and Economic Security (CARES) Act. The department chose not to conflate funding by reducing the CARES grants for the previously identified questioned costs. While we understand the extenuating circumstances, we did identify regular quarterly payments for one of the grant recipients that could have been used to offset the questions costs. As of September 2021, the questioned costs had not been recovered. Effect: The department is not in compliance with federal regulations. Additionally, there is risk the questioned costs will be forgotten and never recovered. Federal regulations allow the FTA to collect interest on funds owed. While interest rates remain low, depending on the length of time outstanding, the amount owed to the federal grating agency could grow larger than the initial questioned costs. Cause: The department indicated their current processes did not consider timely return of identified questioned costs. Recommendation: We recommend the Montana Department of Transportation enhance internal control procedures to ensure timely recovery and remittance of identified questioned costs. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-006: U.S. Department of the Treasury ALN # 21.019, Coronavirus Relief Fund Grant # SLT0077, SLT0006 Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing procedures to ensure eligibility determinations are performed in accordance with program requirements. Per 21 USC 812(c)(10), marijuana is a Schedule 1 drug and controlled substance. Per 21 USC 841(a) ?it shall be unlawful for any person knowingly or intentionally- (1) to manufacture, distribute, or dispense, or possess with intent to manufacture, distribute, or dispense, a controlled substance?. The Montana Department of Commerce (department) established eligibility criteria for the Business Stabilization Grant Program (BSG), funded by the Coronavirus Relief Fund. The eligibility criteria included being a business in good standing in Montana, with 50 or fewer employees, and having sustained revenue loss due to the pandemic. Additionally, criteria indicated marijuana-based businesses were ineligible. Condition: The department?s controls over the BSG were not adequate to ensure only businesses meeting the department?s eligibility requirements received funding under this program, and that the funding was used only for purposes allowed by this program. Some ineligible businesses received funding under the BSG, including two medical marijuana companies. Questioned Costs: We identified questioned costs totaling $49,716. Context: The BSG provided working capital to support allowable business expenses for small businesses in the state. This program aimed to help businesses retain their current employees and maintain business viability. The department spent approximately $253.8 million on grants for the BSG in fiscal years 2020 and 2021. In a non-statistical sample of 60 of the 13,049 grant recipients, we identified one business that was not eligible and that has identified questioned costs, six businesses that used the funding for salary draws which was unallowed, and one nonprofit that received funding. For each of these situations, we performed additional analytical procedures and reviews of supporting documents to determine if these were isolated situations or if other similar situations existed for more than the businesses included in our initial sample. ? One of the businesses that received assistance was a medical marijuana provider. Medical marijuana is illegal at the federal level, and the department?s eligibility requirements disallowed these providers from receiving funding under this program. However, the department?s application review process did not identify the business as a medical marijuana provider and awarded the business $27,620. The department performed additional reviews after we identified this business and identified one additional medical marijuana provider that was awarded $22,096. We consider both of these to be questioned costs of $49,716. ? Several sole proprietors received assistance for salary draws, which are not considered business expenses but instead a return of income. We identified six sole proprietors who indicated they used the funding for salary draws. The department indicated this was confusing to sole proprietors, and many misclassified expenses such as payments to contractors, as salary. During their detailed post-award reviews, the department also identified that sole proprietors who claimed salary draws also had other eligible expenses allowed under the BSG program. The department expects this is the case for the ones we identified but completed post-award reviews were not available to support their assertion at the time of our testing. ? One of the six sole proprietors also indicated on their BSG application that they were receiving unemployment insurance assistance. Sole proprietors could apply for and receive benefits through the Unemployment Insurance program. Disallowing sole proprietor salary draws ensured funding was not received from two federal sources for the same expenses. Using data from the department collected through the application process, we identified an additional 93 businesses that appear to be sole proprietors receiving both unemployment insurance and BSG funding for salary draws. Based on the review of available data, we could not determine if funding was received for the same period, or for the same expenses. As a result, we do not consider these to be questioned costs. ? Nonprofit entities were not initially eligible to receive funding through the BSG program. The Department of Public Health and Human Services administered a separate program with CRF funds specifically for nonprofits. However, after multiple nonprofits applied for the BSG program, the department decided to allow nonprofits to receive funding under the BSG program if they hadn?t received funding through the other CRF program. During our testing we identified four of the 34 nonprofits received funding from both programs. We reviewed the information submitted for each program and determined the funds were used for different purposes under each program, so we do not consider these questioned costs. However, since the department?s controls were not sufficient to prevent or detect these situations, these nonprofits could have received funding for the same activities from both CRF programs. Effect: This resulted in questioned costs and ineligible businesses receiving funding. Cause: The department did perform application reviews before awarding funding and performed audits of randomly selected businesses after the program ended. However, none of these procedures identified the situations above as the department?s controls were not sufficient. Recommendation: We recommend the Department of Commerce: A. Recover the funds from the subrecipients, and pay back the Coronavirus Relief Fund for the $49,716 questioned costs. B. Perform additional risk analysis and post-award reviews of subrecipient use of funds. C. Develop controls that are sufficient to ensure only eligible applicants receive funding, that applicants understand the requirements for the use of funds, and required documentation is sufficient to ensure any new federal program funds are used for appropriate purposes. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-007: U.S. Department of the Treasury ALN # 21.019, Coronavirus Relief Fund Grant # SLT0077, SLT0006 Criteria: Federal regulation, 2 CFR 200.331, requires pass through entities to communicate specific required information to subrecipients. This federal regulation was renumbered to 2 CFR 200.332 during the audit period. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing procedures to ensure eligibility determinations are performed in accordance with program requirements. Condition: The Montana Department of Commerce?s (department) did not ensure all required information was provided to subrecipients of the various grant programs established from funding provided through the Coronavirus Relief Fund (CRF). The department?s internal controls were insufficient to ensure that subrecipients received communication regarding the necessary items. Questioned Costs: None. Context: Through the Business Stabilization Grant, Tourism Safety, Loan Deferment, and Working Capital Loan programs established using CRF funds, the department provided federal assistance to approximately 13,000 businesses. The department considered all of these businesses to be subrecipients. The department awarded approximately $253.8 million, $15 million, $46.6 million, and $23.1 million in grants for the Business Stabilization, Tourism Safety, Loan Deferment, and Working Capital Loan programs, respectively, during fiscal years 2020 and 2021. For each of these programs, the department developed and sent standardized documents to all subrecipients. However, those standardized documents did not contain all required items, such as the Assistance Listing Number (ALN), amount awarded, terms of the award, indirect cost rate, and access to the subrecipient?s records. Some of this information was not initially available when the documents were created. The documents were not updated when the information became available, and other available information was not included in some of the documents. The specific items not communicated to subrecipients under each program are included in the following table, as red Xs. See Schedule of Findings and Questioned Costs for chart/table. Effect: These required communications are intended to help the subrecipient meet all their reporting requirements, and to meet all award terms. Subrecipients subject to Single Audits will also need this information for their audit which will occur after much of the department?s post-award monitoring is complete. The department is also not in compliance with federal subrecipient monitoring requirements. Cause: The documents the department used to communicate with subrecipients did not contain all required items, and the department used the same documents for all subrecipients within a given program. Recommendation: We recommend the Montana Department of Commerce: A. Communicate all required award information to subrecipients subject to Single Audit. B. Develop controls to ensure that all award information is communicated to subrecipients as required for any new federal programs. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-008: U.S. Department of the Treasury ALN # 21.019, Coronavirus Relief Fund Grant # SLT0077, SLT0006 Criteria: Federal regulation, 2 CFR 200.331(d), requires pass through entities to monitor the activities of the subrecipient to ensure that the subaward is used for authorized purposes. This monitoring must include reviewing financial and performance reports and issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the pass-through entity. This federal regulation was renumbered into 2 CFR 200.332 during the audit period. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing procedures to ensure eligibility determinations are performed in accordance with program requirements. Condition: The Department of Commerce (department) does not review subrecipient audit reports and issue management decisions for audits of subrecipients of the Tourism Safety Grant Program, funded by the Coronavirus Relief Fund, as required by federal regulations. Questioned Costs: None. Context: The Tourism Safety Grant Program provided money to the six tourism regions and 18 convention visitor bureaus to help them distribute safety information through marketing campaigns. In total, $15 million in grants were awarded in fiscal years 2020 and 2021. The purpose of the program was to alert those traveling through Montana to COVID restrictions and to promote general safety during the pandemic. All 24 recipients of this funding were considered subrecipients. They are primarily nonprofits subject to Single Audit requirements. This program awarded over $750,000 to two of the subrecipients. Additional subrecipients could also meet this threshold through other federal funding received in addition to Tourism Safety. Effect: If the department does not review audit reports and issue management decisions they will not be in compliance with federal regulations. The department also will not be aware of instances where the subrecipient did not use the funds as required by the program and not recover those funds from the subrecipient, as appropriate. Cause: Program staff indicated that they initially believed the monitoring they are performing was sufficient, but they do plan to review the Single Audit reports for subrecipients. Recommendation: We recommend the Department of Commerce: A. Develop controls to perform the required subrecipient monitoring which includes reviewing the subrecipients? Single Audit reports and issuing management decisions. B. Review the Single Audits of the Tourism Safety Grant program subrecipients, and issue management decisions. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-009: U.S. Department of the Treasury ALN # 21.019, Coronavirus Relief Fund Grant # SLT0077, SLT0006 Criteria: Federal regulation, 2 CFR 200.331(b), (d), and (e), establishes requirements for subrecipient monitoring that includes assessing risk and developing a level of monitoring in line with the level of risk. This federal regulation was renumbered into 2 CFR 200.332 during the audit period. Condition: The Montana Department of Transportation (department) did not initially complete sufficient subrecipient monitoring as required by federal regulation to ensure allowability of expenditures under the Live Entertainment Grant program funded by the Coronavirus Relief Fund. When subrecipients are high-risk, federal regulations require more robust subrecipient monitoring by the department. Questioned Costs: We question $189,261 in costs charged to the program. During our audit period we identified $95,000 in questioned costs, while the department identified an additional $94,261 subsequent to the audit period. Context: The State of Montana received $1.25 billion in funds from the Coronavirus Relief Fund (CRF). In partnership with the Montana Governor?s Office of Budget and Program Planning, the department created the Live Entertainment Grant program from the state?s CRF allocation, totaling $10.3 million in July 2020. The program was designed to help Montana-based businesses and nonprofits whose income was primarily generated through the live entertainment events. The funding replaced the recipient?s lost revenue from the closure of live events during the pandemic. The department and the Governor?s Office determined these businesses and nonprofits were subrecipients. The department was responsible for awarding, managing, and monitoring the subgrants. The department performed risk assessments, beginning in September 2020, of the applicants for the Live Entertainment Grants. The risk assessment process was used to determine whether additional review was needed before a funding determination was made. The department also required a final report and a supporting financial statement be submitted by January 2021. Review of the department?s subrecipient monitoring identified the following: ? The department?s risk assessment process resulted in further review being performed on 29 applications, with a ?no fund? determination made for 14 applicants. According to department personnel, subsequent discussion with the Governor?s Office resulted in six of these applicants receiving grants totaling $1,367,779. ? We reviewed the final report and supporting financial statement for six randomly selected grants out of the 76 grant recipients. This was not a statistically valid sample. At the time of our review in July 2021, the documentation provided for these recipients caused questioned costs. Two of the subrecipients have final reports which do not support the allowability of $95,000 in costs associated with the grant program. One subrecipient self-certified, with support of an excel spreadsheet, $36,000 was spent on allowable expenditures during the granted period. The second recipient did not have support in their final report and submitted a profit and loss statement for $59,000. The second subrecipient reported costs not mentioned in their application and did not provide or document support for why the change in use of the $59,000 was allowable under the program. ? The department?s Audit Services also reviewed eight of 76 grantees in August 2021, including one of the six grants receiving a grant after a no fund recommendation. The reviews addressed approximately 18.5 percent of the awarded funds. We reviewed the results of the eight reviews completed by the department, which included $94,261 in costs considered to be unallowable, which was about five percent of total expenditures reviewed. In October 2021, the department indicated they plan to perform reviews over 18 additional subrecipients with completion occurring between October and the end of December 2021. Effect: Untimely subrecipient monitoring may result in a lack of identified questioned costs or collection of those questioned costs from for-profit businesses which may continue to feel the economic pressures of the pandemic. Cause: Department staff initially determined the final report was sufficient to consider the costs allowable if the report tied back to the initial grant application. Additionally, due to internal discussions a delay in increasing the detailed review of subrecipients occurred. Recommendation: We recommend the Montana Department of Transportation continue to complete additional Live Entertainment Grants reviews to ensure subrecipients complied with federal program requirements. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-010: U.S. Department of Treasury ALN #21.019, Coronavirus Relief Fund Grant # SLT0077, SLT0006 Criteria: Federal regulation, 2 CFR 200.303, requires the non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal regulation, 2 CFR 200.331(1)(a), requires the pass-through entities to communicate specific required information to subrecipients. This federal regulation was renumbered into 2 CFR 200.332 during the audit period. Condition: The Montana Department of Administration?s (department) internal controls did not ensure subrecipients of the Coronavirus Relief Fund (CRF) programs administered by the department were provided all of the required information to identify their subaward, and several required items were not communicated to subrecipients. Questioned Costs: None. Context: The department administered two programs using CRF funding, one that provided reimbursement-based funding to local governments and one that provided reimbursement-based and advance funding to school districts. The department expended approximately $193.98 million through the local government program and $81.77 million through the school district program in fiscal years 2020 and 2021, issuing payments to 124 local governments and 421 school districts. Based on our review, the federal award identification number (FAIN), federal award date, and name of federal awarding agency were not provided to these subrecipients. Effect: The department is not in compliance with subrecipient monitoring requirements. Additionally, subrecipients of the department?s CRF programs were not provided all of the required information to identify their subawards and may not have all of the information necessary to comply with the terms of the award and to meet all of their federal compliance requirements, resulting in unintended noncompliance. Subrecipients subject to Single Audits will also need this information for their audit which will occur after much of the department?s post-award monitoring is completed. Cause: The focus of administering the programs was to provide funding to local governments and school districts to mitigate the impacts of the COVID-19 public health emergency. Due to this and the department?s speed to implement the programs, a few of the upfront communication requirements were overlooked. Recommendation: We recommend the Montana Department of Administration: A. Communicate all required award information to subrecipients, as required by federal regulations for any new federal programs. B. Develop controls to ensure that all award information is communicated to subrecipients as required for any new federal programs. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-011: U.S. Department of Treasury ALN # 21.019, Coronavirus Relief Fund Grant # SLT0077, SLT0006 Criteria: Federal regulation, 2 CFR 200.331(1)(a), requires pass-through entities to communicate specific required information to subrecipients. This federal regulation was renumbered into 2 CFR 200.332 during the audit period. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Internal controls did not ensure the Department of Public Health and Human Services (department) provided subrecipients of the Coronavirus Relief Fund (CRF) programs administered by the department with all of the required information to identify their subaward. Questioned Costs: None. Context: During the audit, we reviewed eight of the department?s CRF programs. Of the eight, four of the programs made grants to subrecipients. These four programs made subgrants totaling approximately $132 million in fiscal years 2020 and 2021, to approximately 2,400 subrecipients. These subrecipients consisted of local and tribal health departments, social services nonprofit organizations, behavioral health providers, school districts, and licensed childcare programs. Based on our review, multiple required disclosures were missing including the subrecipient?s unique entity identifier, federal award identification number, total amount of federal funds committed to the subrecipient, and the name of the federal awarding agency. Effect: The department has not complied with federal regulations regarding required subrecipient disclosures. Additionally, failure to provide subrecipients with the required federal award information increases risk of subrecipient noncompliance with federal requirements. Cause: Per the department, internal controls were not centralized when the funding was awarded to the department resulting in missing disclosures. Due to this and the speed which the department was expected to implement multiple programs, some of the upfront communication with subrecipients was missed. Recommendation: We recommend the Department of Public Health and Human Services: A. Establish and document internal controls to ensure required subrecipient disclosures are included for new federal program subrecipient agreements. B. Ensure the required subrecipient disclosures are included correctly in new federal program subrecipient monitoring agreements. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-012: U.S. Department of Treasury ALN # 21.019, Coronavirus Relief Fund Grant # SLT0077, SLT0006 Criteria: Per the Coronavirus Aid, Relief, and Economic Security (CARES) Act, Title VI, Sec 601(d)(1) funds are allowable if they "are necessary expenditures incurred due to the public health emergency with respect to the Coronavirus Disease 2019 (COVID-19)". Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Public Health and Human Services (department) made two duplicate payments to facilities as part of its Quarantine Isolation benefits program using Coronavirus Relief Funds. Duplicate payments are unnecessary expenditures under the Coronavirus Relief Fund (CRF) program. Questioned Costs: We question costs in the amount of $35,820. Context: The Quarantine Isolation program was one of 17 CRF programs the department administered. This program provided funds to facilities for any isolated or quarantined patients for days where the patient was actively positive or presumptively positive for Coronavirus. Providers included nursing homes, assisted living homes, and group homes. We reviewed a total of 48 payments to 13 different facilities, of 155 total facilities, during fiscal years 2020 and 2021. As part of this work, we identified two duplicate payments to facilities, one for $28,410 and one for $7,410. This was not a statistically valid sample. Effect: The department is not in compliance with federal regulations as the duplicate payments were not an allowable use of the federal funds. Cause: Internal controls did not prevent these payments being issued. Department staff acknowledged the payments were made and stated they were identified during a reconciliation process. Per department personnel, the department was expected to implement multiple programs quickly and as a result, items were overlooked. The department is currently working with the entities to recover the overpayments. Recommendation: We recommend the Department of Public Health and Human Services enhance internal controls to ensure duplicate payments are not made to recipients of federal funds. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-013: U.S. Department of the Treasury ALN # 21.023, Emergency Rental Assistance Program Grant # ERA-2101123145 Criteria: The Consolidated Appropriation Act, 2021, Section 501 establishes the Emergency Rental Assistance program and indicates who is eligible including income thresholds, that the recipient must be facing housing instability, and they must have been impacted by the COVID-19 pandemic. Condition: The Department of Commerce?s (department) internal control procedures identified potentially fraudulent applications paid from the Emergency Rental Assistance program funds. Questioned Costs: For fiscal year 2021, the department identified that $33,700 was incorrectly paid to these applicants, which we consider questioned costs. Similar situations occurred in fiscal year 2022, and as of December 2021, the department identified $62,000 that we have reported as questioned costs. We anticipate additional questioned costs may be identified through the department?s review processes as the department has seen a coordinated effort to submit potentially fraudulent applications. Context: While reviewing applications for this program, the department identified potentially fraudulent applications where applicants submitted incorrect information or, in some cases, did not live at the address they were requesting assistance for. The department determined these applicants were eligible based on the federally-established eligibility criteria for the emergency rental assistance program. Subsequent new information received by the department showed that the initial information submitted by these applicants was incorrect or false, and the department determined these applicants were not actually eligible to receive the funds that had been disbursed to them. The department is working with appropriate authorities to address the potentially fraudulent nature of the applications and could recover some of the payments made to ineligible parties. The United States Department of the Treasury does not require states to report these instances until they reach $100,000. After identifying the initial situations described, the department implemented supplementary controls, including some targeted reviews, to detect future situations before the applicant receives funding through the program Effect: This resulted in the department paying applicants who did not meet the eligibility requirements for the program, resulting in questioned costs. Cause: The department received a high volume of applicants that had to be processed quickly, and did not initially identify these situations, but after identifying the first couple situations, the department implemented additional controls to identify these situations in the future. Recommendation: We recommend the Department of Commerce continue to perform processes and reviews to identify ineligible applicants for the Emergency Rental Assistance Program. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-014: U.S. Department of Homeland Security ALN # 97.036, Disaster Grants ? Public Assistance (Presidentially Declared Disasters) Grant # 4508DRMTP00000001 Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal regulation, 2 CFR 170, Appendix A requires a Federal Financial Assistance Transparency Act (FFATA) report for each subaward no later than the end of the month following the month in which an obligation was made. Condition: The Department of Military Affairs (department) did not have controls in place to ensure timely and accurate FFATA reporting over the federally declared disaster related to the Coronavirus public health emergency. While we noted no errors in the information contained in the reports submitted, the department sub-granted funds to six entities during the months of September 2020 through December 2020 which were not reported until February 2021. This is between one and four months later than required by federal regulations. Questioned Costs: None. Context: During the audit period, the department submitted three FFATA reports. The initial report in February 2021 included all subawards made from the onset of the disaster including the six entities receiving subgrants during the months of September 2020 through December 2020. The reports submitted in April 2021 and May 2021 included the subawards required to be reported for those time periods. While no controls are documented to review the reports for accuracy, we noted no errors in the data reported on any of the reports. In total, $35.5 million was spent during fiscal year 2020 and 2021, of which $6.5 million was not reported timely. Reports should have been filed for the months of October 2020, November 2020, December 2020, and January 2021. Activity that should have been included on these reports were included on the February 2021 report. Repeat Finding: No. Effect: A lack of documented internal controls led to the late submission of required FFATA reports and noncompliance with federal regulations. Additionally, a lack of documented internal controls could result in the omission of subawards on the report or the reporting of inaccurate amounts. Cause: While the department established some controls over the preparation of the report, they did not include documentation of any procedures for review to ensure timeliness and accuracy. Additionally, due to the personnel resources needed to respond to the pandemic, the department did not have the staff necessary to complete timely FFATA reports. Recommendation: We recommend the Department of Military Affairs: A. Document and implement internal controls to ensure the timely and accurate submission of FFATA reports. B. Submit FFATA reports in accordance with federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-015: U.S. Department of Homeland Security ALN # 97.042, Emergency Management Performance Grants (EMPG) Grant # EMD ? 2017-EP-00003 (FY19) EMD ? 2018-EP-00005 (FY19, FY20) EMD ? 2019-EP-00005 (FY20) Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal regulations, 2 CFR 200.53 and 2 CFR 200.403, further state that improper payments include any payments where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper and in order for costs to be allowable they must be adequately documented, respectively. Condition: The Department of Military Affairs (department) does not have adequate internal controls in place to ensure adequate support is provided prior to reimbursement for grant expenditures incurred by local governments. While the department has put in place procedures for the reimbursement process for the grant, the procedures did not properly detail the type of documentation needed from subrecipients in order to approve the reimbursement. Questioned Costs: In our follow-up on finding 2019-028 from the prior Single Audit, we identified actual questioned costs of $38,443 and $89,511in fiscal years 2019 and 2020, respectively. Context: In total for fiscal year 2019 and 2020, $3.7 million was reimbursed to subrecipients for EMPG grants. We completed a statistically valid sample of grants administered by the department?s Disaster & Emergency Services (DES) Division. In this sample, there was a total population of 376 EMPG items, and we selected a sample of 17 EMPG payments. Our sample identified 15 instances where the supporting documentation was not adequate to demonstrate the costs were allowable per the grant. Repeat Finding: This is a repeat finding, initially reported as 2017-011 in the Single Audit report for the two fiscal years ended June 30, 2017. It was reported as finding 2019-028 in the Single Audit report for the two fiscal years ended June 30, 2019. Effect: Because the department does not have adequate internal controls in place over the DES grant reimbursement process, they have reimbursed subgrantees for unallowable costs. We identified questioned costs, as noted above. Cause: This issue is on-going from the department prior audit report. The department had planned to make headway with implementing controls to better oversee reimbursements related to the DES grant program. However, due to the fact that the department?s prior audit report was not issued until October of 2019, they were not able to implement internal controls prior to the next funding cycle for the grant. The department provided state guidance documents to subrecipients that were updated in January of 2020 and implemented for the fiscal year 2020-2021 grant cycle. Recommendation: We recommend the Department of Military Affairs continue to enhance internal control procedures and provide training to ensure proper documentation is obtained prior to the reimbursement of expenses under the Emergency Management Performance Grants program. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-016: U.S. Department of Homeland Security ALN # 97.050, Presidentially Declared Disaster Assistance to Individuals and Households ? Other Needs Grant # 4508DRMTSPLW Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Labor and Industry?s (department) internal controls did not ensure information reported to the federal government was complete and accurate in relation to its Lost Wages Assistance grant. Questioned Costs: None. Context: To help provide additional unemployment benefits during the COVID-19 public health emergency, the department applied for, and received, a federal Other Needs Assistance ? Supplemental Payments for Lost Wages (Lost Wages Assistance) grant award, funded by ALN 97.050. In addition to an Unemployment Insurance claimant?s calculated benefit, the grant provided eligible claimants an extra $400 per week. The Federal Emergency Management Agency (FEMA) Lost Wages Assistance program was active for six benefit weeks. During the grant award period, the department was required to submit quarterly financial reports and weekly programmatic reports to the federal government. To ensure the accuracy of the quarterly financial reports, the information was reviewed by a person other than the preparer of the report before the report?s submission. However, in our review, two of the four financial reports submitted to the federal government for this grant did not have evidence of a review being completed prior to submission. In addition, while obtaining an understanding of the department?s procedures for completing the weekly programmatic reports, we were unable to identify a departmental control over the accuracy of the information submitted to the federal government. Effect: While we did not identify any errors in the information reported to the federal government, without documentation, or implementation, of internal controls, the department is at increased risk of reporting incorrect information to the federal government and is not in compliance with federal regulations. Cause: Department personnel stated all quarterly financial reports were reviewed and approved, but verbal approval was given for the two we identified as not having documented evidence of review. Additionally, when we inquired specifically about the department?s control over the weekly programmatic reports, department personnel stated the risk of error was deemed low for these reports as they did not require complex calculations or a compilation of data from multiple sources. As a result, the department did not have someone review the reported information prior to submitting it to the federal government. Recommendation: We recommend the Department of Labor and Industry develop, implement, and document internal controls over reporting requirements for new federal funding sources to ensure compliance with federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-017: U.S. Department of Labor ALN # 17.225, Unemployment Insurance Grant # UI-35659-21-55-A-30 (2021 Base Grant) UI-34069-19-55-A-30 (2020 Base Grant) UI-34726-20-55-A-30 (2020 COVID funding) Criteria: Federal regulation, 20 CFR 602.30(a), indicates the U.S. Department of Labor (USDOL) shall establish required methods and procedures and provide technical assistance as needed on the QC process. This regulation outlines the U.S. Department of Labor will establish guidelines for states to follow regarding quality control reviews. Federal regulation, 20 CFR 602.21(a) ? Standard methods and procedures, requires each state to perform the requirements of this section in accordance with instructions issued by the U.S Department of Labor, pursuant to ?602.30(a) of this part, to ensure standardization of methods and procedures in a manner consistent with this part. This regulation instructs the Department of Labor and Industry (department) to follow the Benefit Accuracy Measurement (BAM) State Operation Handbook. Benefit Accuracy Measurement State Operations Handbook (ET Handbook No. 395, 5th Edition) Chapter II Section 3, states ?each SWA must develop written procedures to guide the operation of the BAM program. The procedures must cover all investigative and administrative functions of the BAM unit. The procedures should be adapted to the particular circumstances of the state, but must adhere to the guidelines contained in this Handbook so as to provide for proper administration of the BAM program.? Montana Benefit Accuracy Measurement Quality Control Program Policy and Procedures Manual, Section IX(A), states ?The BAM Supervisor is responsible for the cases completed in the BAM unit, whether she reviews each of them or not. USDOL has recommended that the BAM Supervisor review as many completed cases as possible. At a minimum, the Montana BAM Supervisor will review all improper cases.? Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department did not follow its documented internal control regarding BAM audits resulting in noncompliance with federal regulations. Questioned Costs: None. Context: We tested a sample of 41 BAM reviews out the approximately 1,400 completed by the department?s BAM unit in fiscal years 2020 and 2021. The sample included both paid and denied claims. The sample was not statistically valid. Per the department?s BAM policies, the BAM supervisor must review all cases where improper payments to claimants are identified by BAM staff. In our review, we found BAM staff determined improper payments were made to claimants for seven of the 19 paid claims in our sample. However, six of the seven improper payments were not reviewed by the BAM supervisor as required by department policy. Effect: Because internal controls failed to ensure required supervisory reviews occurred, the department was not in compliance with the department?s BAM policies and procedures, and thus, not in compliance with federal regulations. If policies and procedures over the BAM process are not followed, the department is at increased risk of additional errors occurring within the Unemployment Insurance program. Cause: Department staff stated the required reviews did not occur due to significant staff turnover and restructuring within the BAM unit in addition to the significant demands placed on the department resulting from the COVID-19 public health emergency. Recommendation: We recommend the Department of Labor and Industry: A. Follow its documented internal control policies and procedures governing benefit accuracy measurement reviews completed by the department, and B. Complete the required supervisory reviews of benefit accuracy measurement audits that identify improperly paid unemployment insurance benefits, as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-018: U.S. Department of Labor ALN # 17.225, Unemployment Insurance Grant # UI-34726-20-55-A-30 (2020 COVID funding) Criteria: Federal regulation, 20 CFR 625.6(a), states ?In all States, except as provided in paragraphs (c) and (d) of this section, the amount of DUA payable to an unemployed worker or unemployed self-employed individual for a week of total unemployment shall be the weekly amount of compensation the individual would have been paid as regular compensation, as computed under the provisions of the applicable State law for a week of total unemployment. In no event shall such amount be in excess of the maximum amount of regular compensation authorized under the applicable State law for that week.? Federal regulation, 20 CFR 625.6(b), states ?If the weekly amount computed under paragraph (a) of this section is less than 50 percent of the average weekly payment of regular compensation in the State, as provided quarterly by the Department, or, if the individual has insufficient wages from employment or insufficient or no net income from self-employment (which includes individuals falling within paragraphs (a)(3) and (b)(3) of ? 625.5) in the applicable base period to compute a weekly amount under paragraph (a) of this section, the individual shall be determined entitled to a weekly amount equal to 50 percent of the average weekly payment of regular compensation in the State.? Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Labor and Industry?s (department) internal controls did not detect and correct errors in benefit amounts for unemployment insurance claimants receiving Pandemic Unemployment Assistance (PUA) benefits. Questioned Costs: We identified $4,066 in known question costs, and project likely questioned costs of more than $25,000. Context: In a statistical sample of 60 PUA claimants, we found four claimants who received incorrect benefit amounts, as described below. This was a statistically valid sample. ? For one claimant, department staff entered the claimant?s yearly wages divided equally between all four quarters instead of recording the wages that were actually earned each quarter. This resulted in the claimant receiving $1,088 less than entitled. ? For one claimant, the department again entered the claimant?s yearly wages divided equally between all four quarters, instead of recording the wages actually earned each quarter. While we determined the underpayment could be as much as $3,042, when we brought this error to the department?s attention, it was determined further investigation was necessary due to potential fraud. ? One claimant had two Schedule Cs filed with their taxes, one showing a profit and one showing a loss. To determine the claimant?s base period wages, the department should have netted the two schedules together. However, the department only entered the information reflecting the profit resulting in an overpayment of $448. ? For one claimant, the department accepted a 1099-MISC tax form as proof of income. However, the 1099-MISC tax forms report gross income, but regulations require net income to be used in benefit calculations. This resulted in an overpayment of $3,618. Effect: The department is not in compliance with federal requirements related to the PUA program with the Unemployment Insurance program for fiscal years 2020 and 2021. We brought the discrepancies we found to the department?s attention. Claimants entitled to additional benefits have been paid what they were owed, and the department waived the overpayments of the claimants, as allowed by federal regulations, who received more than they were entitled to. Cause: Per department personnel, these were human errors on the part of the department. All four instances were due to department staff entering incorrect base period wages into the PUA system. Recommendation: We recommend the Department of Labor and Industry: A. Enhance internal controls to ensure wage information is correctly used to calculate unemployment insurance benefits, and B. Calculate Unemployment Insurance benefits correctly in accordance with federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-019: U.S. Department of Labor ALN # 17.225, Unemployment Insurance Grant # UI-35659-21-55-A-30 (2021 Base Grant) UI-34069-19-55-A-30 (2020 Base Grant) UI-34726-20-55-A-30 (2020 COVID funding) Criteria: Federal regulation, 26 USC 3304(a)(4)(D), states ?all money withdrawn from the unemployment fund of the State shall be used solely in the payment of unemployment compensation, exclusive of expenses of administration, and for refunds of sums erroneously paid into such fund and refunds paid in accordance with the provisions of section 3305(b); except that?amounts shall be deducted from unemployment benefits and used to repay overpayments as provided in section 303(g) of the Social Security Act.? Federal regulation, 42 USC 503(a)(11)(A), states ?At the time the State agency determines an erroneous payment from its unemployment fund was made to an individual due to fraud committed by such individual, the assessment of a penalty on the individual in an amount of not less than 15 percent of the amount of the erroneous payment.? Section 39-51-3201(1)(a)(ii), Montana Code Annotated (MCA), states ?A person who makes a false statement or representation knowing it to be false or who knowingly fails to disclose a material fact in order to obtain or increase any benefit or other payment under this chapter or under an employment security law of any other state or territory or the federal government, either for the individual or for any other person, is?required to repay to the department, pursuant to the provisions of ?39-51-3206, a sum equal to the amount wrongfully received by the individual, plus a department-assessed penalty equal to 50% of the fraudulently obtained benefits. The department-assessed penalty incorporates the 15% penalty required under 42 U.S.C. 503(a).? Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Labor and Industry (department) did not implement adequate internal controls to ensure compliance with federal regulations and state laws governing pandemic-related unemployment insurance overpayment recovery and did not comply with those laws and regulations. Questioned Costs: None. Context: We completed a sample of 60 of approximately 25,600 department-identified overpayments and found ten claimants who continued to receive unemployment benefits after their overpayment was established. This was not a statistically valid sample. For six claimants, the department took measures to recover the associated overpayment by reducing the benefit amount the claimants were still receiving. However, the department did not offset the continuing benefits for four claimants to reduce their established overpayment. Based on our review, the four claimants without benefit offsets had been placed in the wrong Unemployment Insurance program at the beginning of their claims which resulted in the overpayments, as described below. ? Three claimants were incorrectly established in the Pandemic Unemployment Assistance (PUA) program when they were eligible for regular Unemployment Insurance. When the department discovered this, they created an overpayment in the PUA program for the PUA benefits received to date and established the claims in the regular Unemployment Insurance program. The claimants then received a payment for the amount they would have received under the regular Unemployment Insurance program had they been established correctly, in addition to the amounts already received in the PUA program, essentially doubling the claimants? benefits. The PUA overpayments were not paid back by the claimants using the regular UI benefits received after the overpayments were established and they were not offset against the regular Unemployment Insurance benefits the claimants continued to receive. ? One claimant was incorrectly established in the regular Unemployment Insurance program when the claimant qualified for the PUA program. An overpayment was established in the regular Unemployment Insurance program and a claim established in the PUA program. The claimant received a PUA program payment for the time they were on regular Unemployment Insurance and should have been on PUA, resulting in excess benefits being paid. In this instance, the claimant did repay a significant portion of the regular Unemployment Insurance overpayment though not through a departmental offset. Additionally, in our review, we discovered the department did not assess the required penalty on PUA overpayments related to fraud. Effect: Since internal controls were insufficient to ensure overpayments were offset by continuing Unemployment Insurance benefit payments, were unable to identify overpayments that resulted from fraudulent activity in the PUA program, and were unable to ensure penalties were assessed, the Department of Labor and Industry is not in compliance with federal regulations governing Unemployment Insurance overpayments. Cause: Department personnel stated because the department was utilizing two different benefits systems, one for regular Unemployment Insurance and one for PUA, it was not possible to offset some PUA claims. Programming did occur in the fall of 2020 to allow the offset of an overpayment if a claimant went from the PUA program to the regular Unemployment Insurance program. However, overpayment offsets were not always established by the department. Additionally, related to assessing required penalties, department personnel stated they were working with the PUA system vendor prior to the end of the PUA program to improve system capabilities to be able to identify, and assess penalties on, overpayments due to fraud. This was not accomplished prior to fiscal year-end 2021, resulting the department?s inability to assess the required penalties for fraud related PUA overpayments during the audit period. Recommendation: We recommend the Department of Labor and Industry: A. Develop and implement internal controls to ensure necessary information system modifications are made to properly administer new federal programs, and B. Recover unemployment benefit overpayments, including any associated penalties, as required by federal and state law. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-020: U.S. Department of Labor ALN # 17.225, Unemployment Insurance Grant # UI-34726-20-55-A-30 (2020 COVID funding) Criteria: Montana Operations Manual (MOM) State Information Technology Services Division (SITSD) Security Policy ? Appendix A outlines baseline security controls for every state agency to implement for information technology systems they manage. Included among the baseline controls are requirements for the development and documentation of a security plan; documentation of access control policies and procedures, including periodic review of user access; and documentation of a formal change management system. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Labor and Industry (department) relied on the Pandemic Unemployment Assistance (PUA) information system to determine claimant eligibility and calculate benefit payments. However, we determined the department relied on the PUA system without having adequate internal controls in place to do so. Questioned Costs: None. Context: The department utilizes one system to collect employer contributions and another to process claims and provide benefits to eligible claimants. However, the department?s regular unemployment benefit system, MISTICS, was not equipped to process new requirements, such as acceptance of self-employment information, imposed by the PUA benefit program. As a result, the department contracted with a vendor to utilize software explicitly designed to administer the PUA program. The department did not obtain a Service Organization Controls (SOC) report specifically for the PUA system and while the department does have a system security plan (SSP) for the PUA system, it does not document all the information required by state policy. The vendor did provide the department with a SOC report, but it was for a different service offered by the vendor and provided no assurance over the PUA system. In addition to not having sufficient documentation of security controls in general, we also identified two important system controls not adequately addressed by the department: user access and change management controls. The process for requesting, terminating, and reviewing user access to the system should be clearly documented. However, while the department does have procedures for requesting and terminating access for department employees, those procedures are not officially documented. The department also does not perform any periodic reviews of current user access and does not manage the access of employees outside of the department. The second system control not addressed by the department pertains to change management. Although the department could not make changes to the application, they were responsible for knowing what changes the vendor made and why. Even though the department held weekly meetings with the vendor to discuss software changes and had access to an environment to test new features before implementation, the department still relied on the vendor to provide a complete log of changes made. Without testing the system, the department had no assurance that changes were made as described or that other, unexpected changes were not made. Effect: These internal control issues have a cumulative effect on software processing integrity and we were unable to determine if all eligibility and benefit determinations were complete, valid, accurate, timely and authorized. This resulted in a significant deficiency in internal controls and noncompliance with federal regulations and state policies. Cause: The department put great effort into making the PUA program operational in a very short time frame with many competing priorities of high importance. The department?s focus on operational success resulted in some general system controls being overlooked or not officially documented. Additionally, department management considered the SOC report received adequate even though it did not address the core responsibilities of the department or the vendor related to the PUA system. Recommendation: We recommend the Department of Labor and Industry enhance internal controls by obtaining an application-level Service Organization Controls (SOC) report, or implement and formally document baseline security controls for all new Unemployment Insurance program-related information technology systems, as required by state policy and federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-021: U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Programs Cluster Grant # Not Applicable U.S. Department of Health and Human Services ALN # 93.264, 93.342, 93.364, 93.925, Student Financial Assistance Programs Cluster Grant # Not Applicable Criteria: Federal regulation, 16 CFR 314.4(b) (version effective for fiscal years 2020 and 2021), requires Montana?s universities to ?Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures.? Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Section 20-32-101, Montana Code Annotated (MCA), establishes an educational telecommunications network for instructional and educational coursework of students from kindergarten through higher education as well as any supporting information to teachers. Section 20-25-301, MCA, outlines the powers and duties of the Board of Regents (board), including that the board shall ensure an adequate level of security for data within the university system by addressing state law information security requirements. These requirements are further defined in ?2-15-114, MCA, and direct agencies to develop and maintain policies and procedures to ensure information security, ensure an individual is responsible for a security program and safeguards, and conduct internal evaluations of the security program for improvements. Board policy is meant to clarify how this statute is carried out and states that ?Where appropriate, campuses should follow the National Institute of Standards and Technology (NIST) Framework for policy guidance.? Condition: The current board security policy has not been reviewed since 2014. The Office of the Commissioner of Higher Education (OCHE) has delegated to the major campuses the authority to administer their own information network. As a result, campuses have the individual responsibility to assess their IT environments and security programs for various risks from external threats, weak controls, and compliance with state and federal requirements. As described in Findings 2021-022 and 2021-023, during fieldwork we identified that risk management processes within IT were not consistent or comprehensive at the universities. This has contributed to the universities? non-compliance with federal regulations requiring an information security risk assessment process. Questioned Costs: None. Context: The universities gather and store various types of sensitive information electronically related to students? education and personal information, employees? personal information, credit and bank account information, intellectual property, and personal health information. Personally identifiable information (PII) can include student names, mothers? maiden names, social security numbers, identification numbers, or parent/guardian information. As the entity directed to ensure security, the board and OCHE are responsible for governance and policies that guide the frameworks in place for the university system. This governing policy should create consistency and be explicit about the high-level procedures to maintain a security program. Each university can determine more specific policies around controls and how they are managed as they also need to consider business differences. Effect: The universities are not in compliance with federal regulations as described in Findings 2021-022 and 2021-023. Cause: One FTE at OCHE is tasked with operational, management, and oversight responsibilities, leaving little time for establishing governance or coordinating security across an entire university system. OCHE staffing does not include dedicated security responsibilities. According to board security policy, security responsibilities are expected to be established at each university. Currently, these staff dedicated to security are at each flagship campus. The smaller campuses do not have IT security staff. While OCHE intended to give the universities leeway in deciding on what exact framework would work best, the language chosen has caused the universities to not formally adopt any framework to guide their security programs. The lack of framework has contributed to the current state of security programs and has slowed progress in development. The lack of this governance structure has contributed to the struggles in maturing security programs at each university and could make sharing IT services related to security more complicated. If each university addresses a problem differently, they lose the ability to share knowledge and services for efficiency. Recommendation: We recommend that the Board of Regents establish system-wide IT governance that ensures: A. OCHE has an active role in improving security posture of the university system, B. Security policy addresses the requirements of data security statute and other relevant federal requirements, C. There is clear allocation of security responsibility, authority, and accountability, and D. Communication and reporting mechanisms are formalized between various entities that oversee or make decisions within the university system. We further recommend that Board of Regents and the universities review and enforce university system security policy that includes: E. Clear direction within policy to manage a security program and mandate a consistent security framework, going above and beyond maintaining security policies. F. Requirements for Board of Regents security policy to be reviewed continuously. Views of Responsible Officials: OCHE concurs with these recommendations. For additional information regarding OCHE?s planned corrective action see Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-022: U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Programs Cluster Grant # Not Applicable U.S. Department of Health and Human Services ALN # 93.264, 93.364, 93.925, Student Financial Assistance Programs Cluster Grant # Not Applicable Criteria: Federal regulation, 16 CFR 314.4(b) (version effective for fiscal years 2020 and 2021), requires Montana State University (university) to ?Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures.? Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: As indicated in finding 2021-021, the Office of the Commissioner of Higher Education (OCHE) has delegated to the major campuses the authority to administer their own information network. As a result, campuses have the individual responsibility to assess their IT environments and security programs for various risks from external threats, weak controls, and compliance with state and federal requirements. We identified that risk management processes within information technology (IT), including those required by federal regulations governing the Student Financial Assistance Cluster related to information security and risk assessment, were not consistent or comprehensive at the university. We determined that the Bozeman campus has individuals coordinating the information security program. However, it?s unclear how affiliate campuses at Billings, Great Falls and Havre should be included in this work because the boundary of the security programs that each university manages is not clearly defined. After reviewing IT risk assessment procedures, we determined that the Bozeman campus has not performed an IT risk assessment that addresses the three areas required by federal regulations. There is no IT formal risk management program, including documented safeguards, that supports the improvements and drives initiatives for a comprehensive security program that meets the intentions of the requirements. Industry standards provide many tools and guidance on assessing security programs. For our work, we chose an assessment tool that was developed for higher education. The tool assesses high-level, common security practices. The university scored low in risk management. We also contracted with an outside consultant with experience in security testing and phishing campaigns to review security vulnerabilities and security awareness at the university. Our contractor?s work identified vulnerabilities where the control structure does not completely mitigate a specific risk. From testing, the university had two high concerns and five moderate concerns found in testing. The university?s security program is at a lower maturity level. Questioned Costs: None. Context: The university is comprised of four separate campuses with a combined total enrollment of 20,261 and 19,422 students during fiscal years 2020 and 2021, respectively. The table below summarizes the number of students receiving assistance through Title IV-A programs by campus; the table contains duplicate counts because individual students may qualify for multiple types of assistance. No students received new Perkins loans during this period; students with loan balances from prior periods are not included in the table. See Schedule of Findings and Questioned Costs for chart/table. The university gathers and stores various types of sensitive information electronically related to students? education and personal information, employees? personal information, credit and bank account information, intellectual property, and personal health information. Personally identifiable information (PII) can include student names, mothers? maiden names, social security numbers, identification numbers, or parent/guardian information. Effect: The university is not in compliance with federal regulations. Possible outcomes could be data breaches or ransomware attacks that impact university reputation and could stop the university from providing services to students. Cause: While the Office of the Commissioner of Higher Education intended to give the university leeway in deciding on what exact framework would work best, the language chosen has caused the university to not formally adopt any framework to guide their security programs. The lack of framework has contributed to the current state of security programs and has slowed progress in development. University staff indicated that overall IT staffing challenges have impacted the progress of the security program. Recommendation: We recommend the Montana State University complete a comprehensive IT risk assessment to develop a formal approach for maturing security procedures. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university?s planned corrective action see Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-023: U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Programs Cluster Grant # Not Applicable U.S. Department of Health and Human Services ALN # 93.342, Student Financial Assistance Programs Cluster Grant # Not Applicable Criteria: Federal regulation, 16 CFR 314.4(b) (version effective for fiscal years 2020 and 2021), requires the University of Montana (university) to ?Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures.? Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: As indicated in finding 2021-021, the Office of the Commissioner of Higher Education (OCHE) has delegated to the major campuses the authority to administer their own information network. As a result, campuses have the individual responsibility to assess their IT environments and security programs for various risks from external threats, weak controls, and compliance with state and federal requirements. During fieldwork we identified that risk management processes within information technology (IT) were not consistent or comprehensive at the university. We determined the Missoula campus has individuals coordinating the information security program. However, it?s unclear how affiliate campuses at Butte, Helena and Dillon should be included in this work because the boundary of the security programs that each university manages is not clearly defined. After reviewing IT risk assessment procedures, we determined that the Missoula campus has not performed an IT risk assessment that addresses the three areas required by federal regulations. There is no IT formal risk management program, including documented safeguards, that supports the improvements and drives initiatives for a comprehensive security program that meets the intentions of the requirements. Industry standards provide many tools and guidance on assessing security programs. For our work, we chose an assessment tool that was developed for higher education. The tool assesses high-level, common security practices. The university scored low in risk management. Additionally, we contracted with an outside consultant to conduct testing and run a phishing campaign at the university. This testing identified specific vulnerabilities and showed what security weaknesses could be exploited if identified by a malicious actor. Our contractor?s work also identified vulnerabilities where the control structure does not completely mitigate a specific risk. From testing, the university had two high concerns and five moderate concerns found in testing. The university?s security program is at a lower maturity level. Questioned Costs: None identified Context: The university is comprised of four separate campuses with a combined total enrollment of 12,764 and 11,915 students during fiscal years 2020 and 2021, respectively. The table below summarizes the number of students receiving assistance through Title IV-A programs by campus; the table contains duplicate counts because individual students may qualify for multiple types of assistance. No students received new Perkins loans during this period; students with loan balances from prior periods are not included in the table. See Schedule of Findings and Questioned Costs for chart/table. The university gathers and stores various types of sensitive information electronically related to students? education and personal information, employees? personal information, credit and bank account information, intellectual property, and personal health information. Personally identifiable information (PII) can include student names, mothers? maiden names, social security numbers, identification numbers, or parent/guardian information. Effect: The university is not in compliance with federal regulations. Possible outcomes could be data breaches or ransomware attacks that impact university reputation and could stop the university from providing services to students. Cause: The university?s IT division has had multiple changes and temporary staff since 2018. Management is also responsible for ensuring sufficient resources are available for a security program, and that roles and responsibilities are clearly defined. Throughout these changes in management and leadership, responsibilities related to security have not been defined or documented officially for all security related positions. Key security roles at the university varied in their level of documentation, including a job description that was being updated, a job posting, and an inaccurate job description. Without this clarity, the university?s security program lacks accountability and understanding of expectations in some areas. This also limits enforcement to ensure staff complete necessary tasks that meet the needs of the security program. The university has not been able to hire a permanent position to be accountable for a comprehensive security program either. In recent attempts, they have struggled to bring someone in who is willing to progress a security program from a low maturity level. Recommendation: We recommend the University of Montana: A. Update and formalize job descriptions for positions that have responsibilities for developing, maintaining, or supporting the security program, and B. Complete a comprehensive IT risk assessment that is used to develop strategic initiatives and the required budget to mature the security program and security awareness. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university?s planned corrective action see Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-024: U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Programs Cluster Grant # Not Applicable U.S. Department of Health and Human Services ALN # 93.264, 93.364, 93.925, Student Financial Assistance Programs Cluster Grant # Not Applicable Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Great Falls College MSU and MSU-Northern did not have documented controls in place addressing review requirements for the School Account Statement (SAS) data file Direct Loan reconciliations and did not retain any documentation demonstrating the reconciliations were reviewed. Questioned Costs: None. Context: Through our testing, we determined all four of the Montana State University campuses were completing the required reconciliations. However, two of the four did not have documented internal controls or evidence of reviews being completed. Effect: Our audit did not identify any material noncompliance, but a lack of documented internal controls could result in reconciliations not being done or being done inaccurately. Current staff are aware of the requirement but if there is staff turnover, that knowledge leaves with the person. Cause: Both campuses have a process in place to complete the reconciliations and keep documentation of the process, but they were unaware there should be documentation and evidence that a review was completed. Recommendation: We recommend the Great Falls College MSU and MSU-Northern document their internal control process and retain evidence of reviews over Direct Loan reconciliations. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-025: U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Programs Cluster Grant # Not Applicable U.S. Department of Health and Human Services ALN # 93.264, 93.364, 93.925, Student Financial Assistance Programs Cluster Grant # Not Applicable Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Through our testing, we determined Montana State University (MSU) Bozeman, MSU Billings, MSU-Northern, and Great Falls College MSU do not have documentation of review of the Cost of Attendance (COA) calculation performed by someone not involved in the process of creating it. Questioned Costs: None. Context: This condition exists at all four of the MSU campuses. Each campus calculates and awards individual student financial aid awards based on the institution?s COA and the individual?s expected family contribution. Although each campus uses slightly different methodology, the financial aid director at each campus creates the COA using historical costs, known or estimated tuition and fee increases, averages of meal plans and local rents, as well as consumer price index increases. A different COA is calculated for the different enrollment categories such as: resident vs nonresident, off campus vs on campus, graduate, undergraduate, and full-time vs ? time vs ? time. Effect: Deficiencies in internal control increase the risk the university may not identify non-compliance in a timely manner. The large number of COAs at each campus increases the risk that not all errors in the COA would be identified on a timely basis and may cause students? Student Financial Assistance amounts to be incorrect. Cause: University staff indicated they believe their practice is sufficient because any large errors would be noticed as they would significantly affect the amount of aid students are awarded. Recommendation: We recommend each campus of Montana State University document their internal controls over the calculation of Cost of Attendance. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-026: U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Programs Cluster Grant # Not Applicable U.S. Department of Health and Human Services ALN # 93.264, 93.364, 93.925, Student Financial Assistance Programs Cluster Grant # Not Applicable Criteria: Federal regulation, 34 CFR 674.19(e)(4)(iii), requires an institution to return the original or a true and exact copy of the note marked ?paid in full? to the borrower, or otherwise notify the borrower in writing that the loan is paid in full and retain a copy for the prescribed period, after the loan obligation is satisfied. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Montana State University (MSU) Northern did not send paid in full letters to Perkins Loan borrowers when the loan obligation was satisfied, contrary to federal regulations. Questioned Costs: None. Context: The MSU Bozeman, MSU Billings, and MSU Northern campuses participate in the Perkins Loan program. While new loans are no longer made under the program, the three campuses are still servicing loans. They each contract with a third-party service provider to perform some of the services and federal record retention requirements of these loans. We tested a sample of 71 of the approximate 3,500 borrowers with paid in full, cancelled, or assigned loans status, divided proportionately between the three campuses. This was not a statistically valid sample. We tested a total of 17 borrowers at MSU Northern and found none of them received the paid in full letters. Of the three campuses, MSU Northern is the only campus where we found noncompliance with this requirement. Effect: MSU Northern is not in compliance with federal regulations for the Student Financial Assistance cluster. Such noncompliance could result in inaccurate loan records of whether a loan is still active or fully paid off. Cause: MSU Northern staff indicated they thought the service provider was responsible for the letters. While a contract could not be located to support this, compliance with federal regulations is ultimately the responsibility of the university. Recommendation: We recommend that MSU Northern: A. Develop internal controls to ensure paid in full notifications are sent when a borrower?s loan obligation is satisfied. B. Send ?paid in full? letters to borrowers after the loan obligation is satisfied in accordance with federal Perkins loan requirements. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-027: U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Programs Cluster Grant # Not Applicable U.S. Department of Health and Human Services ALN # 93.342, Student Financial Assistance Programs Cluster Grant # Not Applicable Criteria: Federal regulation, 2 CFR 200.303, requires the non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: We found that the University of Montana (university) campuses UM Missoula, UM Western, and Helena College do not have internal controls in place to ensure review and approval of the cost of attendance (COA) calculations by someone not involved in the process of creating it. Helena College has a process in place to provide the calculations to various other campus staff for review, but their review is not documented and thus untestable. Montana Tech did not have these controls in place for fiscal year 2020, but controls were put in place and documented beginning in fiscal year 2021. Questioned Costs: None. Context: The financial aid director at each campus calculates and awards individual students financial aid based on the COA at the institution and the individual?s expected family contribution. The COA is, generally, the total of: tuition and fees; an allowance for books, supplies, transportation and miscellaneous personal expenses; an allowance for room and board; where applicable, allowances for costs for dependent care; costs associated with study abroad and cooperative education; costs related to disabilities; and fees charged for student loans. Although each campus uses slightly different methodology, they each create the COA using historical costs, known or estimated tuition and fee increases, averages of meal plans and local rents, as well as consumer price index increases. A different COA is created for the different categories of students: resident vs. nonresident, off campus vs. on campus, graduate, undergraduate, and full-time vs. ? time vs. ? time. The number of yearly COAs calculated by each campus range from 76 to 294. Effect: Without a review and approval process, there is risk the COA calculation may contain errors and/or may not be adequately supported and cause students to be awarded an incorrect amount of financial aid. As part of testing, we identified that UM Western did not have support for three and four of the five elements of the report in the COA calculations for academic years 2019-20 and 2020-21, respectively. Additionally, the total COAs published on the campus website were $1,020 less than the COA calculated by the campus on the spreadsheets provided to us as part of the audit. Cause: Some university staff indicated their current practice is sufficient because any large errors would be noticed as they would significantly affect the amount of aid students are awarded. Recommendation: We recommend: A. UM Missoula, UM Western, and Helena College implement internal controls as required by federal regulations to ensure the COA calculations are accurate and supported. B. MT Tech continue to implement and document their review process over the COA. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-028: U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Programs Cluster Grant # Not Applicable U.S. Department of Health and Human Services ALN # 93.342, Student Financial Assistance Programs Cluster Grant # Not Applicable Criteria: Federal regulation, 2 CFR 200.303, requires the non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal regulation, 34 CFR 668.22(c)(1) outlines how an institution determines a student?s withdrawal date for the purposes of calculating the amount of the term attended by the student. Federal regulation, 34 CFR 668.22(c)(4) requires an institution to document a student?s withdrawal date and maintain the documentation as the date of the institution?s determination that a student withdrew. Federal regulations, 34 CFR 668.22(g)(1) and (2) require an institution to return the lesser of the total amount of unearned Title IV assistance or an amount equal to the total institutional charges incurred by the student for the period multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, and requires the institutional charges incurred by the student used in the calculation only be tuition, fees, room and board and other educationally-related expenses assessed by the institution. Federal regulation, 34 CFR 668.22(j)(1) requires an institution return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution's determination that the student withdrew. Condition: We identified material weakness in internal controls for multiple instances where the University of Montana (university) campuses UM Missoula and UM Western did not comply with the federal regulations for calculating and timely returning unearned student financial aid. Questioned Costs: There are $5,588 of known questioned costs but likely questioned costs are projected to exceed $25,000. Context: The university calculates and awards individual student?s financial aid based on the cost of attendance at the institution and the individual?s expected family contribution. The cost of attendance used to award the aid is based on the student?s enrollment at the beginning of each term. If a student drops any courses or fully withdraws from the university, their aid must be adjusted. If a student fully withdraws, either by officially notifying the university or simply no longer attending classes, federal regulations require each campus to calculate the amount of aid the student earned for the time they attended. If a student attended less than 60 percent of the calendar days in a term, they did not earn the full amount of their initially disbursed financial aid, and federal regulations require the unearned funds be returned to the federal government. We tested a sample of 54 of the 3,849 students who received aid and subsequently withdrew during the audit period. This sample was not statistically valid. UM Missoula: The campus?s process is for one staff member in Student Accounts to complete the calculation of the aid to be returned. If the calculation indicates a portion of the student?s aid must be returned, a second staff member in Student Accounts reviews and approves the calculation. If the calculation indicates no aid must be returned, this review and approval does not occur. After Student Accounts staff complete the calculation, Financial Aid staff are responsible for adjusting the student?s Banner account and Business Services staff are responsible for returning the funds to the Department of Education (ED). Based on our review of the campus?s processes and the results of our sample testing, we identified the following areas of internal control deficiencies and noncompliance: ? For instances where the initial return calculation indicates the student has attended at least 60 percent of the semester, and thus earned 100 percent of their aid, the campus does not have controls in place to verify the accuracy of the calculation. We tested 18 students whom staff determined had attended 60 percent or more of the semester and did not identify any instances where the determination was incorrect. While we did not identify any resulting noncompliance for these students, the university should have a process in place to verify the initial calculations as an error at this stage could result in the campus not returning federal funds as required. ? For three students reviewed in the sample, the university?s controls did not ensure the calculation of funds to return was correct. For these instances, staff used an incorrect withdrawal date to determine how much of the semester the students attended, and the review process did not identify the errors. ? The campus also does not have sufficient internal controls to ensure the aid is returned to ED timely once it has been calculated. We identified one instance where the campus completed the return 96 days after the student notified the campus of their withdrawal instead of within the 45 days required. We also identified two instances where the campus did not complete the return process once the amount had been calculated. UM Western: The campus does not have sufficient internal controls to ensure the amount of aid to be returned was calculated correctly. Staff use a calculation form on the Common Origination and Disbursement (COD) system to determine the amount of funds to be returned. The entire process is completed by a single staff member, without review and approval by another staff person. We identified the following errors in the calculations, indicating internal controls should be enhanced: ? We identified one instance where the campus used an incorrect tuition amount in the calculation and thus miscalculated the amount of aid to be returned by $75.13. However, the campus ultimately returned the correct amount. ? We identified one instance where the campus used an incorrect withdrawal date in the calculation. However, the campus ultimately returned the correct amount. ? We also identified one instance where the campus was unable to provide support for a student?s last day of attendance. As such, we were unable to determine whether the amount of funds returned was appropriate. Effect: The university is not in compliance with federal regulations for the Student Financial Assistance programs. Additionally, without maintaining supporting documentation for key items in the calculation, such as the last date of attendance, the campus cannot demonstrate compliance with federal regulations. Cause: UM Missoula staff stated they stop the return process once they have determined a student has attended at least 60 percent of the semester, so these items never make it to the review portion of the process discussed above. Additionally, campus staff believe the items above were the result of an employee not completing assigned job duties who was ultimately relieved of those duties. The employee worked in the position from December 2019 through early January 2021. UM Western staff believed the use of the COD form to complete the calculation was sufficient internal controls to ensure the calculation is correct. Recommendation: We recommend: A. UM Missoula enhance internal controls to ensure the amount of financial aid to be returned is calculated correctly and the aid is returned to ED timely. B. UM Western implement internal controls to ensure the amount of financial aid to be returned is calculated correctly and supporting documentation is maintained. C. UM Missoula and UM Western comply with the federal requirements governing the return of Title IV funds process. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-029: U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Programs Cluster Grant # Not Applicable U.S. Department of Health and Human Services ALN # 93.342, Student Financial Assistance Programs Cluster Grant # Not Applicable Criteria: Federal regulation, 2 CFR 200.303(a) requires non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal regulation, 34 CFR 685.309(b) requires schools participating in the Direct Loan program to complete an enrollment reporting process outlined by the Secretary of Education. Federal regulation, 34 CFR 690.83(b)(2) requires institutions participating in the Pell grant program to submit reports and information required by the Secretary of Education in accordance with established deadlines. The National Student Loan Data System Reporting Guide, Section 5.1, issued November 2020, requires schools to certify enrollment data at least every 60 days by receiving the Roster file, responding within 15 days and correcting errors within 10 days. Condition: To assist the Department of Education (ED) in administering the Pell Grant and Direct Loan Programs, each campus is required to complete student enrollment reporting throughout the year. Student enrollment information is housed in a central, federal database by ED: the National Student Loan Data System (NSLDS). Periodically, NSLDS provides a roster file of enrollment information for students who received Pell grants or Direct Loans to the campuses. Each campus must review, update, and verify student enrollment statuses, program information, and effective dates within 15 days of receiving the file. The University of Montana campus UM Missoula did not complete the required enrollment reporting for over 200 students receiving student financial aid, in violation of federal regulations. Given the number of students and range of grade levels affected, this is a material weakness in internal controls. Questioned Costs: None. Context: Although ultimately responsible for the reporting, all of the campuses use a third-party organization, the National Student Clearinghouse (clearinghouse), to complete the reporting. Campus staff extract the current enrollment information from Banner via standard reports and review it for errors and students who should not be included. Staff then send the report to the clearinghouse, who matches it up to the roster file provided by ED and sends it back to NSLDS. If errors or inconsistencies are identified by NSLDS, they provide an error file that must be corrected and resubmitted within 10 days. As part of our testing, we completed a sample of 69 students across the University of Montana?s (university) four campuses, who received Pell grants or Direct Loans during the audit period across all campuses. Of the sampled students, 37 were at UM Missoula. This sample was not statistically valid and identified errors in the enrollment reporting for two students at UM Missoula. Through follow-up testing, we identified deficiencies in UM Missoula?s enrollment reporting process and significant noncompliance with the federal reporting requirements, as outlined below: ? Dual Enrollment Students: Eligible Montana high school students can take college courses for credit for free or at a reduced cost at any campus in the Montana University System. At UM Missoula, these students are identified in Banner using a specific attribute code. As part of the enrollment reporting process, staff filter out students with the dual enrollment attribute code as they are not eligible to receive federal financial aid and are thus not entered in NSLDS. During our testing, we determined the dual enrollment code was not being updated in Banner for students who became regularly enrolled after participating in the dual enrollment program. There were 147 students with this inaccurate code ranging from freshmen to doctoral students. Of these students, 28 received Pell grants or Direct Loans during the audit period, and thus should have been included in the enrollment reporting to NSLDS. Given the range of grade levels affected, this is a systemic internal control deficiency. ? Missing Social Security Numbers (SSN): Students are not required to provide SSNs as part of the admissions application process. Providing SSNs is, however, required to receive federal financial aid and SSNs are provided as part of the student?s Free Application for Federal Student Aid (FAFSA) application process. When a student provides the SSN as part of the FAFSA but not the admissions application, their SSN is only housed in the financial aid Banner data. As of spring semester 2021, there were approximately 1,400 students enrolled at UM Missoula who had not provided their SSN as part of the enrollment application. When staff run the extract process for the enrollment reporting, the financial aid data is not included as the reporting is specific to enrollment data. Student?s SSNs are used only as an identifier to match campus student records to the NSLDS student records. The SSNs themselves are not required to be reported to NSLDS. As a result, these students with no SSNs in the enrollment Banner data are flagged by the clearinghouse and returned to campus staff as potential errors or students who do not need to be reported. Because the errors are not resolved, these students are not reported to NSLDS by the clearinghouse. Of the 1,400 students with no enrollment SSN, 173 received Pell grants or Direct Loans during the audit period, and thus should have been included in the enrollment reporting to NSLDS. Effect: By not reporting these 201 students, UM Missoula is not in compliance with the federal requirements and is at risk of being fined by ED for their administration of the Pell Grant program. Additionally, it is like they are not enrolled at all from ED?s perspective. Cause: During our testing, we determined the dual enrollment attribute code was not being updated in Banner for students who became regularly enrolled after participating in the dual enrollment program. For the missing SSNs, UM Missoula staff do not resolve these errors when they are flagged by the clearinghouse because it is not required to be reported to NSLDS and they want to instead focus their time on resolving errors in the information that is required to be reported. Recommendation: We recommend UM Missoula improve internal controls to ensure all required students are reported to NSLDS and comply with the federal requirements governing the enrollment reporting process. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-030: U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Programs Cluster Grant # Not Applicable U.S. Department of Health and Human Services ALN # 93.342, Student Financial Assistance Programs Cluster Grant # Not Applicable Criteria: Federal regulation, 2 CFR 200.303, requires the non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal regulation, 34 CFR 685.300(b)(5), requires institutions to reconcile institutional records with Direct Loan funds received from the Secretary and the disbursement records submitted to and accepted by the Secretary on a monthly basis. Federal regulation, 34 CFR 668.24(c)(1)(vi), requires institutions to maintain records for the reports and forms used in its participation in a title IV, HEA program, and any records needed to verify data that appear in those reports and forms. Federal regulation, 34 CFR 668.24(e)(2)(ii), requires institutions to keep records relating to its participation in the FFEL or Direct Loan Program, including records of any other reports or forms, for three years after the end of the award year in which the records are submitted. Condition: The University of Montana (university) did not complete all federally required monthly reconciliations for the Direct Loan Program during the audit period. The university?s controls over these monthly reconciliations are not sufficient to ensure the required monthly Direct Loan reconciliations are completed, accurate, and any differences are followed up on in compliance with the federal regulations. Questioned Costs: None. Context: Campuses calculate and award individual students Direct Loan awards based on the cost of attendance (COA) at the institution and the individual?s expected family contribution. Once accepted, these loans are applied to the students? bills and any excess is disbursed directly to students. The university is then required to report these disbursements to the Department of Education (ED) via the Common Origination and Disbursement (COD) System within 15 days of applying to the students? accounts. Each month, the COD system provides institutions with School Account Statement (SAS) data files consisting of financial information related to the Direct Loan disbursements. Institutions are required to reconcile these files to their financial records monthly. We completed a sample of three reconciliations at each campus. This sample was not statistically valid. We identified the following: ? UM Missoula: The campus was missing reconciliations for five of the 24 months in fiscal years 2020 and 2021. The campus maintained some supporting documentation for the reconciliations, but not enough to fully tie them back to support for the three reconciliations we sampled. UM Missoula also had a difference of $910 noted on the reconciliation from January through June 2021 with no documentation of any follow-up being performed. Because a reconciliation process involves both comparing amounts and then following up on any differences, when unresolved differences exist it indicates the campus did not fully complete the process. ? UM Western: The campus did not complete any of the required monthly reconciliations during fiscal years 2020 and 2021. ? MT Tech: The campus did not complete the June 2021 monthly reconciliation and did not have supporting documentation for the other 23 reconciliations completed during fiscal years 2020 and 2021. The campus also had a difference of $982 noted on the reconciliations for February, March, and April of 2020. As noted earlier, when unresolved differences exist it indicates the campus did not fully complete the process. ? Helena College: The campus did not complete any of the required monthly reconciliations during fiscal years 2020 and 2021. Effect: By not completing the required monthly reconciliations and maintaining the supporting documents, the university has violated one of the requirements in their program participation agreements with ED and is not in compliance with federal regulations for the Student Financial Assistance program. Cause: Some university officials indicated that due to limited staff resources, the reconciliations are not always a priority; instead, they focus on activities directly impacting students. Additionally, for UM Missoula, the campus staff stated the staff member responsible for these reconciliations retired and thus they were unsure why the differences were not followed up on and where any remaining supporting documentation was located. UM Western campus staff stated they were not aware they needed to complete these monthly reconciliations. MT Tech campus staff indicated the difference was due to a computer issue and they worked closely with their software provider to investigate and resolve the difference. However, as the work was not documented, we were unable to confirm. The campus staff further stated that the June 2021 reconciliation might not have been saved because no differences were identified. However, in our testing, we observed other monthly reconciliations with no differences saved during the audit period. Helena College campus staff stated the previous employee responsible for these reconciliations left abruptly in January 2020 and did not leave behind any documentation of processes or completed reconciliations. The current staff is developing a process to complete the reconciliations in the future. Recommendation: We recommend UM Missoula, UM Western, Helena College, and MT Tech: A. Implement internal controls to ensure the required monthly Direct Loan reconciliations are completed, accurate, supported, and any differences are followed up on in compliance with the federal regulations, and B. Comply with federal requirements governing the Direct Loan Program by reconciling the SAS data files monthly. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-031: U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Programs Cluster Grant # Not Applicable U.S. Department of Health and Human Services ALN # 93.342, Student Financial Assistance Programs Cluster Grant # Not Applicable Criteria: Federal regulation, 2 CFR 200.303, requires the non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal regulation, 34 CFR 674.19(d)(2), requires, for the Federal Perkins Loan Program, institutions to submit the Fiscal Operations Report and other information required by the Secretary and to insure the information reported is accurate. Federal regulation, 34 CFR 675.19(b)(3), requires, for the Federal Work-Study Program, institutions to submit the Fiscal Operations Report and other information required by the Secretary and to insure the information reported is accurate. Federal regulation, 34 CFR 676.19(b)(3), requires, for the Federal Supplemental Educational Opportunity Grant Program, institutions to submit the Fiscal Operations Report and other information required by the Secretary and to insure the information reported is accurate. Federal regulation, 34 CFR 668.24(e)(1)(i), requires institutions to keep the Fiscal Operations Report and Application to Participate (FISAP) in the Federal Perkins Loan, Federal Work-Study, and Federal Supplemental Educational Opportunity Grant Programs (FSEOG) and any records necessary to support the data contained in the FISAP for three years after the end of the award year in which the FISAP was submitted. Condition: Internal controls over completing the Fiscal Operations Report and Application to Participate (FISAP) reports were insufficient to ensure the reports submitted were complete and accurate at the University of Montana (university) campuses UM Western and Helena College, as required by federal regulations. Questioned Costs: None. Context: Each campus is required to complete the FISAP yearly for its campus-based programs. The institution uses the Fiscal Operations Report portion of the FISAP to report its expenditures and students served in the previous award year and the Application to Participate portion of the FISAP to apply for funding for the following year. As outlined in the table below, our testing identified instances of incorrect or unsupported line items in the FISAP reports reviewed. See Schedule of Findings and Questioned Costs for chart/table. Effect: By not accurately completing and keeping the required support for the FISAP reports, the campuses have violated one of the requirements in their program participation agreements with the U.S. Department of Education and are not in compliance with the federal regulations for the Student Financial Assistance program. Cause: Helena College staff stated they were not aware they needed to keep the supporting documents for these reports. UM Western staff stated the report preparation process was manual and prone to mistakes and other counting errors. Recommendation: We recommend UM Western and Helena College: A. Implement internal controls to ensure the Fiscal Operations Report and Application to Participate (FISAP) reports submitted are accurate and supported in compliance with the federal regulations, and B. Comply with federal requirements governing the Federal Perkins Loan, the Federal Work-Study, and Federal Supplemental Educational Opportunity Grant programs by accurately completing the FISAP reports and maintaining the required supporting documentation. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-032: U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Programs Cluster Grant # Not Applicable U.S. Department of Health and Human Services ALN # 93.342, Student Financial Assistance Programs Cluster Grant # Not Applicable Criteria: Federal regulation, 2 CFR 200.303, requires the non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal regulation, 34 CFR 674.19(e)(3)(ii) requires an institution to retain repayment records, including cancellation and deferment requests for at least three years from the date on which a loan is assigned to the Secretary, canceled or repaid. Federal regulation, 34 CFR 674.19(e)(4) requires an institution to keep the original promissory notes and repayment schedules until the loans are satisfied. Federal regulation, 34 CFR 674.19(e)(4)(iii) requires after the loan obligation is satisfied, an institution to return the original or a true and exact copy of the note marked ?paid in full to the borrower, or otherwise notify the borrower in writing that the loan is paid in full, and retain a copy for the prescribed period.? Condition: University of Montana (university) campuses UM Missoula, UM Western, and MT Tech participate in the Perkins Loan Program. While new loans are no longer made under the program, the three campuses still service outstanding loans. Our testing identified multiple instances where the campuses did not comply with federal regulations to retain cancellation and deferment requests, repayment schedules, and notification to the borrower the loan obligation is paid in full. Questioned Costs: None. Context: We tested a sample of 65 borrowers with loans in repayment or deferment status out of a population of 2,196 and a sample of 61 borrowers with paid in full, canceled, or assigned loans status out of a population of 1,127. Neither sample was statistically valid. We identified significant noncompliance and systemic internal control issues related to retaining records as described below: ? UM Missoula: We identified 22 loans where the campus was unable to provide documentation that the written ?paid in full? notification was sent. Per Student Accounts staff, they stopped sending the notification in January 2021 due to limited staffing resources due to the COVID pandemic and instead focused on higher priority work. Fourteen of the loans we identified fell after this decision. However, the remaining eight occurred before and staff indicated the notifications were sent but they were unable to find them during our testing. ? UM Western: We identified four loans where the campus was unable to provide cancellation or deferment requests and three loans where they could not provide documentation that the written ?paid in full? notification was sent. ? MT Tech: We identified five loans where the campus was unable to provide the repayment schedule and seven loans where they could not provide documentation that the written ?paid in full? notification was sent. Effect: The UM Missoula, UM Western, and MT Tech campuses are not in compliance with federal requirements related to records retention. Also, by not completing the ?paid-in-full? notifications, there is the potential for borrowers to continue paying on satisfied loans, resulting in the university having to issue refunds. Cause: As noted above, UM Missoula stopped sending the notification in January 2021 due to limited staffing resources due to the COVID pandemic and instead focused on higher priority work. Additionally, for the missing letters prior to this decision, they were not sure why the letters weren?t filed in the student files, but it could be because they are behind with filing and the office is moving. Both UM Western and MT Tech staff indicated the reason they were unable to provide the necessary documents during our testing was because their third-party servicer completed them. UM Western staff stated they were unable to retrieve them from the servicer?s system. MT Tech staff stated the missing repayment schedules were not transferred when they switched servicers. For the written ?paid in full? notifications, the servicer does not keep copies of these letters but rather considers memos on the borrower?s account in their system to suffice as documentation. Additionally, the servicer indicated there were two borrowers who did not have the letters sent at all and they are unsure why. However, as the ultimate responsibility for complying with the federal regulations belongs to the university, this is noncompliance. Additionally, the federal regulations are clear the documents themselves need to be retained, not just an indication in a system that they were completed. Recommendation: We recommend: A. UM Missoula comply with the federal requirements to notify the borrower in writing that the loan is paid in full and retain a copy for the prescribed period. B. UM Western comply with the federal requirements to retain cancellation and deferment requests and written notification to the borrower that the loan is paid in full for the prescribed period. C. MT Tech comply with the federal requirements to retain repayment schedules and written notification to the borrower that the loan is paid in full for the prescribed period. D. UM Missoula, UM Western, and MT Tech implement internal controls to ensure compliance with the record retention requirements for Perkins Loans. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-033: U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, Student Financial Assistance Programs Cluster Grant # Not Applicable U.S. Department of Health and Human Services ALN # 93.342, Student Financial Assistance Programs Cluster Grant # Not Applicable Criteria: Federal regulation, 2 CFR 200.303, requires the non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per the Office of Management and Budget 2021 compliance supplement for the Student Financial Assistance Program Cluster, page 5-3-52, when an institution uses a third party servicer for its Perkins Loan program, the institution must perform due diligence to ensure the third party servicer is in compliance with the requirements for the functions the third party services is performing for the school. Condition: The campuses do not monitor their Perkins Loan servicer and are in noncompliance with the federal requirement to monitor their Perkins Loan servicer. Questioned Costs: None. Context: University of Montana (university) campuses UM Missoula, UM Western, and MT Tech participate in the Perkins Loans Program. While new loans are no longer made under the program, the three campuses still service outstanding loans. Each campus contracts with a third-party to perform some of the servicing and record retention federal requirements for the Perkins Loans they are still servicing, as outlined in the table on the following page: See Schedule of Findings and Questioned Costs for chart/table. Although contracting with a third-party is allowed, the ultimate responsibility for these requirements still lies with the university. Additionally, the Department of Education requires the campuses to perform due diligence to ensure their servicer is in compliance with the requirements for the pieces it is performing for the school. This due diligence could take many forms, including, but not limited to, the items we?ve suggested below. ? Service Organization Controls (SOC) Report review: A SOC I Type II report is used to evaluate the design and operating effectiveness of the contractor?s internal controls over achieving compliance requirements. This report focuses on controls at the service organization that are useful to user entities and their auditors and is an efficient way for the campuses to monitor the loan servicer. The loan servicer does receive a SOC report and makes it available to clients, however none of the campuses currently review it. This leaves them at risk of being unaware of system issues affecting the services it receives and not implementing all of the necessary compensating user entity controls. ? Compliance Audit Report review: Some contractors who perform services for federal programs receive a compliance audit. ? Loan records review: Campus staff could perform a review of the documentation for a selection of borrowers to ensure all the required items are present. Effect: By not performing any due diligence over their third-party loan servicer, the university is not only in noncompliance with the requirement to do so, but also was not aware of the noncompliance with the Perkins Loans record retention federal requirements as discussed in recommendation number 2021-032. Cause: Per campus staff, they were not aware they needed to perform monitoring of their contractor beyond their normal day-to-day contacts. Recommendation: We recommend UM Missoula, MT Tech, and UM Western implement internal controls to ensure they perform due diligence over their Perkins Loans servicer and comply with the federal requirements governing Perkins Loans. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-034: Various Federal Agencies* ALN # Various*, R&D Cluster Grant # Not Applicable Criteria: Federal regulation 2 CFR 200.313(b) requires that a state must use, manage and dispose of equipment acquired under a Federal award by the state in accordance with state laws and procedures. Federal regulation 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Montana Operations Manual Policy 335 (V)(A)(1) requires all major equipment be identified in the manner that promotes easy identification and requires property tags be placed in plain sight on the equipment. While state policy does allow some discretion based on the physical nature of some equipment for situations where property tags may not be feasible, it does require that ?whenever possible, the tag number will still be identified on the item by some means such as etching, decal, indelible ink, etc.? Condition: The University of Montana?s (university) internal controls are not sufficient to ensure equipment purchased with federal Research and Development (R&D) funds are tagged as required by federal requirements. Questioned Costs: None. Context: During fiscal years 2020 and 2021, the university purchased approximately $3.5 million of equipment through the R&D Program. We sampled ten equipment purchases during the audit period out of approximately 111 equipment purchases over $5,000, to determine whether the assets were tagged and easily identifiable, as required by state policy. This was not a statistically valid sample. For eight of the items selected, there were no property tags or other permanent identification affixed to the assets that corresponded to university property records. As such, the assets were not easily identifiable by state policy, and we were unable to confirm the assets we observed were those purchased by the federal grant funds. For all eight items, we believe tagging or labeling of the assets was feasible. The items not tagged included network servers, weather stations, cameras, and traveling museum equipment with costs ranging from $5,054 to $69,347. While completing this work, we visited the data center used to house network servers and estimate asset tag numbers were present on only 5 percent of installed units. Additionally, while looking for a high-speed camera at a field station, we observed three other high-speed cameras, none of which had asset tags. Both locations contained visibly identical equipment and university personnel struggled or were unable to differentiate them. Effect: Equipment tagging is necessary to maintain an accurate physical inventory and to facilitate timely identification of lost or missing equipment. In addition, for equipment purchased using federal funds, there are added requirements related to asset disposals. The primary asset disposal requirement is the university must obtain disposition instructions from the federal awarding agency. Cause: One university personnel responsible for some of the equipment we tested indicated they did not know the process for obtaining asset tags and conceded that although some equipment is difficult to tag without interfering with its function, labeling the equipment is still necessary and possible. We believe the results of our testing indicate university internal controls for tagging of equipment are not adequate. Recommendation: We recommend UM Missoula implement internal controls to ensure all equipment is tagged and comply with federal requirements governing equipment for the Research and Development Program. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university?s planned corrective action see the Corrective Action Plan. * - See Appendix A

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-035: U.S. Department of Education ALN # 84.010, Title I Grants to Local Educational Agencies Grant # SO10A190026-19A, GAN_S010A200026-20A ALN # 84.027, 84.173, Special Education Cluster (IDEA) Grant # H027A200096, H173A200099, H027A190096, H173A190099 ALN # 84.425D, Education Stabilization Fund Under the Coronavirus Aid, Relief, and Economic Security Act Grant # S425D200006 and S425D210006 Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal regulation, 2 CFR 200.331, requires the Office of Public Instruction (OPI) to do the following in relation to the monitoring of their subawards: ? Clearly identify award information to subrecipients at the time the award is granted. ? Evaluate each subrecipient?s risk of noncompliance to determine the appropriate monitoring. ? Review subrecipients? audits, including following up on all deficiencies. ? Issue management decisions for any deficiencies identified in subrecipients? audit reports within six months of the Federal Audit Clearinghouse?s acceptance of the audit report. The regulation also requires OPI to follow 2 CFR 200.521, which requires these management decisions to contain specific elements, including a timetable for follow-up. This federal regulation was renumbered to 2 CFR 200.332 during the audit period. Condition: OPI did not perform all required subrecipient monitoring for federal programs selected for testing, so subrecipient monitoring controls should be improved. Questioned Costs: None. Context: In our prior audit report, we recommended OPI enhance internal controls related to subrecipient monitoring and comply with subrecipient monitoring requirements for a variety of federal programs. Although OPI implemented new procedures in response to our audit finding, we continued to find control and compliance issues related to subrecipient monitoring requirements, as outlined below. Subaward Disclosures: OPI did not ensure required disclosures were made to the subrecipients. Through a statistically valid sample, we tested grant award documents for 35 of 841 local educational agencies (LEAs). We identified missing elements related to grants for Title I, Elementary and Secondary School Emergency Relief (ESSER), and IDEA. Examples of missing elements are clear identification of the award as a subaward, the federal award date, and the identification of whether the award is a research and development program. Since the grant award documents are compiled automatically in OPI?s grant system, we expect any missing elements to impact all grant awards. Risk Assessments: During fiscal year 2020, personnel reviewed the audits and considered financial findings in their risk assessment process but did not consider federal findings. Improvements were made in fiscal year 2021, because risk of noncompliance was considered in the overall risk assessment process. However, federal program personnel did not always rely on these centralized monitoring activities, so the federal programs were not always considering Federal Single Audit findings when determining appropriate subrecipient monitoring. As part of our audit, we conducted three separate samples; a statistically valid sample for the IDEA federal award and separate non-statistically valid samples for each the ESSER and Title I federal awards. In our audit procedures, including the samples, we identified the following issues in the fiscal year 2021 risk assessments: ? For Title I and ESSER, OPI did not use the office-wide risk assessments to determine the appropriate monitoring. o Subrecipients identified as high risk overall were not necessarily considered high risk by Title I program staff. o A post-expenditure monitoring plan has not yet been developed for ESSER. There was a plan during the first round of payments, but OPI determined the plan was not sustainable. ? For IDEA, OPI adjusted their monitoring level for some subrecipients based on increased risk of federal noncompliance but did not document their additional monitoring. ? For ESSER, OPI did not always document the basis for the LEA?s risk assessment. This occurred in 11 out of 60 cash draws tested. Management Decisions: During fieldwork, we reviewed OPI?s management decision letters to determine compliance with these federal regulations. From our testing: ? We could not always determine when the management decision letters were sent out because the template document automatically updated to the current date. This occurred in 3 of the 44 IDEA LEAs tested and 3 of the 60 ESSER LEAs tested. The IDEA sample was statistically valid with a population of 841. The ESSER sample was not statistically valid and had a population of 898. ? Management decisions did not always contain a timetable for follow-up as required by federal regulations. This occurred in 7 of the 60 ESSER LEAs cash draws tested. Repeat Finding: Montana?s Single Audit for the two fiscal years ended June 30, 2019, included a recommendation (#2019-032) to OPI to implement internal controls to ensure compliance with federal subrecipient monitoring requirements and to comply with federal subrecipient monitoring requirements. Effect: Overall, OPI is not in compliance with federal regulations related to subrecipient monitoring. Monitoring is important, because without it: ? OPI may not properly notify subrecipients of applicable federal requirements, ? OPI may not be aware of all risky areas for non-school entities, ? Subrecipients may not understand their responsibilities over the federal grant and may not comply with all federal requirements, and ? Federal money could be misspent. These compliance issues indicate OPI did not have adequate controls in place over subrecipient monitoring in either fiscal year 2020 or 2021. Cause: Per OPI staff, they were adjusting their subrecipient monitoring process during fiscal year 2020 and didn?t get the new process put in place until fiscal year 2021. We also believe the subrecipient monitoring compliance issues happened because there is confusion over the new process?s implementation: what elements of subrecipient monitoring are centralized and what elements are completed by federal program staff. The impacts of COVID-19 and implementing the new ESSER federal program also contributed to confusion on how to implement the prior audit recommendation. Recommendation: We recommend the Office of Public Instruction: A. Continue to implement internal controls to ensure compliance with federal subrecipient monitoring requirements by documenting an office-wide subrecipient monitoring plan, and B. Comply with federal subrecipient monitoring requirements. Views of Responsible Officials: OPI concurs with this recommendation. For additional information regarding OPI?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-036: U.S. Department of Education ALN # 84.425D, Education Stabilization Fund Under the Coronavirus Aid, Relief, and Economic Security Act Grant # S425D200006 and S425D210006 Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Coronavirus Aid, Relief, and Economic Security (CARES) Act section 18003(d) requires Elementary and Secondary School Emergency Relief (ESSER) grant funds be used for pandemic related expenditures. Further, federal regulation 2 CFR 200.439 requires equipment purchases have prior approval from the US Department of Education or the pass-through entity. Federal regulation, 2 CFR 200.334, requires states retain records for audit purposes. Condition: We found the Office of Public Instruction (OPI) did not require sufficient documentation to ensure subrecipients were complying with federal program requirements. Questioned Costs: We question the unsupported cash requests totaling $460,154. We believe additional questioned costs may exist. Context: We tested a random sample of 60 ESSER payments to local educational agencies (LEAs). This was not a statistically valid sample. The population was 898 cash requests. We identified the following issues in the testing: ? Twelve application budgets had insufficient detail to support how funds would be spent on allowable purchases under the subaward. The budgets included salaries, benefits, transportation, and supplies. These descriptions are not specific enough for OPI to determine whether the spending is allowable under ESSER requirements. ? OPI used spreadsheets to calculate ESSER allocations by LEA based on Title I distributions and other factors determined by OPI. We compared the allocations on the spreadsheet to the actual amount in OPI?s grant system to see if LEAs received the intended amount. We found 15 differences for a net amount of $121. No documentation exists on the reasons for the adjustments. Staff noted the person who adjusted the calculation no longer works for OPI. ? Sixteen cash requests, totaling $460,154, either contained insufficient detail to demonstrate the funds were spent in accordance with ESSER regulations, or could not be tied back to the approved budgets. The requests included broad categories such as salaries, benefits, and supplies, or a teacher?s name without detail in the budget or cash request to demonstrate how the teacher?s salary or benefits related to the coronavirus pandemic. Additionally, one equipment line had a budget of ?transportation? without the detail of what would be purchased, but the cash request was for a bus totaling $25,000. Equipment purchases over $5,000 are required to have prior approval. Thus, we considered the purchase unallowable. OPI started requiring more documentation in their cash requests for the second and third allocations of ESSER funds. OPI has the opportunity to finalize their post expenditure monitoring plan in addition to reviewing cash requests. This is important as most of the spending is happening in the future. Effect: The lack of effective internal controls resulted in OPI?s inability to detect and prevent noncompliance for fiscal years 2020 and 2021 for subrecipient activity. LEAs may have spent ESSER funds on items not allowed by federal requirements. Cause: Per OPI staff, this issue occurred because the federal government had not finalized program requirements when they issued the first round of money. We agree federal ESSER program requirements changed, but the requirement to have controls to provide reasonable assurance LEAs comply with federal requirements is not new. OPI needs more information to meet their monitoring responsibilities, no matter how ESSER requirements change. In addition, there were two different ESSER program managers in place during the audit period and the position was a vacant position during our fieldwork. We believe this contributed to difficulties running the ESSER program. Recommendation: We recommend the Office of Public Instruction: A. Strengthen internal controls to ensure ESSER subrecipient grant expenditures are allowable under the program. B. Review and evaluate ESSER subrecipients budgets and cash requests and, where appropriate, obtain additional support or recoup improperly spent funds. Views of Responsible Officials: OPI concurs with this recommendation. For additional information regarding OPI?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-037: U.S. Department of Education ALN # 84.425D, Education Stabilization Fund Under the Coronavirus Aid, Relief, and Economic Security Act Grant # S425D200006, Educational Stabilization Fund Program. Criteria: Federal regulation, 2 CFR 200.328 and 329(a) and (b), requires the non-Federal entity report financial and performance information as required by the terms and conditions of the Federal award. Assertion L, Annual Reporting of the compliance supplement for Elementary and Secondary School Emergency Relief (ESSER) funds lays out the required reporting elements as: ? Overall ESSER I and ESSER II Fund Grant for state education agency (SEA); ? SEA Reserve (up to 10 percent of total allocation); ? Mandatory Subgrants to local educational agencies (LEAs), Section 18003(c) of the Coronavirus Aid, Relief, and Economic Security (CARES) Act and Section 313(c) of the Coronavirus Response and Relief Supplemental Appropriations (CRRSA) Act (at least 90 percent of the ESSER Fund grant); ? Student Participation and Engagement; and ? Full-Time Equivalent (FTE)Positions Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction?s (OPI) internal controls were ineffective in detecting and preventing noncompliance for fiscal year 2021, when the report ESSER annual report was submitted. Questioned Costs: None. Context: The Federal Department of Education required annual reporting of the use of ESSER expenses starting in fiscal year 2021. OPI gathered most of the information in the report by surveying LEAs. They used their grant tracking system for information on total expenditures. OPI submitted the ESSER report twice, and we found the following errors in the required elements in the updated ESSER report: ? OPI reported overall dollar amounts of ESSER I and ESSER II funds granted to OPI and reserves (up to 10 percent of total allocation), but they did not include how the ?reserve? was awarded or expended as required. ? Amounts subgranted to LEAs were inaccurate. At least $1.5 million in subgrants were unreported. ? ESSER I expenditures are not consistent in the report. The total expenditures disbursed to LEAs is $2.7 million through September 3, 2020, but the detail of how the expenditures were spent as reported by LEAs total $5.8 million. The dollar amounts should match. ? FTE positions were inaccurately reported (there were 48 LEAs with no reported FTE). Effect: Because of the number of errors found, we determined OPI?s internal controls were ineffective in detecting and preventing noncompliance for fiscal year 2021, when the report was submitted. Cause: According to OPI personnel, OPI had difficulties reporting ESSER information accurately, because the required data elements were unclear or changed several times right up to the reporting deadline. Due to the fluid requirements, it was difficult for OPI to obtain information from the school districts. OPI surveyed school districts to obtain some information, but some schools reported inaccurate information. We agree that the changes in requirements made reporting difficult, but OPI should consider using their grants or accounting systems when possible going forward. Recommendation: We recommend the Office of Public Instruction: A. Enhance internal controls to ensure ESSER annual reports are accurate and supported. B. Correct and resubmit the ESSER annual report. C. Ensure ESSER annual reports include all required data elements and those elements are fully supported as required by federal regulations. Views of Responsible Officials: OPI concurs with this recommendation. For additional information regarding OPI?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-038: U.S. Department of Education ALN # 84.425D, Education Stabilization Fund Under the Coronavirus Aid, Relief, and Economic Security Act Grant # S425D200006 ALN # 84.010, Title I Grants to Local Educational Agencies Grant # S010A200026 Criteria: Federal regulation, 2 CFR 170 Appendix A(I)(a)(2)(ii), requires the subaward to be reported no later than the end of the month following the month in which the obligation was made. Federal regulation, 2 CFR 170.220(b), requires any subaward equal to or exceeding $30,000 to be reported. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (OPI) had no internal controls to ensure compliance with the Federal Funding Accountability and Transparency Act (FFATA) reporting requirements for Elementary and Secondary School Emergency Relief (ESSER) I and Title I subawards. Questioned Costs: None. Context: Through nonstatistical sampling, we tested five ESSER subawards and five Title I subawards for the June 30, 2021, FFATA reporting, and all ESSER subawards were inaccurate because OPI reported the amount expended, not the amount awarded. We did not find errors for Title I reporting. We found the following compliance issues with the FFATA reporting for ESSER: ? OPI reported expenditures spent at the local educational agency (LEA) level instead of on the amount of the subaward during fiscal year 2020 and 2021, causing the report to be inaccurate for most subawards. ? Some subawards were not reported as required, because their expenses had not reached the reporting threshold but their subaward amount was large enough to be reported. We communicated this issue during the design of our audit, and OPI revised the FFATA reports, but the revisions did not occur during our audit period. The required FFATA summary information is included below. See Schedule of Findings and Questioned Costs for chart/table. Effect: Staff misinterpreting of FFATA reporting requirements resulted in OPI?s inability to detect and prevent noncompliance for ESSER I. While we did not find errors for Title I FFATA reporting, errors can occur without a secondary review. Cause: The general OPI expectation requires a secondary review of all reports, but this requirement was not part of the FFATA desk manual, so it did not occur. Recommendation: We recommend the Office of Public Instruction: A. Establish internal controls to ensure Federal Funding Accountability and Transparency Act (FFATA) reports are submitted, supported and timely. B. Review the ESSER I FFATA reports previously submitted and ensure all subawards over $30,000 have been reported using the subaward amount. C. Comply with reporting requirements for the FFATA. Views of Responsible Officials: OPI concurs with this recommendation. For additional information regarding OPI?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-039: U.S. Department of Agriculture ALN # 10.553, 10.555, 10.556, 10.559, Child Nutrition Cluster Grant # 193MT306N1099, 203MT306N1099, 213MT306N1099, 213MT306N1199 Criteria: Federal regulation, 7 CFR 250.12(b), requires the Office of Public Instruction (OPI) to, on an annual basis, conduct a physical review of donated food inventories at all storage facilities used by the distributing agency (or by a subrecipient distributing agency), and must reconcile physical and book inventories of donated foods. The distributing agency must report donated food losses to Food and Nutrition Service (FNS) and ensure that restitution is made for such losses. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: OPI personnel stated they did not complete a physical inventory in fiscal year 2020. In fiscal year 2021, OPI completed a physical inventory and a reconciliation between the physical count and OPI?s food tracking system. However, OPI?s reconciliation documentation was inaccurate. We noted two discrepancies OPI did not identify, and OPI documented a difference that did not exist when we compared OPI?s records to the count. The differences we noted above indicate controls are not adequate over the inventory process and OPI has not complied with inventory requirements in fiscal years 2020 and 2021. Questioned Costs: None. Context: We noted a 540-item difference in the peanut butter count vs. OPI?s tracking system and another small difference. There were no differences when we compared OPI?s tracking system to the warehouse?s documentation, indicating OPI?s physical count was likely incorrect and the food was not missing. If they completed a reconciliation to OPI records, we would expect them to notice the differences and follow up to determine if the count was inaccurate. Our audit tests did not include sampling procedures. As part of our consideration of the cause of the control issues, we noted the staff member in charge of ordering inventory is also responsible for entering the inventory in the Montana Agreement and Payment System (MAPS) and taking the physical inventory count at fiscal year-end. We generally expect controls to involve more than one person because someone doing the entire process puts them in a position where errors or irregularities may not be detected. Updated control procedures need to address this segregation of duties issue. Effect: The differences we identified indicate either missing food, inaccurate inventory, or inaccurate OPI records in fiscal year 2021. We could not determine if there were similar differences in fiscal year 2020 because OPI records were not available compared to warehouse records. As explained above, the most likely issue is inaccurate inventory counts. Cause: OPI personnel stated they did not complete a physical inventory in fiscal year 2020 because of the COVID-19 pandemic, but noted the Montana Department of Public Health and Human Services warehouse personnel did complete an inventory. OPI received an email from the federal government saying another state agency can complete inventory during the pandemic but encouraged OPI to participate via video. OPI did not participate via video, and no documentation of the inventory count reconciliation to OPI records was maintained. Without a reconciliation, no assurance is provided over the completeness and accuracy of OPI records. Recommendation: We recommend the Office of Public Instruction: A. Establish internal control procedures, including segregating duties, to ensure an annual physical inventory is completed, and the inventory is reconciled to office and warehouse records. B. Comply with federal regulations to complete and document a physical inventory and reconciliation to records for donated foods for the Child Nutrition Cluster. Views of Responsible Officials: OPI concurs with this recommendation. For additional information regarding OPI?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-040: U.S. Department of Agriculture ALN # 10.553, 10.555, 10.556, 10.559, Child Nutrition Cluster Grant # 193MT306N1099, 203MT306N1099, 213MT306N1099, 213MT306N1199 Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Controls over testing the information system used to calculate payments for the Child Nutrition program are not adequate. Questioned Costs: None. Context: We asked the Office of Public Instruction (OPI) about internal controls to test the Montana Agreement and Payment System?s (MAPS) calculation of the Child Nutrition payments. Staff reported completing testing regularly, but testing is not always documented. The contractor that maintains MAPS received a System and Organization Controls (SOC) 2 report, but OPI did not obtain and review the report until our inquiry. Effect: Without assurance over the system via an outside audit of the system or internal testing of the system, MAPS can have issues OPI is not aware of, leading to incorrect payments and unallowable federal costs. OPI is responsible for calculating the applicable meals times rates formula and sending the correct payments to subrecipients. Cause: OPI was not aware they should be requesting and reviewing SOC reports, and they believe the system does not need to be tested unless there are changes to the system. We believe regular system testing is important because the contractor could make changes to the system OPI is not aware of. In addition, staff indicated testing the updated rates was likely a regular part of OPI?s process. Still, they did not consider it necessary to document their testing unless there was a major change to the system. Recommendation: We recommend the Office of Public Instruction document internal control procedures over the Montana Agreement and Payment System?s calculation of Child Nutrition payments to schools to ensure payments recorded in the state?s accounting records and sent to subrecipients are correctly calculated. Views of Responsible Officials: OPI concurs with this recommendation. For additional information regarding OPI?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-041: U.S. Department of Education ALN # 84.027 and 84.173, Special Education Cluster (IDEA) Grant # H027A200096, H173A200099, H027A190096, H173A19009 Criteria: Federal regulation, 2 CFR 200.303, requires the non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Office of Public Instruction (OPI) policies require reviewing allocation increases/decreases greater than 10% as well as written approval via e-mail and a copy of the signed allocation spreadsheet. Federal regulation, 34 CFR 300.163, says the State must not reduce the amount of State financial support for special education and related services for children with disabilities below the amount of support for the preceding year. Federal regulation, 2 CFR 200.1, defines period of performance as the total estimated time between the start of an initial Federal award and the planned end date. Condition: OPI should strengthen internal controls related to IDEA allocations, state maintenance of effort, and period of performance. Questioned Costs: None Context: Most of the money spent on the IDEA program is subgranted to Local Education Agencies (LEAs). Therefore, OPI is responsible for calculating and distributing the correct funding to each school. OPI uses an allocation spreadsheet for both the general Grants to States, IDEA Part B grant, and the preschool grant every fiscal year. We reviewed the four spreadsheets for fiscal years 2020 and 2021. OPI did not always follow their own distribution policies during the audit period: ? Review of differences between years greater than 10 percent by LEA and following up on unexpected differences did not occur in fiscal year 2020 and 2021. ? Approval by a secondary reviewer of the allocations was not documented in fiscal year 2021. OPI did not have a control in place to ensure the maintenance of effort requirement was met. OPI has a spreadsheet it uses to ensure the amount appropriated is sufficient, but they do not compare actual money spent by the state on special education to money spent the previous year. OPI uses a reconciliation process comparing the state?s accounting system to the OPI?s grant system to track the period of performance. We completed a sample of the 24 monthly reconciliations and found two instances out of five tested where numbers on the reconciliations were not supported. This was not a statistically valid sample. We completed additional testing and did not identify any instances of spending outside the allowed time period. Effect: We found no allocation errors, but errors can occur when internal controls aren?t followed. Also, noncompliance with federal activities allowed, allowable costs, maintenance of effort, and period of performance requirements could occur if controls are not in place and working as intended. Cause: OPI staff stated the control issues were a result of staffing changes, lack of documentation, allocations being finalized amid COVID, and not having staff cross-trained to fill in for a staff member on leave. Having a plan on who can cover important controls prior to turnover or emergencies can help prevent this situation from occurring. Recommendation: We recommend the Office of Public Instruction: A. Follow OPI policy related to allocation of grant funds, B. Improve controls over period of performance by including cross training for monthly reconciliations, and C. Improve controls related to state maintenance of effort by reviewing actual state expenditures to ensure compliance with federal regulations. Views of Responsible Officials: OPI concurs with this recommendation. For additional information regarding OPI?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-042: U.S. Department of Education ALN # 84.425D, Education Stabilization Fund Under the Coronavirus Aid, Relief, and Economic Security Act Grant # S425D200006 and S425D210006 U.S. Department of Agriculture ALN # 10.553, 10.555, 10.556, 10.559, Child Nutrition Cluster Grant # 203MT306N1099 and 213MT306N1099 Criteria: Federal regulation, 2 CFR 200.305, requires states follow the treasury state agreement (TSA). The TSA is governed by federal regulation, 31 CFR 205, which requires states use the reimbursement basis. The Child Nutrition TSA requirement is to ?request funds weekly on Wednesday, or as reasonable to address negative cash needs. . . the amount of the request shall be based on the amount of actual program costs incurred during the prior week, Wednesday through Thursday.? Per the Educational Stabilization Compliance Supplement 2021, ESSER requires limiting draw to as close as administratively feasible to a state?s actual cash outlay for direct program costs and proportionate share of any allowable indirect costs. Federal regulation, 2 CFR 200.303, requires the non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Internal controls were ineffective for ensuring the Office of Public Instruction (OPI) did not have excess cash for the Child Nutrition Cluster and ESSER programs. Questioned Costs: None. Context: We completed a sample of draws for the Child Nutrition and ESSER programs. One of 17 Child Nutrition Cluster and one of seven ESSER cash draws tested did not have expenditures supporting revenues drawn. There were 24 total months for both of these samples, and the sample was not statistically valid. The Child Nutrition Cluster error was a typo where the expenditures amount was $317 but $31,700 was requested. The error was corrected in the next draw. The other mistake (for ESSER) was drawing for the same $1.7 million expenditure twice. OPI noted the error at fiscal year-end and reversed the revenue but did not fix the cash draw. There were not ESSER expenses to support the cash on hand for over a month. Effect: Per federal regulation, OPI could owe interest on excess cash. With the current interest rates, this is likely immaterial, but larger errors could occur in the future if the control deficiency is not corrected. Cause: The overdraws were due to human error. All cash draws were reviewed by a second person, so OPI?s controls should have caught these errors before requesting reimbursement from the federal program. The cash draw process at OPI is complex, because there are many federal programs. Management should consider adding cash management controls to their monitoring process in order to determine a way to improve the current control process, so human error is less likely to occur. Recommendation: We recommend the Office of Public Instruction: A. Enhance cash management internal controls and monitor their effectiveness to ensure OPI only requests federal cash for incurred expenditures. B. Comply with cash management requirements. Views of Responsible Officials: OPI does not concur with this recommendation. While management acknowledges there were instances during the audit period where cash was ordered in excess of expenditures and the secondary reviewer did not identify the error, they believe compensating controls did identify the excess cash resulting in correcting journals for the excess funds. For additional information regarding OPI?s planned corrective action, see the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We considered OPI?s nonconcurrence with the recommendation. The correcting entry for ESSER processed by OPI did not mitigate its noncompliance with cash management requirements, because the entry did not affect cash. As noted in the finding, there were not ESSER expenses to support the cash on hand for over a month. In addition, if internal controls are not working as intended, further noncompliance can occur. As such, our recommendation stands.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-043: U.S. Department of Education ALN # 84.010, Title I Grants to Local Educational Agencies Grant # S010A190026-19A, S010A200026-20A Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Section 1003 (b) of the Elementary and Secondary Education Act (ESEA) requires the Office of Public Instruction (OPI) to earmark seven percent of the Title I amount granted to Montana to serve schools implementing comprehensive support and improvement activities or targeted support and improvement activities. Not less than 95 percent of the earmarked funds must be spent on the schools identified. Condition: OPI does not have controls in place to ensure compliance with Title I earmarking requirements. Questioned Costs: We question $40,692 charged to the Title I program. Since we only reviewed a portion of the costs, more questioned costs may exist. Additional questioned costs may also exist in salary charges. Context: The total Title I award to OPI was $50 million. The amount of Title I funding earmarked for school improvement activities in fiscal years 2020 and 2021 was approximately $3.5 million. Schools identified for improvement can give OPI permission to spend the money on serving them, otherwise, OPI would have to send 95 percent of the earmarked funds directly to the schools identified for improvement. OPI budgets 40 percent of the $3.5 million to OPI activities, and 60 percent as grants to schools. OPI spent $729,496 in fiscal year 2020 and $925,453 in fiscal year 2021. We reviewed OPI salary charges to the Title I grant but OPI did not track whose time was administrative costs and whose time benefited identified schools. Therefore, we could not confirm administration costs did not exceed the approximately $175,000 cap, because the 40 percent budgeted to OPI activities included both admin and school improvement activities in one accounting code. In addition, we tested 17 non-personnel services Title I expenditure transactions and determined eight, totaling $40,692 were unsupported. Unsupported costs included costs charged to supporting all schools in Montana instead of those schools identified for improvement, costs with unclear documentation, or costs for overall Title I administration charged to school improvement activities. This was not a statistically valid sample. Effect: Without proper controls, OPI is at risk of spending money allocated for school improvement on administration. Cause: OPI does not monitor the amounts they spend on administration as compared to school improvement activities, so cannot demonstrate compliance with federal earmarking regulations. Recommendation: We recommend the Office of Public Instruction: A. Develop internal controls to ensure earmarked funds are spent on allowable activities and improve documentation to support cost allowability. B. Comply with Title I earmarking requirements. Views of Responsible Officials: OPI concurs with this recommendation. For additional information regarding OPI?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-044: U.S. Department of Education ALN # 84.010, Title I Grants to Local Educational Agencies Grant # S010A190026-19A, S010A200026-20A Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Elementary and Secondary Education Act (ESEA), Section 8101 (25) B requires local education agencies (LEAs) to obtain documentation to confirm that a student has transferred out, emigrated to another country, or transferred to a prison or juvenile facility, or is deceased in order to remove a student from a cohort. Condition: The Office of Public Instruction (OPI) requires each LEA to certify the number of graduates and dropouts by the LEA. However, OPI?s certification policy does not include the federal requirement that LEAs maintain documentation to confirm the appropriate removal of a student from the cohort. In addition, OPI does not have a procedure to monitor LEAs compliance with retaining this documentation. Questioned Costs: None. Context: Federal guidance allows the state?s data system to be official documentation when a student transfers schools within the state. We agree, but OPI must communicate to schools when they can use the state?s system as documentation and when they cannot. For example, the guidance cited by OPI would not apply if the student transferred out of state, moved to home school or a juvenile corrections facility, or died. OPI also does not monitor LEAs? compliance with retaining appropriate documentation for removing students from the cohort. Effect: Without the required policies and procedures, OPI is not compliant with federal regulations related to the Title I program. If LEAs do not know the requirements for removing a student from a cohort, they may provide OPI with an inaccurate graduation rate, which makes the state?s overall graduation rate inaccurate. Cause: As we worked with staff to understand their policies and procedures related to this Title I requirement, there was confusion about who was responsible for this federal regulation. Staff noted districts remove students from the cohort, not OPI. Recommendation: We recommend the Office of Public Instruction: A. Develop internal controls that address LEAs responsibilities for documenting the removal of a student from the adjusted cohort, and B. Monitor the LEA?s adherence to the federal requirements. Views of Responsible Officials: OPI concurs with this recommendation. For additional information regarding OPI?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-045: U.S. Department of Agriculture ALN # 10.551 and 10.561, SNAP Cluster Grant # 202020S251443, 202121S251443 U.S. Department of Health and Human Services ALN # 93.558 Temporary Assistance for Needy Families (TANF) Grant # 1901MTTANF, 2001MTTANF, 2101MTTANF Criteria: Federal regulation, 7 CFR 274.1(i)(2), requires a yearly examination of the State electronic benefit transfer (EBT) service provider for the SNAP Cluster. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Public Health and Human Services (department) obtained an examination by an independent auditor of the EBT service provider. The report only covered three months of the two-year audit period, which is not sufficient for the department to demonstrate adequate internal control or compliance with certain SNAP and TANF program requirements. Questioned Costs: None. Repeat Finding: Montana?s Single Audit for the two fiscal years ended June 30, 2019, included a recommendation (#2019-008) to obtain an annual SOC-1 Type 2 report over the EBT service provider for SNAP and establish and maintain internal controls to ensure SNAP and TANF benefit transactions achieve applicable compliance requirements. Context: The department uses an EBT provider for its SNAP federal program. The EBT service provider is responsible for settlement, or payment, to retailers that have agreed to accept EBT cards for food purchases. The same EBT service provider is involved in delivery of benefits for the TANF program. The following table depicts benefit distributions processed by the EBT service provider: See Schedule of Findings and Questioned Costs for chart/table. Effect: Without assurance over the operating effectiveness and appropriate design and operation of controls at the service organization, the department cannot demonstrate adequate internal control over EBT payments for the audit period. Because the examination does not cover the entire period, the department did not comply with federal SNAP requirements. Cause: Historically, as noted by our prior audit, the department did not obtain a SOC-1 Type 2 report for the EBT service provider. On January 21, 2020, the department instructed the EBT service provider to provide a SOC-1 Type 2 report. While the report for July 1, 2020 through September 30, 2020 was completed as quickly as possible, it does not provide any assurance over processing for fiscal year 2020 and provides limited assurances over fiscal year 2021 activity. Recommendation: We recommend the Department of Public Health and Human Services: A. Establish and maintain internal controls to receive and review assurances over the EBT service provider for the Supplemental Nutrition Services Program and Temporary Assistance for Needy Families program. B. Comply with federal regulations for the Supplemental Nutrition Services Program by requiring a yearly examination of EBT service provider transaction processing regarding the issuance, redemption, and settlement of program benefits and review the results. Views of Responsible Officials: Based on the department?s inability to fully comply with the prior audit recommendation due to timing of when the issue was identified by our prior audit, the department conditionally concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-046: U.S. Department of Health and Human Services ALN # 93.775, 93.777, and 93.778, Medicaid Cluster Grant # 1805MT5MAP, 1905MT5MAP, 2005MT5MAP, 2105MT5MAP ALN # 93.767, Children?s Health Insurance Program (CHIP) Grant # 1905MT5021, 2005MT5021, 2105MT5021 Criteria: Federal regulations, 42 CFR 435.914(a) and 42 CFR 457.965, require the Department of Public Health and Human Services (department) to include facts to support its eligibility decision in each applicant?s case record for Medicaid and CHIP, respectively. Federal regulations, 42 CFR 435.603, 42 CFR 457.310 and 457.315, require the use of multiple criteria, including household income, when determining eligibility for Medicaid and CHIP. As described in the department?s verification plan, if inconsistencies are noted between self-attested information and electronic data sources, follow up is necessary in certain situations. For income discrepancies, if self-attested income is below the applicable income standard and the electronic data source indicates income is above the applicable income standard, and the difference between the two is greater than 10 percent, the state is required to request documentation to resolve the discrepancy. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department administers the Medicaid and CHIP programs to provide medical coverage to eligible individuals. Department personnel enter the necessary data for eligibility determinations into an individual?s case file in the department?s eligibility system, the Combined Healthcare Information and Montana Eligibility System (CHIMES). This data is used to determine the client?s eligibility for the department?s various eligibility categories based on factors including age, household composition, residency, and income. The department?s verification plan details how and when each piece of eligibility criteria needs to be verified. CHIMES interfaces with various electronic data sources to verify information. CHIMES flags discrepancies between the interfaces and self-attested information, and the state?s verification plan requires follow-up on the discrepancies. As part of our testing, we identified instances where the department did not consistently verify eligibility factors per the state?s verification plan, fully document and support eligibility decisions in case files, or place individuals in the correct eligibility categories. We determined the department?s internal controls were insufficient to comply with federal regulations for both the Medicaid and CHIP programs. In addition, we also identified instances where eligibility related processes were inconsistently applied across applications. Questioned Costs: Known questioned costs for the cases in which the eligibility determination or eligibility category was incorrect totaled $34,517 and $10,019 for Medicaid and CHIP, respectively. Known questioned costs for the case where the individual was not eligible for any CHIP or Medicaid eligibility category totaled $1,483 in federal CHIP funds. Overall, federal questioned costs for the full population of both Medicaid and CHIP programs are likely to exceed the known costs discussed above. For all issues identified in both programs, known or likely questioned costs exceed the $25,000 threshold for federal reporting. Context: Eligibility Issues: We performed a sample of Medicaid and CHIP eligibility determinations for individuals for fiscal years 2020 and 2021, which consisted of control and compliance testing. The total population of Medicaid and CHIP cases for the audit period totaled 472,447. For control testing, the populations for Medicaid and CHIP were combined. We selected a sample of 64 to test internal controls (48 Medicaid and 16 CHIP). For compliance testing, the Medicaid and CHIP programs were separately analyzed, so 60 sample items were selected from each Medicaid and CHIP for 120 total sample items. This was not a statistically valid sample. From the sample, we identified 19 cases with control issues, compliance issues, or both. The types of issues we identified in our testing are described below followed by tables summarizing the issues by case. ? Instances where eligibility information was not verified or discrepancies were not followed up on timely as required by the verification plan. ? Income used in eligibility determinations was not fully supported in the case file. Evidence in the case file was not sufficient to support the income used in the eligibility determination. As a result, we could not verify whether the income was correct. ? Income used in determining eligibility was incorrect per support in the case file. ? Residency and/or household composition is not supported in the case file. ? Eligibility criteria used in the determination was incorrect, but the eligibility category was correct. ? Eligibility criteria used in the determination was incorrect and as a result, the eligibility category was incorrect. ? The case file was fully supported, but the department?s eligibility determination was incorrect. ? The case file was not fully supported and as a result the department?s eligibility determination was incorrect. See Schedule of Findings and Questioned Costs for chart/table. See Schedule of Findings and Questioned Costs for chart/table. Based on the issues identified above, there were ten cases (three Medicaid and seven CHIP) in which the eligibility determination or eligibility category was incorrect. In some cases, while the individual was placed in the wrong category, both categories were in the same federal program, so there are no related questioned costs. There were two cases identified where the individuals were eligible but placed into a category in the wrong federal program, resulting in the application of the wrong federal match percentage. There was one CHIP case identified where the individual was not eligible for any CHIP or Medicaid eligibility category. Inconsistencies: We identified the following types of inconsistences: ? Income o Income support can be provided by applications in a weekly or biweekly form, this income is then multiplied by a factor to estimate monthly income per the department?s manual. While the department manual discusses the need to factor income, it does not specify how this should be done. We noted several instances where different factors were used to determine monthly income. For example, when projecting biweekly pay period incomes for a month, some calculations used a factor of 2.0 and others used 2.15. o In some cases, applicants provide multiple pay stubs to support their income. The department?s manual is not clear in how many pay stubs should be used. We identified calculations in which the case workers used all provided pay stubs in determining income, while others used only the most recent pay stub. o Reported overtime or weekend wages were not treated consistently. In comes cases, the amounts were included with normal wages, while in others they were considered separately. ? Transitional coverage o In certain situations, the department may provide transitional coverage to parents and children for up to six months following an Affordable Care Act Medicaid case closure. We identified instances involving similar circumstances where the application of transitional coverage for children in CHIP categories was used differently. For example, in one case while the adult moved to transitional coverage, the children were reauthorized in a CHIP category. In a similar case, the entire household was moved to transitional coverage even though the children were still eligible for a CHIP category. Repeat Finding: Montana?s Single audit for the two fiscal years ended June 30, 2019, included a recommendation (#2019-001) to the department to establish and maintain internal controls to timely verify client eligibility factors and comply with federal regulations and state plan requirements by placing only eligible clients into correct eligibility categories. Effect: The department is not in compliance with federal requirements and is at risk of not making uniform eligibility decisions and potentially placing individuals in wrong eligibility categories without consistent application of the eligibility determination process. For the inconsistencies noted, we did not identify errors in eligibility determinations. However, cases with income close to a category income threshold could result in income calculations that result in different eligibility determinations. Cause: We discussed each of the case files, and the results of our testing with the department during the audit. Based on those discussions, the department agrees there are issues with 11 of the cases summarized above. For these cases, our audit procedures and conversations with department personnel indicate the errors resulted from human error in the determination process. For the other cases, including those where we determined verification did not occur or case files did not contain appropriate support, the department does not agree. In some cases, the department was able to find support or explain why an eligibility decision was made. While we considered this additional information, if the information was not sufficiently documented or supported in the case at the time of determination, we concluded the case file was not supported. For the inconsistencies noted, the department believes the specific facts of individual cases explain different treatments between cases and different treatments would not cause errors in eligibility determinations. Recommendation: We recommend the Department of Public Health and Human Services revise its policies and procedures for Medicaid and Children?s Health Insurance Program and provide training to case workers to: A. Ensure eligibility elements and decisions are documented and supported by the case file. B. Follow up on differences and make changes to case files as required by the department?s verification plan. C. Comply with federal regulations and state plan requirements by placing only eligible clients into correct eligibility categories. D. Improve guidance to ensure consistent calculation of the household income used to determine eligibility. E. Consistently apply the transitional period for children enrolled in the Children?s Health Insurance Program. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-047: U.S. Department of Health and Human Services ALN # 93.775, 93.777, and 93.778, Medicaid Cluster Grant # 1805MT5MAP, 1905MT5MAP, 2005MT5MAP, 2105MT5MAP ALN # 93.767, Children?s Health Insurance Program (CHIP) Grant # 1905MT5021, 2005MT5021, 2105MT5021 Criteria: Federal regulation, 42 CFR 435.914(a), requires the Department of Public Health and Human Services (department) to include facts to support its eligibility decision in each applicant?s case record for Medicaid and CHIP. Federal regulation, 42 CFR 435.916(a)(1), states the eligibility of Medicaid beneficiaries whose financial eligibility is determined using MAGI-based income must be renewed once every 12 months, and no more frequently than once every 12 months. Federal regulation, 42 CFR 457.343, requires the department to apply the renewal procedures described in 42 CFR 435.916 in administering a separate CHIP. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department?s eligibility redetermination processes for Medicaid and CHIP can be improved. While we did not identify any timeliness issues related to redeterminations during the audit period, we did identify some overall system issues with the eligibility redetermination process. Questioned Costs: None. Context: The department administers the Medicaid and CHIP programs to provide medical coverage to eligible individuals. Once individuals are enrolled, they have a 12-month continuous eligibility period, a renewal process is completed at the end of the period, and eligibility is redetermined. For eligibility categories under the Affordable Care Act (ACA), the redetermination is an automated process within the department?s eligibility system, the Combined Healthcare Information and Montana Eligibility System (CHIMES). During the COVID-19 public health emergency, the department suspended the renewal process under multiple waivers. As part of reviewing eligibility determinations, we evaluated whether required eligibility renewals and redeterminations occurred during the audit period. We considered the effects of the changes in process under the COVID-19 public health emergency in evaluating whether redeterminations were done timely. Overall system issues with the eligibility redetermination process are discussed in more detail below: ? For the automatic renewal process in CHIMES, we identified instances where the eligibility redetermination did not include all income types. Overall, the CHIMES renewal process includes data matches for state wage information and unemployment benefits but does not consider other income types including self-employment income or unearned income, such as pension or rental income. We also identified instances where only the individual?s income was used in redetermination instead of the household?s income, which should be used for eligibility determinations. The department represented this issue has since been fixed in the CHIMES system. ? For automatic renewals, we identified instances where the system indicated the automatic renewal failed or there were incompatibilities identified with electronic data matches, yet the case was renewed without explanation or documentation in the case file. ? The manual renewal process allows renewals to be completed without the system recalculating eligibility based on updated income unless a case worker manually selects the option to recalculate in the system. The income information is pulled forward from previous eligibility determinations in this situation. Effect: For automatic renewals, the design of the renewal process in CHIMES creates a risk that the incorrect income amount is used in determining eligibility at renewal. Without proper documentation of decisions made during the renewal process, the department is at risk of noncompliance with federal regulations requiring case files to include facts to support eligibility determinations. For manual renewals, there is a risk income will not be recalculated as part of the renewal process, resulting in incorrect eligibility determinations. Cause: The department agrees with the manual renewal income recalculation issue. They represented they will implement improvements to the renewal process, ensuring recalculation of income does not rely on case workers selection in CHIMES. While the department does not agree with the auto renewal issues resulting in errors in eligibility determinations, they made some changes to the renewal process in CHIMES and indicated more improvements will be made following the public health emergency. Recommendation: We recommend the Department of Public Health and Human Services enhance internal controls for Medicaid and Children?s Health Insurance Program to ensure annual redeterminations are completed accurately using up-to-date information and cases are fully supported as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-048: U.S. Department of Health and Human Services ALN # 93.767, Children?s Health Insurance Program (CHIP) Grant # 1905MT5021, 2005MT5021, 2105MT5021 Criteria: Federal regulation, 42 CFR 457.320(a)(2), sets the age limit for CHIP eligibility at up to age 19. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Public Health and Human Services (department) administers CHIP to provide medical coverage to eligible children under the age of 19. Our testing determined the department does not consistently ensure individuals are removed from CHIP once they turn 19 and age out of the program. Questioned Costs: None. Context: From our sample of 60 individuals enrolled in CHIP, we identified two instances where individuals aged out, but they were not properly removed from the program when they turned 19. For these instances, the individuals aged out in 2017, but remained in the CHIP program during the audit period. This sample was not statistically valid. Additionally, through our testing, we identified four additional individuals who aged out of the program during the COVID-19 public health emergency. These individuals were enrolled in Healthy Montana Kids (HMK) Plus Expansion, which is a CHIP-funded category that receives Medicaid Benefits coverage. During the public health emergency, the department accepted an enhanced federal match for benefits payments. In order to receive the enhanced federal match, the federal government prohibited removing Medicaid coverage from individuals who had coverage at the start of the public health emergency. Since these cases were receiving Medicaid coverage, the department was prohibited from removing the individuals from the program. Under the public health emergency requirements, the department could evaluate aged out individuals for a Medicaid program and transition them to continue coverage, but they were not required to transition individuals. Since the end of the audit period, the department has completed some administrative reviews of specific cases and moved eligible individuals to adult Medicaid programs. As a result of the public health emergency requirements, we did not take issue with these four cases. Effect: The department is not in compliance with federal regulations for CHIP. Department personnel represented the benefits claims processing system for CHIP also has additional controls in place to ensure claims are not paid under these eligibility categories if the individual is aged out. We confirmed there were no benefits paid out for these two cases during the audit period. However, for one case, claims were paid for the individual prior to the audit period, but after the individual aged out. Cause: The department?s eligibility system, the Combined Healthcare Information and Montana Eligibility System (CHIMES), is designed to auto-close CHIP cases at the end of the month the individual turns 19. The system creates a task for a case worker to complete a review to determine if the individual is eligible for Medicaid programs. However, if the case has another open task in CHIMES, the auto-close process cannot be completed. In these situations, a separate task is created for a case worker to manually close the case. For the two cases identified, the department acknowledges CHIMES had open tasks requiring a manual closeout. Per department personnel, the department had a significant backlog of case tasks to complete, so the close outs did not happen timely. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to ensure compliance with federal regulations related to individuals who have aged out of Children?s Health Insurance Program funded program. B. Comply with federal regulations by removing individuals from Children?s Health Insurance Program funded programs who have turned 19. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-049: U.S. Department of Health and Human Services ALN # 93.775, 93.777, and 93.778, Medicaid Cluster Grant # 1805MT5MAP, 1905MT5MAP, 2005MT5MAP, 2105MT5MAP Criteria: NCCI Technical Guidance Manual paragraphs 7.1.2 and 7.1.3 states the department may share quarterly Medicaid NCCI edit file with any entity assisting with implementation of the state?s Medicaid NCCI program in processing of claims, only when appropriate confidentiality agreements are in place. The manual requires, at a minimum, that certain elements are included in the confidentiality agreements. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Public Health and Human Services (department) does not have confidentiality agreements with contracted parties prior to sharing Medicaid National Correct Coding Initiative (NCCI) edit files as required by the NCCI Technical Guidance Manual. Questioned Costs: None. Context: The department is required to incorporate NCCI methodologies into the state Medicaid program. The NCCI methodologies are a set of claim edits created by the federal government to promote correct coding, prevent coding errors, and reduce improper payments related to Medicaid claims. The state contracts with an entity to perform claims processing for the Medicaid program. This contractor has a subcontractor responsible for implementing a portion of the NCCI edit check methodologies for the state?s Medicaid claims. The department downloads the quarterly edit files from the federal government through a secure portal. The edit files are then sent directly to the subcontractor for use in implementing the NCCI edits. The requirements established in the NCCI manual apply to all subcontractors with whom the department shares edit files. Since the department shares the confidential edit files with the subcontractor, a confidentiality agreement should be in place. While the department has some confidentiality agreements in place through its contractor, the specific elements required by the manual are not included. Effect: The department is not in compliance with federal requirements. Additionally, without the required confidentiality agreements, there is increased risk edit files may be used inappropriately by entities outside the department. Cause: The department was unaware of the requirement to have a confidentiality agreement. Additionally, the department believes its already existing confidentiality agreement with its contractor was sufficient to cover the NCCI processing. Recommendation: We recommend the Department of Public Health and Human Services A. Enhance internal controls to ensure compliance with Medicaid NCCI confidentiality agreement requirements. B. Obtain a confidentiality agreement with any contracted party and their subcontractors prior to sharing Medicaid NCCI edit files per federal requirements. Views of Responsible Officials: The department conditionally concurs with this recommendation. The department disagrees that without the required confidentiality agreement, there is increased risk the edit files may be used inappropriately as they have general confidentiality provisions in place. However, since the end of the audit, the department has obtained a confidentiality agreement with the Medicaid NCCI subcontractor. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-050: U.S. Department of Health and Human Services ALN # 93.767, Children?s Health Insurance Program (CHIP) Grant # 1905MT5021, 2005MT5021, 2105MT5021 Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Public Health and Human Services (department) does not review the System and Organization Controls (SOC) report for the CHIP claims processing vendor. It is the department?s responsibility to review the SOC report to confirm no additional work is necessary to ensure proper claims processing. Questioned Costs: None. Context: The department contracts with an entity for claims processing for provider payments on CHIP claims. The department obtains a SOC report for the contractor which provides assurance over data processing and internal controls. The SOC reports obtained during the audit period did not identify significant issues over the vendor?s processing of claims. Effect: By not reviewing the SOC report, the department risks being unaware of system issues affecting the services it receives from the claims processor. Additionally, the department is at risk of not implementing all of the necessary compensating user entity controls. Cause: Department staff indicated they do not review the SOC reports for the claims processing vendor as they are not considered part of the standard reporting requirement of its contract with the vendor. However, department staff represented they are very involved with the vendor and receive and review multiple other reports from the vendor that provide assurance as to whether the claims processing system is working properly. Recommendation: We recommend the Department of Public Health and Human Services review the SOC report for the Children?s Health Insurance Program claims processor, and document this review, to ensure there are no issues with the services received from the vendor and to ensure all necessary compensating controls are implemented. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action, see Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-051: U.S. Department of Health and Human Services ALN # 93.658, Foster Care ? Title IV-E Grant # 2107MTFOST, 2007MTFOST, 1907MTFOST Criteria: Federal regulation, 45 CFR 75.352, requires the Department of Public Health and Human Services (department) to ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the required information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes, but is not limited to: ? Subrecipient name and subrecipient?s unique entity identifier, ? Federal award identification number, ? Date the state?s federal award was signed by the federal awarding agency, ? Subaward start and end dates, ? Amount of federal funds obligated to the subrecipient with the current agreement, ? Total amount of federal funds obligated to the subrecipient including the current agreement, ? Applicable indirect cost rates for the federal award, ? Assistance Listings Number (formerly known as Catalog for Federal Domestic Assistance number) and title, ? Federal awarding agency, ? Department name and contact information, ? Federal award project description, as required to be responsive to Federal Funding Accountability and Transparency Act (FFATA), ? Permission for department officials and auditors to have access to the subrecipient?s records, and ? Terms and conditions concerning the closeout of the award. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Subrecipients for the department?s Foster Care program include tribal governments and institutions of higher education. In response to our prior audit recommendations, in the fall of 2019 the department sent memos to tribes disclosing what is required by the federal government, and subsequently signed amended contracts containing what the department believed to be the required subrecipient disclosures. The department also renewed or amended agreements with two institutions of higher education. However, required items were still omitted, and the department?s controls did not detect or correct omissions in subrecipient agreements for the Foster Care program, resulting in noncompliance with federal regulations. Questioned Costs: None. Context: Amended tribal agreements included a list of disclosures, but not all the disclosures were included correctly. We identified inaccuracies or omissions including the federal award date, the name of the federal awarding agency, the assistance listing number, the amount of federal funds obligated by the current agreement, and the cumulative amount of federal funds obligated to the subrecipient. The department executed a new contract with a university in June 2020 and included most contract disclosures. However, the department omitted the federal award identification number, name of the federal awarding agency, and amount made available under the federal award from the university agreement. Additionally, the department omitted nearly all contract disclosures from its September 2020 contract amendment with a college. The original college contract was also missing the disclosures, as reported in our prior audit. While we agree certain specific information may be unavailable at the time of the award, the department can improve the accuracy and content of its subrecipient contract disclosures. Additionally, the department can use subsequent subaward modifications to notify the subrecipient when data elements change. Repeat Finding: In Montana?s Single Audit for the two fiscal years ended June 30, 2015, we recommended (#2015-014) the department properly classify its agreements with the state?s tribal organizations as subrecipients and comply with all federal regulations regarding subrecipients. Because the department had incorrectly classified the tribal organizations as vendors rather than subrecipients, the related agreements with the tribal organizations were missing required subrecipient disclosures. In Montana?s Single Audit for the two fiscal years ended June 30, 2017, we concluded the recommendation was partially implemented and made no further recommendation because the department represented it intended to include the subrecipient language in the next tribal agreements which were due in fiscal year 2018. In Montana?s Single Audit for the two fiscal years ended June 30, 2019, we recommended (#2019-016) the department establish and document internal controls to ensure required subrecipient disclosures are included in Foster Care contract agreements prior to signature and ensure required subrecipient disclosures are included in Foster Care contract agreements, as required by federal regulations. Effect: The department has not complied with federal regulations regarding required subrecipient disclosures. Because contract information is used to complete Federal Funding Accountability and Transparency Act (FFATA) reporting, omitted, incomplete, and inaccurate contract disclosures put the department at risk for inaccurate federal reporting. Additionally, failure to provide subrecipients with the required federal award information increases the risk of subrecipient noncompliance with federal requirements. Cause: Department staff indicated they included vague information in the contract disclosures because certain information was not available at the time of the subaward. Additionally, department staff indicated the Foster Care program is an entitlement program, and as such, the department does not always know the actual grant number from which they will compensate the subrecipient. Recommendation: We recommend the Department of Public Health and Human Services: A. Establish and document internal controls to ensure required subrecipient disclosures are included in Foster Care contract agreements prior to signature. B. Ensure the required subrecipient disclosures are included correctly in Foster Care subrecipient agreements, as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-052: U.S. Department of Health and Human Services ALN # 93.323, Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Grant # NU50CK000500 Criteria: Federal regulation, 45 CFR 75.352(a), requires the Department of Public Health and Human Services (department) to ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the required information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes, but is not limited to: ? Subrecipient name and subrecipient?s unique entity identifier, ? Federal award identification number, ? Date the state?s federal award was signed by the federal awarding agency, ? Subaward start and end dates, ? Amount of federal funds obligated to the subrecipient with the current agreement, ? Total amount of federal funds obligated to the subrecipient including the current agreement, ? Applicable indirect cost rates for the federal award, ? Assistance Listings Number (formerly known as Catalog for Federal Domestic Assistance Number) and title, ? Federal awarding agency, ? Department name and contact information, ? Federal award project description, as required to be responsive to Federal Funding Accountability and Transparency Act (FFATA), ? Permission for department officials and auditors to have access to the subrecipient?s records, and ? Terms and conditions concerning the closeout of the award. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department did not establish internal controls to ensure subrecipient agreements include required disclosures, resulting in omissions in ELC subrecipient agreements. Questioned Costs: None. Context: Before the Coronavirus Aid, Relief, and Economic Security (CARES) Act, the department incurred less than $3 million in federal expenditures annually for the ELC award. When federal funding increased exponentially in response to the COVID-19 public health emergency, the department amended existing subaward agreements with various county governments to better position the state in responding to the pandemic. We conducted a sample of six of the department?s 27 subrecipient agreements for the ELC award and identified missing subrecipient contract disclosures in all six agreements. The sample was not statistically valid. Based on information from department staff, this noncompliance is pervasive to all subrecipient agreements for the ELC award. Effect: The department has not complied with federal regulations regarding required subrecipient disclosures. Additionally, failure to provide subrecipients with the required federal award information increases the risk of subrecipient noncompliance with federal requirements. Cause: Per our review of the department?s county master contract agreement and task order amendment templates, the required contract disclosure prompt is included in the master contract agreement template. However, the templates are not clear as to when the disclosures are required. Additionally, based on discussion with the department, training is needed to ensure program and fiscal staff are aware of subrecipient contract disclosure requirements. Recommendation: We recommend the Department of Public Health and Human Services: A. Provide training to staff regarding federal requirements for agreements with subrecipients. B. Establish and document internal controls to ensure required subrecipient disclosures are included in Epidemiology and Laboratory Capacity for Infectious Diseases subrecipient agreements prior to signature. C. Ensure the required subrecipient disclosures are included correctly in Epidemiology and Laboratory Capacity for Infectious Diseases subrecipient agreements and contract amendments, as required by federal regulations. D. Modify its Master Agreement and Task Order Contract Amendment templates for county government agreements to make it clear the federal contract disclosures are required for Epidemiology and Laboratory Capacity for Infectious Diseases subrecipient agreements. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-053: U.S. Department of Health and Human Services ALN # 93.558, Temporary Assistance for Needy Families (TANF) Grant # 19001MTTANF, 2001MTTANF, 2101MTTANF Criteria: Federal regulation, 45 CFR 75.352(a), requires the Department of Public Health and Human Services (department) to ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the required information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes, but is not limited to: ? Subrecipient name and subrecipient?s unique entity identifier, ? Federal award identification number, ? Date the state?s federal award was signed by the federal awarding agency, ? Subaward start and end dates, ? Amount of federal funds obligated to the subrecipient with the current agreement, ? Total amount of federal funds obligated to the subrecipient including the current agreement, ? Applicable indirect cost rates for the federal award, ? Assistance Listings Number (formerly known as Catalog for Federal Domestic Assistance number) and title, ? Federal awarding agency, ? Department name and contact information, ? Federal award project description, as required to be responsive to Federal Funding Accountability and Transparency Act (FFATA), ? Permission for department officials and auditors to have access to the subrecipient?s records, and ? Terms and conditions concerning the closeout of the award. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Department controls did not prevent or detect and correct the missing required subaward disclosures for the 24 subaward agreements for the TANF program during the audit period. Questioned Costs: None. Context: The department contracts with 12 subrecipient entities, called Pathways Providers, to manage the cases of the clients who are eligible for TANF and who need assistance to achieve household stability of their finances. We reviewed the 24 agreements in place during the audit period and identified all subrecipient agreements contained incorrect or missing information. Specific errors included incorrect funding source, federal award date, and subaward period of performance start and end dates. Agreements also omitted the name of the federal awarding agency. Effect: The department has not complied with federal regulations regarding required subrecipient disclosures. Because contract information is used to complete Federal Funding Accountability and Transparency Act (FFATA) reporting, omitted, incomplete and inaccurate contract disclosures put the department at risk for inaccurate federal reporting. Additionally, failure to provide subrecipients with the required federal award information increases the risk of subrecipient noncompliance with federal requirements. Cause: Department internal controls were insufficient to identify the omitted or inaccurate information. Although the department?s contract template includes a placeholder for the required contract disclosures, this section was improperly modified in the signed contract agreements. Recommendation: We recommend the Department of Public Health and Human Services: A. Establish and document internal controls to ensure required subrecipient disclosures are included in Temporary Assistance for Needy Families contract agreements prior to signature. B. Ensure the required subrecipient disclosures are included correctly in Temporary Assistance for Needy Families subrecipient contract agreements, as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-054: U.S. Department of Health and Human Services ALN # 93.323, Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Grant # NU50CK000500 Criteria: Federal regulation, 45 CFR 75.352(d) through (e), requires the Department of Public Health and Human Services (department) monitor the activities of the subrecipient as necessary to ensure the subaward is used for authorized purposes, in compliance with federal statutes, regulation, and terms and conditions of the subaward, and subaward performance goals are achieved. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Department procedures did not include post-award monitoring of subrecipients for the federal ELC award, and the department has not complied with the requirements. Questioned Costs: None. Context: The department amended existing subaward agreements with various county governments to better position the state in responding to the pandemic, resulting in subaward agreements with 27 county governments. The department did not provide evidence of post-award monitoring for any of the six county subaward agreements included in our sample. This was not a statistically valid sample. This applies to all county subaward agreements based on discussion with the department. Effect: The department has not complied with federal regulations requiring post-award monitoring of it subrecipients, which means risk exists that federal funds were not expended in accordance with federal award requirements. Cause: Based on discussion with department staff, they were unaware of the degree of subrecipient monitoring required for the subaward agreements. Recommendation: We recommend the Department of Public Health and Human Services: A. Establish and document internal controls for the federal Epidemiology and Laboratory Capacity for Infectious Diseases to ensure subrecipients use funds for authorized purposes, comply with federal statutes, regulations, and terms and conditions of the subaward agreement, and performance goals are achieved, as required by federal regulations. B. Conduct monitoring of subrecipients of the federal Epidemiology and Laboratory Capacity for Infectious Diseases award, as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-055: U.S. Department of Health and Human Services ALN # 93.323, Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Grant # NU50CK000500 Criteria: Federal regulation, 2 CFR 200.331, describes the characteristics for subrecipients and contractors. Subrecipient characteristics include the use of federal funds to carry out the federal program for a public purpose, as opposed to contractor characteristics of providing goods or services for the benefit of the pass-through entity. This federal regulation was renumbered to 2 CFR 200.332 during the audit period. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Public Health and Human Services (department) misclassified certain agreements as contractor, rather than subrecipient, agreements and has therefore not complied with federal subrecipient monitoring requirements. Questioned Costs: None. Context: As part of our audit, we reviewed payments from the ELC program to entities the department classified as subrecipients and contractors. In reviewing the underlying agreements, we identified the following situations where entities were misclassified as contractors rather than as subrecipients. ? The department contracts with a university to maintain full-time equivalent (FTE) positions to assist the department in increasing public health system ability to respond to antibiotic resistant threats. ? The department entered into agreements with three Montana hospitals. The agreements were to dedicate FTE positions to increasing the statewide laboratory capacity in response to the COVID-19 public health emergency. Both the university and the hospital agreements are established to help position the state to better respond to infectious disease and not to provide services directly to the department. As such, these should be classified as subrecipient rather than contractor agreements. Effect: By misclassifying the agreements with the university and the three hospitals, the department has not complied with federal requirements for subrecipients, such as providing federal award information to the entity, assessing risk for the entity, and conducting post-award monitoring of the entity. Misclassification also increases the risk that use of funds will not fully align with the purpose of the federal program. Cause: Department procedures did not include formal consideration of subrecipient or contractor classification for university and hospital agreements at the time the agreements were established. Recommendation: We recommend the Department of Public Health and Human Services: A. Establish internal control review procedures to document consideration of contractor or subrecipient classification at the time of entering into contract agreements for the Epidemiology and Laboratory Capacity for Infectious Diseases federal award. B. Properly classify agreements as subrecipient or contractor relationships for the Epidemiology and Laboratory Capacity for Infectious Diseases federal award, as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-056: U.S. Department of Health and Human Services ALN # 93.558, Temporary Assistance for Needy Families (TANF) Grant # 1901MTTANF, 2001MTTANF, 2101MTTANF Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: There are no Department of Public Health and Human Services (department) level controls over the accuracy and completeness of the ACF-199 TANF Data Report prior to its submission to the federal government. Questioned Costs: None. Context: The department uses its Combined Healthcare Information and Montana Eligibility System-Enterprise Architecture (CHIMES) system to determine TANF eligibility and benefit amounts. A contractor for the department uses the CHIMES system to submit the TANF ACF-199 report on behalf of the department. While the department represents it tested ACF-199 report functionality with CHIMES implementation in approximately 2012 and retests and validates with system enhancements, the department did not provide this evidence for our consideration. As such, there is no current system assurance available for report accuracy and completeness. Our audit did not identify material noncompliance in the department?s ACF-199 reports. Effect: Without department-level controls to review the file for accuracy and completeness prior to submission and in the absence of documentation of initial and ongoing testing of the CHIMES-EA, the department is unable to demonstrate adequate internal control over its ACF-199 reports. Cause: The department believes its up-front data collection procedures within the eligibility system as well as validation of the data file in the state/federal exchange are controls sufficient for its ACF-199 reports. Recommendation: We recommend the Department of Public Health and Human Services document department-level internal controls to ensure complete and accurate reporting for the Temporary Assistance for Needy Families ACF-199 reports. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-057: U.S. Department of Health and Human Services ALN # 93.568, Low-Income Home Energy Assistance Grant # 18B1MTLIEA, 19B1MTLIEA, 2001MTLIEA, 2101MTLIEA, 2001MTE5C3 Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: There are no documented Department of Public Health and Human Services (department) level controls to confirm accuracy and completeness of information system generated extracts used to populate two required annual reports of the Low-Income Home Energy Program (LIHEAP) prior to submission to the federal government. Questioned Costs: None. Context: As part of our audit, we reviewed four different reports the department is required to submit to the federal government for LIHEAP. Of the four types of reports, two are generated using extracts ran out of the department?s case management information system. The case management system is used for intake of client data and eligibility data as well as other uses for the federal program. Department staff also communicated that the information entered into the case management system is reviewed and monitored. Although the department does review and monitor this activity, these types of reviews do not address whether the system extracts are complete and accurate for reporting purposes. While we identified a lack of controls, we did not identify errors in our testing of the reports submitted to the federal government. Effect: The department cannot demonstrate compliance with federal regulation requirements to maintain effective internal controls. Without effective internal controls, there is risk the required federal reports are not complete or accurate. Cause: The department communicated they have controls in place to review the extracts out of the case management system as staff reviews reports for anomalies, comparing to prior year data. However, this process is not documented, and we were not able to test it. Staff acknowledge this process could be better documented. While the department has controls over the data entered into the system, the department lacks controls to ensure that data is being compiled completely and accurately in the system extracts. Recommendation: We recommend the Department of Public Health and Human Services document internal controls over federal reporting data pulled out of the department?s case management system to ensure complete and accurate reporting for the Low-Income Home Energy Program. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-058: U.S. Department of Health and Human Services ALN # 93.575 and 93.596, CCDF Cluster Grant # 1801MTCCDF, 1901MTCCDM, 1901MTCCDF, 1901MTCCDD, 2001MTCCDF, 2101MTCCDF Criteria: Federal regulation, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Public Health and Human Services (department) did not have sufficient controls in place to ensure matching funds and maintenance of effort requirements were met, or to track remaining funds to ensure period of performance requirements would be met for grants, for the Child Care Development Fund (CCDF). Questioned Costs: None. Context: The CCDF Cluster has multiple federal requirements related to fiscal management of grant funds, including the matching federal funds, maintenance of effort, earmarking of administrative funds, and the period in which the grant must be spent. The department lacked controls for the entire audit period to track matching funds, maintenance of effort, and period of performance requirements. For earmarking requirements, the department relied on a tool provided by the federal government. The federal government compiled this tool using quarterly financial reports from the department. Without verifying the information used in the tool is correct, the department cannot rely on this tool as an internal control. We completed additional testing over each of these requirements and concluded the department met each of the matching funds, maintenance of effort, earmarking, and period of performance federal requirements. Repeat Finding: Montana?s Single Audit for the two fiscal years ended June 30, 2019, included a recommendation (#2019-019) to the department to develop internal controls to document the obligation of all funding types for the CCDF federal program. Effect: The department is not in compliance with federal regulations as they did not establish and maintain internal controls to ensure compliance with multiple federal requirements. Without proper internal controls to track these requirements, the department is at risk of unknowingly not complying with federal regulations governing the CCDF program. Cause: For the majority of the requirements, the department agrees that they did not have a control in place to track the requirements. Staff indicated the program had been through some turnover and changes because of reorganization. While we were made aware of a tracking tool developed late in fiscal year 2021 for matching funds, maintenance of effort, and period of performance requirements, we did not see evidence of the tool consistently being used. For the earmarking requirements, the department relied on the tool completed by the federal government to ensure the requirements were met. The federal government stopped providing this tool in fiscal year 2021, so the department recreated the tool for its own tracking purposes. Recommendation: We recommend the Department of Public Health and Human Services establish and maintain internal controls to ensure compliance with federal matching funds, earmarking, maintenance of effort, and period of performance requirements for the Child Care Development Fund program. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-059: U.S. Department of Health and Human Services ALN # 93.575 and 93.596, CCDF Cluster Grant # 1801MTCCDF, 1901MTCCDM, 1901MTCCDF, 1901MTCCDD, 2001MTCCDF, 2101MTCCDF Criteria: Federal regulation, 45 CFR 98.42(b)(2), requires the Department of Public Health and Human Services (department) to complete at least annual inspections of childcare providers and facilities to ensure compliance with health and safety standards. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Department internal controls were not effective in ensuring childcare providers or facilities received inspections annually as required by federal regulations. Questioned Costs: None. Context: We completed a sample of invoices reimbursing childcare costs for participant families receiving Child Care Development Fund (CCDF) assistance during the audit period. The sample was not a statistically valid sample. We also completed testing over the corresponding childcare providers as part of this sample. Out of total 55,075 childcare centers, 40 were tested, and we identified four providers without a current inspection completed within 12 months. Under the COVID-19 public health emergency, the state obtained a waiver that temporarily suspended on-site monitoring and inspections. The four instances identified were not related to this waiver. Effect: The department has not complied with federal regulations regarding annual inspection of childcare providers. As a result, the department is at risk of providing payment for childcare at a provider who has not met all health and safety requirements. Cause: While the department has a process in place to track inspections of childcare providers, department internal controls were not sufficient to identify and prompt inspections to be completely timely. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to complete annual inspections of childcare providers per federal requirements for the Child Care Development Fund program. B. Comply with federal regulations by completing annual inspections of childcare providers. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action, see Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-060: U.S. Department of Health and Human Services ALN # 93.575 and 93.596, CCDF Cluster Grant # 1801MTCCDF, 1901MTCCDM, 1901MTCCDF, 1901MTCCDD, 2001MTCCDF, 2101MTCCDF Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Public Health and Human Services (department) did not maintain records of some approved grant applications for the Child Care Development Fund (CCDF). Questioned Costs: None. Context: We completed a sample of subrecipients for the CCDF. This sample was not statistically valid. Of the 45 grantees we tested, the department could not provide the grant application for five grantees in fiscal year 2020. We completed additional testing over the corresponding payments and do not question the validity of payments made to the grantees. All of the payment amounts were consistent with other grantees and all grantees were licensed providers and had completed the necessary certification. However, we were unable to determine whether the grant application was approved. Effect: Since the department could not provide grant applications, we are unable to see evidence of approval prior to payment. The department could not demonstrate compliance with federal regulations to maintain effective internal controls. Cause: Per department staff, the files were misplaced during the department?s move to a new location. Recommendation: We recommend the Department of Public Health and Human Services enhance internal controls to ensure records of grant applications are tracked and maintained. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-061: U.S. Department of Health and Human Services ALN # 93.658, Foster Care- Title IV-E Grant # 1901MTFOST, 2007MTFOST, 2107MTFOST Criteria: Federal regulation, 2 CFR 200.403 (g), specifies costs must be adequately documented to be allowable under the award. Federal regulation, 45 CFR 1356.60(b)(2), requires all training activities and costs funded under title IV-E be included in the department?s training plan for title IV-B. Regarding training plans for the Foster Care program, Federal regulation, 45 CFR 235.63(c), specifies, in part, that federal financial participation in costs is available when certain conditions are met. These conditions include that grants to educational institutions are made for the purpose of developing, expanding, or improving training for personnel employed by the state or individuals preparing for employment by the state and for an educational program that is directly related to the department?s training program. Federal regulation, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Public Health and Human Services (department) continued to make payments to subrecipients without first obtaining and reviewing detailed supporting documentation. Questioned Costs: Based on our sample results, we question costs for the amount of $2,002,503 for costs associated with the Foster Care program. Based on overall level of activity, we estimate likely questioned costs are $5.1 million, which represents projected errors in payments to Foster Care subrecipients. Repeat Finding: Montana?s prior Single Audit report for the two fiscal years ended June 30, 2019, included a recommendation (#2019-017) that the department reimburse college and tribes only for activities allowed by federal regulations and to design and implement internal control to ensure detailed support for invoices is obtained, reviewed, and approved prior to payment. Context: The department maintains subrecipient agreements with the seven tribes located within the state and two colleges/universities (colleges). Federal funds are provided to these entities to either help administer the Foster Care program, provide stipends to college students studying social work, or to provide training to department staff. In our sample of fourteen invoices submitted by tribes or colleges, we identified nine instances where supporting documentation did not exist or supporting documentation was not detailed enough to determine whether the costs were allowable. Of the fourteen invoices tested, five were related to training costs. This sample was not statistically valid. Due to lack of supporting documentation submitted by the colleges, we were unable to determine whether training costs were specified in the department?s training plan. Our observations of inadequate documentation include: ? Support for one college payment for $59,124 was a budget to actual report by expenditure category which itemized approximately $13,500 for payroll and fringe benefit costs, $600 for supplies, $16,000 for subscriptions, $20,000 for stipends, and $8,000 for indirect expenses. We were unable to determine whether payroll costs were for proper individuals or for correct amounts as no timecards or detailed payroll reports were available to compare to the college contract. Additionally, supply, subscription and stipend cost information were not supported with receipts or details to indicate what was purchased or the names of the stipend recipients. As such, we were unable to determine whether costs incurred by the college were authorized under the contract and allowable for reimbursement with federal funds. ? Tribal invoices were often supported only with standardized billing invoices which outline personnel positions under the contract, the individual salaries including fringe benefits of the personnel, and operating expenditures. When no other support was provided by the tribe, we could not verify if the expenditures outlined on the invoice were actually incurred. The total costs in our sample are as follows: See Schedule of Findings and Questioned Costs for chart/table. Effect: Without adequate supporting documentation, the department is unable to demonstrate compliance with internal control requirements in federal regulation. Additionally, for payments which lack adequate support, the department may have incurred costs for unallowable activities under the federal award. Cause: For instances where a general ledger expense listing is provided, the department believes its controls for review of the summary by each program and fiscal staff for allowability and sufficiency of evidence are effective controls for subrecipient payment activities. For tribal reimbursements, the department created a standardized billing form on which tribes list positions under the contract, the salary amount and fringe benefits, and total operating costs incurred. The department believes the completed standardized billing form information is sufficient because this information can be compared to the contract. We disagree with the department?s position regarding adequate supporting documentation. Reasons for our opinion include instances where: ? Documentation for college invoices included salary, travel costs such as airline and hotel costs, and supply items. Without more detailed documentation, the department can neither be sure the salaries or travel costs were incurred by college staff employed under the contract nor that supplies purchase were reasonable and necessary for administering the program. ? The standardized billing form was incorrectly completed by the tribe which resulted in the department overpaying the tribe. In this case, the tribe did supply the department with detailed wage reports for each employee. Salary amounts for two of the tribal employees were listed as the total gross salary plus the employer and employee payroll deductions. These errors were not identified and corrected in the department?s review. ? Salaries on the standardized billing form listed over $110,000 in salary costs incurred when the tribe?s general ledger print out showed approximately $93,000 in salary costs. The department?s review of the invoice did not identify the discrepancy and the tribe was overpaid. In order to properly identify which of the 25 tribal employee salaries was incorrect, the department would need detailed gross salary information provided to them. Recommendation: We recommend the Department of Public Health and Human Services: A. Design and implement internal controls for its Foster Care federal awards to ensure adequate documentation for contractor and subrecipient is obtained, reviewed, and approved prior to payment. B. Reimburse Foster Care federal award contractors and subrecipients only for activities allowed by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-062: U.S. Department of Health and Human Services ALN # 93.323, Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Grant # NU50CK000500 Criteria: Federal regulation 2 CFR 200.403(g) specifies costs must be adequately documented in order to be allowable under federal awards. Federal regulation, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Public Health and Human Services (department) made payments to ELC subrecipients and contractors without first obtaining and reviewing detailed supporting information. Questioned Costs: We question $2,144,872 in costs incurred for the ELC program which includes all payments made to subrecipients and to the university. Context: As part of our audit, we conducted samples of each subrecipient and contractor payments for the ELC financial assistance program. The subrecipient sample was not a statistically valid sample. The contractor payment testing consisted of a statistically valid sample of 30 journals with an additional 7 journals selected judgmentally. Both samples identified instances where costs were not adequately documented, as further described below. Subrecipient Payments ? The department made payments to 27 county governments, subrecipients of the ELC award, for the purpose of hiring a full-time equivalent (FTE) position for an epidemiologist, county sanitarian, or disease intervention specialist. We sampled one payment to each of six subrecipients. Supporting documentation provided by the department was insufficient to determine whether the subrecipients had incurred costs for purposes under the contract. Auditor observations include: ? Support for each of the payments was an email from the county which simply specified whether the county had hired an FTE and did not contain detailed support such as payroll reports or timesheets. ? Contract payments were established at a set rate and were not based on costs incurred by the counties. For one county where salary and fringe benefit information was provided, we estimate the county was overpaid by $28,970 from December 2020 to June 2021. ? Of the six payments in our sample, there were one each from December 2020, January 2021, and April 2021, with the remaining three payments taking place in June 2021. Because support provided by the department was in email form dated May or June 2021, we concluded the department made payments to counties without any documentation for the December, January, and April payments. ? One county indicated it was in the process of hiring for an FTE. The department disbursed funds to the county in June 2021. However, the subrecipient agreement was not signed until November 2021. Contractor Payments ? We sampled 37 journals, including 114 expenditure transactions. We identified the following payments to contractors where supporting documentation was not sufficient at the time of payment. ? The department maintains a contract with a university to maintain FTE to assist the department in increasing public health system ability to respond to antibiotic resistant threats. Supporting documentation did not include review of payroll reports or timesheets. ? Agreements with three Montana hospitals were to dedicate FTE to increasing statewide laboratory capacity in response to the COVID-19 public health emergency. While supporting documentation was provided at the end of the contract period, it was not obtained and reviewed prior to monthly contract payments to the hospitals. Effect: Lack of sufficient documentation for the subrecipient and contractor payments renders the costs unallowable under federal regulations, and has resulted in significant questioned costs for the audit period. Cause: Department procedures for subrecipient and contractor payments did not include evaluation of adequacy of supporting documentation for federal awards. Recommendation: We Recommend the Department of Public Health and Human Services: A. Design and implement internal controls for its Epidemiology and Laboratory Capacity for Infectious Diseases federal awards to ensure adequate documentation for contractor and subrecipient payments is obtained, reviewed, and approved prior to payment. B. Reimburse Epidemiology and Laboratory Capacity for Infectious Diseases federal award contractors and subrecipients only for activities allowed by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-063: U.S. Department of Health and Human Services ALN # 93.558, Temporary Assistance for Needy Families (TANF) Grant # 19001MTTANF, 2001MTTANF, 2101MTTANF ALN # 93.658, Foster Care ? Title IV-E Grant # 2107MTFOST, 2007MTFOST, 1907MTFOST ALN # 93.767, Children?s Health Insurance Program (CHIP) Grant # 1905MT5021, 2005MT5021, 2105MT5021 ALN # 93.775, 93.777, 93.778, Medicaid Cluster Grant # 1905MT5ADM, 2005MT5ADM, 2105MT5ADM, 11905MTIMPL, 1905MTINCT, 2005MTIMPL, 2005MTINCT, 2105MTIMPL, 2105MTINCT, 2005MT50C3, 2105MT50C3 Criteria: Federal regulation, 2 CFR Appendix VI, in part, requires the state public assistance agency to develop, document, and implement a public assistance cost allocation plan in accordance with federal regulations. Federal regulation, 2 CFR 200.416(a), in part, requires there to be a process whereby central service costs can be identified and assigned to benefited activities on a reasonable and consistent basis. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Public Health and Human Services (department) did not follow its federally approved plan to allocate costs among state and federal programs. Additionally, department internal controls did not identify these inconsistencies. We noted the following exceptions to compliance with the applicable cost allocation plan: ? The allocation method specified for the Economic Section Branch Manager Indirect Cost Pool lists the allocation method as full-time equivalent (FTE) directly supervised by the Economic Services Branch Manager. The department erroneously allocated a portion of the pool costs using FTE which directly report to the Director?s Office. ? We were unable to locate the DET Contract Specialist Indirect Cost Pool or the MHPMP Maint and Operations 75 Indirect Cost Pool in the department?s Cost Allocation Plan (CAP), yet the department allocated costs associated with these pools during the audit period. ? We reviewed three allocations to the Director?s Office Indirect Cost Pool (DO Pool). Per the CAP, the department director supervises Chief Legal, Chief Personnel Officer, branch managers, and the Public Health and Safety Division Administrator. The allocation method for the DO Pool is to benefit other indirect cost pools. During the audit, we noted the department did not allocate costs to the Public Health and Safety Division as required, which also resulted in over-allocations to the other benefiting cost pools. ? We reviewed two allocations for the Operations Services Branch Manager Indirect Cost Pool. Per the CAP, costs for this pool allocate to the Technology Services Division, Business and Financial Services Division, and Quality Assurance Division administrator pools. During the audit, we noted one instance where costs were not allocated to the Chief Information Officer pool and one instance where costs were allocated to the Project Management Bureau, bypassing the Chief Information Officer pool. The department?s organizational chart also lists the Chief Information Officer, Strategic Planning, Research and Analysis, Internal Audit Bureau, Medical Marijuana Bureau, and Office of Budget and Finance as direct reports to the Operations Services Branch Manager. The department allocated costs to each of these functions even though the CAP does not specify them as receiving allocations. ? We reviewed three allocations to the MPQHF QUI LOC Indirect Cost Pool. While costs were allocated, the department did not provide supporting documentation for the review of the allocation method and the pool was not included in the CAP. Questioned Costs: Based on the amount of costs allocated to these programs, we project questioned costs for errors identified in our sample as well as other unidentified errors could accumulate to more than $25,000 for each of the CHIP, Foster Care, Medicaid and TANF programs. Context: During the period under audit, the department allocated costs under two different cost allocation plans. In total, the department allocated approximately $164.8 million and $172.6 million in costs for fiscal years 2020 and 2021, respectively. Monthly, there are approximately 130 cost pools for which the department allocates costs. We conducted a nonstatistical sample of 61 cost pool allocations. The table below depicts total indirect costs allocated to each of the 4 federal programs where we identified material noncompliance. See Schedule of Findings and Questioned Costs for chart/table. Repeat Finding: Montana?s Single Audit report for the two fiscal years ended June 30, 2017, included a recommendation (#2017-014) to the department regarding the internal controls over and administration of its cost allocation plan. Montana?s Single Audit report for the two fiscal years ended June 30, 2019, included a recommendation (#2019-022) to the department to conduct and document a review of all cost pools to ensure alignment with the approved cost allocation plan, to implement changes to the cost allocation process only after receiving approval from, or submitting a plan revision to, the federal government, to develop and implement internal controls to detect variances in cost pools allocated using a full-time equivalent staff statistic, and to allocate costs in accordance with its cost allocation plan. Effect: In combination, the errors identified by our audit resulted in both over-allocations and under-allocations of indirect costs. Due to inherent complexities in stepping costs through each indirect cost pool, we did not quantify the errors for individual major federal programs. However, we project questioned costs exceeding $25,000 could exist for those programs. Cause: The department?s CAP is a 33 page text document. When updated, the department must submit a red-line strike out version along with a clean version of the proposed CAP. During each of the last two updates, the department?s review of the changes did not identify and correct cost pools inadvertently deleted or were otherwise overlooked for inclusion. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls over cost allocation, including consideration of an in-depth review of its cost allocation procedures and plan. B. Allocate costs as specified in the cost allocation plan, as required by federal regulations. C. Implement changes to the cost allocation process only after receiving approval from, or submitting a plan revision, to the federal government. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-064: U.S. Department of Health and Human Services ALN # 93.558, Temporary Assistance for Needy Families (TANF) Grant # 1901MTTANF, 2001MTTANF, 2101MTTANF Criteria: Federal regulation, 2 CFR 200.170, Appendix A, requires the Department of Public Health and Human Services (department) report under the Federal Funding Accountability and Transparency Act (FFATA) each action on subaward agreements that equals or exceeds $30,000 in federal funds. Reports must be submitted to the FFATA Subaward Reporting System (FSRS) no later than the end of the month following the month in which the obligation was made and reports must include specific information about the obligating action, as outlined on the FSRS website. In addition, federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing procedures to ensure eligibility determinations are performed in accordance with program requirements. Condition: Department of Public Health and Human Services (department) internal controls did not identify a change in contracting system information which caused necessary FFATA reports to be overlooked for the TANF program. Questioned Costs: None. Context: Department staff query for changes in its contracting system by comparing the current month vendor obligation data to prior month vendor obligation data. The initial time the obligation accumulates to an amount exceeding $30,000, or any increase in obligation amount thereafter, should be identified and reported as part of the department?s procedures. In total for six major programs, we identified 269 instances where changes in the federal obligation in the department?s contracting system prompted, or should have prompted, the department to submit a FFATA report. For TANF, we reviewed four instances; this sample was not statistically valid. We reviewed the underlying agreements which were for Pathways Program providers who are considered subrecipients of federal TANF funds. Their subrecipient status supports the FFATA reports being necessary. However, the department did not complete and submit FFATA reports for these four TANF obligations. The required FFATA summary information is included below. See Schedule of Findings and Questioned Costs for chart/table. Effect: By not submitting required FFATA reports, the department did not comply with federal reporting requirements for the TANF program. Cause: Based on information provided by the department, personnel did not identify when one of the data fields in its contracting system was repurposed to account for federal expenditure activity rather than state general fund activity. When this change occurred, department internal controls were not updated to fully consider the implications for FFATA reporting. Because the department did not update the data field to indicate federal funds were involved, the department did not identify the need to prepare and submit FFATA reports for Pathways Provider obligations. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to identify when changes in data fields in the contracting system impact its ability to properly identify changes in contract obligations for FFATA reporting for the TANF program. B. Submit accurate and complete FFATA reports for the TANF program, as required by federal regulations Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-065: U.S. Department of Health and Human Services ALN # 93.658, Foster Care- Title IV-E Grant # 1907MTFOST, 2007MTFOST, 2107MTFOST Criteria: Federal regulation, 2 CFR 200.170, Appendix A, requires the Department of Public Health and Human Services (department) report under the Federal Funding Accountability and Transparency Act (FFATA) each action on subaward agreements that equals or exceeds $30,000 in federal funds. Reports must be submitted to the FFATA Subaward Reporting System (FSRS) no later than the end of the month following the month in which the obligation was made and reports must specify information about the obligating action, as outlined on the FSRS website. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Foster Care contracts contained unsupported dollar amounts and inaccurate federal award identification numbers, resulting in errors in FFATA reporting. Questioned Costs: None. Context: Department staff query for changes in its contracting system by comparing the current month data to prior month data. The initial time the obligation accumulates to an amount exceeding $30,000, or any increase in obligation amount thereafter, should be identified and reported as part of the department?s procedures. In total for six major federal programs, we identified 269 instances where changes in the federal obligation in the department?s contracting system prompted, or should have prompted, the department to submit a FFATA report. For Foster Care, we reviewed 6 instances; this sample was not statistically valid. While the reports were submitted timely, we could not determine the accuracy of the obligation information and the federal award identification number included on the FFATA reports, as the underlying contracts did not contain accurate disclosure information. The required FFATA summary information is included below. See Schedule of Findings and Questioned Costs for chart/table. Effect: The department did not comply with federal FFATA reporting requirements. Cause: The department?s contracts with subrecipients for the Foster Care program did not include complete and accurate information, as discussed in Finding 2021-051. Because the contracts were incomplete and inaccurate, the contracting system that drives FFATA reporting also contained incomplete or inaccurate data. Recommendation: We recommend the Department of Public Health and Human Services: A. In conjunction with enhancements to Foster Care subrecipient award agreements discussed in Finding 2021-051, enhance internal controls to ensure contracting system information is complete and accurate for Foster Care subawards. B. Submit accurate and complete FFATA reports for the Foster Care program, as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-066: U.S. Department of Health and Human Services ALN # 93.323, Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Grant # NU50CK000500 Criteria: Federal regulation, 2 CFR 200.170, Appendix A, requires the Department of Public Health and Human Services (department) report under the Federal Funding Accountability and Transparency Act (FFATA) each action on subaward agreements that equals or exceeds $30,000 in federal funds. Reports must be submitted to the FFATA Subaward Reporting System (FSRS) no later than the end of the month following the month in which the obligation was made and reports must specify information about the obligating action, as outlined on the FSRS website. In addition, federal regulation, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Our sample testing for the ELC award identified multiple internal control and compliance issues related to FFATA reporting. Questioned Costs: None. Context: Department staff query for changes in its contracting system by comparing the current month data to prior month data. The initial time the obligation accumulates to an amount exceeding $30,000, or any increase in obligation amount thereafter, should be identified and reported as part of the department?s procedures. For the ELC program, we identified 144 instances where changes in the federal obligation in the department?s contracting system prompted, or should have prompted, the department to submit a FFATA report, and we reviewed 19 instances. This sample was not statistically valid. We identified eight instances where reports were not submitted and 11 instances where reports were not submitted timely. For all reports submitted, we identified subaward data was missing key elements as the federal award identification number was omitted and did not properly describe the purpose of the award in relation to the underlying subrecipient agreements. The required FFATA summary information is included below. See Schedule of Findings and Questioned Costs for chart/table. Effect: By not submitting required FFATA reports, the department did not comply with federal reporting requirements for the ELC program. Without clear communication between department functions, the department risks continued FFATA reporting errors. Cause: For three of the required reports not submitted, there was a breakdown in communication between the department?s Business and Financial Services Division (BFSD) and the program staff involved in the contracting processes. For these instances, BFSD staff indicated there was no Data Universal Numbering System (DUNS) number, yet program staff were able to quickly locate the DUNS number at our request. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to ensure the Business and Financial Services Division staff receives unique entity identification number information for Epidemiology and Laboratory Capacity for Infectious Diseases contracts to allow for proper FFATA reporting. B. Submit accurate and complete FFATA reports for the Epidemiology and Laboratory Capacity for Infectious Diseases program, as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-067: U.S. Department of Health and Human Services ALN # 93.658, Foster Care ? Title IV-E Grant # 1901MTFOST, 2001MTFOST, 2101MTFOST Criteria: Instructions for completion of the CB-496 report indicate Federal Share of Child Support Collections related to Title IV-E be included on line 3 of the CB-496 report. Additionally, instructions for line 17 of the CB-496 report require an estimate for Foster Care expenditures for the next quarter. Federal regulation, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Public Health and Human Services (department) did not properly correct misreported information in its Foster Care CB-496 reports submitted during the audit period. Questioned Costs: None. Context: We reviewed four CB-496 reports, out of eight submitted for the audit period. This was not a statistically valid sample. We identified incorrect amounts were included in reports submitted for quarters ended September 2020 and December 2020. On those reports, the department incorrectly reported Temporary Assistance for Needy Families cost recoveries rather than Foster Care cost recoveries. While the department identified the errors and made adjustments on its report for the quarter ended March 2021, the adjustments were not made correctly. Additionally, for reports reviewed, the department reported estimated federal expenditures ranging from $1.3 million to $2.9 million. In contrast, for these same reports the department incurred between $1.5 million and $4.4 million in federal expenditures. On average, the department under-estimated upcoming federal expenditures by over $1 million on each report. Effect: Without effective internal control, the department continues to risk submitting incorrect CB-496 Foster Care reports. Due to the department?s under-estimation of upcoming quarterly expenditures, the department exhausts its federal grant allocation early each quarter. Cause: Department internal control procedures include identification and investigation of variances greater than 10% from the prior report for individual line items in the CB-496 reports. For the errors identified in our audit, the department?s controls did not flag the variances for follow-up even though the percentage of change ranged from 32% to 1192%. Additionally, the department input adjustments backwards on subsequent reports and these errors were not identified in the department?s review of the reports. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal control to review Foster Care CB-496 reports for accuracy prior to submission. B. Submit accurate information for cost recoveries and adjustments from prior periods on Foster Care CB-496 reports, as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-068: U.S. Department of Interior ALN # 15.605, 15.611, 16.626, Fish and Wildlife Cluster Grant # F15AF00528 Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal regulation, 2 CFR 200.405, states costs must be ?allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received.? Per the standard, ?this standard is met if the cost: (1) Is incurred specifically for the Federal award; (2) Benefits both the Federal award and other work of the non-Federal entity and can be distributed in proportions that may be approximated using reasonable methods; and (3) Is necessary to the overall operation of the non-Federal entity and is assignable in part to the Federal award in accordance with the principles in this subpart.? Federal regulation, 2 CFR 200.403 states costs must ?be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles? and ?be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity.? It also states costs must be ?adequately documented.? Condition: The Department of Fish, Wildlife & Parks (department) obtained an administrative grant from the U.S. Fish and Wildlife Service related to the Wildlife Restoration and Basic Hunter Education grant that included 100% of the internal auditor?s position salary. The grant agreement indicates that the internal auditor position is responsible for assessing agency functions to ensure the department complies with all requirements necessary to maintain ongoing eligibility relative to the grant programs. While the internal auditor performed two audits directly related to the grant, the internal auditor also performed duties that are not directly related to the grant. The employee did not track time in a way that would allow a determination of what portion of time benefited the grant and was allowable to be charged to the grant. We question the entire amount of the internal auditor?s salary and benefit expenditures charged to the grant in state fiscal year 2020. Questioned Costs: We identified $28,105 in questioned costs. Context: The department charged approximately 40% of its internal auditor?s salary to the Wildlife Restoration and Basic Hunter Education grant in state fiscal year 2020. While there were two internal audits conducted related to the grant, most of the pay periods charged do not line up with the timeline of when the audits were in progress. Effect: Because the department did not have internal control procedures to ensure the portion of the internal auditor?s salary and benefits costs charged to the Wildlife Restoration and Basic Hunter Education grant program benefitted the program, the department cannot demonstrate compliance with federal regulations, resulting in questioned costs. Cause: The internal auditor?s position responsibilities include assessing fiscal and programmatic functions to ensure that the department complies with all requirements necessary to maintain ongoing eligibility relative to the Wildlife Restoration and Basic Hunter Education grant program. The internal auditor performs duties, such as internal audits for other department activities, that are not associated with the grant. While department personnel stated their internal auditor?s time was used to complete eligible activities, they neglected to document activities performed for time worked to support the costs charged to the grant. Repeat Finding: This is a repeat finding and was reported as Single Audit finding 2019-036 in the audit for the two fiscal years ended June 30, 2019. Recommendation: We recommend the Department of Fish, Wildlife & Parks: A. Implement procedures to ensure the internal auditor?s time is allocated to the Wildlife Restoration and Basic Hunter Education grant according to the proportionate benefit received. B. Charge internal audit salary costs to the grant for time that is necessary, reasonable, and allocable. Views of Responsible Officials: The department partially concurs with this recommendation. Management believes that given the employee?s time was used on specific eligible activities or other activities that benefited the grant as a whole, time allocation was not necessary. For additional information regarding the department?s planned corrective action see the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We considered the department?s partial concurrence. As noted above, the internal auditor performs duties, such as internal audits for other department activities, that are not associated with the grant. Due to a lack of documentation, the department cannot demonstrate the portion of the internal auditor?s salary and benefits costs charged to the grant directly benefitted the program.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2021 Section III ? Federal Award Findings and Questioned Costs Finding 2021-069: U.S. Institute of Museum and Library Services ALN # 45.310, Grants to States Grant # LS-246178-OLS-20, LS-249973-OLS-21 Criteria: Federal regulation, 2 CRF 200.430 (f), indicates ?Incentive compensation to employees based on cost reduction, or efficient performance, suggestion awards, safety awards, etc., is allowable to the extent that the overall compensation is determined to be reasonable and such costs are paid or accrued pursuant to an agreement entered into in good faith between the non-Federal entity and the employees before the services were rendered, or pursuant to an established plan followed by the non-Federal entity so consistently as to imply, in effect, an agreement to make such payment.? Federal regulation, 2 CFR 200.403(c), indicates costs must be consistent with policies and procedures that apply uniformly to both Federally-financed and other activities of the non-Federal entity to be allowable uses of Federal funds. State of Montana Operations Manual (MOM) Broadband Pay Policy allows for lump-sum payments for reasons established in an agency?s pay policy, including an employee incentive award, housing allowances, temporary assignment pay, or a performance award for completing pre-set conditions of a project. Condition: The Montana Library (Library) paid employee incentive bonuses in fiscal years 2020 and 2021. The Library?s pay plan policy dated August 10, 2018, in effect during the audit period, did not provide for these types of incentives or lump-sum payments. Contrary to federal regulations, the bonus costs were not paid as part of an established plan during the audit period. Therefore, the costs are unallowable and constitute noncompliance with federal regulations. A pay plan including incentive pay was effective October 13, 2021, subsequent to our audit period. Questioned Costs: We question $45,777 in bonus payments charged to the federal grant. Context: In fiscal years 2020 and 2021, the Library used unspent personal services budget to fund bonuses for library staff. The Montana State Library Commission approved the bonuses based on Library successes throughout the year. The library paid the bonuses to all staff based on position. In fiscal year 2020, Helena Supervisors received 6 percent and remaining staff received 5 percent while Remote Supervisors received 4 percent and the remaining remote staff received 3 percent. In 2021 supervisors received $3,500 and staff received $2,500. The Library split the costs between funds in the same manner as employee salaries. Bonuses charged to the grants were $18,877 in fiscal year 2020 and $26,900 in fiscal year 2021. Total personal service costs for the bonuses were $112,818 and $132,000, respectively. Effect: The bonus practice is noncompliance with federal regulations and state policy, and results in questioned costs. Cause: Under MOM policy, the Library is required to update its pay plan policy every two years. While the pay plan in effect during fiscal years 2020 and 2021 did not have language allowing for lump-sum or incentive payments, prior policies did contain such language. Management indicated the language was accidently removed from the policy in effect during the audit period and they have added the language back into current policy. In addition, Library personnel indicated they cannot implement expectations at the beginning of the period because they may not have sufficient resources to pay the bonus. Recommendation: We recommend the Montana Library comply with federal regulations and state policy regarding employee incentive pay. Views of Responsible Officials: The Library does not concur with this recommendation. While management acknowledges the Library did not include the required language to govern the application of their pay incentive strategy in their adopted pay plan policy, they disagree the bonus costs charged to the federal funds were not consistent with federal regulations. Management?s position is based, in part, on e-mail correspondence with a federal Institute of Museum and Library Services Program Officer, occurring after the audit period. Rebuttal of Views of Responsible Officials: Federal grantor agencies are responsible for issuing management decisions on federal findings after, not before, receipt of the Single Audit report. However, as part of our audit procedures, we considered the e-mail correspondence with the Program Officer. In that correspondence, management indicated the payments were made in accordance with the state?s pay plan policy. We have determined, and management has acknowledged, that the language required to be included in the pay plan policy to govern bonus payments, was not included in the policy in place during the audit period. As such, we do not consider the bonus payments to have been made in accordance with the state?s pay plan policy. Additionally, we do not consider the fact that similar payments were made eight times in the last twelve years to imply, in effect, an agreement to make payment.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-001: U. S. Department of Health & Human Service CFDA # 93.775, 93.777, and 93.778, Medicaid Cluster Grant # 1705MT5MAP, 1805MT5MAP, 1905MT5MAP CFDA # 93.767 Children?s Health Insurance Program (CHIP) Grant # 1705MT5021, 1705MT0301, 1805MT5R21, 1805MT5021, 1905MT5021 Criteria: Federal regulations, 42 CFR 435.10 and 42 CFR 457.305, require the Department of Public Health and Human Services (department) to determine client eligibility in accordance with eligibility requirements in the approved State Plan for the Medicaid Cluster and CHIP program. Federal regulation, 42 CFR 435.914, requires the department to include facts in each applicant?s case record to support the eligibility decision. Federal regulation, 42 CFR 435.945(a), specifies, in part, ??except where the law requires other procedures?, the agency may accept attestation of information needed to determine the eligibility of an individual for Medicaid? without requiring further information from the individual.? Federal regulation, 42 CFR 435.952 (a), requires the department to promptly evaluate information received or obtained by it in accordance with regulations to determine whether such information may affect an individual?s eligibility. Federal regulation, 42 CFR 435.952 (b) and (c)(1), specifies if information provided by an individual is reasonably compatible with information obtained through required data matches, the department must determine or renew eligibility based on such information. Income information obtained through an electronic data match shall be considered reasonably compatible with information provided by the applicant/client if both are either above, at, or below the applicable income standard or income threshold for eligibility. Only in circumstances when information is not reasonably compatible can the department request additional information. The department?s State Plans for both the Medicaid and CHIP programs contain income, age, residency, and other eligibility criteria. For our audit period, as permitted by the verification plan, the department accepted self-attested information at enrollment for Modified Adjusted Gross Income (MAGI) based eligibility determinations. The information is verified against various electronic data sources after enrollment in a process referred to as post-enrollment verification (PEV). The PEV process is automated in the department?s Combined Healthcare Information and Montana Eligibility System (CHIMES) to occur within 3 months. For all eligibility groups, redeterminations of eligibility are required to occur annually. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department?s internal control is not sufficiently designed to identify and remove participants from the Medicaid or CHIP programs when participants misrepresent their household composition, sources of income, or residency in order to circumvent the programs? eligibility requirements. In addition, our audit tests identified a significant number of clients who may not meet eligibility criteria for the Medicaid and CHIP programs. Results of our testing demonstrate that indications of ineligibility in the CHIP and Medicaid populations are isolated to MAGI-based eligibility groups Internal Controls We observed evidence of the following internal control deficiencies over eligibility determinations: Instances in which the interfaces between information in the department?s records with external data sources did not run. Instances when required redeterminations of eligibility did not occur. Instances where the department received evidence of discrepancies in eligibility criteria which were not followed up on. Instances where department staff overrode information system controls to allow ineligible individuals to remain in the Medicaid or CHIP programs. We also observed situations where the department had evidence that a program participant was ineligible, but the department allowed them to remain in the program. Questioned Costs: Known Questioned Costs For the 17 case files with indications of ineligibility for all Medicaid and CHIP eligibility groups, and the 9 individuals placed into an incorrect eligibility group, the associated $216,630 in benefit payments do not meet the allowable cost criteria and are considered questioned costs. For the 16 cases where no tax data was available, the department?s records do not demonstrate that the information used to make the eligibility determination is factual. As such, the associated $362,303 in benefits made on behalf of these individuals are considered questioned costs. Projected Questioned Costs Assuming the same rate of ineligibility in the entire population of Medicaid and CHIP participants where state tax data is available, we projected questioned costs using the average annual claims for each eligibility group. Due to error isolation in the MAGI-based eligibility groups, we factored in a three-month time period to account for the time prior to department verification procedures. Using this methodology, we project likely federal questioned costs for the CHIP program are $1.1 million annually, and $41.3 million and $40.5 million for Medicaid in fiscal years 2018 and 2019, respectively. Using the 5.8 percent error rate associated with the department?s reconsideration of eligibility determinations (see ?Results of Department Conducted Review? in the Context section below), errors in eligibility could equate to as much as $99.2 million and $98.9 million in inappropriate benefit payments for the CHIP and Medicaid programs, in total, for fiscal years 2018 and 2019, respectively, when projected to the population as a whole. Context: In state fiscal year 2018, expenditures totaled approximately $1.5 billion for Medicaid and $97 million for the CHIP program. At fiscal year-end of 2018, there were approximately 246,000 individuals enrolled in Medicaid and 23,000 individuals enrolled in the CHIP program. In state fiscal year 2019, expenditures totaled approximately $1.5 billion for Medicaid and $104 million for the CHIP program. At fiscal year-end of 2019, there were appropriately 236,000 individuals enrolled in Medicaid and 24,000 individuals enrolled in the CHIP program. The department uses the CHIMES system to determine eligibility. All applications are uploaded into CHIMES which then determines eligibility based on established business rules and eligibility requirements. CHIMES interfaces with external data sources and utilizes case workers to follow up on discrepancies between the interfaces and reported information in the system. Internal Control Observations As discussed in the Condition section above, we concluded internal controls, as designed, are likely to be ineffective in preventing ineligible individuals from being determined eligible under the department?s processes. We concluded that limiting our review to information in the department?s records would not provide sufficient and appropriate audit evidence on which to base our conclusion over the department?s compliance with federal eligibility requirements for the Medicaid and CHIP programs. The inadequacies in the department?s Medicaid and CHIP client records is considered a restriction on the scope of the audit. By using only that data source, we were unable to obtain sufficient appropriate audit evidence to support a conclusion over compliance. Based on our observations of internal control deficiencies over Medicaid and CHIP eligibility determinations, at this point in the audit we had enough evidence to disclaim an opinion, and we considered whether this approach was most beneficial for our audit. To avoid questioning over $4.02 billion in federal costs for the Medicaid and CHIP programs that would result from a disclaimer of opinion, we considered whether a third-party data source was available. State law allows us access to state tax records, a data source we consider relevant to both affirm the reliability of information in the department?s eligibility records and as the basis for redetermining eligibility in accordance with requirements in the State Plans using MAGI information. We chose to conduct a statistical sample as a means of testing eligibility, using state tax data. Compliance Testing We performed a statistical sample of 188 Medicaid and CHIP case files from a population of 571,862 unduplicated eligibility determinations from fiscal years 2018 and 2019. This population includes the number of applicants determined eligible for Medicaid or CHIP as well as the number of new applications and closed or denied cases that occurred within the audit period. If an individual?s Medicaid or CHIP eligibility was stopped, or if an individual changed eligibility groups during the audit period, the individual may have been included in the population more than one time. Our sample was designed to achieve two objectives: 1) to affirm the reliability of information in the department?s eligibility records; and 2) to redetermine eligibility in accordance with requirements in the State Plans using additional sources of information, including state tax data. We stopped testing after 63 case files due to the significant number of errors identified in our sample. Affirm the Reliability of Information in the Department?s Eligibility Records For each sample item, we performed a comparison of key eligibility factors between the department?s case file information and state tax data. We considered the following eligibility factors: Household Size: For the MAGI-based groups, the use of tax filer status is critical because it drives whether the department should use CMS ?tax file rules? or ?non-tax filer rules? to determine household size. Household size is critical because it sets the allowable income level for both MAGI-based and non-MAGI-based applicants. Income: For MAGI-based groups, MAGI information available on tax records is the basis for income eligibility determinations. As mentioned above, while certain individuals may qualify for Medicaid regardless of income, for some non-MAGI-based eligibility categories, income remains a key eligibility factor. Residency: In order to qualify for Montana?s Medicaid or CHIP programs, an individual must reside within the state?s boundaries. State tax data includes evidence which supports state residency status. The following table summarizes the results of our testing by key eligibility factor as well as whether or not we found the department?s case file information to be supported, or whether there was no state tax data available. See Schedule of Findings and Questioned Costs for chart/table. Redetermine Eligibility in Accordance with Requirements in the State Plans Using Additional Sources of Information Using all data gathered in our sample, we considered whether the eligibility determination made by the department was appropriate. In some cases, all individual eligibility factors were affirmed using state tax data (as discussed in the previous section); however, the eligibility determination made by the department was not consistent with eligibility criteria in the CMS-approved State Plan when state tax data was also considered. Even when we found evidence in state tax data indicating a circumstance that could be an error under federal regulations, this does not necessarily mean the client should have been identified as categorically ineligible for coverage under any Medicaid enrollment category. A significant proportion of the sample errors we identified resulted in a client being placed in the wrong enrollment category. As shown in the table below, we also found additional errors that were not identified as a result of comparisons with state tax data, but were the results of internal control deficiencies or other errors on the part of the department. See Schedule of Findings and Questioned Costs for chart/table. The table below summarizes the results of our testing by a greater level of detail regarding key eligibility factors and overall eligibility redetermination results. See Schedule of Findings and Questioned Costs for chart/table. Of the 26 cases shown in the Department?s Eligibility Determination Not Supported lines above, 17 of them had indications of ineligibility for all eligibility groups. For the remaining 9 cases, the department placed the individual into an incorrect eligibility group. For the 16 cases shown in the No State Tax Data Available line above, the auditor?s determination on the appropriateness of eligibility could not be made due to a lack information available to verify key eligibility factors. The payments made on behalf of these recipients are considered questioned costs because the case records did not include sufficient appropriate audit evidence to fully support the eligibility decision. Results of Department Conducted Review The department conducted its own review of eligibility determinations included in our sample. The department reviewed the 1,512 `member months? associated with our 63 sample items. Based on results of its review, the department acknowledges a 5.8 percent error rate at the `member month? eligibility level in the population tested in our sample. The department also determined a total of $13,546 in medical claims associated with the months when eligibility determinations were not supported. Revisions to State Law The department is taking steps to change the eligibility process, as the 2019 Montana Legislature passed revisions to state law which require the department to verify eligibility using allowed data sources at application. Changes to state law also provide the department access to state taxpayer return information for purposes of verifying the income reported by applicants for medical assistance. These changes will affect our next federal compliance testing cycle (fiscal years 2020 and 2021). Effect: The results of our compliance testing indicate individuals who did not meet eligibility criteria outlined in the State Plan received Medicaid or CHIP benefits during the audit period, resulting in significant questioned costs for both federal programs. Cause: The department has chosen to apply different processes at application for individuals who preliminarily qualify for certain coverage groups under Medicaid as opposed to individuals who preliminarily qualify for the MAGI-based eligibility groups. For example, for non-MAGI-based Medicaid determinations the verification process takes place at application, while the verification process is delayed for applicants under MAGI-based Medicaid and CHIP determinations. The Verification Plan also includes a 10 percent threshold for reasonable compatibility for income, which means the department only follows up with the client when the information provided by external sources is higher than self-attested income by 10 percent or more. We considered whether the 10 percent threshold applied by the department could extend eligibility when a client does not meet the income criteria, and concluded the department?s Verification Plan could lead to instances where external data indicates the client income exceeds the threshold for an eligibility group but the client is permitted to remain on the program without further department review. For example, an adult with a household size of three who self-reports monthly income of $2,200 would qualify for Medicaid Expansion in the 133 percent Federal Poverty Level group. If the external data source indicates the client?s income is $2,400, the department would not conduct follow-up because the difference in self-reported income and the external data source information is within the 10 percent threshold. However, a monthly income of $2,400 would disqualify the adult from eligibility for all Medicaid Expansion groups. Additionally, the data matches are not designed to identify differences in reported versus actual household make-up or to confirm residency. Recommendation: We recommend the Department of Public Health and Human Services, as it relates to the Children?s Health Insurance Program and Medicaid federal programs: A. Revise its Verification Plan to require additional information from the client when income information received from external data sources exceeds the limitation for the client?s preliminarily authorized eligibility group, as required by federal regulations. B. Revise its policies and procedures, including any necessary revisions in the State Plan, to ensure only eligible individuals receive benefits, as required by federal regulations. C. Establish and maintain internal controls to timely verify client eligibility factors for all applicants and clients at application and redetermination. D. Comply with federal regulations and state plan requirements by placing only eligible clients into correct eligibility categories. Views of Responsible Officials: The department does not concur with this finding, and contends the audit work is flawed. For additional information regarding the department?s planned corrective action see the Corrective Action Plan starting on page D-1. Rebuttal of Views of Responsible Officials: We considered the department?s noncurrence to this finding. Throughout the audit and in its written response to this finding, the department has continued to focus on its disagreement with our audit approach, and in doing so, has not been receptive to our communications and has failed respond to the audit evidence which supports: 1. Internal controls over eligibility determinations were not consistently and correctly applied to Medicaid and CHIP populations during the audit period. 2. The department?s internal controls were not sufficiently designed to identify and remove participants from the Medicaid or CHIP programs when participants misrepresent their household composition, sources of income, and residency in order to circumvent the programs? eligibility requirements. Additionally, the department?s own review of client records included in our sample supports a 5.8 percent error rate in `member month? eligibility decisions. This means, for our sample population, eligibility verification or redetermination was not conducted timely and resulted in clients being determined (or remaining) eligible for Medicaid or CHIP benefits when in fact they were either not eligible or were placed into an incorrect eligibility category. As outlined in the finding, using the department determined error rate, errors in eligibility could equate to as much as $99.2 million and $98.2 million in inappropriate benefit payments for the CHIP and Medicaid programs, in total, for fiscal years 2018 and 2019, respectively, when projected to the population as a whole. As such, our recommendation stands.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-002: U.S. Department of Health and Human Services CFDA # 93.775, 93.777, and 93.778, Medicaid Cluster Grant # 1705MT5MAP, 1805MT5MAP, 1905MT5MAP Criteria: Federal regulation, 42 CFR 433.138(d)(1), requires the Department of Public Health and Human Services (department) to use the information from the state wage information collection agency (SWICA) and from the Social Security Administration (SSA) wage and earnings files data to identify Medicaid beneficiaries that are employed and their employers for purposes of identifying the legal liability of third parties. Federal regulation, 42 CFR 433.138(g), requires follow-up on SWICA and SSA information within 45 days. Federal regulation, 42 CFR 433.139, also requires the obligation of the third party be exhausted before Medicaid program costs are used, or if program costs are used, then reimbursement from the third party must be pursued so long as costs to seek reimbursement do not outweigh the total third party liability. Attachment 4.22-A of the State of Montana Medicaid Plan states that the department conducts SWICA wage and earnings matches upon application and on a quarterly basis. The SSA match is conducted upon application and once a year thereafter. Condition: During the audit period, the department did not conduct SWICA or SSA wage and earnings file data matches upon application for the Modified Adjusted Gross Income (MAGI)-based determination process. There is no amendment or waiver to Montana?s Medicaid Plan allowing these data matches or follow-up to be delayed for MAGI-based applicants. Questioned Costs: None identified. However, questioned costs could exist for the MAGI-based applicants where third party obligor should have made payment prior to using Medicaid program funds. Context: The practice of not conducting SWICA or SSA matches upon application is applicable to both state fiscal years 2018 and 2019. Effect: By delaying the data matches for the MAGI-based applicants, the department has not complied with requirements of the State of Montana Medicaid Plan to identify potential third parties at application. Cause: For its MAGI-based applicants, the department follows its verification plan which indicates these same data matches are conducted within 90 days of application. Recommendation: We recommend the Department of Public Health and Human Services conduct State Wage Information Collection Agency and Social Security Administration data matches to identify potential liable third parties at application for all Medicaid applicants, as stated in the State of Montana Medicaid Plan. Views of Responsible Officials: The department does not concur with this finding, stating, in part, it uses many methods to identify the legal liability of third parties and the auditors appear to take issue with the timing of one of the methods used. The department further indicates it follows its approved state plans with regards to SWICA interfaces. For additional information regarding the department?s planned corrective action see the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We considered the department?s nonconcurrence to this finding. The department is correct that this finding takes issue with the timing of the SWICA and SSA interfaces. As outlined in the Condition, there is no amendment or waiver to Montana?s Medicaid Plan allowing these data matches or follow-up to be delayed for MAGI-based applicants. As such, the department has not followed its approved state plan in regard to TPL-related interfaces. Therefore, our recommendation stands.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-003: U.S. Department of Health and Human Services CFDA # 93.775, 93.777, and 93.778, Medicaid Cluster Grant # 1705MT5MAP, 1805MT5MAP, 1905MT5MAP Criteria: Per 42 CFR 455.14, if the Department of Public Health and Human Services (department) receives a complaint of Medicaid fraud or abuse from any sources or identifies any questionable practices, it must conduct a preliminary investigation. In accordance with 42 CFR 455.15, if a provider is suspected of fraud or abuse, the department must refer the case to the state Medicaid Fraud Control Unit (MFCU). In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department did not maintain adequate documentation of investigations of Medicaid providers, as required by federal regulation. During the period under audit, new provider reviews made up over half of all provider investigations conducted by the department. Additionally, Chapter 82, Laws of 2017 Regular Session, established restrictions on overpayment audits including limiting records requests to a six-month period within three previous years, restricting follow-up audits to the same billing codes associated with the initial audit, requiring audits be completed in 90 days, and prohibiting projection of overpayments identified in the sample to a larger set of claims. Questioned Costs: None identified. Context: The department?s Surveillance Utilization Review Section (SURS) performs retrospective reviews of paid claims, recovers identified overpayments, and educates medical providers. The SURS unit closed 692 investigations during the audit period. From this list, we selected a sample of 40 closed case files. This was not a statistically valid sample. We reviewed the case file documentation for the 37 files provided and considered whether the department followed its guidelines which specify the basis for making a referral to MFCU. The department was unable to locate case files for the remaining three cases selected in our sample. For one of the 37 cases reviewed, the documentation in the case file was incomplete. Effect: Absent complete documentation, the SURS unit decision on whether or not to make a referral to MFCU is not supported. Additionally, focusing on new provider reviews limits the department?s ability to identify potentially fraudulent or abusive billing practices by more established providers which make up a larger percentage of overall Medicaid claims and payments. Without changes in department policy and state law, the department?s ability to identify and fully investigate for provider fraud are hindered. During the 2019 Legislative session, Senate Bill 235 proposed such changes, but failed. Cause: The department does not have adequate internal controls to ensure that documentation of provider investigations exists. The department recognized its focus on new provider reviews required modification. Department management indicates quality improvement controls for record keeping were implemented by the SURS unit in May 2019. Additionally, the department claims it has improved new employee training to focus on record keeping, and has implemented internal reviews of new employee case files for completeness for a period of at least the first six months of employment. Recommendation: We recommend the Department of Public Health and Human Services: A. Establish and maintain internal controls to ensure Surveillance Utilization Review Section investigations for provider fraud are completely documented and retained, as required by federal regulations. B. Implement changes in department policy and seek changes in legislation to remove restrictions on provider overpayment audits. Views of Responsible Officials: The department partially concurs with this finding, and indicates, in part, ?The ultimate responsibility for changes in legislation lies with the Legislative Branch, not the department.? The department?s response further states, ?The department cannot implement a policy that conflicts with state law.? The department?s complete response is included in the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We considered the department?s partial concurrence to the finding. While the department agrees its documentation and retention of investigations can be strengthened, the department contends that seeking legislative change to remove restrictions on overpayment audits is outside the department?s control. While we agree the ultimate outcome of any change in statute is subject to the legislative process, the recommendation is that the department take action to begin the legislative process. Seeking legislation to change existing statute is routine agency-level activity. As such, our recommendation stands.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-004: U.S. Department of Health and Human Services CFDA # 93.775, 93.777, and 93.778, Medicaid Cluster Grant # 1705MT5MAP, 1805MT5MAP, 1905MT5MAP Criteria: Per 42 CFR 455.14, if the Department of Public Health and Human Services (department) receives a complaint of Medicaid fraud or abuse from any sources or identifies any questionable practices, it must conduct a preliminary investigation. In accordance with 42 CFR 455.15, if there is reason to believe that a beneficiary has defrauded the Medicaid program, the department must refer it to law enforcement. If there is reason to believe that a beneficiary has abused the Medicaid program, the department must conduct a full investigation of the abuse. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Internal controls to investigate referrals for Medicaid beneficiary fraud and abuse are not designed to ensure full investigations are conducted and referrals to law enforcement occur, as required by federal regulations. Questioned Costs: None Context: The Program Integrity Unit is responsible for investigating any case of alleged fraud and abuse by Medicaid beneficiaries. During the audit, we reviewed the department?s policies and procedures for investigations of Medicaid beneficiary fraud. Per department policy, Program Integrity Unit staff are directed to stop their investigation if fraud is not identified within the first 20 minutes of initial investigation. Additionally, department policy limits referrals of beneficiary fraud to law enforcement only if the established overpayment amount exceeds $10,000. Department management indicated the policy was put into place in October 2018 as a time management tool to assist in addressing a backlog of referrals. Department management reported the policy limitations were removed in September 2019. C-36 Montana Legislative Audit Division Effect: Absent the ability to conduct full investigations or to make complete referrals to law enforcement, the department is unable to demonstrate compliance with federal regulations. Cause: Department policy does not allow for full investigation of fraud allegations or for referral to law enforcement of all instances where beneficiary fraud is reasonably possible, as required by federal regulation. Recommendation: We recommend the Department of Public Health and Human Services: A. Update policies and procedures for Medicaid beneficiary fraud investigations to require full investigations by department staff, and B. Make referrals to law enforcement when there is reason to believe a beneficiary has defrauded the program, as required by federal regulations. Views of Responsible Officials: The department does not concur with this finding, stating in part, ?The auditors appear to take exception to time management guidelines included in desk level procedures. Those guidelines were removed in September 2019.? For additional information regarding the department?s planned corrective action see the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We considered the department?s nonconcurrence to the finding. While the department represents the time restriction in its ?desk level procedures? were a guideline for time management, as written, these procedures do not allow for a full investigation of fraud to be conducted. While the guidelines were removed in September 2019, the guidelines for initial review were in place during the audit period. As described in the finding, without adequate procedures, the department is unable to demonstrate compliance with federal regulations. As such, our recommendation stands.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-005: U.S. Department of Health and Human Services CFDA # 93.775, 93.777, and 93.778, Medicaid Cluster Grants #1705MT5MAP, 1805MT5MAP, 1905MT5MAP, 1705MT5ADM, 1805MT5ADM, 1905MT5ADM, 1705MTIMPL, 1705MTINCT, 1805MTIMPL, 1805MTINCT, 1905MTIMPL, 1905MTINCT Criteria: Per 2 CFR 200.326, contracts must contain applicable provisions for non-Federal entity contracts under federal awards. Appendix II to 2 CFR 200 lists those provisions including a provision that a contract award must not be made to parties listed on the governmentwide exclusions in the System for Award Management (SAM). Federal regulation, 2 CFR 200.303, states that the Department of Public Health and Human Services (department) must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Condition: The department did not include the required language related to debarment and suspension in a contract for premium billing and collection services for the Medicaid program, and department internal controls did not identify or prevent the omission. Questioned Costs: None identified. Context: In an effort to modernize its Medicaid systems, the department is replacing its Medicaid Management Information System (MMIS). The replacement project is referred to as Montana?s Program for Automating and Transforming Healthcare (MPATH), with total estimated costs of $146 million for state fiscal years 2019 through 2021. As part of the audit, we obtained and reviewed 4 contracts related to this effort. We identified one contract in which the required language related to debarment and suspension was not included. Department management provided the purchase order for the entity that bills and receives payments for these services. While the purchase order contains suspension and debarment language, we do not consider this to be a certification by the entity because the purchase order is not signed by the entity. Effect: The department is not in compliance with federal regulations related to required contract language. Cause: Department staff indicate that while the contractor was informed of the federal debarment requirements during the contracting process, the contract attachment relevant to suspension and debarment was inadvertently excluded from the final contract submitted to and signed by the contractor. Recommendation: We recommend the Department of Public Health and Human Services: A. Establish and document internal controls to ensure all relevant contract disclosures and attachments are included in the contract agreement prior to signature. B. Comply with federal regulations by including all applicable and required language in Medicaid contracts with non-federal entities. Views of Responsible Officials: The department does not concur with this finding, stating in part, ?The auditor?s interpretation of what constitutes acceptance of contract terms and conditions is unnecessarily narrow.? The department indicates the Purchase Order contains a clause for debarment, and upon fulfilling the Purchase Order, the vendor has, in effect, made the representation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We have considered the department?s nonconcurrence to the finding. The department?s response fails to address that its contract and Purchase Order are made with two different entities. At the time the contract was signed, the attachment relevant to debarment and suspension was omitted by the department. Subsequently providing a Purchase Order to a different entity does not eliminate the internal control weakness or noncompliance identified by the audit. As such, our recommendation stands.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-006: U.S. Department of Health and Human Services CFDA # 93.767, Children?s Health Insurance Program (CHIP) Grant # 1705MT5021, 1705MT0301, 1805MT5R21, 1805MT5021, 1905MT5021 Criteria: Federal regulation, 42 CFR 457.310(b)(2), limits participation in the Children?s Health Insurance Program (CHIP) for targeted low-income children. Specifically, a targeted low-income child must be neither found eligible or potentially eligible for Medicaid under policies of the state plan, nor covered under a group health plan or health insurance coverage program, with certain exceptions. Federal regulation, 2 CFR 200.303, states that the Department of Public Health and Human Services (department) must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Condition: Federal regulations permit one Medicaid eligibility group to receive CHIP funded health insurance premium payments. Department controls did not prevent other eligibility groups from receiving CHIP funded health insurance premium payments during the period under audit. Questioned Costs: Payments totaling $30,310 are not an allowable use of CHIP funds, and are considered questioned costs. Using the error rate based on the transactions reviewed, total projected questioned costs are $3.5 million for the period under audit. Context: Through its state plan, the department offers CHIP-funded Medicaid benefits for children six to eighteen years of age whose family income is between 101% and 143% of the federal poverty level. Because this group is covered by Medicaid, recipients may be members of the department?s Health Insurance Premium Payment (HIPP) program if the department determines it to be cost effective. Under the HIPP program, the department uses federal program dollars to pay the premiums for health insurance coverage for other insurance policies. Appropriate federal funds used for HIPP depend on the individual?s eligibility for either the Medicaid or CHIP programs. When conducting a sample of CHIP benefit payments, we identified a portion of the transactions were health insurance premium payments. Because we did not expect this activity in our sample population, we isolated the HIPP transactions totaling $5.5 million to conduct a separate audit test. We selected and reviewed eleven of the 7,762 transactions for health insurance premiums. This was not a statistically valid sample. Our review identified seven instances where the department should have used Medicaid funds instead of CHIP funds to pay the third-party health insurance premiums. Effect: The department is not in compliance with federal regulations, and has expended CHIP monies for individuals who did not meet program requirements. Cause: Department officials indicate the unallowable payments resulted from a lack of internal controls to ensure charging mechanisms used in the administration of HIPP payments were accurate and current. Additionally, department officials indicated the costs are allocated to a different department division whose staff is not aware of the specific details of the HIPP program, and is therefore unable to review the financial activity for accuracy. Recommendation: We recommend the Department of Public Health and Human Services: A. Develop internal control procedures to ensure the appropriate funding source is used for its Health Insurance Premium Payment program. B. Use federal Children?s Health Insurance Program funds to pay third-party health insurance premiums only for those individuals who qualify, as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-007: Various* Federal Agencies CFDA # Various*, Research and Development Cluster Grant # Not applicable Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal regulation, 2 CFR 180.305, prohibits the University of Montana (university) from contracting with or making subawards under covered transactions to parties that are suspended and debarred. Federal regulations, 2 CFR 180.210 and .220, state all nonprocurement transactions, irrespective of award amount, are considered covered transactions. Covered transactions include those procurement contracts for goods and services awarded under a nonprocurement transaction, a grant agreement for example, that are expected to equal or exceed $25,000 or meet certain other criteria. Federal regulation, 2 CFR 180.300, requires the university to verify that entities with which it enters into a covered transaction with are not suspended and debarred or otherwise excluded from participating in the transaction. Condition: The university enters into procurement transactions using research and development federal assistance funds. As part of the procurement process, vendors are selected from the university?s procurement system. The university did not have internal controls in place to verify if vendors were suspended and debarred as required by federal regulations. Questioned Costs: No questioned costs identified. Context: Per discussion with university staff, there was no process in place during the audit period. As part of our testing of federal compliance, we reviewed vendors who had entered into research and development transactions with the university. From a population of 342 transactions, we reviewed a sample of 39 vendors who had entered into research and development transactions during the audit period. We looked up the vendors on the System for Award Management, and none of the vendors were excluded. This was a statistically valid sample. In addition to this sample, we judgmentally tested an additional 46 items. None of the additional tested vendors were excluded. Effect: The university was not in compliance with federal regulations and did not have sufficient internal controls in place to ensure transactions were not conducted with suspended and debarred vendors. Without internal control, there is risk the university will unknowingly enter into a transaction with an excluded party. Cause: Per discussion with university staff in vendor maintenance, accounts payable, and procurement, they were not aware if or when the verification took place and they assumed a different office was completing the check. Recommendation: We recommend the University of Montana comply with federal regulations by establishing internal controls to verify vendors are not suspended or debarred from federal procurement transactions. Views of Responsible Officials: The university concurs with the recommendation and has contracted with a new supplier information management system which captures suspension and debarment alerts. These alerts are reviewed by the university?s vendor maintenance administrator. With the new system, suspended and debarred vendors will be excluded from the university?s procurement process. For additional information regarding the department?s planned corrective action see Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-008: U.S. Department of Agriculture CFDA # 10.551 and 10.561, SNAP Cluster Grant #: 201717S251443, 201818S251443, 201919S251443 U.S. Department of Health and Human Services CFDA #93.558, TANF Cluster Grant #: 1701MTTANF, 1801MTTANF, 1901MTTANF CFDA #10.557, Special Supplemental Nutrition Program for Women, Infants and Children (WIC) Grant #: 201818W100643, 201818W500343, 201818W100343, 201817W541243, 201818Y860743, 201818Y860443, 20919W100643, 201918W100643, 201919W500343, 201919W100343, 201918W100343, 201919Y860743, 201919Y860443 Criteria: Federal regulation, 7 CFR 274.1 (i), requires a yearly examination of the State Electronic Benefit Transfer (EBT) service provider for the SNAP Cluster. This is called a SOC-1 Type 2 examination, which is further defined and discussed below. Federal regulations, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing procedures to ensure eligibility determinations are performed in accordance with program requirements. Condition: The Department of Public Health and Human Services (department) does not have adequate internal controls to ensure transactions were processed in compliance with federal SNAP, WIC and TANF program requirements. The department has not complied with federal requirements to obtain an examination of its EBT service provider for the SNAP program. Questioned Costs: None identified. Context: The department uses the same electronic benefit processing service provider (EBT service provider) for its SNAP, WIC and TANF federal programs. The EBT service provider is responsible for settlement, or payment, to retailers that have agreed to accept EBT cards for food (SNAP and WIC) or other (TANF) purchases. Because the TANF program provides cash assistance, EBT transactions are similar to those processed for any purchase made with a debit card. The following table represents the total amount of benefits processed by the EBT service provider for fiscal years 2018 and 2019. See Schedule of Findings and Questioned Costs for chart/table. A System and Organization Controls (SOC) examination can be structured in various ways to meet the needs of intended users of information included in the SOC report. The following table outlines two types of SOC examinations: See Schedule of Findings and Questioned costs for chart/table. During the period under audit, the department received a SOC-2 Type 2 report for its EBT service provider. However, the SOC-2 report covered only the Security, Availability, and Confidentiality Trust Principles. The SOC-2 report did not address the Processing Integrity trust principle, which considers whether system processing is complete, accurate, timely and authorized. While not required for the TANF and WIC programs, a SOC-1 Type 2 report provides the department and its auditors with assurances regarding proper design and operation of controls at the EBT service provider. The department did obtain a SOC-2 Type 2 report, but the report does not cover the Program Integrity trust principle which evaluates whether system processing is complete, accurate, timely, and authorized. Prior to transitioning to the current EBT service provider in June 2017, the department conducted extensive testing and certification of system controls and processes for the SNAP program. Results of similar testing during the period prior to transition for the TANF and WIC programs, which were implemented in June 2017 and September 2017, respectively, were provided by the department. As a result, the department is able to demonstrate that the system was properly designed at the time of implementation for both the TANF and WIC programs. Effect: Without the annual SOC-1 examination, the department is not in compliance with related SNAP program federal regulations. Additionally, without updated EBT service provider assurances provided by a SOC-1 report, the department is unable to fully demonstrate it has established and maintained adequate internal controls to ensure federal program requirements are met for its SNAP, TANF, and WIC programs for the entire audit period. Further, the department is at risk for reporting incomplete or inaccurate information to the federal government, providing incorrect benefit amounts to clients, and over- or under-drawing benefit reimbursements for its federal programs. Cause: For the SNAP program, the department was unaware of the federal requirement to obtain an annual SOC-1 Type 2 examination by an independent auditor of the transaction processing of the EBT service provider. The department chose to obtain a SOC-2 Type 2 report for the EBT service provider, but overlooked the need to include the Processing Integrity Trust Principle relevant to system processing controls. Recommendation: We recommend the Department of Public Health and Human Services: A. Obtain an annual SOC-1 Type 2 report over the Electronic Benefit Transfer service provider for Supplemental Nutrition Assistance Program, as required by federal regulations. B. Establish and maintain adequate internal controls to ensure Supplemental Nutrition Assistance Program, Temporary Assistance for Needy Families, and Special Supplemental Nutrition Program?Women, Infants and Children benefit transactions achieve applicable compliance requirements. Views of Responsible Officials: The department partially concurs with this finding, citing that, in spite of the absence of SOC 1 Type 2 examination, it maintains there are significant controls in place to ensure benefit transactions achieve applicable compliance requirements. For additional information regarding the department?s planned corrective action see the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We have reviewed the department?s partial concurrence with this finding. The department?s views do not contain any information not already considered during the audit. As such, we maintain our position as reported.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-009: U.S. Department of Agriculture CFDA #10.551 and 10.561, SNAP Cluster Grant #: 201717S251443, 201818S251443, 201919S251443 Criteria: Federal regulation, 2 CFR 200.303, states that the Department of Public Health and Human Services (department) must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Federal regulation, 7 CFR 274.4, requires a reconciliation comparing retailer credit activity as reported into the banking system to client transactions maintained by the processor to the funds drawn down by the state or contractor. Condition: The department did not complete all required reconciliations over SNAP benefits information. Specifically, the department is required to compare the following three data sources to each other: ?? Retailer transactions reported to the Electronic Benefit Transfer (EBT) banking system?these are transactions processed by the retailer (grocery store/vendor) on behalf of the SNAP client. ?? Client transactions maintained by the EBT service provider?this is SNAP benefits redeemed. ?? Funds drawn for reimbursement from the federal treasury?as permitted by federal regulations, the EBT service provider draws state benefit reimbursements directly from the federal government. The two-way reconciliation completed by the department did not incorporate retailer transaction activity or the drawdown activity from the federal treasury. Consequently, department procedures do not cover the requirements set forth in federal regulations. Questioned Costs: We believe questioned costs related to the SNAP program could exceed $25,000 for the audit period. Context: A daily two-way reconciliation conducted by the department compares benefits issued per the department?s system to the benefits applied to client EBT cards according to EBT service provider reports. In our sample of 44 of these reconciliations, the department did not document the reason for the difference for 7 reconciliations. This was a statistically valid sample. While two-way reconciliations were conducted, the required three-way reconciliation was not completed. Additionally, when partial reconciliations were completed, the department did not consistently document its follow-up and resolution of differences identified. Effect: Without all necessary reconciliations, the department is unable to confirm the accuracy of the SNAP benefits drawn by the EBT service provider on behalf of the State of Montana. Further, the department has no assurance that SNAP benefit draws were based on benefits redeemed by program participants at retailers. Cause: For the required three-way reconciliations not completed, department staff believed there were adequate controls in place at the EBT service provider and relied on the EBT service provider to complete the reconciliations. However, the department was not able to provide evidence that required reconciliations were completed by the EBT service provider. Additionally, the department does not have evidence about the reliability of data or procedures, including reconciliations, involving procedures at the EBT service organization, as discussed in finding #2019-008. Recommendation: We recommend the Department of Public Health and Human Services: A. Establish and maintain adequate internal controls to ensure reconciliations of SNAP benefits issued, redeemed, and unredeemed are conducted, as required by federal regulations. B. Conduct and document follow-up on differences identified in required reconciliations. Views of Responsible Officials: The department partially concurs with this finding, citing that necessary reconciliations required by FNS were conducted but not consistently documented to completion through follow-up of discrepancies identified. For additional information regarding the department?s planned corrective action see the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We have reviewed the department?s partial concurrence with this finding. The department?s views do not contain any information not already considered during the audit. Absent documentation, the department is unable to fully demonstrate compliance with applicable federal compliance requirements. As such, we maintain our position as reported.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-010: U.S Department of Agriculture CFDA # 10.551 and #10.561, SNAP Cluster Grant #: 201717S251443, 201818S251443, 201919S251443 Criteria: Federal regulation, 31 CFR 205.6(b), specifies the Treasury State Agreement (TSA) is effective until terminated. Montana?s 2018 and 2019 TSAs described Modified Actual Clearance as the state requesting the amount of Electronic Benefit Transfer (EBT) benefits and fee payments processed the previous day. Per the TSA, the Department of Public Health and Human Services (department) should be completing the benefits draw process for the Supplemental Nutrition Assistance Program (SNAP). The compliance supplement indicates states may authorize their Electronic Benefits Transfer (EBT) contractors to make benefit draws. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing procedures to ensure eligibility determinations are performed in accordance with program requirements. Condition: The department has permitted the EBT service provider to execute over $300 million in federal cash draws for the SNAP program, which is contrary to the state?s TSA agreement. Additionally, the department did not provide an update to the TSA for changes in its processes. Questioned Costs: To avoid duplication, questioned costs are reported in Finding 2019-009. Context: Approximately $163 million and $149 million in reimbursement draws from the federal government for fiscal years 2018 and 2019, respectively, were executed directly by the EBT processor for the SNAP program. Effect: Because the TSA specifies the department conducts the draws for SNAP benefits, permitting the EBT contractor to perform the draws results in noncompliance with the state?s TSA. Cause: Annually, the Department of Administration solicits input from state agencies regarding necessary changes to the TSA. The department overlooked the need to update the TSA when entering into the agreement with the EBT service provider. Recommendation: We Recommend the Department of Public Health and Human Services: A. Work with the Department of Administration to properly update the Treasury State Agreement for benefit draws related to the SNAP Cluster. B. Comply with the Treasury State Agreement by completing the SNAP Cluster benefit draws from the federal government until such time as the Treasury State Agreement is revised. Views of Responsible Officials: The department partially concurs with this finding, citing the administrative burden to conduct SNAP Cluster benefit draws is too significant to fully comply for the remainder of state fiscal year 2020. For additional information regarding the department?s planned corrective action see the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We have reviewed the department?s partial concurrence with this finding. The department?s views do not contain any information not already considered during the audit. As such, we maintain our position as reported.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-011: U.S. Department of Agriculture CFDA #10.551 and 10.561, SNAP Cluster Grant #: 201717S251443, 201818S251443, 201919S251443 Criteria: Federal regulation, 2 CFR 200.303, states that the Department of Public Health and Human Services (department) must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Federal regulation, 7 CFR 272.10, requires the department to sufficiently automate its SNAP operations and computerize their systems for obtaining, maintaining, utilizing and transmitting information concerning SNAP. This includes: ?? Determining eligibility, calculating benefits, or validating the eligibility worker?s calculations by processing and storing all information necessary for eligibility determination and benefit calculations, as well as identifying and alerting department staff and clients when eligibility or benefit changes occur. ?? Providing an automatic cutoff of participation when annual renewal information and procedures are not provided. ?? Generating data necessary to meet federal issuance and reconciliation reporting requirements. Specifically, the SNAP information system must produce data for the federal FNS-46 SNAP Issuance Reconciliation Report and the FNS-209 Status of Claims Against Households report. Condition: The department?s internal controls related to use of the Automated Data Processing (ADP) systems for SNAP could be strengthened in the following areas: follow-up on results of the department?s eligibility audits, training for staff completing eligibility determinations, and adequate support for federal reports. Additionally, all portions of SNAP reporting are not automated by the ADP system, as required by federal regulation. Questioned Costs: No questioned costs identified. Context: Eligibility Audits and Staff Training We reviewed the top ten reasons for audit eligibility errors for each fiscal year 2018 and 2019 as reported by the department?s internal audits of SNAP eligibility determinations and C-52 Montana Legislative Audit Division benefits calculations because the department indicated these audits were a key control for the SNAP ADPA systems compliance requirement. Each of the ten reasons had underlying issues reported. We were testing to see if there were patterns to indicate the information in the department?s eligibility system (CHIMES) was inaccurate or that the system was not working effectively. In total, the department identified 9 instances where errors were the result of computer programming issues. Additionally, the department?s internal audits identified 48 errors due to incorrect case file information, and an additional 58 errors resulting from information being disregarded or not applied in eligibility determinations and benefit calculations. While the department shares results of the monthly eligibility audits with SNAP program staff, eligibility errors continued to remain high for the audit period. Our audit work did not include a sample. Reporting The department uses the Accounts Receivable Management System (ARMS) to track SNAP accounts receivable. While most of the information for the FNS-209 report is generated from ARMS, the beginning balance for the report must be manually adjusted. The department is able to retrieve accurate beginning balances from the federal system, but the beginning and ending balances are defined as key line items by federal regulations. As such, these balances should be automated in the department?s systems. While the department completes a daily reconciliation between the department?s eligibility system and the service organization?s system for newly issued SNAP benefits, the department does not complete and document a monthly reconciliation which supports the information included in the FNS-46 report. Effect: The department is not in compliance with federal regulations. Additionally, the accuracy of information included in required federal reports is at risk due to identified deficiencies in internal controls. Cause: The department cites staffing shortages and inadequate staff training as reasons for the increased eligibility errors. The ARMS system does not is not designed to report beginning balances for the FNS-209 report. The department contends the daily reconciliation is sufficient for purposes of the FNS- reports. The lack of Service Organization Controls (SOC) assurances over its EBT service organization, as reported in #2019-008, also contributes to the internal control weakness. Recommendation: We recommend the Department of Public Health and Human Services enhance internal control and compliance with federal regulations for the Supplemental Nutrition Assistance Program by: A. Maintaining documentation to demonstrate consideration of the results of monthly Quality Assurance Division eligibility audits. B. Conducting and documenting training for staff completing eligibility determinations to address common errors, when identified by monthly Quality Assurance Division eligibility audits. C. Updating the Accounts Receivable Management System to automatically generate the beginning balances for the FNS-209 quarterly report, as required by federal regulations. D. Ensure the FNS-46 report is supported by accurate information via an audit of the service organization or a monthly reconciliation. Views of Responsible Officials: The department does not concur with this finding. The department suggests that the auditor has not addressed the ?underlying issues associated with the error rate? in the recommendations. The department also contends a daily reconciliation meets the federal requirements for the monthly FNS-46 report. For additional information regarding the department?s planned corrective action see the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We have reviewed the department?s nonconcurrence with this finding. As discussed with the department throughout the audit, we reviewed the department-conducted audit results because the department noted these audits were an important control over the ADP system. In our review, trends identified indicate further training can assist department staff gather information and apply necessary corrections. Additionally, because the department?s monthly FNS-46 report is supported by the EBT contractor?s system over which the department has not obtained an independent SOC 1 Type 2 (as further discussed in Finding 2019-008), absent a documented monthly reconciliation, a daily undocumented visual check is insufficient to support the FNS-46 reports. We maintain our position as reported.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-012: U.S. Department of Health and Human Services CFDA #93.558, TANF Cluster Grant # 1701MTTANF, 1801MTTANF, 1901MTTANF Criteria: Federal regulation, 2 CFR 200.303, states that the Department of Public Health and Human Services (department) must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Federal regulations, 45 CFR 205.55 and 42 USC 1320b-7, require the department to twice annually coordinate data exchanges with other federally assisted benefit programs, to request and use income and benefit information when making eligibility determinations, and adhere to standardized formats and proceedings in exchanging information. One required data exchange is for unearned income information from the Internal Revenue Service (IRS). Federal regulation, 45 CFR 205.56, directs the department to use the unearned information downloaded from the IRS, in conjunction with other information, for determining individuals? eligibility for assistance under the State plan and determining the amount of assistance. Condition: The department did not use information from the IRS in making eligibility determinations. Additionally, in some instances department procedures were insufficient to allow for IRS information obtained to be used. Questioned Costs: None identified. Context: Our prior audit reported the department obtained the required information but was not subsequently using the information in evaluating eligibility and assistance determinations. During the current audit, we determined the department was able to complete the IRS data comparison one of the four times it was required. Repeat Finding: Montana?s prior Single Audit report for the two fiscal years ended June 30, 2017, included a recommendation (#2017-023) that the department comply with federal regulations by comparing income information obtained from the IRS to information contained in individual case records in order to determine the effect, if any, in individuals? eligibility or amount of assistance. Effect: The department did not comply with the required IRS data comparison for the audit period. Without fully using the IRS data to evaluate eligibility and assistance determinations, the department risks errors in benefit costs incurred for the TANF program. Cause: In two instances where the data comparison was not completed, the department was unable to convert the IRS data into a usable format. In another instance, the department did not receive the file required from the IRS and did not follow-up to ensure data was received. Although the department requested information from the IRS, the department?s procedures did not instruct staff when or how to follow-up when a file was not returned from the IRS. Additionally, procedures documents did not instruct staff regarding the conversion of the IRS data. Department staff also suspect IRS files were not provided or were provided late due to the federal government shut downs. Department management cites one section of United States Code which specifies no state shall be required to use the IRS information to verify the eligibility of all recipients. We agree the IRS information is not required to verify the eligibility of all recipients. However, other federal regulations require the IRS data be used in conjunction with other information for determining an individual?s eligibility and amount of assistance, as well as changes to eligibility. Recommendation: We recommend, with respect to the Temporary Assistance for Needy Families program Income Eligibility and Verification System requirements, the Department of Public Health and Human Services: A. Develop and maintain internal controls to ensure staff follow-up when the file from the IRS is not received timely, and properly convert the file to a usable format upon receipt. B. Comply with federal regulations by comparing income information obtained from the Internal Revenue Service to information contained in the individual case records in order to determine the effect, if any, on individuals? eligibility or amount of assistance. Views of Responsible Officials: The department does not concur with this finding and indicates the recommendations are not necessary, as the department is compliance with federal regulations with regard to use of the DIFSLA file. For additional information regarding the department?s planned corrective action see the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We have reviewed the department?s nonconcurrence with this finding. As outlined in the finding, the department completed the required IRS data comparison one of the four times it was required. As such, the department has not complied with federal regulations with regard to the use of IRS information. Additionally, the department fails to fully recognize that IRS information is required by federal regulations in making eligibility determinations for individuals. We maintain our position as reported.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-013: U.S. Department of Health and Human Services CFDA #93.558, TANF Cluster Grant # 1701MTTANF, 1801MTTANF, 1901MTTANF Criteria: Federal regulation, 2 CFR 200.303, states that the Department of Public Health and Human Services (department) must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Federal regulations, 45 CFR 264.1 (c) and (e), specify the average number of families that include a head of household who has received assistance under any state program funded by federal Temporary Assistance for Needy Families (TANF) funds for more than 60 countable months may not exceed 20 percent of the average monthly number of all families to which the state has provided assistance during the current or immediately preceding fiscal year. Condition: To ensure the limitation in federal regulation is achieved, the department uses a spreadsheet as its internal control to track clients receiving extended benefits. The department?s spreadsheet to track cases with extended benefits for the TANF program was incomplete. Questioned Costs: None identified. Context: The department maintains a spreadsheet to track the number of cases receiving TANF benefits beyond 60 months. During the audit, we compared the department?s tracking spreadsheet to a listing from the Combined Healthcare Information and Montana Eligibility System (CHIMES) system, and noted the department?s tracking spreadsheet was not complete. The spreadsheet listed 17 cases while the CHIMES report listed 35 cases. Based on an average monthly TANF caseload of 3,614, the department may allow up to 723 TANF participants to exceed 60 countable months of assistance under the program. The prior year average monthly caseload was 4,355. Effect: Although our audit did not identify an excess number of participants exceeding the 60-month limitation for TANF assistance, without maintaining an accurate tracking mechanism, the department is at risk of exceeding the limitation outlined in federal regulation. Cause: The department cites human error as the reason the manual tracking spreadsheet was incomplete. Recommendation: We recommend the Department of Public Health and Human Services develop and maintain internal controls, in accordance with federal regulations, to ensure its tracking spreadsheet for recipients of extended TANF Cluster benefits is complete. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-014: U.S. Department of Health and Human Services CFDA #93.558, TANF Cluster Grant # 1701MTTANF, 1801MTTANF, 1901MTTANF Criteria: Federal regulation, 2 CFR 200.303, states that the Department of Public Health and Human Services (department) must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Federal regulation, 45 CFR 265.3, require submission of quarterly Temporary Assistance for Needy Families (TANF) Financial Reports (ACF-196R). Instructions for the ACF-196R reports specify: ?? A state should not revise unobligated funds in prior years once it liquidates the funds and reports on them in future fiscal periods. ?? If a state revises an expenditure reported in a prior year which affects the amount of federal unliquidated obligations, then it should revise the report. Condition: Contrary to instructions for federal reporting, federal reports included expenditures which were incurred by the state after the reporting period ended. Questioned Costs: None identified. Context: We reviewed two of the eight ACF-196R reports required for the TANF program during the audit period. This was not a statistically valid sample. In the revised report submitted for the period ended September 30, 2018, which was revised in December 2018, we noted the department included expenditures which were not incurred by the state until after the reporting period had ended. Specifically, we noted total federal expenditures for the 2017 grant were over-stated by $2.2 million on the September 2018 report because the department had included costs incurred through December 2018. Regarding the additional amounts reported by the department, because the costs were not incurred by the state until after September 30th, there is no impact on unliquidated obligations. Therefore, costs incurred after September 30th should not be included on the report for the period ended September 30, 2018. Instead, these costs should be included on the appropriate federal award report for the federal fiscal year ending September 30, 2019. Effect: The department has misrepresented federal expenditure activity in its reports to the federal government. Cause: The department intentionally included adjustments in its September 30, 2018, federal report for costs incurred by the state after September 30, 2018. Recommendation: We recommend the Department of Public Health and Human Services: A. Include only current cumulative expenditures in its federal Temporary Assistance for Needy Families reports. B. Develop and implement internal controls to ensure only expenditures incurred during the reporting period are included on federal Temporary Assistance for Needy Families reports. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-015: U.S. Department of Health and Human Services CFDA #93.558, TANF Cluster Grant #: 1701MTTANF, 1801MTTANF, 1901MTTANF CFDA #93.658, Foster Care?Title IV-E Grants #1701MTFOST, 1801MTFOST, 1901MTFOST Criteria: Federal regulation, 2 CFR 200.317, requires the state to follow the same policies and procedures used for non-federal funds when procuring property and services under a federal award. Federal regulation, 45 CFR 75.329, further specifies the type of procurement methods the Department of Public Health and Human Services (department) must follow for its public welfare programs. Federal regulation, 2 CFR 200.88, requires a competitive process for all procurements in excess of $150,000. The department is delegated certain purchasing authority from the Department of Administration?s Procurement Bureau. Under the delegation agreement, the department may use the following purchasing methods: ?? Small Purchases ? for total contract value of $5,000 or less, the department may choose a purchasing technique that best meets its needs. ?? Limited Solicitations ? for total contract value between $5,001 and $25,000, the department must obtain and document prices from a minimum of three viable sources. ?? Formal Competition ? for total contract value between $25,001 and $200,000, the department must use either an invitation for bid or request for proposal process. ?? Sole Source ? for total contract value up to $200,000, the department determines whether a purchase qualifies as sole source. Condition: Contrary to state procurement policies and federal regulations, the department continues to make payments to vendors for services without having a contract in place. Questioned Costs: We question $805,539 in costs for the Temporary Assistance for Needy Families (TANF) program for the audit period. Context: The department can use a portion of its federal TANF funds to pay costs associated with children in Foster Care. During the audit period, the department did not follow federal regulations and state procurement policies when incurring over $6 million in total costs from all funding sources for nonmedical services for the Foster Care program. Our review was limited to service costs for one-on-one supervision of youth, chemical dependency evaluations, urine analyses, and support services for a child placed in the Foster Care program. This was not a statistically valid sample. Our prior audit determined these services did not meet the statutory exemption in state law for services from health care providers because these services are not provided by health care providers. We identified four vendors whose total annual payments exceeded the department?s delegation agreement level of $200,000, which requires approval from the Department of Administration. For these four vendors, the total annual payments exceeded the $150,000 federal threshold which requires a competitive procurement process. Repeat Finding: Montana?s prior Single Audit report for the two fiscal years ended June 30, 2017, included a recommendation (#2017-024) that the department comply with state laws and federal regulations by following state procurement policies to obtain services for the TANF and Foster Care programs. The department disagreed with our recommendation as they believe the services in question are exempt from procurement requirements based on state statute. The federal Administration for Children and Families sustained the finding and recommendation, but did not pursue a monetary penalty against the department. Effect: By not following applicable procurement procedures, payments to these vendors are not an allowable use of TANF funds. Cause: The department believes the exclusions in law for medical services (section 18-4-132, Montana Code Annotated) apply to these services. Recommendation: We recommend the Department of Public Health and Human Services comply with state law and federal regulations by following state procurement policies to obtain services for one-on-one supervision of youth, chemical dependency evaluations, urine analyses, and support serviced for a child placed in the Foster Care program using Temporary Assistance for Needy Families funds. Views of Responsible Officials: The department does not concur with this finding, citing it complies with state procurement policies and federal regulations. For additional information regarding the department?s planned corrective action see the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We have reviewed the department?s nonconcurrence with this finding. The department?s views do not contain any information not already considered during the audit. As such, we maintain our position as reported.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-016: U.S. Department of Health and Human Services CFDA #93.658, Foster Care ? Title IV-E Grants #1701MTFOST, 1801MTFOST, 1901MTFOST Criteria: Federal regulation, 2 CFR 200.331 (a), requires the subrecipient be informed of the federal award information. Required disclosures include, but are not limited to: The federal award identification number, Amount of federal fund obligated to the subrecipient, Applicable indirect cost rates for the federal award, CFDA title and number, Federal awarding agency, Award name and number, Award year, Permission for department officials and auditors to have access to the subrecipient?s records, and Terms and conditions concerning the closeout of the subaward. Federal regulation, 2 CFR 200.303, states that the Department of Public Health and Human Services (department) must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Condition: Department procedures did not detect omissions from subrecipient agreements, and the department did not include the required subrecipient disclosures in newly signed subrecipient agreements with the state?s tribal organizations for the Foster Care program. Questioned Costs: No questioned costs identified. Context: In November 2017, the department signed new agreements with seven tribal organizations. None of these new agreements include the required subrecipient disclosures. In addition, the department?s agreements with two colleges/universities which provide services under the Foster Care program are also missing the required subrecipient disclosures. Repeat Finding: In Montana?s Single Audit for the two fiscal years ended June 30, 2015, we recommended (#2015-014) the department properly classify its agreements with the state?s tribal organizations as subrecipients, and comply with all federal regulations regarding subrecipients. Because the department had incorrectly classified the tribal organizations as vendors rather than subrecipients, the related agreements with the tribal organizations were missing required subrecipient disclosures. In Montana?s Single Audit for the two fiscal years ended June 30, 2017, we concluded the recommendation was partially implemented and made no further recommendation because the department represented it intended to include the subrecipient language in the next tribal agreements which were due in fiscal year 2018. Effect: The department has not complied with federal regulations regarding required subrecipient disclosures. Additionally, failure to provide subrecipients with the required federal award information increases the risk of subrecipient noncompliance with federal requirements. Cause: Department staff overlooked the need to include the subrecipient disclosures for the newly signed Foster Care contracts. Recommendation: We recommend the Department of Public Health and Human Services: A. Establish and document internal controls to ensure required subrecipient disclosures are included in Foster Care contract agreements prior to signature. B. Ensure the required subrecipient disclosures are included in Foster Care contract agreements, as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. However, the department indicates recommendations part A and B are redundant. For additional information regarding the department?s planned corrective action see the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We have reviewed the department?s concurrence with this finding, and provide the following clarification. Recommendation part A addresses a material weakness in internal control over subrecipient monitoring. Recommendation part B addresses the absence of required subrecipient disclosures in subrecipient agreements, which is noncompliance with federal regulations. We maintain our position as reported.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-017: U.S. Department of Health and Human Services CFDA #93.658, Foster Care ? Title IV-E Grants #1701MTFOST, 1801MTFOST, 1901MTFOST Criteria: Federal regulation, 2 CFR 200.403 (g), specifies costs must be adequately documented to be allowable under the award. Federal regulation, 45 CFR 1356.60(b)(2), requires all training activities and costs funded under Title IV-E be included in the Department of Public Health and Human Service?s (department) training plan for Title IV-B. Regarding training plans for the Foster Care program, federal regulation, 45 CFR 235.63, in part, specifies federal financial participation in costs are available when certain conditions are met. These conditions include, but are not limited to: Grants to educational institutions must be made for the purpose of developing, expanding, or improving training for personnel employed by the state or individuals preparing for employment by the state. Grants are made for an educational program (curriculum development, classroom instruction, field instruction, or any combination of these) that is directly related to the department?s training program. For stipends, persons preparing for employment are selected by the state agency and accepted by the school. Federal regulation, 45 CFR 235.65, specifically disallows salaries of supervisors from participation in federal match. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department incurred training related costs without obtaining detailed documentation to support the costs were allowable under the federal Foster Care requirements. Additionally, department controls for certain Foster Care payments require strengthening. Questioned Costs: We estimate questioned costs totaling $969,176 for the period under audit. Likely questioned costs could exceed $4 million, the value of college training contracts, if other services billed by the college do not align with federal program requirements or do not directly benefit the department?s Foster Care training program. Context: The department maintains Foster Care contracts with seven tribes and two colleges/universities (colleges). Foster Care IV-E funds are provided to these entities to either help administer the Foster Care program, provide stipends to college students studying social work, or to provide training to department staff. We conducted a sample of 17 invoices from a total of 176 transactions totaling $4.1 million which were submitted by the tribes or the colleges. Our sample was not statistically valid. We identified 15 instances where supporting documentation did not exist or supporting documentation was not detailed enough to determine whether the costs were allowable. Examples for each a college and tribal payment are described below. Support for one college invoice consisted of a printout of monthly expenditures incurred by a college, but there were no supporting receipts or details to indicate what was purchased. The listing also showed payroll costs incurred, but supporting documentation was neither specific as to which employees were paid nor for what purpose. As such, we were unable to determine whether the costs incurred by the college were authorized under the contract and allowable for reimbursement via the Foster Care program. Support for one tribal payment consisted of a standardized billing invoice, which is utilized by all of the tribes, that outlined personnel positions under the contract, the individual salaries including fringe benefits of the personnel, and operating expenditures. Because no other support was provided by the tribe, we could not verify if the expenditures outlined on the invoice actually were incurred. Of the 17 invoices tested, 8 were transactions related to training costs. Because the invoices did not specify which training task for which the department was being billed, we reviewed the entire contract in comparison to the associated training plan. Our review identified several costs outlined in the contract which were not included in the training plan as well as contract budget items which are specifically disallowed or only permitted under specific circumstances under federal regulations, as summarized following table. See Schedule of Findings and Questioned Costs for chart/table. Salaries for directors and supervisors are allowed at 50% of the associated costs if certain conditions are met. We noted in our review of both the contract budgets and associated payments that federal monies were the only source of funding planned and spent on these activities. For stipends, the department inappropriately delegated selection of stipend recipients to the college. Additionally, department management claims department staff actively participated in the selection process for stipend recipients. However, the department did not provide evidence to support this claim. As such, the costs associated with salaries and stipends are not allowable under federal regulations. Effect: Without adequate supporting documentation, the department is unable to demonstrate compliance with internal control requirements in federal regulation. Additionally, for payments which lack adequate support, the department incurred costs for unallowable activities under the federal award. Cause: For tribal subrecipient payments, the department believes the documentation it maintains is sufficient. Billing forms submitted to the department contain summarized information for wages, benefits, travel costs, and other administrative cost categories. We did not observe evidence where additional supporting documentation other than the billing form was obtained. Department staff indicate they do not review supporting documentation when performing site visits for the tribes. Additionally, the department contends its contract with colleges include directives on appropriate accounting and billing practices, as well as language which would allow for the acquisition of additional information if there is a billing question. However, during the audit period the department did not request such clarifying information to ensure the underlying activity was for allowed activities related to its training program. Recommendation: We recommend the Department of Public Health and Human Services: A. Reimburse colleges and tribes only for activities allowed by federal regulation for the Foster Care program. B. Design and implement internal control to ensure detailed support for college and tribal invoices is obtained, reviewed, and approved prior to payment. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-018: U.S. Department of Health and Human Services CFDA #93.658, Foster Care ? Title IV-E Grants #1701MTFOST, 1801MTFOST, 1901MTFOST Criteria: Instructions for completion of the CB-496 report indicate the Federal Share of Child Support Collections includes child support collections on behalf of Title IV-E eligible children on whose behalf maintenance assistance payments have been reported in either Part 1 or Part 3 of the CB-496 report. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacks internal control to ensure all required information is included in Foster Care CB-496 reports, which resulted in incomplete and inaccurate reports submitted during the audit period. Questioned Costs: None identified. Context: Child support recoveries are required to be included in Line 1 of the CB-496 Foster Care reports. This information was not included in 4 out of 8 reports submitted for the period under audit. Effect: The department is unable to demonstrate compliance with internal control requirements in federal regulation. Additionally, without adequate internal control, the department submitted and continues to risk submitting incorrect and incomplete information in its Foster Care reports. Cause: Due to a change in the procedures document, internal control procedures did not direct department staff to include child support collections in Line 1 of the CB-496 report. Additionally, department staff indicate child support recoveries are less than $20,000 per quarter, and as such the variance between quarters was not significant enough to trigger additional follow-up prior to report submission. Recommendation: We recommend the Department of Public Health and Human Services: A. Design and implement internal control to ensure child support recoveries are properly reported on its Foster Care CB-496 reports. B. Submit complete and accurate information in its Foster Care CB-496 reports. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-019: U.S. Department of Health and Human Services CFDA # 93.575 and 93.596, CCDF Cluster Grant #: 2017G996005, 2018G996005, 2019G996005, 2017G999004, 2018G999004, 2019G9990042017G999005, 2018G999005, 2019G999005 Criteria: Federal regulation, 2 CFR 200.303, states that the Department of Public Health and Human Services (department) must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Federal regulation, 45 CFR 98.60, requires Discretionary Funds to be obligated by the end of the 2nd fiscal year after the award, Mandatory Funds to be obligated by the end of the fiscal year in which the funds are granted (when Matching Funds are received), and both the Federal and non-Federal share of Matching Funds to be obligated in the fiscal year in which the funds are granted. Federal regulation, 45 CFR 98.55(3), requires all Mandatory Funds for states to be obligated by the end of the fiscal year in which they are awarded prior to receiving Federal Matching Funds. This section also indicates federal matching funds are available for expenditures based on a formula, for allowable activities as described in the approved state plan. Obligation is defined by federal regulation, 45 CFR 75.2, as orders placed for property and services, contracts and subawards made, and similar transactions during a given period that require payment by the non-Federal entity during the same or a future period. Federal regulation, 45 CFR 98.6, does allow for obligations of funds occurring upon entering into agreement through a subgrant with the third party issuing certificates to a family. Condition: The department does not have internal controls in place to ensure CCDF funds are obligated as required by federal regulations, and complete evidence of such obligation has not been provided by the department. As such, we can only conclude the department has not obligated its Mandatory or Discretionary Funds. Additionally, because the department has not obligated its Mandatory Funds, it is not eligible to receive federal Matching Funds. Questioned Costs: We question Matching Funds received by the department totaling $9,158,195. We also question unobligated Mandatory Funds of $3,166,460. Context: In both fiscal years under audit, the department received a Matching Fund grant for CCDF. The department must obligate its Mandatory Funds prior to being eligible to receive Matching Funds. Under the CCDF program, the department contracts with entities around the state who evaluate needs and authorize certificates to families for reduced cost child care. In relation to these contracts, we requested support to confirm the Mandatory and Matching funds were obligated by the end of the fiscal year they were granted, as required by federal regulations. The department responded they obligate the Mandatory Funds through their certificate plans using historical data and projections based on caseload. Federal regulations allow for an obligation to occur when there is a contract with a third-party for determining eligibility and issuing child care certificates. While the department provided a chart to demonstrate expenditures tracking, the tracking mechanism lacked detail by individual federal grant award or by types of expenditure such as certificates or grant payments. As such, we have no evidence to confirm full obligation of each federal grant award occurred within the required time frame. Effect: The department is not in compliance with federal regulations. Cause: When we communicated a control issue related to period of performance, the department provided other controls related to the federal program but did not explain controls related to the period of performance by each funding type. The department noted they estimate obligations based on historical data and project based on caseload to determine and report obligation. Documentation provided by the department lacked sufficient detail to demonstrate compliance. Recommendation: We recommend the Department of Public Health and Human Services: A. Develop internal controls to document the obligation of all funding types for the Child Care Development Fund federal award. B. Ensure obligation for Mandatory, Discretionary, and Matching funds for federal Child Care Development Fund awards occurs within the timelines required in federal regulation. Views of Responsible Officials: The department does not concur with this finding. The department contends the obligation of child care funds are supported by documented historical data which, ?informs completion of the ACF 696 obligations.? The department further indicates if the ACF 696 report had not been done correctly, the federal matching funds could not have been released. For additional information regarding the department?s planned corrective action see the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We have reviewed the department?s nonconcurrence with this finding. The department?s views do not contain any information not already considered during the audit. As described in the finding, the historical data provided by the department lacked sufficient detail to demonstrate compliance with the federal compliance requirements. As such, we maintain our position as reported.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-020: U.S. Department of Health and Human Services CFDA # 93.575 and 93.596, CCDF Cluster Grant # 2017G996005, 2018G996005, 2019G996005, 2017G999004, 2018G999004, 2019G999004, 2017G999005, 2018G999005, 2019G999005 Criteria: Federal regulation, 45 CFR 98.41, requires the Department of Public Health and Human Services (department) to ensure child care providers serving children who receive subsidies meet ten specific health and safety requirements, such as prevention and control of infectious diseases, prevention of sudden infant death syndrome and use of safe sleeping practices, and building and physical premises safety. Federal regulation, 2 CFR 200.303, states that the department must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Condition: The department?s internal control did not ensure federally required elements were included in its health and safety inspections of day-care facilities which resulted in noncompliance with federal regulations. Questioned Costs: No questioned costs identified. Context: Beginning February 28, 2018, the date of the department?s extension provided by the federal government, ten health and safety requirements required for child care providers receiving subsidies became effective. The department completes inspections of day-care facilities using a ?Key Indicator Summary? or KIS for lower risk facilities. During the audit, we tested health and safety elements items against the KIS inspection template, because the KIS inspections include the least amount of testing by the department, they are therefore the riskiest in terms of not having all the required elements. Most of the health and safety elements were not being tested by the department via the KIS inspections during fiscal year 2018. Some, but not all, missing elements were incorporated to the KIS in fiscal year 2019. See the summary in the table below. See Schedule of Findings and Questioned Costs for chart/table. Effect: The department is not in compliance with federal regulations. Cause: Department staff indicate they do not update the monitoring form each year. Additionally, department staff said they overlooked certain elements of the health and safety requirements because the department previously required the emergency plan and fire drill record be submitted and therefore not included in the checklist. Recommendation: We recommend the Department of Public Health and Human Services: A. Ensure all health and safety standards are considered in its reviews of day-care facilities, as required by federal regulation. B. Enhance internal control by updating its day-care monitoring form to ensure all health and safety elements are included. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-021: U.S. Department of Health and Human Services CFDA #93.575, 93.596, CCDF Cluster Grant #: 2017G996005, 2018G996005, 2019G996005, 2017G999004, 2018G999004, 2019G999004, 2017G999005, 2018G999005, 2019G999005 Criteria: Federal regulation, 45 CFR 98.60, (i), requires the Department of Public Health and Human Services (department) to recover child care payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department did not attempt to recover overpayments from recipients in 8 out of 11 cases identified as fraud by the department during the audit period. Questioned Costs: We identified questioned costs totaling $20,014. Context: In response to the prior audit, the department developed an internal control procedure to use a communication form to convey fraudulent overpayment information to Business and Financial Division (BFSD). The communication form was completed for 10 of 11 fraudulent overpayments identified during the audit. However, repayment was only sought for 3 of the 11 fraud cases. Repeat Findings: Montana?s Single Audit for the two fiscal years ended June 30, 2017, included a recommendation (#2017-022) to the department to develop internal control procedures to ensure coordination between Child Care Development Fund (CCDF) program staff and BFSD staff for recovering overpayments resulting from fraud, and to seek timely recovery for all identified fraudulent child care overpayments. Effect: The department did not comply with the requirements to recover fraudulent overpayments. Cause: While overpayments were communicated to BFSD, the employee entering cases into the system which tracks overpayments was using an outdated procedure that indicated the cases should be marked with an indicator which prevents a recovery invoice from being generated. Recommendation: We recommend the Department of Public Health and Human Services: A. Develop internal control procedures for the Child Care Development Fund program to confirm letters have been sent and collections initiated when required for fraud cases. B. Comply with federal regulations by seeking timely recovery of all identified fraudulent child care overpayments for the Child Care Development Fund program. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-022: U.S. Department of Agriculture CFDA #10.551 and 10.561, SNAP Cluster Grant #: 201717S251443, 201818S251443, 201919S251443 U.S. Department of Health and Human Services CFDA #93.558, TANF Cluster Grant # 1701MTTANF, 1801MTTANF, 1901MTTANF CFDA #93.563, Child Support Enforcement Grants #17504MTCSES, 18504MTCSES, 1901MTCSES, 1704MTCSET, 1804MTCSET, 1904MTCSET CFDA #93.575 and 93.596, CCDF Cluster Grants # 2017G996005, 2018G996005, 2019G996005, 2017G999004, 2018G999004, 2019G999004, 2017G999005, 2018G999005, 2019G999005 CFDA #93.658, Foster Care ? Title IV-E Grants #1701MTFOST, 1801MTFOST, 1901MTFOST CFDA # 93.767, Children?s Health Insurance Program (CHIP) Grant # 1705MT5021, 1705MT0301, 1805MT5R21, 1805MT5021, 1905MT5021 CFDA #93.775, 93.777, and 93.778, Medicaid Cluster Grants #1705MT5MAP, 1805MT5MAP, 1905MT5MAP, 1705MT5ADM, 1805MT5000, 1805MT5ADM, 1905MT5000, 1905MT5ADM, 1705MTIMPL, 1705MTINCT, 1805MTIMPL, 1805MTINCT, 1905MTIMPL, 1905MTINCT Criteria: Federal regulation, 2 CFR Appendix VI, in part, requires the state public assistance agency to develop, document, and implement a public assistance cost allocation plan in accordance with federal regulations. Federal regulation, 2 CFR 200.416, in part, requires there to be a process whereby central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. Federal regulation, 2 CFR 200.303, states that the Department of Public Health and Human Services (department) must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Federal regulation, 45 CFR 95.517, specifies the department may claim federal financial participation costs associated with a program only in accordance with its approved cost allocation plan, or, at its option, the department may claim federal financial participation based on a proposed plan or plan amendment if the plan or plan amendment has been submitted to the federal government. Condition: The department did not follow its federally approved plan to allocate costs among state and federal funding sources. Additionally, department internal controls did not identify these inconsistencies. In our sample of costs allocated by the department, we noted the following exceptions to compliance with the applicable cost allocation plan: ?? For the Operations Branch Manager Indirect Cost Pool, costs should be allocated by full-time equivalent (FTE) staff who are directly supervised by the Operations Services Branch Manager. We tested the November 2018 and December 2018 allocations, and noted in each month the department did not include all FTE which are directly supervised by the branch manager. ?? For the Financial Technical Analyst Indirect Cost Pool, the department began using a new allocation method in June 2018, prior to its September 2018 submission to request an amendment to its Cost Allocation Plan. ?? The Technology Services Division (TSD) Administrator Indirect Cost Pool is allocated by FTE directly supervised by the TSD Administrator. We reviewed the June 2019 allocation, and noted FTE not supervised by the TSD Administrator were included in the pool. For the September 2017 and July 2018 allocations, costs associated with one FTE were inappropriately excluded from the calculation. ?? Costs associated with the County Use Allowance Indirect Cost Pool were allocated beginning in July 2017, but the pool was not included in the department?s Cost Allocation Plan until May 2018. ?? The Reimbursement Travel Indirect Cost Pool was utilized by the department for at least nine months prior to its inclusion in the department?s Cost Allocation Plan in May 2018. ?? The April 2018 allocation for the Office of the Medicaid and Health Services Branch Manager Indirect Cost Pool is considered an error because the department used time and effort reporting as its allocation method, rather than FTE directly supervised by the Medicaid and Health Services Branch Manager, as specified in the department?s Cost Allocation Plan. Questioned Costs: We limited our questioned costs to federal programs with indirect cost activity exceeding or approaching $25,000 in the Operations Branch Manager Indirect Cost Pool, the Financial Technical Analyst Indirect Cost Pool, and the Technology Services Division Administrator Cost Pool. For the County Use Allowance Indirect Cost Pool and the Reimbursement Travel Indirect Cost Pool, allocation changes were made prior to submitting a revised cost allocation plan to the federal government. Department management indicates these new cost pools did not result in changes to how costs were allocated among federal programs. As such, we have excluded these cost pools from our projection of questioned costs. We question $48,960 for the TANF Cluster, $67,509 for the Child Support Enforcement program, $24,413 for Foster Care ? Title IV-E, $373,551 for the Medicaid Cluster, $109,909 for the CCDF Cluster, $70,571 for the SNAP Cluster, and $29,745 for CHIP. Questioned costs total $724,658 for fiscal years 2018 and 2019 combined. Based on the number of discrepancies between the approved cost allocation plan and the department?s allocation of indirect costs, additional discrepancies not identified in our sample likely exist. These likely additional discrepancies could include additional unallowable costs and could potentially impact all programs administered by the department. Context: Our prior audit report contained a recommendation to the department regarding the internal controls over and administration of its cost allocation plan. Through the cost allocation process, the department allocated $66.5 million and $80.6 million in costs to various federal programs in fiscal years 2018 and 2019, respectively. During the period under audit, the department allocated costs under three different cost allocation plans. Monthly, there are approximately 140 cost pools for which the department allocates costs. We conducted a sample of 56 cost pool allocations. This was not a statistically valid sample. Repeat Finding: Montana?s Single Audit report for the two fiscal years ended June 30, 2017, included a recommendation (#2017-014) to the department regarding the internal controls over and administration of its cost allocation plan. Effect: The department is not in compliance with its federally approved cost allocation plan. Cause: Department staff indicate human error or oversight, controls insufficient to detect variances in cost pools with an FTE based statistic, and costs associated with multiple staff being charged to a single task profile code as reasons for the allocation errors. One error identified by our audit was also identified by the department and corrected going forward when a new internal control process was implemented in May 2018. Department staff also indicate costs were claimed anticipating a back-dated approval, as requested, for the Financial Technical Analyst Indirect Cost Pool. Recommendation: We recommend the Department of Public Health and Human Services: A. Conduct and document a review of all cost pools to ensure department procedures align with the approved cost allocation plan. B. Implement changes to the cost allocation process only after receiving approval from, or submitting a plan revision to, the federal government. C. Develop and implement internal control to detect variances in cost pools based on a full-time equivalent staff statistic. D. Allocate costs as specified in the cost allocation pool, as required by federal regulations. Views of Responsible Officials: The department partially concurs with this finding because it does not agree with the underlying findings related to two cost pools. The department?s Corrective Action Plan further indicates the department only implements changes to the cost allocation process after submitting plan revisions to the federal government, yet further cites it is not always feasible to submit or receive approval for cost allocation plans prior to claiming costs related to modified or amended cost pools. Rebuttal of Views of Responsible Officials: We have reviewed the department?s partial concurrence with this finding. As outlined in the finding, the department did in fact implement changes to its cost allocation process prior to submitting plan revisions to the federal government. The department?s views do not contain any information not already considered during the audit. As such, we maintain our position as reported.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-023: U.S. Department of Health and Human Services CFDA #93.568, Low-Income Home Energy Assistance Program Grant # 17B1MTLIEA, 18B1MTLIEA, 19B1MTLIEA, 1701MTLIEA4, 1801MTLIEA4, 1901MTLIEA4 Criteria: Federal regulation, 31 CFR 205.33, requires the Department of Public Health and Human Services (department) minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. The timing and amount of funds transferred must be as close as administratively feasible to the department?s cash outlay for direct and indirect program costs. Federal regulation, 31 CFR Part 205, which implements the Cash Management Improvement Act of 1990, requires the State to enter into agreements Treasury State Agreements (TSA). The state?s TSA specifies warrants related to the Low-Income Home Energy Assistance program are on a 5 day clearance pattern. Federal regulation, 2 CFR 200.303, states that the department must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Condition: The department has not conducted cash draws for the Low-Income Home Energy Assistance Program (LIHEAP) in accordance with the federal agreement. Additionally, department procedures were not sufficient to achieve compliance with the TSA. Questioned Costs: None identified. Context: For at least 18 months of the current audit period, we noted the department systemically recorded LIHEAP expenditures on a tracking spreadsheet the day after the costs were incurred, which caused the department to draw cash following a six-day clearance pattern for warrants. Total federal draws related to warrants were approximately $3 million for each year of the audit period. Repeat Findings: Montana?s Single Audit for the two fiscal years ended June 30, 2017, noted the department used a four-day clearance pattern for LIHEAP warrants rather than the five-day clearance pattern specified in the TSA (#2017-015). Effect: The department is unable to demonstrate compliance with cash management requirements in federal regulation. Although the department has not drawn funds in advance of the timing permitted by the TSA for the current audit period, the five-day clearance pattern is considered revenue neutral and remains the requirements under the TSA. Cause: Staff responsible for LIHEAP cash draws misunderstood department procedures and recorded expenditures in a way that delayed the federal draw by one day. Recommendation: We recommend the Department of Public Health and Human Services: A. Develop internal review processes to ensure staff apply the clearance pattern approved in the Treasury State Agreement for Low-Income Home Energy Assistance program cash draws. B. Comply with the requirements of the Treasury State Agreement by drawing federal funds for Low-Income Home Energy Assistance program warrants on a five-day clearance pattern. Views of Responsible Officials: The department does not concur with this finding, and indicates the clearance pattern error was identified by the department?s control process as designed, the internal draw spreadsheet was corrected, and the draw rectified. For additional information regarding the department?s planned corrective action see the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We have considered the department?s nonconcurrence to the finding. As reported in the finding, for at least 18 months of the audit period the department systemically recorded program expenditures to the tracking spreadsheet incorrectly. This resulted in following a clearance pattern contrary to the clearance pattern specified in the TSA. Such long-term noncompliance cannot be corrected by retroactively modifying the tracking spreadsheet. Additionally, if the department?s control process detected the clearance pattern error after 18 months, we do not consider it to be timely. As such, we maintain our position as reported.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-024: U.S. Department of Agriculture CFDA #10.557, Special Supplemental Nutrition Program for Women, Infants and Children (WIC) Grant #: 201818W100643, 201818W500343, 201818W100343, 201817W541243, 201818Y860743, 201818Y860443, 10919W100643, 201918W100643, 201919W500343, 201919W100343, 201918W100343, 201919Y860743, 201919Y860443 U.S. Department of Health and Human Services CFDA #93.563, Child Support Enforcement (CSE) Grant #: 17504MTCSES, 18504MTCSES, 19504MTCSES, 1704MTCSET, 1804MTCSET, 1904MTCSET Criteria: Federal regulation, 31 CFR 205.33, requires the Department of Public Health and Human Services (department) minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. The timing and amount of funds transferred must be as close as administratively feasible to the department?s cash outlay for direct and indirect program costs. Federal regulation, 2 CFR 200.303, states that the department must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Condition: Contrary to federal regulations, the department carried excess cash during the audit period for multiple federal programs. Additionally, department controls were not sufficient to prevent such instances of excess cash. Questioned Costs: No questioned costs identified. Context: We analyzed cash balances for the department?s WIC and CSE programs for the period under audit and noted significant time periods when the department carried excess federal cash. For the WIC program, we noted 10 instances of excess federal cash for time periods spanning between 2 and 19 days. The balance of excess WIC cash ranged from $1,000 to $360,000. These instances of excess cash are not related to monthly rebates received for the WIC program, as the department appropriately ceases federal cash draws until the program rebates have been used. For the CSE program, the department draws federal funds for the program, and also receives non-federal cash collections. The non-federal cash collections are mainly comprised of child support payments from the absent parent, which are supposed to be sent to the custodial parent within two days. During the audit, we noted nearly 50 instances of excess federal cash. Excess cash ranged from $1,000 to $525,000, and the overage often lasted for more than a week. Effect: The department is unable to demonstrate compliance with cash management requirements in federal regulation. Cause: Department staff claim most of the instances of WIC excess cash in question were times when extra cash was drawn in anticipation of a federal government shutdown. However, absent express permission from the federal government, the department is not permitted to draw in advance for the WIC program. Department staff indicated the non-federal cash collections from the previous day are considered in its calculation of the CSE federal draw. However, by the time the federal funds are received, the department generally collects additional non-federal funds, which results in a positive cash balance in the CSE account. Recommendation: We recommend the Department of Public Health and Human Services: A. Modify procedures for federal cash draws for the Supplemental Nutrition Program for Women, Infants and Children, to eliminate instances of excess federal cash, as required by federal regulations. B. Modify the calculation for federal cash draws for the Child Support Enforcement program to take into consideration anticipated cash collections from non-federal sources, and to eliminate instances of excess federal cash, as required by federal regulations. C. Comply with federal regulations to minimize the time between the drawdown of cash for the federal Supplemental Nutrition Program for Women, Infants, and Children and Child Support Enforcement programs and disbursement for federal program purposes. Views of Responsible Officials: The department partially concurs with this finding, and claims it may not be able to fully estimate cost collections from non-federal sources to completely eliminate excess federal cash. For additional information regarding the department?s planned corrective action see the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We have reviewed the department?s partial concurrence with this finding. The department notes it, ?may not be able to fully estimate collections from non-federal sources to completely eliminate excess cash.? As the independent auditor, we are prohibited from directing the department?s corrective action. However, we believe the department can explore options to establish a clearance pattern than accommodates the internal control and compliance issues identified in this finding. We maintain our position as reported.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-025: U.S. Department of Health and Human Services CFDA # 93.563, Child Support Enforcement Grant #17504MTCSES, 18504MTCSES, 1901MTCSES, 1704MTCSET, 1804MTCSET, 1904MTCSET CFDA # 93.658, Foster Care ? Title IV-E Grant #1701MTFOST, 1801MTFOST, 1901MTFOST CFDA # 93.659, Adoption Assistance Grant #1701MTADPT, 1801MTADPT, 1901MTADPT CFDA # 93.767 Children?s Health Insurance Program (CHIP) Grant # 1705MT5021, 1705MT0301, 1805MT5R21, 1805MT5021, 1905MT5021 CFDA # 93.775, 93.777, 93.778, Medicaid Cluster Grant # 1705MT5MAP, 1805MT5MAP, 1905MT5MAP Criteria: Federal regulation, 45 CFR 95.621, requires the Department of Public Health and Human Services (department) to review the Automated Data Processing (ADP) system security of installations involved in the administration of its federal Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personal practices. This requirement is applicable to titles IV-B, IV-D, IV-E, XIX, or XXI of the Social Security Act. In addition, federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department did not complete the biennial review of ADP systems, as required by federal regulations. Additionally, department internal controls did not ensure APD system reviews were fully documented. Questioned Costs: None identified. Context: HHS programs administered by the department include Medicaid, Child Support Enforcement, Foster Care, Adoption Assistance, and the Children?s Health Insurance program, which account for over 81 percent of federal program expenditures incurred by the department. We performed a sample of 14 ADP systems of a population of 27 systems used in administering HHS programs. Of the 14 systems, we identified 2 for which a biennial review was not completed. We identified an additional 2 systems for which the review occurred, but the review was not fully documented. This was not a statistically valid sample. Repeat Finding: Montana?s Single Audit reports for the two fiscal years ended June 30, 2017, and June 30, 2015, have included recommendations (#2017-019 and #2015-012, respectively) to the department regarding the internal controls over, and compliance with, required ADP system reviews. Effect: The requirements related to ADP system risk analyses and security reviews are to ensure that appropriate, cost effective safeguards are incorporated into new and existing systems. Without the required biennial reviews, ADP systems could operate with undetected system inefficiencies and security weaknesses. Cause: The department cites turnover as a contributing factor to incomplete and untimely reviews, and acknowledges the two system reviews which were not fully documented. However, the department contends the two reviews not conducted were completed after our audit test was conducted and within the biennium, as required by federal regulation. The prior ADP security reviews were completed in March and April 2017, while the subsequent reviews were completed in November 2019. Because more than two years passed since the completion of each of the prior reviews, the department has not complied with the biennial time frame required. Recommendation: We recommend the Department of Public Health and Human Services establish and maintain internal controls to ensure Automated Data Processing system reviews are completed and fully documented on a biennial basis, as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-026: U.S. Department of Transportation CFDA #20.205, 20.219, and 20.224, Highway Planning and Construction Cluster Grant #Not Applicable Criteria: Federal law, 40 USC 3142, requires contractors and subcontractors to pay prevailing wages to laborers and mechanics for work completed under federally funded contracts in excess of $2,000. Federal regulation, 29 CFR 5.5, establishes contract language requiring contractors to submit payrolls to the department, along with a statement of compliance that all laborers and mechanics employed on the contract during the payroll period have been paid not less than the applicable wage rates for the classification of work performed, as specified in the applicable wage determination incorporated into the contract. Federal regulation, 29 CFR 5.6, prohibits payment to contractors after construction begins unless there is certification by the contractor that the contractor and its subcontractors have complied with the provisions of 29 CFR 5.5. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Montana Department of Transportation?s (department) internal controls were not effective in ensuring certified payrolls were received and reviewed for highway construction projects. Questioned Costs: No questioned costs were identified. Context: In the prior audit, we determined the department?s internal controls did not ensure all payrolls were received prior to issuing payments to contractors. We also identified multiple projects for which the department did not receive all payrolls. In the current audit, we noted the department took steps to address this recommendation, including implementing a new electronic payroll submission module. Per department personnel, the electronic submission module will work with the department?s new project management information system and is designed to flag instances of missing payrolls as exception when contractor pay estimates are generated in the system. This payroll submission module is intended to be used only on projects let from October 2019 forward, along with a small group of test projects let prior to October 2019. The module was only used on a limited basis during the audit period, and the department does not intend to convert pre-existing projects to the new system. Based on review of department records, there were approximately 250 projects with construction occurring in fiscal year 2018 or 2019. Only two used the electronic payroll submission module. We also estimate there are a minimum of 45 projects that will have active construction into the next audit period, that will not use the electronic submission module. Due to the continued control deficiency, and the resulting noncompliance identified in the prior audit, we anticipated noncompliance occurred in the current audit period and designed the nature, timing, and extent of our testing accordingly. Our testing to confirm noncompliance included reviewing payroll submissions for one project from each of the department?s five districts, and confirming known or likely noncompliance identified by the department?s internal audit function. This was not a statistically valid sample. Through this testing, we considered a total of 10 projects, and identified 4 with untimely or incomplete payroll submissions. ?? On one project, a subcontractor submitted one payroll late. The payroll was for a week in September 2018 and was not submitted until January 2019. ?? On one project, a subcontractor did not submit certified payrolls until the project was in winter shut-down. The subcontractor performed work from April 2018 through October 2018. Department staff indicated a majority of the payrolls were not submitted until sometime after October 2018. ?? On one project, one subcontractor did not submit any payrolls. The subcontractor performed work intermittently from May 2018 to August 2018 but had not submitted any payrolls as of October 2019. ?? On one project, two subcontractors did not submit payrolls for one week each. Department staff were unaware of the missing payrolls. Effect: The department is not in compliance with federal regulations requiring the receipt of certified payrolls prior to issuing payments to contractors. There is also a risk the department will not identify instances where contractors or subcontractors do not pay their employees prevailing wages. Cause: Department staff indicated the timing of the implementation of the electronic submission model was tied to its implementation of a new project management system. The deficiency in internal controls for which the submission module is designed to address contributed to the department not identifying the missing payrolls identified during the audit period. Repeat Finding: This is a repeat finding, initially reported as 2017-028 in the Single Audit report for the two fiscal years ended June 30, 2017. Recommendation: We recommend the Montana Department of Transportation: A. Enhance internal controls to ensure all required certified payrolls are received for projects not being managed through the electronic payroll submission module. B. Obtain and review certified weekly payrolls from contractors and subcontractors for all active construction projects of the Highway Planning and Construction Program. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-027: U.S. Department of Transportation CFDA #20.205, 20.219, and 20.224, Highway Planning and Construction Cluster Grant #Not Applicable Criteria: Federal law, 23 USC 112(1), requires construction for each project under CFDA #20.205 be performed by contract awarded by competitive bidding. Federal regulation, 23 CFR 635.109, requires standard contract language be incorporated into each construction contract related to significant changes to the character of the work, and contains standard contract language defining a significant change as occurring when one or more of the following circumstances occurs: The character of the work differs materially in kind or nature from that involved or included in the original proposed construction. A major item of work, as defined in the contract, is increased or decreased in excess of 25 percent of the original quantity in the contract. This regulation also requires an adjustment be made to the contract when a significant change has occurred. Federal regulation, 2 CFR 200.403(a) and (g), requires that except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal Awards: Be necessary and reasonable for the performance of the Federal award Be adequately documented Condition: For projects with quantity overruns in excess of 25 percent on major items of work, the Montana Department of Transportation?s (department) documentation included in project files did not contain information to justify the reasonableness and necessity of quantity overruns and their associated costs. Questioned Costs: We question approximately $36,000 of direct, and approximately $4,000 of associated indirect, costs inappropriately charged to CFDA #20.205 in state fiscal years 2018 and 2019. Additional questioned costs likely exist. Context: In our prior audit, we determined the department did not always formally document adjustments to contracts when major items of work had quantity overruns in excess of 25 percent (or 125 percent of the initial quantity estimates). We also noted the department?s contract language associated with significant changes in the character of work was more restrictive than the language required by federal regulations. The contract language, as contained in the Standard Specifications for Road and Bridgework (spec book), also included quantity overruns and underruns in excess of 50 percent on nonmajor items of work within the definition of a significant change. We made a recommendation to the department to issue contract amendments for changes in contract quantities that were considered significant under the spec book and federal regulation, and to consider updating the definition of a significant change in the spec book to more closely align with federal regulation and actual business practices. As part of their work to resolve the prior audit finding, Federal Highway Administration (FHWA) personnel and the department came to an agreement that quantity overruns in excess of 25 percent on major items of work would be in the form of change orders. In April 2019, the department updated established guidance for change orders to reflect agreement with FHWA. The department also worked with FHWA personnel and other interested parties to modify the spec book language regarding significant changes to more closely align with federal regulations. This new language was applicable for projects let after April 2019. While the department began to take steps to address the recommendation in the current audit period, we also noted instances where the department did not issue change orders when major items of work had quantity overruns in excess of 25 percent. The documentation department personnel included in the project files to support not issuing a change order for the overruns did not contain information to justify the reasonableness and necessity of quantity overruns and their associated costs. This documentation was similar in form and general content to what was on file in the prior audit, which FHWA personnel indicated they did not consider to be sufficient to document the adjustment to the contract required by federal regulations to support federal participation in the costs. From department data, we performed an analysis on projects with change order overrides in the department?s project management system. We selected three projects each having one major item of work with actual quantity overruns in excess of 25 percent. This was not a statistically valid sample. Based on our review, we estimate the amounts paid for actual quantities in excess of 125 percent of the contracted quantities to be approximately $200, $12,000, and $28,000 for these three instances of quantity overruns. We estimate the federal share of these costs to be approximately $36,000. Effect: The department has not adequately documented the necessity and reasonableness of the additional costs incurred for projects, resulting in questioned costs. Cause: As noted in the prior Single Audit finding, department management indicated they did not believe all quantity changes in excess of 25 percent resulted in actual significant changes in the kind or nature of work being performed. It took several months for the department and FHWA to determine the corrective action for the prior audit finding, and for the department to work with the contracting community to implement the resulting changes. Repeat Finding: This is a repeat finding, initially reported as 2017-027 in the Single Audit report for the two fiscal years ended June 30, 2017. Recommendation: We recommend the Montana Department of Transportation continue to implement the directive of the Montana Division of the Federal Highway Administration to formally document adjustments to contracts through change orders when major items of work have quantity overruns in excess of 25 percent. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-028: U.S. Department of Homeland Security CFDA #97.042, Emergency Management Performance Grants Grant # EMW-2015-EP-00004, EMD-2016-EP-00002, EMD-2017-EP-00003, EMD-2018-EP-00005 #97.067, Homeland Security Grant Program Grant # EMW-2014-SS-00019, EMW-2015-SS-00005, EMW-2016-SS-00006, EMW-2017-SS-00009, EMW-2018-SS-00021 #97.039, Hazard Mitigation Grant Grant # 1996DRMTP00000005, 4127DRMTP00000005, 4172DRMTP00000005, 4198DRMTP00000001, 4275DRMTP00000005, 4271DRMTP00000005 Criteria: Federal regulation, 2 CFR 200.303, requires the Department of Military Affairs (department) to establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with statutes, regulations, and the terms and conditions of the federal award. Federal regulations, 2 CFR 200.53 and 2 CFR 200.403, further state that improper payments include any payments where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper and in order for costs to be allowable they must be adequately documented, respectively. Condition: The department?s internal control procedures do not address the amount and detail of supporting documentation required for each grant reimbursement. As a result, the department?s supporting documentation did not contain enough detail to determine whether the expenditure reimbursements provided to the subrecipients were allowable under the grant. Additionally, department procedures did not prompt department personnel to request additional support. Questioned Costs: We question $27,580 and $54,027 in grant reimbursement costs charged to CFDA #97.042, with potential questioned costs up to $1,416,431 and $994,388 in fiscal years 2017 and 2018, respectively. We question $48 and $627 in grant reimbursement costs charged to CFDA #97.067, with potential questioned costs up to $1,724,741 and $1,748,706 in fiscal years 2017 and 2018, respectively. We question $33,000 in grant reimbursement costs charged to CFDA #97.039 in fiscal year 2017, with potential questioned costs up to $556,072 and $717,593 in fiscal years 2017 and 2018, respectively. We did not perform testing for fiscal year 2019. However, questioned costs are likely to exceed $25,000 for each of the three programs for fiscal year 2019 because, as indicated in the department?s response from September 2019 included below, the department is unable to change its process to address the issue. Context: The department issued payments totaling approximately $7.5 million and $7.0 million in fiscal years 2017 and 2018, respectively. In a total population of 714 items, we selected a sample of 78 payments. This was a statistically valid sample. However, we only sampled 46 payments because we stopped testing after finding 16 errors. Our sample identified five instances where the amount of the reimbursement was unsupported by subrecipient documents and 16 instances where the expenditures were unallowable under the grant award due to inadequate documentation. We did not perform testing for fiscal year 2019. Repeat Finding: This is a repeat finding, initially reported as 2017-011 in Montana?s Single Audit report for the two fiscal years ended June 30, 2017. Effect: Because the department does not have adequate internal controls in place over the DES grant reimbursement process, they are reimbursing subrecipients for unsupported and unallowable costs. Cause: Department staff responsible for reviewing and approving reimbursement requests stated they believe their internal control processes are adequate because they have multiple levels of oversight for the reimbursements. Additionally, department staff noted two on-site monitoring visits are conducted for each subrecipient each year, for each grant. Recommendation: We recommend the Department of Military Affairs implement internal controls in the Disaster & Emergency Services Division to ensure subrecipient reimbursements are supported and allowable under the grant awards at the time the reimbursement is made. Views of Responsible Officials: The department conditionally concurred with the finding. They stated, ?MT DES and the Department of Military Affairs strongly support internal controls and grant management oversight. The department is willing to improve internal controls for preparedness grants but is unable to develop additional measures without knowing what specific concern to address and what adequate control measures will pass future state audits. The audit does not provide specific examples of instances where unallowable expenditures were reimbursed.? Rebuttal of Views of Responsible Officials: We considered the department?s conditionally concurring response to the finding. The response notes the department ??is unable to develop additional measures without knowing what specific concern to address?? and ??the audit does not provide specific examples of instances where unallowable expenditures were reimbursed.? As outlined in the finding, the documents the department received and reviewed did not demonstrate that the expenditures the department ultimately paid were allowable under the program. The department?s response further states the department ??is unable to develop additional measures without knowing?what adequate control measures will pass future state audits.? As the independent auditor, we are prohibited from directing the department?s corrective action. We believe we provided sufficient information in this report and through conversations throughout the audit process to enable the department to independently complete a corrective action to address the underlying issue.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-029: U.S. Department of Defense CFDA #12.401 National Guard Military Operations and Maintenance (O&M) Grant # W9124V-16-2-1001, W9124V-18-2-1001 Criteria: Federal regulation, 2 CFR 200.303, requires the Department of Military Affairs (department) to establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Federal regulation, 2 CFR 200.403(g), requires costs to be adequately documented in order to be allowable. The Office of Management and Budget 2018 and 2019 Compliance Supplement, 4-12.401-6, also states that the recipient?s required matching percentage varies by Appendix and is listed in the Funding Limitation section of each Master Cooperative Agreement (MCA) Appendix. The National Guard Bureau (NGB) share of all authorized charges, unless expressly stated elsewhere in the Appendix, is based on the Facilities Inventory and Support Plan (FISP) support code for the facility generating the expenditure. Appendix 1001 to the MCA provides support to the department for the operation and maintenance of authorized facilities coded on the FISP, and guidance prescribed in National Guard Regulation (NGR) 420-10. This appendix provides 3 different funding supports. 1. 100% federal funding for certain expenses for operating and maintaining facilities, 2. 75% federal funding of certain expenses for operating and maintaining licensed readiness centers. 3. 50% federal funding of certain expenses for operating and maintaining state-owned readiness centers. Condition: The expenses for buildings that share state and federal use were split based on square footage of the use of the building and then split according to the FISP. However, there is no support for how these funding splits for square footage use was created. Department management stated they could recreate the documentation of the split calculation from underlying information contained on their computer system. We performed additional audit procedures over the recreated support and found it did not match the split used during the audit period for six of the buildings. Based on current usage, the funding splits are incorrect, which resulted in an understatement of the federal share. Questioned Costs: The state share is overstated and the federal share is understated, therefore there are no questioned costs. Context: We tested two samples of operations and maintenance transactions which covered July 1, 2017, through December 31, 2018. One of the samples was statistically valid and the other was not. In total, we tested 42 transactions and found 12 instances where the match rate was incorrect. Additional testing over program expenditures was completed for the remainder of the audit period, January 1, 2019, through June 30, 2019. However, we did not include matching in our additional testing, given our previous testing indicated this was a systemic problem and because we knew the department had not made any changes to the splits through June 30, 2019. Effect: Results of testing indicate there is non-compliance with the matching requirement for the entire audit period. For fiscal year 2018, we estimate the federal government was under charged $48,629. For fiscal year 2019, our testing estimate the federal government was under charged $48,382. Cause: The match percentages based on square footage were determined prior to 2006 and documentation for the calculations could not be located by department officials. Additionally, since 2006, construction had been completed on a number of facilities that resulted in changes in allocations. Recommendation: We recommend the Department of Military Affairs: A. Comply with federal requirements to match the percentages as required by the Funding Limitation section of each Master Cooperative Agreement Appendix and the Facilities Inventory and Support Plan. B. Establish internal controls to ensure the basis of the splits is supported. Views of Responsible Officials: The department concurs with the recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-030: U.S. Department of Education CFDA #84.287, Twenty-First Century Community Learning Centers Grant # S287C180026, S287C190026 Criteria: Federal regulation, 2 CFR 200.303, requires the Office of Public Instruction (office) to establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with statutes, regulations, and the terms and conditions of the federal award. Condition: The office administers the 21st Century Community Learning Centers (21st CCLC) federal program. The 21st CCLC program provides 5-year subawards to subrecipients around the state to operate centers to provide students with academic enrichment opportunities during non-school hours or periods when school is not in session to complement the students? regular academic program, including tutoring and mentoring, homework help, hands-on science and technology education programs, music, arts, sports and cultural activities. When a subrecipient wants payment for this program, they submit a cash request via the office?s E-Grants system. This can happen as often as monthly; although many subrecipients only do it a few times a year depending on cash needs. The cash request contains the budget categories, budgeted amounts, amounts previously requested, and current amounts requested. The subrecipient enters the amounts requested and provides details of what the requests are for in a description for each budget category. These descriptions varied in detail between the different cash requests. There is also a place on the screen for the subrecipient to upload supporting documents. The office does not require any documentation from subrecipients beyond a cash request. This request is reviewed and approved by office fiscal staff. If there are any unusual items included in the request or the fiscal staff has questions, they work with 21st CCLC program staff to resolve them prior to approving the payment. Office staff also perform monitoring visits in the first year of each subrecipient?s grant award and at least once in the remaining years (years 2-5). The office?s internal controls are not designed to ensure only allowable costs are charged to the grant. Office staff would only identify potentially unallowable costs during the payment approval process if the subrecipient included descriptions in the expenditure description that was inconsistent with the budget category. Questioned Costs: No questioned costs identified. Context: We intended to test a statistically valid sample of 49 payments out of the approximately 960 payments totaling approximately $10.5 million during the audit period, but based on testing the first four items in the sample, it was clear the support for these payments did not provide enough information to determine whether the amounts requested were for allowable costs under the grant. We instead focused our testing on the office?s monitoring process to determine whether any unallowable costs would have been detected by the office. Office staff perform monitoring visits in the first year of each subrecipient?s grant award and at least once in the remaining years (years 2-5). These visits include reviews of financial records and supporting documents. However, this leaves three years of the 5-year grant period without any monitoring beyond the payment request review. If a subrecipient?s second monitoring visit does not occur until year five, the office could be paying for unallowable costs for three years before identifying it with a monitoring visit. Combined with the lack of supporting documentation for the payments, this time frame does not allow the office to timely identify if unallowable costs have been paid. Additionally, many of the program subrecipients are nonschool entities that do not receive as much scrutiny and monitoring as schools do. Effect: Without more robust controls, there is risk that unallowable costs are being paid and would not be detected by office staff. Cause: The office believes their current process provides them reasonable assurance the funds are expended as required by the federal regulations. Recommendation: We recommend the Office of Public Instruction enhance their internal controls over the 21st Century Community Learning Centers program payments in order to ensure the expenditures charged are supported. Views of Responsible Officials: The office partially concurs with the recommendation. For additional information regarding the office?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-031: U.S. Department of Education CFDA #84.010, Title I Grants to Local Education Agencies Grant #S010A180026, S010A190026 Criteria: Federal regulation, 2 CFR 200.303(a), requires the Office of Public Instruction (office) to establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Elementary and Secondary Education Act, Section 1111(b)(2(B))(iii), requires the office to establish and maintain an assessment system which uses testing to provide data used to measure student achievement. Student testing must be valid, reliable, and consistent with relevant professional and technical standards. In order to ensure the tests are valid and reliable, the office must have policies and procedures in place to ensure local education agencies (LEAs) are maintaining test security. Condition: In the prior audit, we found the office?s procedures for ensuring LEAs are maintaining test security were incomplete. Information regarding test security was distributed to Montana?s K-12 schools. However, the office had not yet developed a plan to monitor school level implementation of security procedures. We tested this requirement in the current audit and found the office took steps to address the issue but was unable to fully implement the recommendation during the audit period. Questioned Costs: No questioned costs identified. Context: There are six required assessments in Montana: the Smarter Balanced Assessment Test, the ACCESS for ELLS 2.0, the Science Criterion-Referenced Test, the Science Criterion-Referenced Test-Alternate, the Multi-State Alternate Assessment, and the American College Testing (ACT). During fiscal year 2018, the office maintained its previous test security policy requiring schools to electronically certify they are abiding by the office?s policies, but performed no additional on-site monitoring, as it conducted best practices research and developed a new testing security monitoring process. In fiscal year 2019, the office began implementing the new monitoring process. The new process includes obtaining the certifications from the schools and following up on schools without the certifications or with incomplete certifications. The office began following up on the missing or incomplete certifications, but this extended beyond the audit period, meaning there were many schools who had not implemented the required testing security in fiscal year 2019. The office also performed on-site test monitoring for 34 schools during fiscal year 2019, as required by the new process. Even though the office developed and implemented the new testing security monitoring process during the audit period, they did not ensure the LEAs were maintaining test security while the new monitoring process was being developed in fiscal year 2018, which is an integral part of ensuring the tests are valid and reliable. This noncompliance extended into fiscal year 2019 because there were 58 schools with missing or incomplete certifications. Repeat Finding: This is a repeat finding, initially reported as 2017-006 in Montana?s Single Audit report for the two fiscal years ended June 30, 2017. Effect: The office is not in compliance with the federal regulations. State assessments are important in securing federal funding like Title I. They also allow teachers and parents to identify needs for each individual student. Without oversight, there is the possibility of unfair testing or inaccurate data. Cause: Office staff stated it took time to perform the best practices research and implement a new monitoring process. Recommendation: We recommend the Office of Public Instruction: A. Continue to implement control procedures to monitor Montana?s schools? implementation of the assessment security process. B. Comply with federal assessment security requirements for the Title I, Grants to Local Education Agencies. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-032: U.S. Department of Education CFDA #84.010, Title I Grants to Local Education Agencies Grant #S010A180026, S010A190026 CFDA #84.027, 84.173, Special Education Cluster (IDEA) Grant #H027A180096, H027A190096 CFDA #84.287, Twenty-First Century Community Learning Centers Grant #S287C180026, S287C190026 U.S. Department of Agriculture CFDA #10.553, 10.555, 10.556, and 10.559, Child Nutrition Cluster Grant #183MT306N1099, 193MT306N1099 Criteria: Federal regulation, 2 CFR 200.303(a), requires the Office of Public Instruction (office) to establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Federal regulation, 2 CFR 200.331(b), requires the office to evaluate each subrecipient?s risk of noncompliance to determine the appropriate monitoring. Federal regulation, 2 CFR 200.331(d), requires the office to monitor subrecipients? audits, including following up on all deficiencies. Federal regulation, 2 CFR 200.331(f), requires the office to verify that each subrecipient receives a Single Audit if required. Federal regulation, 2 CFR 200.521, requires the office to issue management decisions for any deficiencies identified in subrecipients? audit reports within six months of the Federal Audit Clearinghouse?s acceptance of the audit report. The regulation also requires these management decisions to contain specific elements. Condition: The office?s controls over subrecipient monitoring are not sufficient to ensure compliance with the federal regulations, as outlined below: ?? Subrecipient Audits: Review of subrecipient audit reports is performed centrally by office staff. The office does not have controls in place to verify its nonschool entity subrecipients receive a Single Audit and that school subrecipient audits are reviewed timely. The nonschool entities are not for profit organizations. ?? Risk Assessments: As part of reviewing subrecipient audit reports, central office staff create a risk assessment for each subrecipient. Program staff for the Title I, Special Education, and Child Nutrition programs rely on this central risk assessment and do not perform their own. Thus, for these programs, the only subrecipients who are assessed for risk are those receiving a Single Audit. A Single Audit is not required for subrecipients expending less than $750,000 in federal awards each year, but a risk assessment is required for all subrecipients regardless of the amount of federal funds they expend. Office personnel indicated the program managers complete risk assessments in addition to the risk assessments completed by the central office. However, upon request, no documentation supporting this statement was provided by the office. ?? Management Decisions: During design of the audit, office staff stated the letters issued to subrecipients who are put on high risk or watch status as part of the central risk assessment process serve as their management decisions. We reviewed these letters during fieldwork and determined many of the elements were not present. When we communicated this noncompliance, office staff stated audit acceptance letters issued by Local Government Services in the Department of Administration were in fact the management decisions. These letters contain none of the elements required by the federal regulations. In addition, we determined all of the letters the office issued to subrecipients tested in our sample were not issued within 6 months of the subrecipient audit report being accepted by the federal audit clearinghouse. Questioned Costs: No questioned costs identified. Context: Of the 413 local education entities receiving federal funds under the Title I, IDEA B, and Child Nutrition programs in fiscal year 2018 and 414 in fiscal year 2019, only 59 are included in the risk assessment for each year. Of the 47 entities awarded 21st CCLC funds in fiscal year 2018 and 29 in fiscal year 2019, 10 were non-school entities in each year. We intended to review a statistically valid sample of 45 subrecipients out of the population of 827 subrecipients for the audit period for subrecipient monitoring activities. However, as we completed this testing we determined not all subrecipients should have received a management decision and did not complete the full sample for those requirements. Instead, we tested all 11 high-risk and watch letters issued by the office during the audit period. We also tested 6 of the audit acceptance letters issued by Local Government Services. We also identified two school subrecipients as part of our testing who received a Single Audit report during the audit period, but the office had not reviewed it as of the date of testing, even though our testing occurred months after the audit reports were submitted. Effect: The office is not in compliance with federal regulations. Cause: Office staff stated verifying nonschool entities receive a Single Audit has not become a high enough priority to be addressed. Office staff further stated their concept of risk has evolved over the last several years to go beyond just financial risk, but they are having trouble developing a risk assessment process to encompass all risks associated with the subrecipients. Office staff believe they were meeting the intent of the management decision federal regulations through other, less formal interactions with subrecipients. Recommendation: We recommend the Office of Public Instruction: A. Implement internal controls to ensure compliance with federal subrecipient monitoring requirements. B. Comply with federal subrecipient monitoring requirements for the Title I, Grants to Local Education Agencies; Individuals with Disabilities Act, Part B; 21st Century Community Learning Centers; and Child Nutrition Cluster programs. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-033: U.S. Department of Education CFDA #84.010, Title I Grants to Local Education Agencies Grant #S010A180026, S010A190026 CFDA #84.027, 84.173, Special Education Cluster (IDEA) Grant #H027A180096, H027A190096 CFDA #84.287, Twenty-First Century Community Learning Centers Grant #S287C180026, S287C190026 U.S. Department of Agriculture CFDA #10.553, 10.555, 10.556, 10.559, Child Nutrition Cluster Grant #183MT306N1099, 193MT306N1099 Criteria: Per 2 CFR 180.300 and .305, participants are required to verify that the person they are doing business with is not excluded or disqualified, and they may not enter into a transaction with an excluded person. Federal regulation, 2 CFR 200.303, requires the Office of Public Instruction (office) to establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The office receives many federal awards it then subawards out to various subrecipients. The office performs a monthly check of subrecipients to determine whether any are suspended or debarred. This check is done centrally for all federal programs but was not documented for a portion of the audit period. This check only includes schools, but the office awards funds to nonschool entities in some of its programs. Questioned Costs: There are no questioned costs. Context: When we tested the monthly central suspended and debarred check performed by the office for schools, we found no evidence the suspended and debarred status of subrecipients was checked for 8 of the 24 months of the audit period. Six of the 8 months were consecutive, and payments made during these months constitute approximately 25 percent, or $63.8 million, of total payments made for the IDEA B, Title I, 21st CCLC, and Child Nutrition programs. During our audit of the 21st CCLC program, we found the program had 14 nonschool subrecipients during the audit period. The office awarded these nonschool subrecipients approximately $1,400,000 and $2,000,000 in fiscal years 2018 and 2019, respectively. These awards comprised approximately 26 percent and 37 percent of the total amount awarded to subrecipients in fiscal years 2018 and 2019, respectively. Effect: The office cannot demonstrate its compliance with federal regulations requiring that it confirm that the entities it is entering into transactions with are not suspended or debarred. This could result in the office conducting business with a suspended or debarred entity. Our audit testing did not identify any suspended or debarred subrecipients. Cause: Office staff indicate there was a change in staff completing these checks during the audit period. Office staff could not locate documentation of those checks completed before the change occurred, but represented the checks were performed. Office staff stated the data used in the monthly check includes all entities, but their current process does not provide a listing of nonschool entities for the verification. Recommendation: We recommend the Office of Public Instruction strengthen internal controls related to checking suspended and debarred status for all subrecipients. Views of Responsible Officials: The office partially concurs with the recommendation. For additional information regarding the office?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-034: U.S. Department of the Interior CFDA #15.605 and 15.611, Fish and Wildlife Cluster Grants # F18AF00061, F18AF00195, F18AF00596, F18AF00631, F18AF00633, F18AF00634, F18AF00647, F18AF00751, F18AF00752, F18AF00860, F11AF01282, F15AF00490, F17AF00653, F18AF00581, F18AF00582, F18AF00593, F18AF00594, F18AF00622, F18AF00624, F18AF00635, F18AF01043, F18AF01066, F18AF01172, F19AF00301, F13AF00104, F13AF00116, F15AF01166, F16AF00234, F16AF00359, F16AF00970, F16AF01144, F17AF00455, F17AF00468, F17AF00474, F17AF00505, F17AF00506, F17AF00507, F17AF00549, F18AF0006, F18AF00099, F15AF00528, F11AF01282, F14AF00109, F15AF00010, F15AF00022, F15AF00490, F16AF00108, F16AF00109, F16AF00293, F16AF00294, F16AF00516, F16AF00865, F16AF01118, F16AF01202, F17AF00472, F17AF00477, F17AF00478, F17AF00479, F17AF00480, F17AF00508, F17AF00527, F17AF00652, F17AF00726, F17AF01222, F18AF00008, F18AF00393 Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal regulation, 2 CFR 200.403(a), states costs must be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. Condition: The Department of Fish, Wildlife, & Parks (department) requires all charges to a federal program to be reviewed by the program supervisor to ensure the costs are accurate and allowable. During the current audit, we identified expenditures related to the department?s vehicle and aircraft fleet that were not reviewed and approved by a program supervisor. Questioned Costs: No questioned costs were identified. Context: The department maintains a fleet of vehicles and aircraft for department personnel use. As of June 30, 2019, the department had 629 vehicles and 7 aircraft in its inventory. When department personnel use fleet vehicles or flight services, either the employee using the vehicle or the pilot of the aircraft subsequently submits a mileage or flight log to accounting staff. The logs contain the project codes used by accounting staff to record the expenditure on the state?s accounting system. In fiscal years 2018 and 2019, the department recorded $473,859 and $578,386, respectively, in vehicle fleet expenditures and $240,071 and $189,982, respectively, in aircraft fleet expenditures to federal funds. We completed a statistical sample of 32 operating expenditures recorded to the Wildlife and Sport Fish Restoration (WSFR) grant programs in fiscal years 2018 and 2019. We found five vehicle and two aircraft fleet transactions, totaling $6,265, were not reviewed and approved by a program supervisor as required by department policy. The department utilizes hundreds of project codes to identify the proper funding sources for expenditures and if an incorrect project code is used, it could result in unallowable costs being charged to a federal grant. The program supervisor?s review helps mitigate the risk of employees using incorrect project codes. Effect: The department does not have controls in place to ensure fleet and aircraft expenditures are allowable costs of the Fish and Wildlife Cluster federal programs. Cause: In relation to its vehicle fleet expenditures, department personnel stated they have tried to enforce the policy, but it frequently resulted in expenditures not being recorded timely due to delays in receiving the approved paperwork. In order to process the expenditures timely, the department stopped requiring a program supervisor?s signature for these expenditures. Regarding the aircraft expenditures, department staff stated it was not feasible to obtain signatures from program supervisors. The project codes recorded on the flight logs are often given to the pilots via email or text message when the flight is requested, and pilots do not keep the paper flight log in the aircraft for safety reasons. Recommendation: We recommend the Department of Fish, Wildlife & Parks either implement new procedures, or enforce its current procedures, to ensure the allowability of vehicle and aircraft expenditures charged to the Wildlife and Sport Fish Restoration grant programs. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-035: U.S. Department of the Interior CFDA #15.605 and 15.611, Fish and Wildlife Cluster Grants # F18AF00061, F18AF00195, F18AF00596, F18AF00631, F18AF00633, F18AF00634, F18AF00647, F18AF00751, F18AF00752, F18AF00860, F11AF01282, F15AF00490, F17AF00653, F18AF00581, F18AF00582, F18AF00593, F18AF00594, F18AF00622, F18AF00624, F18AF00635, F18AF01043, F18AF01066, F18AF01172, F19AF00301, F13AF00104, F13AF00116, F15AF01166, F16AF00234, F16AF00359, F16AF00970, F16AF01144, F17AF00455, F17AF00468, F17AF00474, F17AF00505, F17AF00506, F17AF00507, F17AF00549, F18AF0006, F18AF00099, F15AF00528, F11AF01282, F14AF00109, F15AF00010, F15AF00022, F15AF00490, F16AF00108, F16AF00109, F16AF00293, F16AF00294, F16AF00516, F16AF00865, F16AF01118, F16AF01202, F17AF00472, F17AF00477, F17AF00478, F17AF00479, F17AF00480, F17AF00508, F17AF00527, F17AF00652, F17AF00726, F17AF01222, F18AF00008, F18AF00393 Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal regulation, 2 CFR 200.56, defines indirect costs as those costs incurred for a common or joint purpose benefitting more than one cost objective, and not readily assignable to the cost objectives specifically benefitted, without effort disproportionate to the results achieved. To facilitate equitable distribution of indirect expenses to the cost objectives served, it may be necessary to establish a number of pools of indirect (F&A) costs. Indirect (F&A) cost pools must be distributed to benefitted cost objectives on bases that will produce an equitable result in consideration of relative benefits derived. Condition: We estimate unallowed costs included in the Department of Fish, Wildlife & Parks (department) indirect cost rate calculations totaled $205,791 and $585,102 in fiscal years 2018 and 2019, respectively. The department does not have internal controls in place over the calculation of its indirect cost rate, resulting in noncompliance with federal regulations. Questioned Costs: No questioned costs were identified. Context: We completed a basic recalculation of the indirect cost rates for both years, adjusting for the identified errors. For fiscal year 2018, despite the errors and unallowed costs we identified, due to how the rate is calculated, our calculation reflected the same indirect cost rate determined by the department. For fiscal year 2019, we determined the department?s rate was lower than it should have been, resulting in the department forfeiting $167,302 in federal indirect cost recoveries. The department did not: Have adequate documentation of underlying calculations and decisions such as the split in technology expenses between direct and indirect. Exclude unallowed items or document why they were allowable items. Ensure the calculation was free of mathematical errors. Calculate the rate consistently between years. Effect: Because the department does not have controls in place over the calculation of its indirect cost rate, errors were made in the calculation of the indirect cost rates for fiscal years 2018 and 2019, resulting in noncompliance with federal regulations. Cause: Department staff responsible for calculating the rate stated there were no written procedures when they took over the calculation several years ago but have been keeping notes over different aspects of the calculation each year, just not consistently. Recommendation: We recommend the Department of Fish, Wildlife & Parks implement internal controls over the calculation of its indirect cost rate to comply with federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department?s planned corrective action see the Corrective Action Plan.

State of Montana Schedule of Findings and Questioned Costs For the Two Fiscal Years Ended June 30, 2019 Section III ? Federal Award Findings and Questioned Costs Finding 2019-036: U.S. Department of Interior CFDA #15.605 and 15.611, Fish and Wildlife Cluster Grants # F18AF00061, F18AF00195, F18AF00596, F18AF00631, F18AF00633, F18AF00634, F18AF00647, F18AF00751, F18AF00752, F18AF00860, F11AF01282, F15AF00490, F17AF00653, F18AF00581, F18AF00582, F18AF00593, F18AF00594, F18AF00622, F18AF00624, F18AF00635, F18AF01043, F18AF01066, F18AF01172, F19AF00301, F13AF00104, F13AF00116, F15AF01166, F16AF00234, F16AF00359, F16AF00970, F16AF01144, F17AF00455, F17AF00468, F17AF00474, F17AF00505, F17AF00506, F17AF00507, F17AF00549, F18AF0006, F18AF00099, F15AF00528, F11AF01282, F14AF00109, F15AF00010, F15AF00022, F15AF00490, F16AF00108, F16AF00109, F16AF00293, F16AF00294, F16AF00516, F16AF00865, F16AF01118, F16AF01202, F17AF00472, F17AF00477, F17AF00478, F17AF00479, F17AF00480, F17AF00508, F17AF00527, F17AF00652, F17AF00726, F17AF01222, F18AF00008, F18AF00393 Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal regulation, 2 CFR 200.405(a), states that for a cost to be allocable to a federal award, the services must be chargeable or assignable to that federal award in accordance with relative benefits received. This standard is considered met if a cost: 1. Is incurred specifically for the Federal award; 2. Benefits both the Federal award and other work of the non-Federal entity and can be distributed in proportions that may be approximated using reasonable methods; and 3. Is necessary to the overall operation of the non-Federal entity and is assignable in part to the Federal award in accordance with the principles in this subpart. Federal regulation, 2 CFR 200.403, states, among other things, that costs must be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. Federal regulation, 50 CFR 80.50, outlines the numerous activities eligible for funding under the Pittman-Robertson Wildlife Restoration Act. These allowed activities are centered around all aspects related to the management and restoration of wildlife. Federal regulation, 50 CFR 80.51, outlines the numerous activities eligible for funding under the Dingell-Johnson Sport Fish Restoration Act. These activities are centered around all aspects related to the management and restoration of sport fish. Condition: The Department of Fish, Wildlife, and Parks (department) does not have controls in place to determine the portion of its internal auditor?s time to be allocated to the Wildlife and Sport Fish Restoration (WSFR) grant program. The internal auditor?s job duties encompass multiple state and federal programs, but during fiscal years 2018 and 2019, 100% of the internal auditor?s time was charged to the WSFR. Questioned Costs: We question costs totaling $49,362 and $49,855 for fiscal years 2018 and 2019, respectively. Context: During our audit, we reviewed a list of employees who charged their time to the WSFR grant programs in fiscal years 2018 and 2019 to determine the reasonableness of the expenditures based on our outlined expectations. Because the internal auditor?s job duties encompass multiple state and federal programs, we would not expect all of the employee?s time to be recorded to the WSFR grant programs. Effect: Because the department does not have internal control procedures established to determine the portion of the internal auditor?s time spent specifically on activities benefitting the WSFR grant programs, the department cannot demonstrate compliance with federal regulations, resulting in questioned costs in fiscal years 2018 and 2019. Cause: Department management stated they requested and received specific approval in a grant award from the federal government to include the internal auditor position in the funding under the WSFR grant programs, so they believed it was allowable for the internal auditor to charge all of their time to the WSFR grant programs. Recommendation: We recommend the Department of Fish, Wildlife & Parks implement procedures to ensure the internal auditor?s time is allocated to the Wildlife and Sport Fish Restoration grant in accordance with federal regulations. Views of Responsible Officials: The department partially concurs with this finding, stating, ??we strongly believe the ineligible hours are minimal and still benefit the grant program as a whole.? For additional information regarding the department?s planned corrective action see the Corrective Action Plan. Rebuttal of Views of Responsible Officials: We have reviewed the department?s partial concurrence with this finding. The department?s views do not contain any information not already considered during the audit. As such, we maintain our position as reported.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION