State of IdahoState Government

FINDING 2024-200 The Commission did not comply with federal Matching, Level of Effort, and Earmarking grant requirements for the Rehabilitation Services-Vocational Rehabilitation Grants to States program. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A220017, H126A230017, H126A240017 Program Year: October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Matching, Level of Effort and Earmarking Questioned Costs: Matching: $232,813 Known, Earmarking: $278,509 Known Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 34 CFR 361.60(a)(1) states that the federal share for expenditures made by the State under the vocational rehabilitation services portion of the Unified or Combined State Plan, including expenditures for the provision of vocational rehabilitation services and the administration of the vocational rehabilitation services portion of the Unified or Combined State Plan, is 78.7 percent. The State share for expenditures is 21.3 percent. Requirements in 34 CFR 361.62 state that to maintain a level of nonfederal share it provided in the previous federal fiscal year is at least equal to the total nonfederal share provided by the State two years prior. Section 110(d)(1) of the Rehabilitation Act of 1973 (Rehabilitation Act), as amended by the Workforce Innovation and Opportunity Act (WIOA), requires a state to reserve at least 15 percent of its state allotment, under the State Vocational Rehabilitation (VR) Services grant (Assistance Listing 84.126), for the provision of pre–employment transition services to students with disabilities under section 113 of the Rehabilitation Act. Condition: Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2024 grant period is October 1, 2023, through September 30, 2025. In State fiscal year 2024, there were 3 grants open – federal fiscal years 2022, 2023, and 2024. The federal fiscal year 2022 grant period was October 1, 2021, to September 30, 2023, and was the only grant period that concluded within State fiscal year 2024. We evaluated the Commission’s compliance with the matching, level of effort, and earmarking requirements for the fiscal year 2022 grant. Matching The Commission is required to provide at least 21.3 percent of total rehabilitation program spending from nonfederal sources as a match. We reviewed the amounts reported as federal and State expenditures on the Commission’s final RSA-17 report for the federal fiscal year 2022 grant. The Commission reported the federal share as $2,954,061 and the State matching expenditures as $835,255, which calculates as 22 percent of total program expenditures and meets match requirements. We compared the amounts reported on the RSA-17 report to the expenditures in the former statewide accounting system (STARS) in State fiscal years 2022 and 2023 and the current statewide accounting system (Luma) in State fiscal year 2024. We verified that the federal expenditures matched the RSA-17 report; however, the State expenditures reported internally were only $566,698, which calculates as 16.1 percent of total program expenditures and does not meet match requirements. The Commission could not provide documentation to support the amounts reported in the RSA-17 report. To calculate questioned costs, we verified that the federal share of expenditures matched the amounts reported in Luma. We calculated the matching requirement by dividing the federal expenditures by the federal participation rate, and then subtracting the federal share to arrive at the state share ($2,954,061 / 0.787 = $3,753,571.79 - $2,954,061 = $799,511). We then compared the required state match amount to the state expenditures in Luma and the result was the Commission expended $232,813 less than the required matching amount ($799,511 - $566,698 = $232,813). Level of Effort Maintenance of effort is one part of the level of effort grant requirements. The Commission is required to spend at least the amount of State funds expended in the fiscal year two years prior. We compared State expenditures for the federal fiscal years 2020 and 2022 grants based on amounts reported on the RSA-17 reports. The State expenditures reported for the federal fiscal year 2020 grant on the September 30, 2021, RSA-17 report were $835,255, and the expenditures reported for the federal fiscal year 2022 grant on the September 30, 2023, RSA-17 report were $835,255 indicating that the maintenance of effort requirement was met. We compared the amounts reported on the RSA-17 report to the expenditures in STARS for State fiscal years 2022 and 2023 and Luma for State fiscal year 2024. The State expenditures for the federal fiscal year 2020 grant were $468,147 and for the federal fiscal year 2022 grant were $566,698, which also indicates that the Commission met maintenance of effort requirements, but the Commission could not provide documentation to support the amounts reported in the RSA-17 reports. Earmarking The Commission is required to spend at least 15 percent of the total federal grant expenditures on the Pre-Employment Transition Services (pre-ETS) program. We identified the total federal grant expenditures in Luma as $2,954,061 and the amount spent on pre-ETS as $164,600, which calculates to 5.57 percent of total spending, indicating that the Commission did not meet earmarking requirements. To calculate questioned costs, we multiplied the total federal grant expenditures by 15% and then subtracted the Pre-ETS amount of expenditures in Luma and found that the Commission expended $278,509 less than the required earmarking amount ($2,954,061 * .15 = $443,106 – $164,600 = $278,509). Cause: Each month, the Commission uses a spreadsheet to calculate its cost allocations in accordance with its cost allocation plan (CAP). This spreadsheet includes calculations to track federal and State expenditures and compliance with matching, level of effort, and earmarking requirements. The CAP spreadsheet is prepared by one person and reviewed by a second person. However, this process did not identify the errors indicating that the staff completing these reviews did not have adequate knowledge to ensure this internal control was effective. Effect: Noncompliance with matching and earmarking requirements could result in a reduced federal award amount in future fiscal years. The Commission’s internal control procedures did not include maintaining documentation to support amounts reported for the matching, level of effort, and earmarking requirements which could lead to future errors. Recommendation: We recommend that the Commission design and implement procedures to monitor compliance with matching, level of effort, and earmarking requirements and retain documentation to support compliance. Providing appropriate training and staff recruitment is critical to ensuring that internal controls are effective in preventing or detecting errors. Additionally, we recommend the Commission contact the federal grantor to resolve the noncompliance with matching and earmarking requirements. Management’s View: Agree - The Cost Allocation Plan (CAP) needs to be updated, resubmitted, and approved through RSA. We also agree that ICBVI needs to provide clear documentation to support the numbers in our CAP. ICBVI has reviewed its documentation and believes we met the federal Matching, Level of Effort, and Earmarking requirements for the Rehabilitation Services-Vocational Rehabilitation Grants to States program. Corrective Action: • Matching and Maintenance of Effort (MOE): ICBVI uses a monthly/semi-monthly CAP process to determine the level of federal draw for reimbursement. These draw amounts are based on the necessary monthly amounts (1/12) of the required 21.3% of the total grant award + match, OR the MOE amount from 2 years prior (whichever is greater). This CAP process keeps track of the Grant Total, Draws to Date, To be Drawn, State Portion, and Match/MOE amount YTD. It is through this systematic monthly process that we calculate what the allowable direct and indirect State expenditures are and will make draws that allow us to reach the Match/MOE targets. Based on our documentation, we have made our Match and MOE amounts for the years in question. Documentation supporting the reported amounts can be found in the CAPs from any FFY. • Earmarking: Allowable expenditures for Pre-Employment Transition Services (Pre-ETS) are also tracked in the CAP. Documentation to support amounts reported can be found in the CAPs from any FFY. • CAP Update and Approval: We have a meeting scheduled with the Director of the Indirect Cost Division at the US Dept of Education on 12/10/25. The CAP will be revised to reflect the current chart of accounts and reporting parameters of the Luma system. We will be submitting an updated CAP for review and approval. • Documentation: All expenditure data and supporting documentation will be sourced directly from Luma and retained for verification. • Internal Controls and Training: ICBVI will continue to improve its internal control procedures to include periodic training and cross-training on compliance requirements, ensuring reviews are substantive and error detection is robust. ICBVI will also seek further guidance from the federal grantor and will document all correspondence and remedial efforts. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit. We continue to assert that the Commission did not provide documentation to support the amounts included on the RSA-17 reports and used to calculate compliance with matching and earmarking requirements. As a result, the only available financial information supports that the Commission did not comply with matching and earmarking requirements. We also want to emphasize that the Commission should work with the federal grantor to determine how to rectify the noncompliance.

FINDING 2024-201 Multiple errors were identified in the amounts reported on the Rehabilitation Services Administration (RSA) reports required for the Rehabilitation Services-Vocational Rehabilitation Grants to States. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A220017, H126A230017, H126A240017 Program Year: October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Reporting Questioned Costs: None Criteria: The Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 200.400 contains the policy guide for cost principles related to federal grant administration. Paragraph (a) states that the nonfederal entity is responsible for the efficient and effective administration of the federal award through the application of sound management practices. Paragraph (d) states that the accounting practices of the nonfederal entity must be consistent with these cost principles and support the accumulation of costs as required by the principles and must provide for adequate documentation to support costs charged to the federal award. Section CFR 200.302 – Financial Management states that federal award recipient’s financial management system must identify all federal awards received and expended and the federal programs under which they were received. Additionally, they must maintain records that sufficiently identify the amount, source, and expenditure of federal funds for federal awards. These records must contain information necessary to identify federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Condition: The RSA requires the Commission to submit financial reports quarterly. The reports are cumulative and cover the entire grant period through to the end of the reporting period. The RSA also requires a final report at the end of the grant period. The Vocational Rehabilitation Basic Services (BS) Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2024 grant period is October 1, 2023, through September 30, 2025. The Commission identifies the grant periods using the initials BS and the last two digits of the grant year. During State fiscal year 2024, there were three grants open: BS22, BS23, and BS24. We tested four quarterly reports that reported on the periods within State fiscal year 2024. We identified errors in 3 of the 4 quarterly reports. We also identified errors in the final report for the federal fiscal year 2022 grant which ended on September 30, 2023. The following errors were identified: BS23 – Report Period July 1, 2023, to September 30, 2023 • Line 21 Total Federal Program Income Received: The reported amount was $47,300, and the supporting documentation showed $43,700, resulting in a $3,600 overstatement. This error carried forward to all subsequent quarterly reports because the amounts reported were cumulative. • Line 38A Required Pre-ETS Services Provided: The amount reported was $47,755. The Commission could not provide any documentation to support that amount or provide an explanation for how the amount was calculated. This error carried forward to all subsequent quarterly reports because the amounts reported were cumulative. • Line 38B Authorized Pre-ETS Services Provided: The amount reported was $73,708. The Commission could not provide any documentation to support that amount or provide an explanation for how the amount was calculated. This error carried forward to all subsequent quarterly reports because the amounts reported were cumulative. • Line 39G Transition Services to Youth and Students: The amount reported was $211,595; however, the supporting schedule showed $199,194 resulting in a $12,401 overstatement. The Commission included expenditures outside of the reporting period. • Line 41 Total Innovation and Expansion Expenditures: The amount reported was $20,943. The Commission could not provide any documentation to support that amount or provide an explanation for how the amount was calculated. BS23 – Report Period October 1, 2023, to December 31, 2023 • Line 39G Transition Services to Youth and Students: The amount reported was $211,594; however, the supporting schedule showed $227,249 resulting in a $15,655 understatement. The Commission included expenditures outside of the reporting period. • Line 41 Total Innovation and Expansion Expenditures: The amount reported was $20,943; however, the supporting schedule showed $10,472 resulting in a $10,471 overstatement. BS23 – Report Period January 1, 2024, to March 31, 2024 • Line 39E Business Enterprise Program (Randolph-Sheppard Program): The reported amount was $383,399; however, the supporting schedule showed $383,399 resulting in a $46,380 overstatement. • Line 39G Transition Services to Youth and Students: The amount reported was $254,977, however, the supporting schedule showed $249,977 resulting in a $4,303 overstatement. The Commission included expenditures outside of the reporting period. BS22 – Report Period October 1, 2021, to September 30, 2023 (Final report for federal fiscal year 2022 grant) • Line 21 Total Federal Program Income Received: The reported amount was $0; however, the supporting schedules showed $43,700 resulting in a $43,700 understatement. • Line 37 Administrative Expenditures: The reported amount was $853,677; however, the supporting schedules showed $1,399,438 resulting in a $545,761 understatement. • Line 38A Required Pre-ETS Services Provided: The reported amount was $302,972; however, the supporting schedules showed $287,258 resulting in a $15,714 overstatement. • Line 38B Authorized Pre-ETS Services Provided: The reported amount was $44,151; however, the supporting schedules showed $75,110 resulting in a $30,959 understatement. • Line 39E Business Enterprise Program (Randolph-Sheppard Program): The reported amount was $372,887; however, the supporting schedule showed $438,558 resulting in a $65,671 understatement. • Line 39G Transition Services to Youth and Students: The amount reported was $91,966; however, the supporting schedule showed $76,407 resulting in a $15,559 overstatement. • Line 41 Total Innovation and Expansion Expenditures: The amount reported was $104,647; however, the supporting schedule showed $83,903 resulting in a $20,744 overstatement. We also noted an error while testing compliance with the Matching and Level of Effort requirements using amounts reported on the final RSA-17 report for the federal fiscal year 2022 grant. The Commission reported $835,255 as total State expenditures; however, the amount recorded in STARS was $566,698, resulting in a $268,557 overstatement. Cause: The Commission has designed a procedure to detect errors in reporting prior to issuance. The reports are compiled by one individual and reviewed by a second individual prior to issuing them to the federal agency. However, the review did not detect the errors indicating that the staff completing these reviews did not have adequate knowledge to ensure this internal control was effective. Our testing found that two of the three quarterly reports with errors were not reviewed prior to submission. The Commission could not provide an explanation for the errors. Effect: The RSA uses the RSA-17 reports to determine compliance with federal statutes, regulations, and the terms and conditions of the federal award. Incorrect reporting can affect both the ability to cover current obligations and the amount of future federal grant awards received by the State of Idaho. The total errors in the quarterly reports were overstatements of $219,561 and understatements of $15,655. The total errors in the final report for the federal fiscal year 2022 grant were overstatements of $271,578 and understatements of $701,746. The aggregated errors are a $229,262 understatement of costs. Recommendation: We recommend that the Commission design and implement procedures to ensure accurate federal grant reporting and retain appropriate documentation to support the amounts reported. We also recommend that the Commission review prior submissions, identify correct reporting, and communicate with the federal grantor about resubmitting corrected reports. Providing appropriate training and staff recruitment is critical to ensuring the internal controls are effective in preventing or detecting errors. Management’s View: Agree - These errors in quarterly and final RSA-17 reports are acknowledged, and immediate measures are being taken to address root causes Corrective Action • Accurate Financial Reporting: ICBVI will develop detailed procedures to ensure all amounts reported on federal forms are reconciled to supporting documentation in the accounting system (Luma) prior to submission. • Review and Oversight: A two-person review process will be formalized, ensuring every report is checked for accuracy by a knowledgeable reviewer before submission. • Documentation and Training: Supporting documentation for all line items will be archived securely. Staff will receive training in federal grant reporting standards. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit.

FINDING 2024-202 The Cost Allocation Plan (CAP) used in fiscal year 2024 was not approved by the RSA as required and contained multiple errors. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A220017, H126A230017, H126A240017 Program Year: October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Allowable Costs/Cost Principles Questioned Costs: $210,203 Known Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 200.400 contains the policy guide for cost principles related to federal grant administration. Paragraph (a) states that the nonfederal entity is responsible for the efficient and effective administration of the federal award through the application of sound management practices. Paragraph (d) states that the accounting practices of the nonfederal entity must be consistent with these cost principles and support the accumulation of costs as required by the principles and must provide for adequate documentation to support costs charged to the federal award. The U.S. Code of Federal Regulations (CFR) Title 34 contains the regulations of the offices of the U.S. Department of Education, including the Rehabilitation Services Administration (RSA). Title 34 CFR § 76.560 (b) states: A grantee must have a current indirect cost rate agreement to charge indirect costs to a grant. Title 2, Subtitle A contains the Office of Management and Budget Guidance for Grants and Agreements. Title 2 CFR § 200 Appendix VII part 3 states: Indirect Cost Allocations Not Using Rates: In certain situations, governmental departments or agencies (components of the governmental unit), because of the nature of their Federal awards, may be required to develop a cost allocation plan that distributes indirect (and, in some cases, direct) costs to the specific funding sources. In these cases, a narrative cost allocation methodology should be developed, documented, maintained for audit, or submitted, as appropriate, to the cognizant agency for indirect costs for review, negotiation, and approval. Condition: The Commission uses a CAP to allocate indirect costs among its various programs that should be certified annually by the RSA. The CAP used by the Commission in fiscal year 2024 was not submitted to the RSA for recertification until April 2025 after we inquired about the certification process and documentation for the CAP. Additionally, this CAP was created to be used with data from STARS and no changes were made to coincide with changes in the chart of accounts and reporting available in Luma. The Commission uses a spreadsheet to calculate the indirect costs in accordance with its CAP. This spreadsheet is prepared each month and also keeps track of total spending for federal grants and calculates the amount of federal draws. We tested 4 of the 12 (33 percent) CAP spreadsheets from State fiscal year 2024 to verify that the expenditure amounts used in the calculations tied to support in Luma. One of the CAP spreadsheets reported monthly expenditures of $703,475; however, reports from Luma showed expenditures of $454,004, which is a difference of $249,471. The Commission could not provide documentation or an explanation to support the difference. Cause: The Commission did not have a procedure in place to review the CAP and submit it for recertification annually as required. The Commission has used the CAP spreadsheet for many years, and it has been changed and prepared by multiple personnel, many of whom no longer work for the Commission. The spreadsheet includes multiple tabs, many formulas, cells with hard coded amounts, and no restrictions or controls on data entry. This creates an environment where data entry errors could be made, or a formula could be overridden, and the errors would be difficult to detect. The primary internal control that the Commission relies upon is that the CAP spreadsheet is prepared by one person and reviewed by a second person. However, this control has been ineffective in preventing errors from occurring. Effect: The CAP used by the Commission was not properly submitted for recertification, was not properly modified for Luma, and was not reviewed for accuracy resulting in multiple errors. The Commission has drawn excess federal funds due to the reliance on inaccurate spreadsheets that are not supported by Luma. The reported expenditures of $703,474 were adjusted down by $95,065 for a new total of $608,409, which was also not supported by the accounting records. This amount, run through the CAP resulted in a draw calculation of $512,644, which is 84 percent of $608,409. To calculate the possible overdraw, we started the allowable calculation with the expenditures identified in Luma of $454,004, less the $95,065 adjustment equaling $358,839 of allowable costs, multiplied by the 84 percent CAP estimation is $302,441 for a possible overdraw of $210,203 ($512,644 - $302,441). Our estimation of the error is based on total program expenditures in Luma for November 2023. The Commission could not provide documentation to support various amounts included in the November CAP calculation and could not explain the reason for the differences. If support for adjustments made was available, the amount of the error may have been reduced. Recommendation: We recommend that the Commission work with the federal grantor, the Rehabilitation Services Administration (RSA), to establish an indirect cost rate plan based on Luma reporting. We further recommend that the Commission design and implement procedures to ensure the indirect cost rate plan is implemented as designed and to ensure that future plans are submitted and approved timely and appropriate supporting documentation is retained. We also recommend that the Commission work with the federal grantor to resolve the questioned costs due to unsupported expenditures. Management’s View: Agree - ICBVI recognizes it did not submit its Cost Allocation Plan for annual recertification as required and that the CAP contained errors due to transition challenges with the new accounting software (Luma). Corrective Action: • CAP Update and Approval: The CAP will be revised to reflect the current chart of accounts and reporting parameters of the Luma system. We have a meeting scheduled with the Director of the Indirect Cost Division at the US Dept of Education on 12/10/25. We will be submitting an updated CAP for review and approval. Annual submission for federal recertification will be scheduled and tracked. • Documentation: All expenditure data and supporting documentation will be sourced directly from Luma and retained for verification. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit. We would like to clarify that some of the errors in the CAP were related to the transition to Luma, however many errors occurred because of a lack of internal controls such as reviews for accuracy, protected cells, and detailed procedures. It is important that the Commission address all of the reasons the CAP was unreliable to ensure only appropriate supported costs are charged to federal grants.

FINDING 2024-203 The Commission is not following Idaho Administrative Rules for Purchasing as required for compliance with the requirements applicable to the Rehabilitation Services-Vocational Rehabilitation Grants to States program. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A220017, H126A230017, H126A240017 Program Year: October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Procurement, and Suspension and Debarment Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) contains guidance that nonfederal entities must follow as a condition of receiving federal awards. This guidance in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The CFR procurement standards at 2 CFR 200.317 state that, when procuring property and services under a federal award, a state must follow the same policies and procedures it uses for procurements from its nonfederal funds. The state of Idaho purchasing rules within the Idaho Administrative Procedures Act (IDAPA) contain the following provisions: IDAPA 38.05.01.32. Total Cost: The acquisition cost of property, including all components, options, and add-ons available under the contract, related services, and, in the case of ongoing services, the cost of the full term of the contract, including all authorized renewals. Unless a different total term is provided in the contract, the term used for purposes of total cost is five (5) years. IDAPA 38.05.01.041. Acquisition Procedures: • Small Purchases: Services with less than $25,000 total cost; software with less than $15,000 total cost; property with less than $15,000 total cost; a mix of property and services less than $15,000. o Small purchases do not require acquisition through competitive solicitation. Agencies must comply with the division’s small purchase policy. Property available under single agency or open contracts shall be purchased under such contracts and are not a small purchase under this rule unless otherwise authorized by the administrator. • Informal Purchases: Acquisition of property with a total cost exceeding the dollar limits established in this rule for a small purchase and less than the formal sealed procedure limit are informal purchases. o Informal Purchases may be made using:  An informal solicitation issued through e-procurement, unless exempted by the administrator; or  The formal sealed procedure, when the purchasing authority makes a written determination that using a formal solicitation is in the best interest of the state, including where selection based solely on cost is not appropriate. o Agencies procuring property under this rule shall maintain a purchasing file containing:  The solicitation document posted and quotes received. If the acquisition was not publicly posted, the agency shall include a statement describing the justification for determining that posting was impractical or impossible, along with the administrator’s authorization.  If not using e-procurement, the agency shall document the quotes received (or its attempt to obtain quotes) from at least three (3) vendors having a significant Idaho economic presence as defined in Section 67-2349, Idaho Code.   • Formal Sealed Procedure: o The sealed procedure limit is one hundred fifty thousand dollars ($150,000). o Purchases of property in excess of the sealed procedure limit are made using the formal sealed procedure, unless exempted by these rules or the administrator. IDAPA 38.05.01.042.01. Exceptions requiring written administrator approval. The administrator may exempt the following purchases from the requirement for competitive solicitation by issuing a written determination to the purchasing authority. • Rehabilitation Agency Acquisitions. Acquisitions of property that is provided by non-profit corporations and public agencies operating rehabilitation facilities serving the handicapped and disadvantaged and that is offered for sale at fair market price as determined by the administrator in accordance with these rules. The buyer must submit a written request to the administrator to purchase from a rehabilitation agency and a written approval from the administrator. The purchase must comply with the division’s policy for rehabilitation agency acquisitions. Condition: We identified two vendors that the Commission paid more than $25,000 in total expenditures in fiscal year 2024 and would be subject to compliance with procurement requirements. We tested payments to those vendors for compliance with procurement policies and found that the Commission could not provide documentation to show that State procurement policies were followed. Cause: The Commission erroneously believed that the exemption for rehabilitation agencies applied to more vendors than just not-for-profit entities and public agencies. The Commission also believed that the State purchasing policies did not apply to vendors with many small purchases that are individually below, but collectively exceed, the purchasing thresholds. The Commission has control procedures in place to ensure that grant expenditures are for allowable activities and costs at the transactional level but did not have control procedures to ensure that State procurement rules were followed. Effect: The State’s purchasing policies are designed to ensure that State and federal funds are expended efficiently to meet the goals of State and federal programs. By not following these policies, the Commission could be overpaying for products and services. Recommendation: We recommend that the Commission design and implement procedures to ensure that State purchasing policies are followed. We further recommend that the Commission design and implement procedures to ensure that appropriate documentation is retained to demonstrate compliance and internal controls were operating as intended. Management’s View: Agree - ICBVI acknowledges the failure to document compliance with state procurement policies for select vendors. Corrective Action: • Policy Clarification: ICBVI will ensure future purchases above the threshold are fully documented in accordance with state requirements. • Procedural Update: A procurement checklist and documentation template will be added to internal controls to support purchases subject to state policy. We have a training setup with DOP on 12/18/25 to help with correcting this deficiency. Upon completion of this training, we will conduct comprehensive internal training for all ICBVI staff to ensure consistent understanding and compliance with state procurement requirements. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit.

FINDING 2024-204 The Commission did not verify that vendors were not suspended or debarred prior to making federal grant payments. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A220017, H126A230017, H126A240017 Program Year: October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Procurement, and Suspension and Debarment Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) contains guidance that nonfederal entities must follow as a condition of receiving federal awards. This guidance in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 180.300) requires grantees to verify an entity is not suspended or debarred or otherwise excluded before entering into a covered transaction. The verification is accomplished by (1) checking the System for Award Management (SAM) exclusions maintained by the General Services Administration and available online, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. Nonfederal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Covered transactions, as defined by 2 CFR 180.220, include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria. Condition: We identified two vendors that the Commission paid more than $25,000 in total expenditures in fiscal year 2024. We tested compliance with procurement policies for both vendors and found that the Commission could not provide documentation to show that suspension and debarment verifications were completed as required. Cause: The Commission was not completing the suspension and debarment checks because they incorrectly believed that the checks were already being performed by the Office of the State Controller. Effect: We reviewed all vendors selected as part of our testing and verified that none of the vendors were on the SAM list as suspended or debarred. However, the Commission does not have adequate controls in place to ensure it is not entering into covered transactions with suspended or debarred vendors. Vendors can be suspended or debarred for many reasons including financial crimes such as fraud, embezzlement, or bribery, and other issues such as consistent poor performance on previous contracts or violations of laws. Taking steps to ensure vendors are not suspended or debarred is important to prevent fraud, waste, and abuse. Recommendation: We recommend that the Commission develop and implement procedures to ensure that it is not entering into covered transactions with suspended or debarred vendors and retain documentation to support the procedures performed. Management’s View: Agree - ICBVI recognizes the absence of vendor suspension/debarment verifications prior to payment. Corrective Action: • Verification Process: Procedures will be put in place to check applicable vendors against the SAM.gov database on an annual basis. Documentation of each check will be retained and periodically reviewed. • Staff Training: Relevant staff will be trained on suspension/debarment requirements, and responsibility for checks will be clearly assigned. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit.

FINDING 2024-205 The Commission could not provide documentation to support the review of the Schedule of Expenditures of Federal Awards (SEFA) Closing Package. Type of Finding: Material Weakness Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A220017, H126A230017, H126A240017 Program Year: October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b ) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Additionally, 2 CFR 200.510 requires the State to prepare the SEFA, which must include the total federal awards expended for each individual federal award program. The Office of the State Controller requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Commission prepared the SEFA closing package as required but could not provide documentation to show that the closing package was reviewed for accuracy prior to submission. Cause: One Commission employee was listed as the preparer and submitter for the SEFA closing package. Luma did not prevent the same person from preparing and submitting the closing package. The Commission was under pressure to submit the closing package timely and did not document a review process. Effect: We did not detect any errors in the SEFA closing package; however, without a detailed and documented review, errors could be made and remain undetected. Recommendation: We recommend that the Commission design and implement procedures to accurately record, compile, and document the amounts reported in the SEFA closing package and to retain documentation supporting the amounts reported. Management’s View: Agree - ICBVI acknowledges that it did not document the review process for the SEFA closing package. Corrective Action: • Review Documentation: Procedures will be implemented requiring a documented review prior to submission, with signatures from both preparer and reviewer and archiving of supporting schedules. • Procedural Update: We will ensure that the preparer and reviewer/approver are assigned to different individuals for closing packages going forward. This separation of duties will be incorporated into our procedures to strengthen internal controls and enhance the accuracy and integrity of our financial reporting. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit.

FINDING 2024-206 The Department did not complete required reports for the Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Coronavirus Capital Projects Fund Assistance Listing Number: 21.029 Federal Award Number: CPFFN0170 Program Year: February 4, 2022 – December 31, 2026 Federal Agency: Department of the Treasury Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that non-federal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include reliable financial reporting and compliance with applicable laws and regulations. In addition, the FFATA, as codified in 2 CFR Part 170, requires that subawards of $30,000 or more be reported to the FFATA Subaward Reporting System (FSRS). Condition: The FFATA was developed to provide better transparency over management of federal grants and contracts. Reporting is required for subawards or contracts in excess of $30,000 through the FSRS website. The Department issued 15 subawards for the Capital Projects Fund program (Assistance Listing # 21.029) in fiscal year 2024 with anticipated expenditures in excess of $30,000 each. The Department presumed the Capital Projects Fund program was exempt from FFATA reporting because guidance for this program was provided in conjunction with guidance for another federal program that was exempt from FFATA reporting. Additionally, the FSRS was inaccessible for reporting purposes due to a technical configuration problem until August 2023. However, the configuration problem was corrected in August 2023, and the U.S. Department of the Treasury requested all recipients complete their FFATA reports by June 30, 2024. The Department did not comply with this request. Cause: The Department staff were not aware of the FFATA reporting requirements for the Capital Projects Fund program, nor did they implement internal controls to ensure the accurate and timely submission of the FFATA reports. Effect: The FFATA reports are required to be submitted to the FSRS, which makes the information available to the public in a searchable database. Late reporting, or non-reporting, impacts the integrity of the federal transparency information. Additionally, ineffective internal controls increase the risk that errors or noncompliant reporting could occur and remain undetected. Recommendation: We recommend that the Department design and implement internal controls procedures to ensure an understanding of compliance requirements applicable to grants received and with FFATA requirements for submitting accurate and timely FFATA reports. Management’s View: The Department agrees with this finding. Corrective Action: 1. Multiple RFPs were issued to obtain subject matter experts support for Grant Accounting Support and Grant Administration Support. Internal discussions determined the need for more accounting, administration, and grant management support. Below is our status for support through public procurement. a. The Grant Accounting support was awarded October 2025. b. Procurement of Grant Administration support is in the end stages of award. 2. Updated Procedures (Implemented – April 2025) a. The Department has updated its Notice of Award procedures to explicitly include FFATA reporting as a required step once a Federal grant agreement is fully executed. This requirement is now documented in agency procedures, internal checklists, and award processing workflows. 3. Assignment of Responsibility (Implemented – April 2025) a. Responsibility for FFATA compliance has been formally assigned to the Grants and Contracts Officer with the contracted administrative grant support, with assistance provided from the contracted accounting support when necessary. Their duties now include: i. Completing required FFATA submissions following award execution, and   ii. The process has now been added to our internal processes and procedures and updated with staff. 4. Quarterly Monitoring and Verification (April - 2025) a. To prevent recurrence, Grants and Contracts Officer will conduct a quarterly review of all Federal Grant programs to ensure: i. All applicable awards are listed in the FFATA, ii. No required submissions have been omitted. iii. Any discrepancies are corrected promptly. iv. These quarterly reviews will be documented and retained for audit and internal monitoring purposes. 5. Training and Staff Communication (In Progress — Completion in February 2026 a. Training began in April 2025 and was expanded in October 2025 with support from our Grant Accounting Contractor. The contractor assists in finalizing accounting, reporting, and compliance with OMB guidance. They provide training, updated procedures, and staff guidance. Updated procedures and training will be completed in conjunction with our contractor’s subject matter expertise. Updated policies, training materials, and procedural guidance will be completed and fully implemented in February 2026, with training documented and provided to all Grants and Contracts Officers, contracted services, and relevant program personnel. The training includes but is not limited to: a. All Federal reporting requirements (including FFATA) b. Applicable CFR compliance obligations. c. Newly implemented internal controls and review procedures. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-207 The summary schedule of prior findings required by Uniform Guidance did not accurately include all information required by section 2 CFR 200.511(b). Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Supplemental Nutrition Assistance Program; Highway Planning and Construction Grant; Coronavirus State and Local Fiscal Recovery Fund; Education Stabilization Fund - ARPA ESSER III; Special Programs for the Aging, Title III, Part B Grants for Supportive Services and Senior Centers; Special Programs for the Aging, Title III, Part C, Nutrition Services; Nutrition Services Incentive Program; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program; Medical Assistance Program; Assistance Listing Number: 10.561; 20.205; 21.027; 84.425U; 93.044; 93.045; 93.053; 93.391; 93.558; 93.568; 93.575; 93.658; 93.659; 93.775; 93.777; 93.778; Federal Award Number: Various Program Year: Various Federal Agency: Various Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) section 2 CFR 200.511(a)) states that the auditee is responsible for follow-up and corrective action on all findings. As part of this responsibility, the auditee must prepare a summary schedule of prior audit findings. Section 2 CFR 200.511(b) requires that the summary schedule of prior findings report the status of all audit findings included in the prior audit’s schedule of findings and questioned costs. Additionally, section 2 CFR 200.511(b)(2) requires that when audit findings were not corrected or only partially corrected, the summary schedule must describe the reasons for the findings’ recurrence, planned corrective action, and any partial corrective action taken. Condition: The summary schedule of prior findings reported incorrect statuses for prior findings reported for the 2023 Single Audit Report and a prior finding Internal Control Report for the fiscal year audit of the fiscal year 2023 Annual Comprehensive Financial Report (ACFR). The summary schedule prepared by the Office included the following finding statuses for which its determination differed from the determination made by the auditor after completing follow-up procedures: Idaho Department of Correction: • 2023-203: Office determination – Not Corrected. Based on follow-up procedures completed, the Department of Correction had designed a new process in March 2024 which was implemented for fiscal year 2024 reporting. Audit determination – Corrected. Idaho Department of Environmental Quality: • 2023-206: Office determination – Corrected. Based on follow-up procedures completed, the Department of Environmental Quality did not document their evaluation of each subrecipients risk of noncompliance with a subaward as required by Uniform Guidance for 13 of 13 subrecipients tested. Audit determination – Not Corrected Department of Health and Welfare: • 2023-210: Office determination – Corrected. Based on follow-up procedures completed, the Department did not include a review or approval for 2 of 8 reports tested. Audit determination – Not Corrected • 2023-211: Office determination – Corrected. Based on follow-up procedures completed, the review and approval of the LIHEAP benefits matrix do not go into effect until fiscal year 2025 and the process is to be implemented prior to the beginning of the new federal fiscal year beginning October 1, 2024. Audit determination – Not Corrected • 2023-212: Office determination – Corrected. Based on follow-up procedures, the LIHEAP earmarking review process did not go into effect until fiscal year 2025, as per the documented approval email on November 11, 2024. Audit determination – Not Corrected • 2023-222: Office determination – Corrected. Based on follow-up procedures, the Department was unable to locate the risk assessment for 2 out of 6 subrecipients tested. Audit determination – Not Corrected Idaho Transportation Department • 2023-226: Office determination – Partially Corrected. Based on follow-up procedures, the Department provided correspondence from the Federal Highway Administration (FHWA) showing that the finding had been closed at the federal level as of March 2025. Audit determination – Corrected The summary schedule of prior findings for the single audit also did not explicitly provide a reason for recurrence for findings 2023-201, 2023-203, 2023-208, 2023-223, 2023-224, and 2023-226, as required. Additionally, the summary schedule of prior findings for the single audit did not include follow upfollow-up work for the following findings: Commission on Aging: • 2022-201 which remained Partially Corrected in the 2023 single audit. Based on follow-up procedures, the Commission did not submit timely 5 of 5 reports tested that were submitted after March 2024 and were due by June 30, 2024. The Commission has created a workbook to track awards and reporting dates, with reporting period end dates and due dates added to fiscal calendars, but continues working to catch up on their federal reporting. Audit Determination – Partially Corrected. State Department of Education: • 2022-205 which remained Partially Corrected in the 2023 single audit. Based on follow-up procedures, a sample of 20 fiscal year 2024 ESSER transactions were tested for proper controls, to ensure transactions were for allowable activities, and to ensure transaction information agreed to supporting documentation. No deviations were noted. Audit Determination – Corrected. The ACFR prior finding follow-up included the following finding status determination, which differed between the Office determination and the audit determination. Office of the State Controller: • 2023-103: Office determination – Corrected. Based on follow-up procedures, we were able to see additional processes were added in the fiscal year 2024 ACFR, but were not sufficient to detect or prevent significant misstatements in the 2024 ACFR Audit Determination – Not Corrected Additionally, the ACFR prior finding follow-up did not include follow-up work for the following finding: Idaho State Tax Commission: • 2022-105: for the Idaho State Tax Commission. Based on follow-up procedures, the amount of Restricted Cash was understated in fiscal year 2024 closing packages. Audit Determination – Not Corrected. Cause: The Office did not complete follow-up procedures until the audit work was completed, and the report was in process. Additionally, Office procedures to complete the review are not well documented or properly designed to properly determine the status of prior findings or to ensure a clear reason for recurrence was provided for findings that were not corrected. Effect: The summary schedule of prior findings does not adequately report all the information required by Uniform Guidance. Recommendation: We recommend that the Office design and implement follow-up procedures to accurately and timely determine if prior findings have been corrected. We also recommend that the Office improve review procedures to ensure the summary schedule of prior findings includes all information required by Uniform Guidance. Management’s View: The State Controller’s Office acknowledges and agrees with this finding. Corrective Action: The office will work closer with the agencies to ensure we get the same information provided to the auditors and have the correct statuses along with the needed information when not corrected. The office will also dedicate a position to the findings follow up and corrective action plans from other agencies. Auditor’s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit.

FINDING 2024-208 The Department does not have documented internal controls functioning as intended for the Title I Grants to Local Educational Agencies (Title I) annual allocation process increasing the risk of errors occurring and going undetected. Type of Finding: Significant Deficiency Assistance Listing Title: Title I Grants to Local Educational Agencies Assistance Listing Number: 84.010 Federal Award Number: 170ED2102:170ED2202; 170ED2302; 500ED2002; 500ED2102; 500ED2202; 500ED2302 Program Year: July 1, 2021 – September 30, 2024; July 1, 2022 – September 30, 2024; July 1, 2023 – September 30, 2025; July 1, 2020 – September 30, 2023 Federal Agency: U.S. Department of Education Compliance Requirement: Eligibility; Matching, Level of Effort, Earmarking; Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: Title I is a formula program to States. The U.S. Department of Education (USED) allocates Title I funds to State educational agencies (SEAs) through four statutory formulas (Basic Grants, Concentration Grants, Targeted Grants, and Education Finance Incentive Grants) that are based primarily on the annually updated census poverty local educational agency (LEA) data adjusted for the cost of education in each State. SEAs in turn distribute Title I funds to their LEAs in accordance with Title I requirements. The annual allocation process used by the Department for the Title I program includes steps to determine eligibility of the LEAs, calculate federal earmarking requirements, and ensure funding for new and expanding charter schools. The Department must also ensure that new or significantly expanded charter schools receive the appropriate level of funds under each program for which they are eligible. The new and expanding charter school allocations are determined as part of the annual allocation process. The annual allocation process includes factors for two earmarking requirements. The first requirement is that at least 95 percent of the total Title I funding is passed through to LEAs. The second requirement is that no LEA allocation is below 85 to 95 percent of their prior-year funding. The allocation amounts calculated for distribution to the LEAs and charter schools are maintained using Excel spreadsheet templates. The Department director typically completes a review of the calculations and allocations to each LEA and charter school. Allocations are determined with the initial USED calculations, then with a final allocation, and again if there are revised final allocations. However, the Department’s director and financial principal completed the eligibility and allocation process together during the current audit period. There was no separate documented review completed of the annual allocation calculation in fiscal year 2024. Cause: The Department experienced significant turnover in the financial specialist position since 2022 that made it difficult to completely train staff to perform the annual allocation calculations independently from the standard reviewers; the director and financial principal. No alternative procedures were completed to ensure accuracy. Effect: No errors were noted in the eligibility determinations, earmarking requirements, or funding levels for new and expanding charter schools. However, without a separate documented review, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department implement internal control procedures that include a separate, documented review process for the annual allocation calculations. Management’s View: The Department agrees with this finding. Corrective Action: Immediately following discussions with the auditors on site, allocations, earmarking, and eligibility summary reports were generated as companions to the regular Title I-A allocations process. These three documents are printed, reviewed by the Federal Programs Director, signed and dated by both the Financial Specialist, Principal and Director, then scanned and uploaded to the shared Department drive. This process is completed with both preliminary allocations and final allocations after LEAs have had the opportunity to complete new and significant expansion-related data uploads, if applicable. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We want to emphasize that the Department needs to create procedures that include documenting and retaining the information related to the review processes completed.

FINDING 2024-209 The Department does not have documented internal controls functioning as intended for the Title I Grants to Local Educational Agencies (Title I) Assessment and Integrity Guide increasing the risk of errors occurring and going undetected. Type of Finding: Significant Deficiency Assistance Listing Title: Title I Grants to Local Educational Agencies Assistance Listing Number: 84.010 Federal Award Number: 170ED2102:170ED2202; 170ED2302; 500ED2002; 500ED2102; 500ED2202; 500ED2302 Program Year: July 1, 2021 – September 30, 2024; July 1, 2022 – September 30, 2024; July 1, 2023 – September 30, 2025; July 1, 2020 – September 30, 2023; July 1, 2022 – September 30, 2024; July 1, 2023 – September 30, 2025 Federal Agency: U.S. Department of Education Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Department is required to establish and maintain an assessment system that is valid, reliable, and consistent with relevant professional and technical standards. The assessment system must include policies and procedures to maintain test security and ensure that LEAs implement those policies and procedures (Title I, Section 1111(b)(2)(B)(iii) of the Elementary and secondary Education Act (ESEA) (20 U.S. Code 6311(b)(2)(B)(iii))). Condition: As part of complying with the requirements for receiving the Title I grants, the Department is required to maintain a policy manual regarding test security. The Department uses an assessment and accountability team to review and update policies and procedures for test security on an annual basis. The team then meets with the assessment and accountability director; however, there was no documented review of the policy updates in the current audit period. Cause: The Department did not formally document the review process over updates on the test security policy manual. There were changes in personnel, and internal control procedures were not designed effectively to document the review and approval process. Effect: We identified no errors in compliance with the Assessment and Integrity Guide. However, the lack of a documented review process for updates to the test security manual increases the risk of errors or misinformation in test security guidance occurring and going undetected. Further, the lack of review controls could lead to questions about the integrity and effectiveness of the policy changes. Recommendation: We recommend that the Department implement internal control procedures that include a documented review process over updates to the policies of procedures for test security. Management’s View: The Department agrees with this finding. Corrective Action: The Assessment and Accountability team has implemented a process whereby the staff documents their approval in writing, and then the Director documents her approval in writing as well. Those approvals were taking place previously, and now there is a formalized, written process. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-210 The Department did not complete sufficient subrecipient monitoring for the Individuals with Disabilities Education Act (IDEA) program during fiscal year 2024. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Special Education Cluster Assistance Listing Number: 84.027; 84.173 Federal Award Number: 170ED2131; 170ED2231; 500ED2131; 500ED2141; 500ED2231; 500ED2241; 500ED2331; 500ED2341 Program Year: July 1, 2021 – September 30, 2023; July 1, 2022 – September 30, 2024; July 1, 2021 – September 30, 2023; July 1, 2023 – September 30, 2025 Federal Agency: U.S. Department of Education Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administration Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. The requirements for pass-through entities are in 2 CFR 200.332, which states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and include the following information at the time of the subaward or if information changes. The required information includes: • Federal Award Identification. 1. Subrecipient’s name (which must match the name associated with its unique entity identifier) 2. Subrecipient’s unique entity identifier 3. Federal Award Identification Number (FAIN) 4. Federal award date of award to the recipient by the federal agency 5. Subaward period of performance start and end date 6. Subaward budget period start and end date 7. Amount of federal funds obligated by this action by the pass-through entity to the subrecipient 8. Total amount of federal funds obligated to the subrecipient by the pass-through entity to the subrecipient 9. Total amount of the federal award committed to the subrecipient by the pass-through entity 10. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA) 11. Name of awarding agency, pass-through entity, and contact information for awarding official of the pass-through entity 12. Assistance Listings (AL) number and title 13. Identification of whether the award is research and development (R&D) 14. Indirect cost rate for the federal award • All requirements imposed by the pass-through entity on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the federal award. • Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the federal awarding agency, included identification of any required financial and performance reports. Pass-through entities must also: • Evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining the appropriate subrecipient monitoring. • Consider imposing specific subaward conditions upon a subrecipient, if appropriate. • Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subawards, and that subaward performance goals are achieved. • Verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, and follow up on the results of those audits. Further guidance is provided by the U.S. Department of Education in the State General Supervision Responsibilities Under Parts B and C of the IDEA, Monitoring, Technical Assistance, and Enforcement, which states that a state should monitor all LEAs within a reasonable period of time and at least once within a six-year period. Condition: The Department has designed a monitoring plan to meet the IDEA subrecipient monitoring requirements that includes reviewing all LEAs in the State within a five-year period. The USED guidelines indicate reviews should occur within a reasonable amount of time and at least once within a six-year period. The annual award notification letters to LEAs contain the required grant award information. The program administrators perform an annual risk assessment of all LEAs and subrecipients receiving IDEA Funds. The risk assessment dictates the frequency of completed monitoring. The LEAs are scheduled to be reviewed every year for high risk, every two years for medium risk, and every four to five years for low risk. There are approximately 180 LEAs receiving IDEA funding each year; therefore, between 36 and 45 subrecipients should be monitored each year. Fiscal year 2022 was the first year in the monitoring cycle, and monitoring was completed during calendar year 2022 for 35 LEAs. Fiscal year 2023 activity monitoring included 5 LEAs monitored in calendar year 2023, 8 LEAs monitored in calendar year 2024, and 14 LEAs monitored in calendar year 2025. Based on the number of reviews completed in the prior four years, it is unlikely that the Department could complete those remaining 118 reviews in calendar year 2026 to be compliant with the Department’s internal policy or at the conclusion of calendar year 2027 to be compliant with USED monitoring guidelines. Cause: The Department does not have effective written policies and procedures to ensure all LEAs are monitored for IDEA activity within an appropriate amount of time. Further, the Department has not implemented appropriate procedures to ensure monitoring is completed at a sufficient level to ensure compliance with federal program requirements. Effect: Monitoring for fiscal year 2023 activity took three years to complete. This created a significant backlog of monitoring to be completed for activity in fiscal years 2024, 2025, and 2026 that ensures every LEA is reviewed at least once in a six-year period to be compliant with federal monitoring requirements. Monitoring LEAs is a critical requirement in accepting federal funds and ensuring that those funds are spent in compliance with allowable costs and other guidelines provided by the grantor. Lack of monitoring of LEAs increases the risk that LEAs may not comply with the grant terms. Recommendation: We recommend that the Department implement robust written procedures outlining monitoring activities so that an appropriate number of LEAs are monitored annually to help ensure compliance with federal requirements. Management’s View: The Department disagrees with this finding. Corrective Action: Although the Department agrees that not as many LEAs were monitored as might normally be in a given year, the Department is on track to have monitoring activities completed for all LEAs within the five-year cycle and in accordance with the US Department of Education’s six-year cycle. There is no statute that states a certain amount of monitoring must take place each year. Rather, states are required to monitor all LEAs within a six-year period. In Office of Special Education Programs (OSEP) QA 23-01, State General Supervision Responsibilities under Parts B and C of the IDEA, it states: “States should ensure all LEAs or EIS programs are monitored at least once within the six-year cycle of the State’s SPP/APR, presumptively implementing a reasonable timeframe for monitoring.” (See also Q A-11). The special education fiscal monitoring process includes robust written policies and procedures to meet federal requirements, and the Department underwent thorough federal on-site monitoring by OSEP in FY 2024 and passed without any fiscal findings. The LEA fiscal monitoring is assigned and takes place throughout the state fiscal year. The Department has completed or is in the process of completing 88 LEA monitors for the first three years in the cycle before the end of calendar year 2025. Corrective actions will be forthcoming, and LEAs have 365 days to complete any state monitoring and enforcement corrective actions under 34 CFR 300.600(e). This program-specific rule complements the Uniform Grant Guidance of 2 CFR 200.332(d) in which passthrough entities (SEAs) “must ensure subrecipients take ‘timely and appropriate action’ to correct deficiencies.” The Department is currently transitioning to year four of the five-year cycle for FY 2025-26 (reviewing FY 2024-25 records). With the support of five contracted staff, 60 LEAs are scheduled between December 2025 and June 2026 to review FY 2024-25 fiscal records (made available in November 2025 when CPA audits are due to the state). The Department is also continuing to close out corrective action plans for LEAs from prior reviews. Year five (FY 2026-27) of the cycle will evaluate the FY 2025-26 fiscal records of remaining LEAs. Those LEAs will not be available to monitor until November 2026 when LEA CPA audits are finalized and available. The Department will conduct those reviews in FY 2026-27 (after November 2026). The Department will continue to conduct other monitoring activities throughout the year for all LEAs including through claim reimbursement reviews, the annual IDEA Part B Application, and the risk assessment activities in alignment with Idaho’s Special Education System of General Supervision. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We continue to assert that the Department’s documented progress monitoring LEAs through the end of fiscal year 2024 does not indicate it will comply with federal monitoring requirements. As stated in the finding, documentation reviewed shows that only 62 out of 180 LEAs have been monitored over three and ¾ years, between January 2022 and October 2025. Approximately 63% of the available 6 year monitoring period has elapsed and the Department has only completed approximately 34% of the required reviews. While the Department indicates its intention to catch up the completed reviews, it is unlikely to occur until the Department not only outline a well-defined schedule of monitoring to be completed that complies with the requirements, but also tracks its performance of monitoring completed each year to ensure that each LEA is monitored at least once every six years in accordance with federal monitoring guidelines.

FINDING 2024-211 The Department did not consistently document compliance with federal suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds program. Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of the Treasury Compliance Requirement: Procurement, and Suspension and Debarment Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR Part 180.300) requires grantees to verify an entity is not suspended or debarred or otherwise excluded before entering into a covered transaction. The verification is accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration and available online, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. Nonfederal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Covered transactions, as defined by 2 CFR 180.220, include contracts for goods and services awarded under a non-procurement transaction (for example, grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. Condition: During fiscal year 2024, the Department procedures utilized the process for routing a contract to verify that a vendor was not suspended and debarred. The routing slip includes necessary bidding documents, solicitation documents, bidder evaluations, SAM check on vendor, and the notice of award, as documented in the Department’s DEQ Contract Officer Desk Manual. Contracts 2495 and 2392, solicited to respective contractors Amplifund and Energy Laboratories, did not include evidence of the required SAM check for the vendor on the routing slip. This resulted in two deviations out of a sample of four, reporting a 50 percent exception rate. The Department’s fiscal officer informed us that these contracts were solicited through the State Division of Purchasing; however, the Department was unable to provide information from the State Division of Purchasing that the SAM check was done prior to funds being sent to the vendor. The responsibility to ensure compliance with federal requirements remains with the Department issuing the contract. Cause: Department staff did not verify that all steps required on the routing slip were appropriately completed when a contract was solicited by the State Division of Purchasing. Effect: We did not identify suspended or debarred vendors receiving federal funds during our testing. However, the requirement is to ensure that funds do not go to a contractor that is suspended or disbarred and without a consistently applied and documented internal control the Department increases the risk of paying funds to a contractor who is suspended or disbarred Recommendation: We recommend that the Department strengthen control procedures to include procedures to document the Department’s verification that vendors are not suspended or debarred prior to entering into a covered transaction whether the contract is solicited by the Department or by the State Division of Purchasing. Management’s View: We agree with and acknowledge the finding presented and are committed to addressing it with the following corrective action plan. Corrective Action: The agency utilizes a routing slip or checklist that includes a suspension and debarment check, which will be used and reviewed prior to entering into a covered transaction. This check will be done regardless of whether the solicitation is through our Department, or the State Division of Purchasing. DEQ has had significant turnover in the fiscal office, which has resulted in gaps of knowledge of policies and practices. In summer 2025, DEQ leadership reorganized the fiscal department to improve efficiency, enhance oversight of grants and contracts, and strengthen financial controls. The fiscal office is currently in a rebuilding phase and is dedicated to training and developing staff, implementing best practices, and documenting processes and procedures, including those for federal grant compliance. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-212 The Department’s Indirect Cost Rate Proposal (ICRP) contained multiple errors. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Drinking Water State Revolving Fund; Clean Water State Revolving Fund Assistance Listing Number: 66.468; 66.458 Federal Award Number: Various Program Year: Various Federal Agency: Environmental Protection Agency Compliance Requirement: Activities and Costs Allowed Questioned Costs: Undetermined Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 200.400 contains the policy guide for cost principles related to federal grant administration. Paragraph (a) states that the nonfederal entity is responsible for the efficient and effective administration of the federal award through the application of sound management practices. Paragraph (d) states that the accounting practices of the nonfederal entity must be consistent with these cost principles and support the accumulation of costs as required by the principles and must provide for adequate documentation to support costs charged to the federal award. Condition: The Department uses an Indirect Cost Rate Agreement to charge indirect costs to its programs. We reviewed the ICRP used to calculate the indirect cost rate in place in fiscal year 2024 and found multiple errors: • The direct cost base was reported as $27,355,390; however, the ICRP did not define the methodology used to calculate that amount, the amount reported was also not defined in a detailed schedule in the ICRP, and the Department could not provide documentation to support that it was correct. • The indirect departmental cost was reported as $9,685,891 however, the ICRP did not define the methodology used to calculate that amount nor was the amount reported or supported by a detailed schedule in the ICRP, and the Department could not provide documentation to support that it was correct. • The rate calculation did not include a carryforward amount from the prior year, as required. • The schedules in the proposal contained multiple mathematical errors, including the total sum of the fiscal year 2024 indirect cost pool. The sum was reported as $9,543,761; however, the amounts in the schedule sum to $9,696,805. The difference, $153,044, was the carryover amount from the fiscal year 2022 ICRP, which was incorrect. Cause: The Department’s procedures require the ICRP to be compiled by the fiscal staff and reviewed by separate staff to identify errors. The Department provided documentation to verify that the review occurred; however, it was not performed at a level of detail necessary to identify the errors. The Department also did not include a procedure to retain documentation to support the amounts reported in the ICRP. Effect: We were unable to determine if the indirect cost rate used in fiscal year 2024 was correctly calculated because the methodology and documentation to support the amounts used in the calculation were unavailable. Further, Department staff could not explain or recreate what had been calculated. Even if we make assumptions about what the direct cost base was intended to include, typically direct salary, wages, and fringe benefits, there is no support available to identify which salaries were included or how fringe benefits were calculated. Additionally, formula errors within the schedule used to calculate the rate increase the risk of an incorrect calculation. Recommendation: We recommend that the Department provide training for the staff preparing and reviewing the ICRP to ensure compliance with applicable regulations. We further recommend that the Department design and implement procedures to retain documentation of the methods used to compile the ICRP and the basis for the amounts reported in the ICRP. Management’s View: We agree with and acknowledge the finding presented and are committed to addressing it with the following corrective action plan. Corrective Action: The agency has new staff that will be preparing and submitting the indirect cost rate proposal this year and will take the auditor’s recommendations very seriously in our development and preparation. We have reached out to our federal oversight agency for assistance and direction and are committed to maintaining a file with all supporting documentation used to compile and prepare the proposal, as required by 2 CFR 200. DEQ has had significant turnover in the fiscal office, which has resulted in gaps of knowledge of policies and practices. In summer 2025, DEQ leadership reorganized the fiscal department to improve efficiency, enhance oversight of grants and contracts, and strengthen financial controls. The fiscal office is currently in a rebuilding phase and is dedicated to training and developing staff, implementing best practices, and documenting processes and procedures, including those for federal grant compliance. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-213 The Department did not have documentation to support the verification that grant subrecipients were not suspended or debarred. Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Drinking Water State Revolving Fund Assistance Listing Number: 66.468 Federal Award Number: Various Program Year: Various Federal Agency: Environmental Protection Agency Compliance Requirement: Procurement, and Suspension and Debarment Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards contains guidance that nonfederal entities must follow as a condition of receiving federal awards. Section 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 180.300 requires grantees to verify an entity is not suspended or debarred or otherwise excluded before entering into a covered transaction. The verification is accomplished by (1) checking the System for Award Management (SAM) exclusions maintained by the General Services Administration and available online, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. Nonfederal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Covered transactions, as defined by 2 CFR 180.220, include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria. Condition: Loan recipients from the Drinking Water State Revolving Fund (DWSRF) are considered subrecipients for federal grant compliance purposes. We tested 7 of the 46 identified subrecipients (or 15 percent) to determine if the Department verified that the subrecipients were not suspended or debarred. The Department could not provide documentation to support that suspension and debarment checks were performed for 2 subrecipients (or 28.57 percent). Cause: The Department did not have procedures in place to maintain documentation to support the checks for suspended or debarred subrecipients. Effect: We reviewed all subrecipients selected as part of our testing and verified that none were on the SAM list as suspended or debarred. However, the Department does not have adequate controls in place to ensure that they are not entering into covered transactions with suspended or debarred subrecipients. Subrecipients can be suspended or debarred for many reasons including financial crimes such as fraud, embezzlement, or bribery, and other issues such as consistent poor performance on previous contracts or violations of laws. Taking steps to ensure vendors are not suspended or debarred is important to prevent fraud, waste, and abuse. Recommendation: We recommend that the Department develop and implement procedures to ensure that they are not entering into covered transactions with suspended or debarred parties and retain documentation to support compliance with suspension and debarment requirements. Management’s View: We agree with and acknowledge the three findings presented and are committed to addressing them with the following corrective actions being taken by DEQ. Corrective Action: The agency utilizes a routing slip or checklist that includes a suspension and debarment check, which will be used and reviewed prior to entering into a covered transaction. This check will be done, and documented, regardless of whether the solicitation is through our Department, or the State Division of Purchasing. DEQ has had significant turnover in the fiscal office, which has resulted in gaps of knowledge of policies and practices. In summer 2025, DEQ leadership reorganized the fiscal department to improve efficiency, enhance oversight of grants and contracts, and strengthen financial controls. The fiscal office is currently in a rebuilding phase and is dedicated to training and developing staff, implementing best practices, and documenting processes and procedures. Along with these changes, the grants and contracts teams have been combined to help with oversight and consistency. This is particularly valuable when contracting or procuring goods or services with grant or federal funds. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-214 The Department does not have documented internal controls for cash draws and requested reimbursement for the same $175,500 grant expenditure twice. Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Clean Water State Revolving Fund Assistance Listing Number: 66.458 Federal Award Number: EB25020-22 Program Year: November 1, 2022 – October 31, 2027 Federal Agency: Environmental Protection Agency Compliance Requirement: Cash Management Questioned Costs: $175,500 Known Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 200.400 contains the policy guide for cost principles related to federal grant administration. Paragraph (a) states that the nonfederal entity is responsible for the efficient and effective administration of the federal award through the application of sound management practices. Paragraph (d) states that the accounting practices of the nonfederal entity must be consistent with these cost principles and support the accumulation of costs as required by the principles and must provide for adequate documentation to support costs charged to the federal award. Condition: The Department draws grant funds for reimbursement of allowed costs such as loan disbursements and set-aside funds which may be used for administrative expenses, technical assistance to small water systems, and State program management. One employee uses reports from the statewide accounting system, Luma, to prepare the draw request, accesses the Environmental Protection Agency’s (EPA) Automated Standard Application for Payments (ASAP) system to request the draw, and enters the receivable amount into Luma. The Department does not have a procedure in place for a second person to verify the amounts requested in the grant draws are correct. We tested the following cash draws for the Drinking Water State Revolving Fund (DWSRF) and the Clean Water State Revolving Fund (CWSRF) to verify they were made in compliance with applicable requirements and were recorded in the correct amount: • The Department made five cash draws for reimbursement of loan disbursements for the DWSRF. We tested all five and found no errors. • The Department made four cash draws for reimbursement of loan disbursements for the CWSRF. We tested all four and found one $175,500 draw that was a duplicate of a previously drawn amount. • The Department made six draws for set-aside amounts. These draws were made for multiple EPA programs including the CWSRF and DWSRF. We tested all six and found no errors. Cause: The Department relied on the expenditure controls in Luma to identify the grant expenditures used to determine the amount of the cash draws and did not believe additional controls were necessary. However, these controls would not be effective for ensuring that errors in the draw process would be detected or prevented. Effect: The Department did not have controls in place to identify a duplicate cash draw request for $175,500, resulting in questioned costs. Without control procedures in place to ensure the correct grant expenditures are identified for cash draw requests, additional errors could be made and remain undetected. Recommendation: We recommend that the Department design and implement control procedures to ensure cash draw requests are correct and supported. Management’s View: We agree with and acknowledge the three findings presented and are committed to addressing them with the following corrective actions being taken by DEQ. Corrective Action: The duplicate payment in question was issued but not redeemed. The issuance was to a similar, but incorrect, vendor name and was caught by staff before it was sent to the vendor. The transaction was cancelled in Luma but was not properly recorded in the following draw request. Fiscal staff now perform a thorough review of transactions before a loan draw is finalized in Luma, reconciling the transactions from the Loans and Grants Tracking System (LGTS) to the information generated in the Luma draw invoice. The reconciling and supporting documentation from LGTS is attached to the Luma draw invoice. DEQ has had significant turnover in the fiscal office, which has resulted in gaps of knowledge of policies and practices. In summer 2025, DEQ leadership reorganized the fiscal department to improve efficiency, enhance oversight of grants and contracts, and strengthen financial controls. The fiscal office is currently in a rebuilding phase and is dedicated to training and developing staff, implementing best practices, and documenting processes and procedures, including those for federal grant compliance. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We agree that a more stringent review process and reconciliation control in place would likely prevent or detect an error of this nature in the future, however we would also like to emphasize that the Department should contact the federal grantor to resolve the overdraw of $175,500.

FINDING 2024-215 The Department did not document subrecipient risk assessments or ensure subrecipient audits were received for the Coronavirus State and Local Fiscal Recovery Fund. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of the Treasury Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administration Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The requirements for pass-through entities are in 2 CFR 200.332, which states that all pass-through entities must: • Evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations and the terms and conditions of the subaward for the purpose of determining the appropriate subrecipient monitoring. • Consider imposing specific subaward conditions upon a subrecipient, if appropriate. • Verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, and follow up on the results of those audits. A non-Federal entity that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single or program-specific audit conducted for that year. Condition: The Department received funds for the Coronavirus State and Local Fiscal Recovery Fund (Assistance Listing Number 21.027) from the U.S. Department of Treasury through the Idaho Department of Financial Management. The funds were for two specific program areas within the Department: planning and construction grants for the clean and drinking water infrastructure projects and waste management projects. During fiscal year 2024, there were 128 subrecipients for these funds. The Department established oversight for these funds under the Grant Loan Bureau (planning and infrastructure grants) and the Waste Management Group (various waste management projects). The Department complied with some, but not all, of the pass-through entity requirements. Noncompliance was identified in the following areas: 1) The Department did not adequately document their evaluation of each subrecipient’s risk of noncompliance with federal statutes, regulations, and terms and conditions of the subaward for 13 out of 13 (100 percent) of the sample tested. The Department completes thorough reviews throughout the project timeline to ensure that subrecipients are complying, but those reviews do not adequately assess the subrecipients risk of noncompliance with a subaward, prior to award, as required by 2 CFR 200.332(c). While the Department’s review does ensure each subrecipient has financial review controls in place, the Department does not document a formal risk assessment that evaluates each subrecipient’s risk of noncompliance based on the subrecipient’s prior experience with the same or similar awards, the results of previous awards including whether the subrecipient receives a Single Audit, whether the subrecipient has new personnel, or the extent and results of any Federal agency monitoring. 2) The Department does not have a process in place to ensure that subrecipients are audited, as required by 2 CFR 200, Subpart F for 1 out of 13 (7.69 percent) of the contracts tested. In the prior-year audit, it was stated that the planning/construction group in the Grants Loans Bureau were aware of this issue and have procedures in place within their Loan Grant Tracking Software (LGTS) and that the Waste Program was aware that the subrecipients also required procedures; however, no procedures are in place. During this year’s audit, however, no documentation was submitted in support of the Grants Loan Bureau or the Waste Program. Cause: The Department did not have a formal documented risk assessment process in place as they believed the application process and monitoring during the actual grant award period met the requirements. The Department has procedures in place to check the Federal Audit Clearinghouse for Single Audit Act (SAA) grant audits to see if a subrecipient has a recent audit, however, this procedure alone does not satisfy the requirement. The Department did not deem it necessary to implement additional procedures to ensure an audit was completed for subrecipients meeting the threshold because the grant makes up more than 50 percent of the total project cost and are reimbursement grants. The fact that these are reimbursement grants does not exempt the Department from ensuring that the subrecipient is audited as required by 2 CFR 200, Subpart F. Effect: Subrecipient monitoring is a critical requirement when accepting federal funds and ensuring that those funds are spent in compliance with allowable costs and other guidelines provided by the grantor. Assessing the risk of subrecipient noncompliance enables a pass-through entity to determine the proper level of monitoring procedures. Without completing the risk assessment process, a pass-thought entity may increase the risk that appropriate monitoring procedures will not be performed, and noncompliance may occur and go undetected. Subrecipient audit reports may identify internal control issues and noncompliance with federal award requirements. Reviewing these reports and ensuring that potential issues are addressed decreases the overall risk of noncompliance with the federal award requirements. Recommendation: We recommend that the Department design and implement appropriate procedures to ensure that subrecipient risk assessments are properly completed and documented and subrecipient audits are completed and reviewed in accordance with federal grant regulations. Management’s View: We agree with and acknowledge the three findings presented and are committed to addressing them with the following corrective actions being taken by DEQ. Corrective Action: The Department created a Subrecipient Monitoring Policy that will be implemented by the end of this calendar year, December 31, 2025. This policy includes a risk assessment checklist that will be used prior to issuing a subaward. The results of the risk assessment, the overall risk level, and the level of monitoring will be included in the subaward agreement. The risk assessment and the process will be documented with each subaward request. DEQ has had significant turnover in the fiscal office, which has resulted in gaps of knowledge of policies and practices. In summer 2025, DEQ leadership reorganized the fiscal department to improve efficiency, enhance oversight of grants and contracts, and strengthen financial controls. The fiscal office is currently in a rebuilding phase and is dedicated to training and developing staff, implementing best practices, and documenting processes and procedures. Along with these changes, the grants and contracts teams have been combined to help with oversight and consistency. This is particularly valuable when contracting or procuring goods or services with grant or federal funds. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-216 Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) project and expenditure reports (P&E) contained material overstatements. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The CSLFRF grant award from the U.S. Department of the Treasury requires recipients to provide quarterly P&E reports that contain related costs incurred during the covered period. The recipient’s quarterly P&E report submissions should be supported by the data in the recipient’s accounting system. Condition: During fiscal year 2024, the CSLFRF program was required to submit four P&E reports to the federal government. The agency’s state financial officer compiles and submits the reports to the U.S. Department of the Treasury. The report for the quarter ending March 31, 2024, was overstated by $36.5 million, and the report for the quarter ending June 30, 2024, was overstated by $1.3 million. Cause: The Division’s controls are not performed at the level of detail necessary to prevent or detect errors in the reports before they are submitted to the U.S. Department of the Treasury. The Division compiles P&E reports based off information provided by State agencies. In the prior year, the Division pulled queries to ensure accuracy of agency reported amounts. This process was not performed in the current year as the Division encountered difficulties when attempting to pull reports from the newly implemented accounting system, Luma, to verify agency reported amounts. Effect: The report for the quarter ending March 31, 2024, was overstated by $36.5 million, and the report for the quarter ending June 30, 2024, was overstated by $1.3 million. Recommendation: We recommend that the Division design and implement internal controls to ensure CSLFRF P&E reports are accurate. We also recommend that the Division e-mail the U.S. Department of the Treasury to correct erroneous information in the Treasury Portal as suggested in the Project and Expenditure Report User Guide published by the U.S. Department of the Treasury. Management’s View: The agency agrees with this finding. With significant turnover at DFM, and the implantation of a new statewide accounting system it was difficult to identify expenditure data that was provided by agencies to the division. Additionally, it was difficult to get responses from the US Department of Treasury when identifying errors to be correct in prior periods. Currently there is no option to update prior quarter errors when they are identified. Corrective Action: DFM is currently training other staff members to add to the bench of support for SLFRF quarterly reporting. This training includes matching expenditures in Luma. We are also going to engage with SCO to see if we can get a report built to identify agency expenditures and match them to the reports provided by the agencies. Additionally, we will continue to work with the US Treasury to see if we can update previous reporting periods. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

FINDING 2024-217 The Department lacked documentation to support continued eligibility for providers within the Medicaid program. Type of Finding: Material Weakness, Material Noncompliance AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Special Tests and Provisions Questioned Costs: Undetermined Criteria The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 431.107 states that providers must be licensed in accordance with federal, state and local laws, and regulations to participate in the Medicaid program and receive payments. Additionally, the Uniform Guidance included in 42 CFR 455.412 states that the state Medicaid agency must: (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any state is licensed by such state. (b) Confirm that the provider’s license has not expired and that there are no current limitations on the provider’s license. Condition: The Department could not provide documentation to support the eligibility for 14 of the 62 MCO providers tested (or 22.6 percent) and could not provide documentation that 9 of the 14 noted providers (or 64.3 percent) had applicable licenses and certifications. Also, 4 out of 14 noted providers (or 28.6 percent) did not have an active contract with the MCO during the applicable period. The Department also could not provide documentation for 1 out of the 14 noted providers (or 7.1 percent) that the provider entered into an agreement and made the required disclosures to the State. We were unable to verify if the MCOs paid claims to ineligible providers. The Department should have been tracking and verifying payments were not made to ineligible providers by the MCOs. All providers noted were included in the rosters as of December 2024, indicating they were eligible to participate in the Medicaid program. Cause: The Department did not review the documentation supporting eligibility for 14 providers at a level of detail sufficient to properly identify the required missing support, despite the providers being included in the provider roster reports. Effect: Without supporting documentation, we are unable to confirm that the noted providers were eligible to participate in the Medicaid program. In addition, there is an increased risk that a Medicaid recipient could utilize an ineligible provider from the roster and claim payments could be processed by an MCO and go undetected by the Department. Recommendation: We recommend that the Department strengthen internal controls to ensure required documentation is maintained by MCOs to support the eligibility of contracted providers, including applicable licenses and certifications, provider agreements, and required disclosures to the State. In addition, we recommend that the Department determines if payments were made to ineligible providers. Management’s View: The Department Agrees with this Finding. Corrective Action: As part of the Provider Enrollment project, the division will audit provider payments starting in 2026. The health plans will be required to validate that the providers are fully enrolled with Medicaid prior to enrolling with the health plan in early 2026. These are [sic] audits will begin in May 2026 and continue through the end of the year depending on when provider reports are due to Medicaid. This is also part of the Corrective Action Plan mentioned in finding #5. The information required to validate that no payment was made inappropriately is part of the audits that will be conducted this year with the provider rosters. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-218 The Department did not ensure compliance with federal requirements that Managed Care Organizations (MCO) were submitting provider roster reports annually to verify that all providers are properly licensed and in good standing. Type of Finding: Material Weakness, Noncompliance AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR Section 431.107 states that providers must be licensed in accordance with federal, state and local laws, and regulations to participate in the Medicaid program and receive payments. Additionally, the Uniform Guidance included in 42 CFR 455.412 states that the state Medicaid agency must: (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any state is licensed by such state. (b) Confirm that the provider’s license has not expired and that there are no current limitations on the provider’s license. Condition: The Department has contracts with 4 MCOs; 2 of the Department’s MCOs submitted provider roster reports as required. We confirmed that the Department received 4 provider roster reports for the applicable Managed Care Plans. The receipt of the provider roster reports for each plan, the review of the plan, and the approval of the plan are documented on a tracking spreadsheet. We noted that 3 out of 4 managed care plans (or 75 percent) did not have the receipt, the review, or the approval information documented on the tracking spreadsheet for fiscal year 2024. Cause: It appears that while the Department had established internal controls to document the receipt, review, and approval of the provider roster reports on the tracking spreadsheet, it was not consistently performed due to the Division of Medicaid oversight. The Department is updating the tracking spreadsheet to ensure proper documentation is maintained in the future. Effect: In the absence of internal controls over the provider roster reports, an MCO could be enrolling and maintaining ineligible providers. Recommendation: We recommend that the Department strengthen internal controls over the MCO provider roster reports and properly document the receipts, reviews, and approval information. Management’s View: The Department Agrees with this Finding. Corrective Action: Starting early 2026 most providers will be required to enroll with Medicaid prior enrollment with the health plans. Health plans have been receiving a daily file with the provider enrollment information and are working on their own system changes to intake that information. This is part of the Corrective Action Plan that is mentioned in finding #5. The report trackers that the Medicaid teams use will document when these reports are received, whether or not they meet metric criteria. The audit of those provider rosters will occur annually. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-219 The Medicaid Enterprise System was not properly updated for members deemed ineligible, resulting in capitation payments issued to Managed Care Organizations for ineligible members within the Medicaid program. Type of Finding: Material Weakness, Material Noncompliance AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Eligibility Questioned Costs: $78 Known, $2,051,295 Projected Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 435.10 states that a state plan must: (a) Provide that the requirements of this part are met; and (b) Specify the groups to whom Medicaid is provided, as specified in subparts B, C, and D of this part, and the conditions of eligibility for individuals in those groups. The Uniform Guidance included in 42 CFR 438.3(c)(2) states that capitation payments may only be made by the state and retained by the Managed Care Organization, Prepaid Inpatient Health Plans, or Prepaid Ambulatory Health Plans for Medicaid-eligible enrollees. Condition: During our review of the eligibility determination for Medicaid members, we tested 78 claims that included capitation payments. Capitation payments are payments made by the State to Managed Care Organizations (MCO), Prepaid Inpatient Health Plans, or Prepaid Ambulatory Health Plans for Medicaid eligible enrollees. For each MCO, capitation payments are calculated per member per month. The Department makes payments to an MCO based on the total number of members per month. Out of 78 claims tested, 3 capitation payments (or 3.8 percent) were paid to the MCOs for Medicaid members that were no longer eligible; 2 of the 3 capitation payments were paid for a Medicaid member that was eligible through May 2023; and 1 of the 3 capitation payments was paid for a Medicaid participant that was eligible through the end of April 2023. Questioned costs were calculated based on a sample error of $78 of known questioned costs paid that was projected out to the overall population for $2,051,295 of projected questioned costs. Cause: During May 2023, eligibility was re-evaluated in the Idaho Benefit and Eligibility System (IBES). The members in some MCO plans were determined ineligible in IBES. The updates to eligibility status were not forwarded to the Medicaid Enterprise System (MES). Capitation payments were still paid on behalf of these members despite being deemed ineligible in IBES. The MES relies on member eligibility information from IBES and interfaces nightly; however, the eligibility status in IBES was not appropriately updated in MES. No claims were paid on behalf of those members during fiscal year 2024. Effect: Though we did not identify claims in our sample that were paid on behalf of the ineligible members during fiscal year 2024, the Department did issue Medicaid capitation payments on behalf of ineligible members. Additionally, given the nature of the error in updating the MES, other capitation payments or claims may have been paid for ineligible members. Recommendation: We recommend that the Department properly design, implement, and maintain internal controls to ensure that MES and IBES data are properly interfacing, complete, and accurate, ensuring that capitation payments are issued only for eligible members. In addition, we recommend that the Department review those recipients that were deemed ineligible to determine which would have contributed to capitation payments and if any more had been made in error. Management’s View: The Department Agrees with this finding. Corrective Action: Medicaid recognizes that this appears to be an interface issue with Self Reliance, and their inability to send correct eligibility records to Medicaid in certain instances. Medicaid will investigate and work with Self Reliance to mitigate these issues while working through our new system implementations and interfaces. Self-Reliance is looking at the issue to identify root causes and will work closely with MC to determine next steps to implement. System integration is expected in 2028. In the interim, we’ll identify issues and develop implementation strategies by 2027. Strategies will align with system updates and builds for both Self-Reliance and Medicaid. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-220 The expenditures reported on the Quarterly Medicaid Statement of Expenditures for the Medical Assistance Program form (CMS-64) were understated by $16,348,275 for the Medicaid program. Type of Finding: Material Weakness, Noncompliance AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 45 CFR 302.15(a)(3) states that the agency should maintain the necessary records for the proper and efficient operation of the State plan, including records regarding amount and sources of support collections and the distribution of these collections. In addition, the Uniform Guidance included in 42 CFR 430.30(c)(1) states that the State must submit the CMS-64 to the central office (with a copy to the regional office) not later than 30 days after the end of each quarter. Condition: The CMS-64 is used by the Department to report its actual program benefit costs and administrative expenses to the Centers for Medicare and Medicaid Services (CMS). We reviewed two of the four quarters submitted during fiscal year 2024. One of the two tested quarters on the CMS-64 (or 50 percent) was submitted 207 days late. The other quarter was submitted 185 days late. The Department notified CMS and received return communications acknowledging that reporting for Idaho would be delayed due to the implementation of Luma. In addition, one of the two quarters tested on the CMS-64 (or 50 percent), the state and local administration amount was understated by $16,348,275. Cause: The implementation of Luma resulted in significant reporting issues and caused the Department to submit the CMS-64 forms late. In addition, staff turnover and insufficient training caused the misstatement of the state and local administration amount on the CMS-64, and the review of the report was not performed at a level sufficient to identify errors. Effect: The late submission of the CMS-64 caused the Department to be noncompliant with the federal requirements. Additionally, the state and local administration amount reported on the CMS-64 was understated by $16,348,275 for one quarter during fiscal year 2024 for the Medicaid program. The understatement was eventually corrected in the June 30,2025, CMS report. Recommendation: We recommend that the Department strengthen internal controls to ensure accurate amounts are reported and timely submission of the CMS-64. Management’s View: The Department Agrees with this finding. Corrective Action: As noted in the finding, the late submission and understated expenditures were primarily the result of the Luma system implementation and the unavailability of required data for CMS reporting. During the development phase, concerns were raised regarding the system’s ability to meet federal reporting requirements—specifically the CMS-64 and CMS-21 reports for Medicaid. The Budget Team requested sample output reports to proactively update workpapers and ensure accurate and timely reporting; however, these requests were not fulfilled. During the delay in timely reporting, DHW maintained ongoing communication with our federal partners. The Budget Team developed the necessary reports and revised internal processes to bring reporting current. The Budget Team also worked closely with our federal auditors to ensure no reporting elements were inadvertently omitted. During this review, we identified that our initial submission excluded indirect expenditures associated with the federally approved Cost Allocation Plan. This allocation process cannot be completed within Luma and requires coordination among the State Controller’s Office, two external vendors, and the Cost Allocation Budget Analyst. These dependencies created significant delays. As a result, indirect cost allocation charges were substantially delayed, and the first successful import for July 2023 did not occur until November 2023. Upon receiving the complete data, the Reporting Team corrected the process, documented the updates, and submitted a prior period adjustment to capture previously under-reported expenditures. As we entered SFY 2025, we had a more comprehensive understanding of the new processes and required timelines. This resulted in improved timeliness: the December 2024 submission was five days late submitted 2/4/25, the March 2025 submission was two days late submitted 4/30/25 and resubmitted 7/31/25, and the June 2025 submission was only one day late submitted 7/31/25. We are pleased to report that the September 2025 submission was certified on time and submitted 10/30/25. While some reporting adjustments were needed, CMS and the Budget Team collaborated effectively to update and recertify the report to ensure accuracy. We have updated all relevant process documentation and continue to automate steps where feasible to further improve efficiency and reduce turnaround times. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-221 The Division of Medicaid did not document the review and approval of the audited financial reports of the Managed Care Organizations (MCO). Type of Finding: Material Weakness Related to Prior Finding: 2023-224 AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 438.3(m) requires the contract with MCO to include the requirement to submit audited financial reports specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Condition: We reviewed all 4 MCO contracts with the Department that were active during fiscal year 2024. The Department did include requirements for the MCOs to submit audited financial reports in the contracts but did not have documented reviews and approvals in places over those audited financial reports provided for 2 out of 4 MCO contracts (or 50 percent). Cause: The Department did not realize that the annual submission of the audited financial reports provided by the MCO was not included in the monitoring spreadsheet until we requested clarification which led to a lack of a documented review. Effect: Audited financial reports provide information about internal controls and compliance with laws, rules, and regulations. Collecting and reviewing audited financial reports provides additional oversight and the ability to react to the risk of noncompliance occurring at the MCO. Recommendation: We recommend that the Department follow intended procedures to monitor and document the receipt, and review, of the audited financial reports. Management’s View: The Department Agrees with this Finding. Corrective Action: The division has signed and [sic] MOU with the Department of Insurance to review audited financial reports. The first reports will be sent to the Division of Insurance December 2025 with the exception of the Magellan report which is [sic] will be sent to the Division of Insurance in January 2026 as they are finalizing their report currently. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-222 Four providers lacked documentation to support continued eligibility within the Medicaid program. Type of Finding: Significant Deficiency, Noncompliance Related to Prior Finding: 2023-223 AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Special Tests and Provisions Questioned Costs: Undetermined Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 455.412 states that the state Medicaid agency must: (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any state is licensed by such state. (b) Confirm that the provider’s license has not expired, and that there are no current limitations on the provider’s license. In addition, the Uniform Guidance included in 42 CFR 455.414 states that the state Medicaid agency must re-validate the enrollment of all providers regardless of provider type at least every five years. Condition: During testing, we identified 4 out of 60 providers (or 6.7 percent) that did not submit maintenance documents over 5 years. The specific maintenance documents that are required to be submitted depend on the type of provider. The Gainwell Provider Enrollment Specialist did not ensure that provider eligibility was properly maintained prior to updating the provider’s eligibility in the MES. Cause: Idaho Medicaid provider re-validation was scheduled to be completed in March 2025. The service organization, Gainwell Technologies, was unable to complete re-validation due to their own constraints. This is a known issue to the Department, and it anticipates completion of the provider re-validation by December 2025. Effect: If providers are not properly validated every five years, they may be ineligible to participate in the Medicaid program and still receive payments for services. Recommendation: We recommend that the Department strengthen internal controls to ensure provider validation is completed timely and in compliance with federal requirements. This may include providing for alternative procedures when a contractor does not perform agreed upon services. Management’s View: The Department Agrees with this finding. Corrective Action: Medicaid is currently under a Corrective Action Plan with CMS requiring all Managed Care providers to enroll with Medicaid. This project is currently underway. The initial date of completion of having all providers enroll was 12/31/2025. However, there were unforeseen system enrollment issues that delayed the project. The go live date is now April 1, 2026. Once all providers are enrolled Medicaid will audit provider rosters throughout the year to ensure those providers are in fact enrolled within Medicaid's system. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-223 The submission of a Child Care and Development Fund (CCDF) financial report used to support compliance with the Matching, Level of Effort (LOE), and Earmarking requirement was not completed timely. Type of Finding: Significant Deficiency, Noncompliance AL Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund AL Number: 93.575, 93.596 Federal Award Number: 2001IDCCDF, 2001IDCCC3, 2401IDCCDD, 2401IDCCDF, 2401IDCCDM Program Year: October 1, 2019 – September 30, 2022, March 27, 2020 – September 30, 2023, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Matching, Level of Effort, Earmarking Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 45 CFR 98.65(g) states that Lead Agencies shall submit financial reports, in a manner specified by the Administration for Children and Families (ACF), quarterly for each fiscal year until funds are expended. Additionally, the Administration for Children and Families (ACF) Form ACF-696 (Financial Reporting Form for State and Territory Child Care and Development Fund (CCDF) Lead Agencies) states that this form must be submitted quarterly. These reports are due 30 days after the end of the quarter: Quarter 1 by October 31, Quarter 2 by April 30, Quarter 3 by July 31, and Quarter 4 by January 31. Condition: The Department is required to complete a CCDF financial report, Form ACF-696 on a quarterly basis for each grant. Each report must be submitted within 30 days after the end of the applicable quarter. The final report for the quarter ended September 30, 2023, that included earmarking and level of effort amounts was submitted 1 month later, on November 30, and was signed off by the Department’s financial executive officer about 5 months after the deadline, on March 25, 2024. We did not note errors related to maintenance of effort and earmarking compliance requirements in the reports. Cause: Staff turnover, insufficient training, and the implementation of Luma caused the Department’s late submission of the required Form ACF-696 for the quarter ended September 30, 2023. The Department requested an extension from the ACF to complete necessary adjustments, but the request was denied. Effect: Late submission of the report resulted in the Department’s noncompliance with federal requirements. Additionally, the documentation of a review by the financial officer almost 4 months after submission calls into question how effective the review would be in detecting and correcting errors prior to submission. Recommendation: We recommend that the Department strengthen internal controls to ensure the timely and reviewed submission of the CCDF financial report, Form ACF-696. Management’s View: The Department Agrees with this Finding. Corrective Action: The Department has seen an increased time commitment related to financial grant reporting since the implementation of Luma in July 2023. This was particularly relevant in SFY 2024 as Luma implementation, training and interfaces were still evolving, resulting in a tremendous increase in time commitments without the corresponding staff increases needed. In many cases, this resulted in late filings and/or filing reports that were not reviewed in sufficient detail. The Division of Financial Services continues to work through the inefficiencies encountered and design processes that include sufficient review and other internal controls while also allowing for timely completion of required reports. One FTE was transferred from another team to the Cash and Grants team. This position is expected to assist in completing preliminary tasks so that Grant Reporters have necessary data at their fingertips when drafting financial reports. As Department staff continue to learn nuances of the Luma system, both accuracy and timeliness of financial reporting is expected to improve. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-224 Some expenditures were misclassified on the Child Care and Development Fund (CCDF) financial report resulting in an overstatement of Child Care Administration expenditures and an understatement of Direct Services. Type of Finding: Material Weakness, Material Noncompliance AL Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund AL Number: 93.575, 93.596 Federal Award Number: 2001IDCCDF, 2001IDCCC3, 2401IDCCDD, 2401IDCCDF, 2401IDCCDM Program Year: October 1, 2019 – September 30, 2022, March 27, 2020 – September 30, 2023, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 45 CFR 98.65(g) states that Lead Agencies shall submit financial reports, in a manner specified by ACF, quarterly for each fiscal year until funds are expended. Also, 45 CFR 98.54(a) states that not more than 5 percent of the aggregate funds expended by the Lead Agency from each fiscal year's allotment, including the amounts expended in the state pursuant to 45 CFR 98.55(b), shall be expended for administrative activities. Additionally, Form ACF-696 (Financial Reporting Form for State and Territory Child Care and Development Fund (CCDF) Lead Agencies) states that the CCDF program has a number of fiscal requirements associated with multiple funding streams that comprise the block grant. Form ACF-696 has separate columns for reporting expenditures from each of these component funding streams. Condition: The Department is required to complete a CCDF financial report, Form ACF-696 on a quarterly basis for each grant. The Department compiles reports using quarterly supporting workpapers which are broken out by source, including the mandatory fund, the matching fund, and the discretionary fund. We found 1 out of 4 Form ACF-696 tested (or 25 percent), in which the Department misclassified the expenditures included in the mandatory funds, reporting $2,867,578 under the Child Care Administration line instead of Direct Services Line. Cause: Staff turnover and the implementation of Luma contributed to the human error that caused the expenditure misclassification. In addition, the review of Form ACF-696 was not completed at a level sufficient to identify errors. Effect: Expenditures in CCDF Direct Services included in mandatory funds were misclassified as Child Care Administration expenditures. With an incorrect amount being reported, the spending requirements applicable to the Child Care Administration expenditures were also not met. Recommendation: We recommend that the Department strengthen internal controls over the compilation and submission of the CCDF financial report, Form ACF-696, to ensure the amounts are classified properly and accurately. Management’s View: The Department Agrees with this Finding. Corrective Action: The Department's Grant Reporting team has been developing additional internal controls to put in place with the utilization of the Luma ERP. Some of the controls include conducting reconciliations between internal workpapers and Luma records as well as reconciling to external parties such as the Payment Management System. The deeper reviews being performed during reconciliations are also highlighting areas where workpaper adjustments may be needed as some of the templates used may be outdated. We believe these increased focused efforts will alleviate issues like this in the future and are ongoing as the Department identifies opportunities for advancements in our own processes and working with SCO to implement better Luma reports and controls within the grant reconciliation process. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-225 Amounts reported as provided to subrecipients by financial services on the Schedule of Expenditures of Federal Assistance (SEFA) are not properly supported. Type of Finding: Significant Deficiency, SEFA Misstatement Related to Prior Finding: 2023-208; 2022-211; 2021-206 AL Title: Special Supplemental Nutrition Program for Women, Infants, and Children, Temporary Assistance for Needy Families, Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund AL Number: 10.557, 93.558, 93.575, 93.596 Federal Award Number: Various Program Year: Various Federal Agency: Department of Health and Human Services Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in 2 CFR 200.510(b), which states, in part, it must include: • Total federal awards expended as determined in accordance with 2 CFR 200.502, and • Total amount provided to subrecipients from each federal program (2 CFR 200.510(b)(4)) The Office of the State Controller (Office) requires agencies to complete the SEFA closing package and uses the reported information to compile the statewide SEFA. Condition: Amounts reported on the SEFA closing package as expenditures to subrecipients did not agree to amounts provided by program staff to auditors for testing purposes. The following programs had discrepancies between what was reported on the SEFA closing package and what was retained by program personnel: • An overstatement of $4,503,700 for the Child Care and Development Block Grant (Assistance Listing Number (AL) 93.575) • An overstatement of $29,079 for the Child Care and Development Block Grant (AL 93.596) • An understatement of $1,014,475 for the Temporary Assistance for Needy Families (AL 93.558) • An understatement of $362,470 for the Special Supplemental Nutrition Program for Women, Infants, and Children (AL 10.557) Cause: Contradicting information was provided by financial services personnel and program personnel related to expenditures to subrecipients reported on the Schedule of Expenditures of Federal Awards (SEFA) closing package for three major programs. A new statewide accounting system (Luma) was implemented in July 2023. The Office provided guidance to the Department on how to code expenditures to subrecipients, using specific account codes. According to financial services personnel, some expenditures to subrecipients were incorrectly coded causing incorrect amounts to be included on the SEFA. The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2024 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. In addition, Department financial services personnel and program personnel are not communicating effectively to discover and resolve any discrepancies related to expenditures to subrecipients reported on the SEFA. Effect: The amounts provided to subrecipients were misstated in the Department’s SEFA closing package as detailed in the condition section above. The net overstatement is a combination of over and under statements that total $3,155,834 in the Department’s SEFA closing package. Recommendation: We recommend that the Department improve the process of gathering information to prepare the SEFA closing package and review for accuracy at a level of detail sufficient to detect and correct errors in the SEFA closing package. In addition, we recommend that the Department improve training of program personnel regarding the proper coding of the expenditures to subrecipients. Management’s View: The Department Agrees with this finding. Corrective Action: For major grants, Financial Services staff will send a summary of transactions coded as subrecipient payments to the program manager to review prior to inclusion in the SEFA closing package. The review will be requested to be twofold: to ensure that everything that should be included as a subrecipient payment is and to ensure that nothing that should not be considered a subrecipient payment is included. This process helps to identify that we are reporting the accurate amount of expenditures for each subrecipient. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-226 The Bureau of Facility Standards within the Department failed to complete timely health and safety surveys for three long-term care facilities. Type of Finding: Material Weakness, Material Noncompliance AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 488.330(a)(i) states that the survey agency surveys all facilities for compliance or noncompliance with requirements for long-term care facilities. Also, 42 CFR 488.308(a) states that the survey agency must conduct a survey of each nursing facility not later than 15 months after the last day of the previous survey. Additionally, 42 CFR 488.308(b) states that the statewide average interval between standard surveys must be 12 months. The Centers for Medicare and Medicaid Services (CMS) provided the QSO-22-02-ALL memo on November 12, 2021, which stated that as of November 2021, the Bureau of Facility Standards (Bureau) should be able to resume re-certification surveys on a regular basis and should do so by establishing new intervals based on each facility’s next survey, not based on the last survey that was conducted prior to the COVID-19 Public Health Emergency (PHE). Condition: The Bureau is required to conduct unannounced standard re-certification surveys, which provide a comprehensive review of the quality of care furnished in a facility. For long-term care facilities, these recertification surveys must be conducted no later than 15 months after the previous recertification survey with a statewide average interval of 12 months or less. We identified 3 out of 18 providers tested (or 16.6 percent) that did not have a survey completed within 15 months of the previous survey as required. The timing of the re-certification surveys was 27 months, 42 months, and 38 months, respectively. Collectively, the timing of the re-certification surveys caused the Department to be noncompliant with the statewide average interval of 12 months or less requirement as well. Cause: The Bureau experienced staffing shortages that delayed survey completions. The Bureau also stated that they followed the guidance provided by CMS QSO-22-02-ALL memo by prioritizing facility recertification surveys for facilities that had a history of noncompliance or allegations of noncompliance. Effect: Delays in the completion of health and safety surveys increases the risk of inadequate care for Medicaid recipients and that Medicaid providers are not complying with health and safety standards. In addition, ineligible providers could be receiving federal funds. Recommendation: We recommend that the Department ensure that surveys required are conducted not later than 15 months after the last day of the previous survey and ensure that the statewide average interval between standard surveys must be 12 months. Management’s View: The Department Agrees with this finding. Corrective Action: During SFY24, Bureau of Facility Standards (BFS) was still coming out of the COVID response for recertification time frames and actively recruiting new health facility surveyors to ensure proper multidisciplined teams were available to complete the overdue surveys. BFS also contracted with Healthcare Management Solutions, LLC. to supplement overdue recertification surveys. On October 3, 2025, during the government shutdown, we were able to complete the final overdue surveys to be compliant with 15.9 months between surveys. Due to the government shutdown, CMS paused recertification surveys for nursing facilities. This may restrict our ability to maintain the required recertification timeline of 15.9 months. We have recruited and maintained staffing posture but are still actively recruiting to round out of staffing to meet the statutory timelines. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We appreciate the Department’s efforts to reduce the time between required surveys to 15.9 months; however, the United States Code of Federal Regulations Title 42 Section 488.308(a) requires the survey agency to conduct a survey of each nursing facility not later than 15 months after the last day of the previous survey. Based on our interpretation of the very specific language in the requirement that the reviews be completed not later than 15 months after the last day of the previous survey, we assert that the Department was not compliant with the requirement during the audit period and still not compliant as of October of 2025.

FINDING 2024-227 The review and approval of the annual updates to the Low-Income Home Energy Assistance Program (LIHEAP) benefits matrix were not documented. Type of Finding: Material Weakness Related to Prior Finding: 2023-211 AL Title: Low-Income Home Energy Assistance AL Number: 93.568 Federal Award Number: 2101IDLWC6, 2201IDLIEA, 2301IDLIEA, 2301IDLIEE, 2301IDLIEI Program Year: May 28, 2021 – March 31, 2024, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Eligibility Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The LIHEAP program staff utilizes software to determine eligibility and benefit amounts for applicants based on energy burden and qualifying factors. There is a benefits matrix within the software, which is updated annually. Each year, the Department’s LIHEAP program staff update the benefits matrix with any required changes. The review and approval of the changes were completed by program staff, who met in-person and completed testing scenarios to verify the accuracy of the information. After the test results were reviewed and no errors identified, the matrix information was uploaded into software production. Verbal confirmation was provided to the program manager. The review and approval of the changes to the benefits matrix were not documented during fiscal year 2024. The documented review and approval procedures were implemented in February 2025. Cause: The Department did not consider that documentation to support the review and approval of the updates to the benefits matrix was necessary during fiscal year 2024. Effect: We did not identify errors in the 60 approved and 60 denied eligibility determinations that were reviewed. However, without a documented review, there is an increased risk of errors in the benefits matrix. Recommendation: We recommend that the Department maintain sufficient documentation to support the review and approval of the updates to the benefits matrix. Management’s View: The Department Agrees with this Finding. Corrective Action: A process was developed that includes obtaining and documenting approval by the Bureau Chief. This process was shared with LSO following receipt of the FY23 review findings. Supporting documents can be provided again as needed. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The corrective action referenced was not completed, by the Department’s own admission, until March 6, 2025 which would have been significantly after the fiscal year 2023 issuance of the Single Audit Report, and also would have left fiscal year 2024 and most of fiscal year 2025 without proper internal controls in place. Without an appropriate control in place the Department continued to risk errors in the matrix going undetected and uncorrected until March of 2025.

FINDING 2024-228 The review of the Low-Income Home Energy Assistance Program (LIHEAP) earmarking compliance requirements was not documented. Type of Finding: Material Weakness Related to Prior Finding: 2023-212 AL Title: Low-Income Home Energy Assistance AL Number: 93.568 Federal Award Number: 2101IDLIE4, 2201IDLIE4, 2301IDLIEE, 2401IDLIEA, 2401IDLIEI Program Year: October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025 Federal Agency: Department of Health and Human Services Requirement: Matching, Level of Effort, Earmarking Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The LIHEAP requires earmarking, which limits the percentage of grant funds that can be spent on administration, weatherization, and leveraging programs. The monitoring of LIHEAP earmarking requirements was completed by the program manager on a spreadsheet that tracked expenditures and appropriate limitations to ensure compliance was met. There was no documented review for accuracy nor approval of the tracking spreadsheet during fiscal year 2024. The documented review and approval procedures were implemented in February 2025. Cause: The Department did not consider that documentation to support the review and approval of the earmarking tracking spreadsheet was necessary to ensure accuracy and compliance during fiscal year 2024. Effect: We did not identify any errors in compliance with earmarking requirements during completion of audit procedures, but the lack of a documented review increases the risk of errors occurring and going undetected. Recommendation: We recommend that the Department maintain sufficient documentation to support the review and approval of the earmarking tracking spreadsheet. Management’s View: The Department Agrees with this Finding. Corrective Action: A process was developed that includes obtaining and documenting approval by the Bureau Chief. This process was shared with LSO following receipt of the FY23 review findings. Supporting documents can be provided again as needed. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The corrective action referenced above was not completed, by the Department’s own admission, until March 25, 2025 which would have been significantly after the fiscal year 2023 issuance of the Single Audit Report, and also would have left fiscal year 2024 and most of fiscal year 2025 without proper internal controls in place. Without an appropriate control in place the Department continued to risk errors in the spreadsheet going undetected and uncorrected until March of 2025 which could lead to noncompliance with earmarking requirements.

FINDING 2024-229 Low-Income Home Energy Assistance Program (LIHEAP) special reports did not include a review for accuracy and compliance prior to submission. Type of Finding: Material Weakness Related to Prior Finding: 2023-210 AL Title: Low-Income Home Energy Assistance AL Number: 93.568 Federal Award Number: 2101IDLIE4, 2201IDLIE4, 2301IDLIEE, 2401IDLIEA, 2401IDLIEI Program Year: October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: During fiscal year 2024, the Department was required to submit 6 LIHEAP special reports to the Federal Government. The Department’s LIHEAP program manager compiled the program special reports. The reports are submitted by the same program manager to the Office of Community Services. The reviews and approvals for 2 out of 6 program special reports tested (or 33 percent) were not documented. The LIHEAP program manager indicated that there were no documented review and approval of the program special reports between July 2023 and January 2024 for fiscal year 2024. Review and approval procedures were designed in April 2024 and implemented in February 2025. Cause: The Department staff indicated that there was no official approval process as reports are submitted online and the data source was either collaborated or provided by internal sources and verified during fiscal year 2024. The Department did not consider that documentation to support the review and approval of these reports was necessary to ensure accuracy and compliance with reporting requirements. Effect: We did not identify any errors in the LIHEAP special reports. However, without a documented internal control, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department maintain sufficient documentation to support the completion of a review for accuracy and compliance of required LIHEAP special reports prior to submission. Management’s View: The Department Agrees with this Finding. Corrective Action: A process was developed that includes obtaining and documenting approval by the Bureau Chief. This process was shared with LSO following receipt of the FY23 review findings. Supporting documents can be provided again as needed. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We would like to clarify that while the Department has indicated that review and approval procedures were developed in April 2024, the program manager stated that they were not implemented until February 2025, which is outside of our audit period. As a result, the Department was at risk for errors occurring and going undetected and uncorrected during fiscal year 2024.

FINDING 2024-230 The Department did not provide documented support to verify the accuracy of a Low-Income Home Energy Assistance (LIHEAP) performance report. Type of Finding: Significant Deficiency, Noncompliance AL Title: Low-Income Home Energy Assistance AL Number: 93.568 Federal Award Number: 2101IDLIE4, 2201IDLIE4, 2301IDLIEE, 2401IDLIEA, 2401IDLIEI Program Year: October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.302(b)(3) states that the recipient's financial management system must maintain records that sufficiently identify the amount, source, and expenditure of federal funds for federal awards. These records must contain information necessary to identify federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Condition: During fiscal year 2024, the Department was required to submit one LIHEAP performance report to the Federal Government. The Department’s LIHEAP program manager compiled and submitted the report to the Office of Community Services. The Department was unable to provide the supporting documentation to confirm the accuracy of the information included in the report. Cause: The Department did not design and implement an internal control to ensure that sufficient documentation was maintained to support the accuracy of the required report. Effect: Without documented support for the LIHEAP performance report, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department maintain sufficient documentation to support information in LIHEAP performance reports. Management’s View: The Department Agrees with this Finding. Corrective Action: A process was developed that includes obtaining and documenting approval by the Bureau Chief. This process was shared with LSO following receipt of the FY23 review findings. Supporting documents can be provided again as needed. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The corrective action referenced above was not completed, by the Department’s own admission, until March 25, 2025, which would have been significantly after the fiscal year 2023 issuance of the Single Audit Report, and also would have left fiscal year 2024 and most of fiscal year 2025 without proper internal controls in place. Without an appropriate control in place the Department continued to risk errors in the report going undetected and uncorrected until March of 2025 which could lead to noncompliance.

FINDING 2024-231 Supporting documentation for subrecipient risk assessments for the Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program was not available for review. Type of Finding: Significant Deficiency, Noncompliance Related to Prior Finding: 2023-222 AL Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises AL Number: 93.391 Federal Award Number: 1 NH75OT000105-01-00, 6 NH75OT000105-01-00 Program Year: June 1, 2021 – May 31, 2024 Federal Agency: Department of Health and Human Services Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.332(b) states that all pass-through entities must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Additionally, 2 CFR 200.332(c)(2) states that all pass-through entities must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the results of previous audits. This includes considering whether the subrecipient receives a Single Audit in accordance with 2 CFR 200 subpart F and the extent to which the same or similar subawards have been audited as a major program. Condition: The Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program had a total of 6 subrecipients during fiscal year 2024. During testing, the Department was unable to provide a subrecipient risk assessment for 2 out of 6 subrecipients tested (or 33 percent). In the risk assessment, the Department documents the need for a subrecipient to have a Single Audit, if necessary, and the Department’s review of required subrecipient Single Audits. The Department was compliant with all other aspects of the subrecipient monitoring compliance requirements for the subrecipients. Cause: Staff turnover led to the documentation creation and retention shortcomings as new staff were being trained and onboarded when risk assessments should have been completed and documented, including Single Audit requirements. Effect: The Department is exposed to increased risk of noncompliance related to subrecipients and improper payments in the STLT Health Department Response to Public Health or Healthcare Crises program. Recommendation: We recommend that the Department strengthen internal controls to ensure required risk assessments are completed and supporting documentation is retained. Management’s View: The Department Agrees with this Finding. Corrective Action: The Division of Public Health updates its standard operating procedures annually and communicates updates to staff. The DPH Federal Compliance Officer is conducting monthly trainings to cover all required steps in the process and will begin conducting mini audits in calendar year 2026 to ensure all steps are being followed consistently. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-232 An incorrect Federal Medical Assistance Percentage (FMAP) rate was applied while calculating the federal and state share of expenditures for the Child Care and Development Fund (CCDF) financial report resulting in an understatement of $1,064,932 of the federal share of costs. Type of Finding: Significant Deficiency, Noncompliance AL Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund AL Number: 93.575, 93.596 Federal Award Number: 2001IDCCDF, 2001IDCCC3, 2401IDCCDD, 2401IDCCDF, 2401IDCCDM Program Year: October 1, 2019 – September 30, 2022, March 27, 2020 – September 30, 2023, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Matching, Level of Effort, Earmarking Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 98.55(a) states that federal matching funds are available for expenditures in a state based upon the formula specified in 42 CFR 98.63(a). Also, 42 CFR 98.55 (b) states that expenditures in a state under paragraph (a) of this section will be matched at the federal medical assistance rate for the applicable fiscal year for allowable activities, as described in the approved State Plan, that meet the goals and purposes of the Act. Additionally, 42 CFR Section 98.55 (c) states that in order to receive federal matching funds for a fiscal year under paragraph (a) of this section: (1) States shall also expend an amount of non-Federal funds for child care activities in the State that is at least equal to the State's share of expenditures for fiscal year 1994 or 1995 (whichever is greater) under sections 402(g) and (i) of the Social Security Act as these sections were in effect before October 1, 1995; and (2) The expenditures shall be for allowable services or activities, as described in the approved State Plan if appropriate, that meet the goals and purposes of the Act. (3) All Mandatory Funds are obligated in accordance with Section 98.60(d)(2)(i). Condition: The Department is required to complete a CCDF financial report, Form ACF-696, on a quarterly basis for each grant. We found that 1 out of 4 CCDF financial reports tested (or 25 percent), had an incorrect FMAP rate applied while calculating the federal and State share of expenditures, understating federal funds by $1,064,932. Cause: Staff turnover, insufficient training, and the implementation of Luma caused an incorrect FMAP rate to be applied while calculating the federal and state share of expenditures on the CCDF financial report. In addition, the review procedures were not completed at a level sufficient to identify an error. Effect: An incorrect FMAP rate was applied causing federal funds to be understated by $1,064,932. Recommendation: We recommend that the Department strengthen internal controls over the application of FMAP rates and review the reports at a level sufficient to identify errors. Management’s View: The Department Agrees with this Finding. Corrective Action: The Department's Grant Reporting team has been developing additional internal controls to put in place with the utilization of the Luma ERP. These controls include conducting reconciliations between internal workpapers and Luma records as well as reconciling to external parties such as the Payment Management System. This has streamlined our approach and has allowed management more opportunity to review items with higher risk factors, such as the quarterly change in FMAP rates during the stepdown from enhanced FMAP rates during COVID. We believe these increased focused efforts will alleviate issues like this in the future and are ongoing as the Department identifies opportunities for advancements in our own processes and working with SCO to implement better Luma reports and controls within the grant reconciliation process. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-233 The submission of Child Care and Development Fund (CCDF) financial report was not completed timely. Type of Finding: Significant Deficiency, Noncompliance AL Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund AL Number: 93.575, 93.596 Federal Award Number: 2001IDCCDF, 2001IDCCC3, 2401IDCCDD, 2401IDCCDF, 2401IDCCDM Program Year: October 1, 2019 – September 30, 2022, March 27, 2020 – September 30, 2023, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 45 CFR 98.65(g) states that Lead Agencies shall submit financial reports, in a manner specified by the ACF, quarterly for each fiscal year until funds are expended. Additionally, Form ACF-696 (Financial Reporting Form for State and Territory Child Care and Development Fund (CCDF) Lead Agencies) states that this form must be submitted quarterly, reports are due 30 days after the end of the quarter: Quarter 1 by October 31, Quarter 2 by April 30, Quarter 3 by July 31, and Quarter 4 by January 31. Condition: The Department is required to complete a CCDF financial report, Form ACF-696, on a quarterly basis for each grant. Each report must be submitted within 30 days after the end of the applicable quarter. We found 1 out of 4 ACF-696 tested (or 25 percent) was submitted 2 months after the due date. The report for the quarter ended September 30, 2023, was submitted in January 2024. No other compliance or substantive errors were noted related to the report submission. Cause: Staff turnover, insufficient training, and the implementation of Luma caused the Department’s late submission of the required Form ACF-696 for the quarter ended September 30, 2023. The Department requested an extension from the ACF to complete necessary adjustments, but the request was denied. Effect: Late submission of the report resulted in the Department’s noncompliance with federal requirements. Recommendation: We recommend that the Department strengthen internal controls to ensure the timely submission of the CCDF financial report, Form ACF-696. Management’s View: The Department Agrees with this Finding. Corrective Action: The Department has seen an increased time commitment related to financial grant reporting since the implementation of Luma in July 2023. This was particularly relevant in SFY 2024 as Luma implementation, training and interfaces were still evolving, resulting in a tremendous increase in time commitments without the corresponding staff increases needed. In many cases, this resulted in late filings and/or filing reports that were not reviewed in sufficient detail. The Division of Financial Services continues to work through the inefficiencies encountered and design processes that include sufficient review and other internal controls while also allowing for timely completion of required reports. One FTE was transferred from another team to the Cash and Grants team. This position is expected to assist in completing preliminary tasks so that Grant Reporters have necessary data at their fingertips when drafting financial reports. As Department staff continue to learn nuances of the Luma system, both accuracy and timeliness of financial reporting is expected to improve. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-234 Payroll adjustments lacked sufficient internal controls. Type of Finding: Significant Deficiency AL Title: Immunization Cooperative Agreements, Temporary Assistance for Needy Families, Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund, State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.268, 93.558, 93.575, 93.596, 93.777, 93.778 Federal Award Number: Various Program Year: Various Federal Agency: Department of Health and Human Services Requirement: Activities Allowed or Unallowed, Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The State implemented a new Enterprise Resource Planning system, Luma, in July 2023. Due to the implementation, and insufficient experience, some transactions were entered incorrectly into Luma. Necessary adjustments were completed by both the Department and the Office. We noted 21 out of 42 payroll adjustments tested (or 50 percent) that were not properly reviewed and approved, and of those 21 noted payroll adjustments, 4 were completed by the Office, and 17 were completed by the Department. Additionally, of those 21 noted payroll adjustments, 6 were completed by the Department and had the same personnel submitting, approving, and releasing the adjustment. The remaining 15 payroll adjustments had no documented review and approval information. Cause: The majority of the noted deviations were processed in the beginning of fiscal year 2024. According to the Department’s personnel, the reviews of payroll adjustments were not consistently documented following the implementation of Luma. The significant number of adjustments processed and time constraints were provided as the reason the Department had the same personnel submit, approve, and release the adjustments. In addition, according to Office personnel, multiple adjustments were processed due to a statewide correction to the benefit coding in the beginning of fiscal year 2024. An incorrect account was used to record benefits. This correction was reviewed by the Department’s payroll team and followed the financial payroll correction process. However, there was no documentation of the review process. Effect: We did not identify any substantive or compliance errors during testing over payroll adjustments. However, without documentation of a review and approval, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department consistently maintain documentation of implemented review and approval procedures over payroll adjustments. We further recommend that the Department request that it be provided appropriate documentation of any adjustments made by the Office on its behalf. Management’s View: The Department Agrees with this Finding. Corrective Action: The department has established internal controls to ensure appropriate separation of duties and proper documentation of all reviews. When an accounting adjustment is required, staff prepare the adjustment using either an Infor Spreadsheet Designer (ISD) template or an Excel template. ISD is used for adjustments involving large volumes of data. Because ISD-generated adjustments cannot be reviewed within the system after entry, the completed template is sent to a Financial Specialist Principal (or higher) for review prior to upload. Email approval is obtained and attached to the adjustment record when it is entered into the system. For adjustments involving smaller amounts of data, staff use the Excel template. The Excel template, original GL lines, supporting documentation, and any other relevant information are attached when the adjustment is entered. After the manual adjustment is submitted, it is automatically routed to a Financial Specialist Principal (or higher) for approval before final posting. These procedures ensure that all adjustments undergo an independent review and that documentation is consistently maintained. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-235 Quarterly financial reports for the Social Security Disability (DI) grant were submitted after the required deadline. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Social Security Disability Insurance Assistance Listing Number: 96.001 Federal Award Number: 23-04IDD100; 24-04IDD100 Program Year: October 1, 2022 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: Social Security Administration Compliance Requirement: Reporting Questioned Costs: None The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Social Security Administration (SSA) oversees the administration of the DI program with comprehensive guidance provided in the Program Operations Manual System (POMS). At the end of each quarter, the State Disability Determination Services (DDS) submits a Form SSA-4513, State Agency Report of Obligations for SSA Disability Programs, to account for program disbursements and obligations, and a Form SSA-4514, Time Report of Personnel Services for Disability Determination Services, to account for employee time. The State DDS is required to submit the forms to the designated SSA regional office, which, pursuant to POMS sections DI 39506.202 and DI 39506.230, is responsible for setting the submission deadlines for quarterly reports. The State’s designated regional office has mandated a deadline of thirty days following the conclusion of each fiscal quarter. Condition: The Department submitted four reports during our audit period. We selected a sample of 2 quarterly reports, each including forms SSA-4513 and SSA-4514, to test for compliance and internal controls. The Department has a control procedure in place for the reports to be reviewed by a qualified person prior to submission. Our testing found that reports were submitted 17 and 23 days after the established deadline set by SSA’s regional office. However, no substantive errors were identified in our testing, and we confirmed that the internal control procedure for accuracy was operating as designed. Cause: Reports were submitted late due to delays in obtaining the payroll data needed to comply with the U.S. Department of Labor’s modified accrual-based grant reporting requirements. Payroll is processed biweekly for the prior timesheet period, creating a delay in the availability of the previous month’s data. In prior years, the Department estimated payroll costs, which led to inaccuracies in federal quarterly reports. Although adjustments were made in the following quarter, they did not align with the actual payroll reporting periods. With the implementation of the State’s current accounting system (Luma), the Department prioritized using actual payroll data to improve accuracy, even if it resulted in late report submissions. Effect: Late report submissions may hinder timely oversight by the federal regulator and delay identification of potential financial or compliance issues. Recommendation: We recommend that the Department consider additional methods to ensure timely submission of reports. Management’s View: The Idaho Department of Labor agrees with the audit finding. Prior to Luma go-live, our legacy cost accounting system was programmed to accrue payroll monthly by grant. The process was programmed into our system to provide estimated payroll earlier than when it paid out in the state system, meaning cost accounting could close the period on a timeline that allowed our reporting staff to file our quarterly federal reports before their due date. Our legacy process then called for a quarterly true-up in the subsequent quarter of our internal cost accounting system to the state system (STARS). This lag between the accrual and the true-up meant that expenses were not fully accounted for or reported in the quarter in which they were incurred. In Luma, complete accrued monthly payroll data is not available until the final payroll for the prior month pays out. There is no mechanism for us to estimate payroll to close the month early like we did in legacy. Because of the timing of the bi-weekly payrolls, there are some months when the final payroll for the quarter does not pay out in Luma until close to the due date for some of our quarterly federal reports. Once that payroll is posted in Luma, it currently takes approximately 10 days to do final entries for the month and then close the period. Many of our federal reports are not due until 45 days after the end of the quarter. Since Luma go-live we have made significant process improvements that now allow us to close the period and file those reports in time. For a couple of our grants, the federal report’s due date is 30 days after the end of the month. Filing those reports within the 30-day filing window has been very challenging due to the lag in payroll and closing described above. The DDS program is one such program where the federal report is due 30 days from the end of the quarter. Corrective Action: The department is taking several steps to provide for a faster month-end close: Step 1: Process Mapping of Cost Accounting Closing a. As part of our strategic planning initiative, document the new closing process in Luma through process maps b. Review process maps internally in accounting and with executive leadership to help identify areas where efficiencies could be achieved c. Implement identified areas of efficiency Step 2: Assess potential for expedited close on quarter-end months a. Cost Accounting manager, supervisor and financial executive officer to review calendar and timing of payroll for quarter-end closings b. Cost Accounting manager, supervisor, and financial executive officer to develop plans for expedited close with potential for overtime, pulling additional resources from other teams and any other options that may help shorten the close period to allow us to file quarterly federal reports timely. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-236 The review and approval of quarterly special reports for the Unemployment Insurance (UI) program were not consistently documented, and the reports were submitted after the required deadline. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Unemployment Insurance Assistance Listing Number: 17.225 Federal Award Number: 24A55UI000030-01; 23A03UI039319-01; UI-35645-21-55-A-16; 23A55UI034712-01 Program Year: October 1, 2023 – December 31, 2026; October 1, 2022 – December 31, 2025; October 1, 2020 – December 31, 2023; April 1, 2020 – June 30, 2024 Federal Agency: U.S. Department of Labor Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Quarterly UI Above-Base (UI-3) report requires information on staff years worked and paid by program category. The reports are due within 30 days after the end of the reporting quarter as required by the U.S. Department of Labor, per the Employment and Training (ET) Handbook No. 336, Unemployment Insurance State Quality Service Plan Planning and Reporting Guidelines. Condition: We tested all 4 UI-3 quarterly reports that were due during our audit period. Our evaluation determined that 3 out of the 4 reports were submitted after the established deadline. Only the first quarterly report, covering the period ending June 30, 2023, and prepared using the State’s prior accounting system (STARS), was submitted by the deadline. The 3 subsequent quarterly reports, prepared after the State’s transition to Luma, were submitted 13, 31, and 35 days late. The Department has a control procedure in place for the reports to be reviewed by a qualified person prior to submission. Our testing found that 1 of the 4 quarterly reports was missing documented approval, typically retained via e-mail. Cause: Reports were submitted late due to delays in obtaining the payroll data needed to comply with the U.S. Department of Labor’s modified accrual-based grant reporting requirements. Payroll is processed biweekly for the prior timesheet period, creating a delay before the previous month’s data is available. In prior years, the Department estimated payroll costs, which led to inaccuracies in federal quarterly reports. Although adjustments were made in the following quarter, they did not align with the actual payroll reporting periods. With the implementation of Luma, the Department prioritized using actual payroll data to improve accuracy, even if it resulted in late report submissions. The Department was in the process of updating their reporting procedures and did not require documentation of the controls to be retained at the time. Effect: Without a documented review, there is an increased risk that the reports contain inaccurate data. Further, late report submissions may hinder timely oversight by the federal regulator and delay identification of potential financial or compliance issues. Recommendation: We recommend that the Department design and implement internal controls to ensure reports are submitted on time and sufficient documentation is maintained to support the completion of a review for accuracy and compliance. Management’s View: The Idaho Department of Labor agrees with the audit finding. During the period in question, our federal reporting team was in the process of transitioning reporting duties from the financial specialist principal over reporting to the financial specialist senior over reporting. During the training process, one report was completed and reviewed in tandem as part of the training process and no paper trail was retained to document that the report had been properly reviewed by the financial specialist principal. Once the handoff of the task was completed, subsequent reports were prepared by the financial specialist senior and then queued to the principal for review, and the paper trail was properly captured and retained. Prior to Luma go-live, our legacy cost accounting system was programmed to accrue payroll monthly by grant. The process was programmed into our system to provide estimated payroll earlier than when it paid out in the state system, meaning cost accounting could close the period on a timeline that allowed our reporting staff to file our quarterly federal reports before their due date. Our legacy process then called for a quarterly true-up in the subsequent quarter of our internal cost accounting system to the state system (STARS). This lag between the accrual and the true-up meant that expenses were not fully accounted for or reported in the quarter in which they were incurred. In Luma, complete accrued monthly payroll data is not available until the final payroll for the prior month pays out. There is no mechanism for us to estimate payroll in order to close the month early like we did in legacy. Because of the timing of the bi-weekly payrolls, there are some months when the final payroll for the quarter does not pay out in Luma until close to the due date for some of our quarterly federal reports. Once that payroll is posted in Luma, it currently takes approximately 10 days to do final entries for the month and then close the period. Many of our federal reports are not due until 45 days after the end of the quarter. Since Luma go-live we have made significant process improvements that now allow us to close the period and file those reports in time. For a couple of our grants, the federal report’s due date is 30 days after the end of the month. Filing those reports within the 30-day filing window has been very challenging due to the lag in payroll and closing. The UI program is one such program where the UI-3 report is due 30 days from the end of the quarter. Corrective Action: The department has taken measures to ensure proper documentation of the review process: Step 1: Provide a designated place on the UI-3 back-up documentation and quarterly report work papers for reviewer to sign off directly in the work papers. Step 2: The individual who enters the report into the federal system will not proceed with entering the report into the system unless the workpapers have the review and approval in the workpapers. The department is taking several steps to provide for a faster month-end close: Step 3: Process Mapping of Cost Accounting Closing a. As part of our strategic planning initiative, document the new closing process in Luma through process maps b. Review process maps internally in accounting and with executive leadership to help identify areas where efficiencies could be achieved c. Implement identified areas of efficiency Step 4: Assess potential for expedited close on quarter-end months a. Cost Accounting manager, supervisor and financial executive officer to review calendar and timing of payroll for quarter-end closings b. Cost Accounting manager, supervisor, and financial executive officer to develop plans for expedited close with potential for overtime, pulling additional resources from other teams and any other options that may help shorten the close period to allow us to file quarterly federal reports timely. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-237 The Division could not provide supporting documentation for amounts included on the Rehabilitation Services Administration (RSA) reports required under the Rehabilitation Services-Vocational Rehabilitation Grants to States. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Reporting Questioned Costs: $1,445,110 Known Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The U.S. Code of Federal Regulations (CFR), 2 CFR 200.303, states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Section CFR 200.302 – Financial Management states that federal award recipient’s financial management system must identify all federal awards received and expended and the federal programs under which they were received. Additionally, they must maintain records that sufficiently identify the amount, source, and expenditure of federal funds for federal awards. These records must contain information necessary to identify federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Condition: The RSA requires the Division to submit financial reports (RSA-17) every 6 months. The reports are cumulative and cover the entire grant period through to the end of the reporting period. Reporting periods end on March 31 and September 30. If the reporting period is the final report for the grant, the report is due 120 days after the close of the period. All other reports are due 30 days after the close of the period. Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2024 grant period is October 1, 2023, through September 30, 2025. In State fiscal year 2024, there were 3 grants open – federal fiscal years 2022, 2023, and 2024. The Division was required to submit 4 reports for these grants. We compared the federal expenditure amounts reported for the grant in total and for the Pre-Employment Transition Services (Pre-ETS) to the amounts in Luma and found errors in all 4 as follows: Total Expenditures Grant Year Report Period End RSA-17 Amount Luma Amount Difference Federal Fiscal Year 2022 9/30/23 $14,601,067 $13,941,207 $659,860 Federal Fiscal Year 2023 9/30/23 $7,633,338 $7,465,827 $167,511 Federal Fiscal Year 2023 3/31/24 $16,823,595 $16,661,795 $161,800 Federal Fiscal Year 2024 3/31/24 $2,007,420 $2,077,874 $(70,454) TOTAL $918,717 Pre-ETS Grant Year Report Period End RSA-17 Amount Luma Amount Difference Federal Fiscal Year 2022 9/30/23 $2,579,855 $2,991,527 $(411,672) Federal Fiscal Year 2023 9/30/23 $3,083,866 $2,869,311 $214,555 Federal Fiscal Year 2023 3/31/24 $5,596,382 $5,005,941 $590,441 Federal Fiscal Year 2024 3/31/24 $211,681 $78,612 $133,069 TOTAL $526,393 Cause: Reports were prepared by former employees, and the current personnel could not determine why the reported amounts did not match Luma. Further, supporting documentation was not retained by the Division, which might have provided insight into the differences. Effect: The RSA uses the RSA-17 reports to determine compliance with federal statutes, regulations, and the terms and conditions of the federal award. Incorrect reporting can affect both the ability to cover current obligations and the amount of future federal grant awards received by the State of Idaho. We are questioning the amount that Division cannot support for reported total expenditures and pre-ETS expenditures of $918,717 and $526,393, respectively. Recommendation: We recommend that the Division design and implement procedures to ensure accurate federal grant reporting and retain appropriate documentation to support the amounts reported. We also recommend that the Division review prior submissions, identify correct reporting, and communicate with the federal grantor about resubmitting corrected reports. Management’s View: The issues uncovered during the single audit are in alignment with challenges and weaknesses uncovered over the last 17 months. As such, we are in agreement with the seven identified findings specified in the Management letter. The Division will ensure the accuracy, reliability, and sufficient supporting documentation of financial data pulled from the state accounting system of record (LUMA) that is reported on all RSA-17 reports by implementing effective internal controls, verification procedures, and record retention practices in compliance with 2 CFR 200.302 and 2 CFR 200.303. Corrective Action: 1.1 Establish Accurate Reporting Procedures: Develop and implement procedures for preparing, reviewing, and approving all RSA financial reports, including step-by-step reconciliation. 1.2 Ensure Documentation and Audit Trail: Maintain comprehensive supporting documentation for all amounts reported, including detailed reconciliations, adjustments, and source data, in accordance with requirements for traceable and verifiable records. 1.3 Strengthen Internal Controls and Oversight: Implement Strategic Leadership review of all reports prior to submission to the Rehabilitation Services Administration to confirm data accuracy and compliance with reporting requirements. 1.4 Complete a Restatement of RSA-17 Reports: Review previously submitted RSA-17 reports for fiscal years 2022–2024, determine accurate expenditure amounts, and coordinate with RSA to correct and resubmit revised reports, if necessary. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. While the Division’s corrective action plans indicate that portions are complete, because they have occurred outside of the period under audit, we have not reviewed those actions to see that they are effective at addressing the issues identified.

FINDING 2024-238 The Division did not comply with Matching, Level of Effort, and Earmarking requirements for the fiscal year 2022 Rehabilitation Services-Vocational Rehabilitation Grants to States program. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Matching, Level of Effort, Earmarking Questioned Costs: $51,728 Known Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 361.62, Maintenance of effort requirements, states (a) General requirements. The Secretary (of Education) reduces the amount otherwise payable to a State for any fiscal year by the amount by which the total expenditures from non-Federal sources under the vocational rehabilitation services portion of the Unified or Combined State Plan for any previous fiscal year were less than the total of those expenditures for the fiscal year two years prior to that previous fiscal year. Condition: Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2024 grant period is October 1, 2023, through September 30, 2025. In State fiscal year 2024, there were 3 grants open – federal fiscal years 2022, 2023, and 2024. Maintenance of effort is one part of the level of effort grant requirements. The federal fiscal year 2022 grant period ended on September 30, 2023. It is the only grant that we could evaluate for level of effort compliance because it is the only one that ended within State fiscal year 2024, which is the period of our audit. The Division is required to spend at least the amount of State funds expended in the fiscal year two years prior. We compared State expenditures for the federal fiscal years 2020 and 2022 grants based on amounts reported on the RSA-17 reports. RSA-17 Report RSA-17 Report Federal Fiscal Year 2020 Grant Expenditures Federal Fiscal Year 2022 Grant Expenditures Difference $4,508,835 $4,222,109 $(286,726) This analysis found that the Division did not meet level of effort requirements because State spending for the federal fiscal year 2022 grant was $286,726 less than State spending for the federal fiscal year 2020 grant. We performed additional analysis on the amounts reported and compared them to the underlying information in Luma and STARS due to errors we identified in the RSA-17 reports; also described in Finding 2024-237. We found that the amounts reported for the federal fiscal years 2020 and 2022 grants did not match the amounts recorded in Luma or STARS, and the Division could not provide documentation to support the differences. We compared the State expenditures for federal fiscal years 2020 and 2022 grants based on the amounts recorded in Luma and STARS. Accounting System Accounting System Federal Fiscal Year 2020 Grant Expenditures (STARS) Federal Fiscal Year 2022 Grant Expenditures (Luma and STARS) Difference (STARS) $4,072,786 $4,021,058 $(51,728) In both of our analyses, the Division still failed to meet level of effort requirements. Cause: The Division has experienced a large amount of turnover in fiscal staff positions. The staff in place during our single audit procedures were not the same as the staff who compiled the RSA-17 reports for the federal fiscal years 2020 or 2022 grants and could not locate any documentation to support the amounts reported or verify that the Division had internal controls in place to monitor the matching, level of effort, or earmarking requirements for compliance. Effect: We did not identify any errors with the matching or earmarking requirements, however, reporting errors, when corrected, could result in noncompliance. The noncompliance with the level of effort requirements could result in the RSA reducing the federal grant award to the Division for the federal fiscal year 2025 grant. Recommendation: We recommend that the Division design and implement procedures to ensure compliance with matching, level of effort, and earmarking requirements. We also recommend the Division contact the federal grantor to resolve the noncompliance related to the level of effort requirement. Management’s View: The Division will ensure compliance with all matching, level of effort, and earmarking requirements by developing and implementing internal control processes, accurate financial tracking mechanisms, and adequate supporting documentation for all federal grant expenditures. Corrective Action: 2.1 Develop and Implement Written Policy (Grants Management Manual Section) and Procedures: Establish documented procedures for monitoring and validating compliance with state match funds, maintenance of effort (MOE), and earmarking requirements for each active RSA grant. 2.2 Training and Staff Accountability: Train fiscal and leadership staff responsible on grant calculation methods, documentation standards, and compliance monitoring for matching and level of effort requirements. 2.3 Ongoing Monitoring: Conduct annual compliance reviews before report submission to verify that all level of effort and earmarking requirements are satisfied and adequately supported. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. While the Division’s corrective action plans indicate that portions are complete, because they have occurred outside of the period under audit, we have not reviewed those actions to see that they are effective at addressing the issues identified.

FINDING 2024-239 The Division does not have documented control procedures in place to ensure compliance with period of performance requirements for the Rehabilitation Services-Vocational Rehabilitation Grants to States. Type of Finding: Material Weakness Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Period of Performance Questioned Costs: Undetermined Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2024 grant period is October 1, 2023, through September 30, 2025. In State fiscal year 2024, there were 3 grants open – federal fiscal years 2022, 2023, and 2024. The Division uses Aware, a case management system which documents clients’ Individual Plans for Employment (IPE). The IPEs have employment goals, planned services, estimated costs, client responsibilities, and criteria for evaluating progress. Expenditures are initially entered into Aware and uploaded into Luma for payment. The Division uses project codes in Aware to designate expenditures to specific grant periods. The project codes correlate to grant codes in Luma when transactions are uploaded from Aware. Grant codes are used to track expenditures and period of performance for each grant award. Client expenditures are entered into Aware, and Regional Managers review the entries for accuracy, including the correct project code for the period of performance. As grant periods begin and end, the project codes in Aware need to be changed to correlate to new grant codes in Luma. The Division stated that, in past years, the changes to the project codes would be discussed among the fiscal staff and communicated to the regional managers, and the final changes were reviewed for accuracy and inclusion in the proper period. The Division made changes to the project codes but could not provide documentation to confirm these changes were reviewed and approved in fiscal year 2024. Further, the Division could not provide documentation of any additional procedures to evaluate period of performance at an overall program level that would detect errors in the coding of project codes or federal grant codes. Cause: The Division has experienced a large amount of turnover in fiscal staff positions. This likely contributed to internal controls not being properly executed. Documentation was not retained to verify internal controls. Effect: Regional managers review transaction entries to ensure they are for allowable costs and coded to the correct project codes to comply with period of performance requirements. This control procedure is ineffective if the project codes in Aware are not linked to the correct grant codes in Luma. The Division does not have any other control procedures in place to evaluate period of performance at an overall program level, which increases the risk of noncompliance. Our testing did not identify any noncompliance with period of performance requirements, however, without effective controls in place, errors could be made and remain undetected. Recommendation: We recommend that the Division design and implement control procedures to ensure compliance with period of performance requirements and maintain documentation to demonstrate both that controls were operating as intended and compliance was achieved. Management’s View: To ensure that all federal grant expenditures are properly recorded within their authorized period of performance by implementing documented internal controls, verification processes, and documentation retention procedures. Corrective Action: 3.1 Document Control Procedures: Develop and implement formal, written procedures (Grants Management Manual Chapter) for verifying that expenditures are assigned to the correct period of performance in both Aware and Luma. 3.2 Training: Train IDVR team members on policies and procedures tied to Period of Performance. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. We would like to emphasize that staff training should be an ongoing activity to ensure that staff are knowledgeable about the program and the requirements to accepting federal assistance. Additionally, implementation of internal controls as identified in the grants management manual will be critical to ensuring compliance. Also, while the Division’s corrective action plans indicate that portions are complete, because they have occurred outside of the period under audit, we have not reviewed those actions to see that they are effective at addressing the issues identified.

FINDING 2024-240 The Division is not following Idaho Administrative Rules for Purchasing as required by federal requirements. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Procurement and Suspension and Debarment Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) contains guidance that nonfederal entities must follow as a condition of receiving federal awards. This guidance in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The CFR procurement standards at 2 CFR 200.317 states that, when procuring property and services under a federal award, a state must follow the same policies and procedures it uses for procurements from its nonfederal funds. The state of Idaho purchasing rules within the Idaho Administrative Procedures Act (IDAPA) contain the following provisions: IDAPA 38.05.01.32. Total Cost: The acquisition cost of property, including all components, options, and add-ons available under the contract, related services, and, in the case of ongoing services, the cost of the full term of the contract, including all authorized renewals. Unless a different total term is provided in the contract, the term used for purposes of total cost is five (5) years. IDAPA 38.05.01.041. Acquisition Procedures: • Small Purchases: Services with less than $25,000 total cost; software with less than $15,000 total cost; property with less than $15,000 total cost; a mix of property and services less than $15,000. o Small purchases do not require acquisition through competitive solicitation. Agencies must comply with the division’s small purchase policy. Property available under single agency or open contracts shall be purchased under such contracts and are not a small purchase under this rule unless otherwise authorized by the administrator. • Informal Purchases: Acquisition of property with a total cost exceeding the dollar limits established in this rule for a small purchase and less than the formal sealed procedure limit are informal purchases. o Informal Purchases may be made using:  An informal solicitation issued through e-procurement, unless exempted by the administrator; or  The formal sealed procedure, when the purchasing authority makes a written determination that using a formal solicitation is in the best interest of the state, including where selection based solely on cost is not appropriate. o Agencies procuring property under this rule shall maintain a purchasing file containing:  The solicitation document posted and quotes received. If the acquisition was not publicly posted, the agency shall include a statement describing the justification for determining that posting was impractical or impossible, along with the administrator’s authorization.  If not using e-procurement, the agency shall document the quotes received (or its attempt to obtain quotes) from at least three (3) vendors having a significant Idaho economic presence as defined in Section 67-2349, Idaho Code. • Formal Sealed Procedure: o The sealed procedure limit is one hundred fifty thousand dollars ($150,000). o Purchases of property in excess of the sealed procedure limit are made using the formal sealed procedure, unless exempted by these rules or the administrator. IDAPA 38.05.01.042.01. Exceptions requiring written administrator approval. The administrator may exempt the following purchases from the requirement for competitive solicitation by issuing a written determination to the purchasing authority. • Rehabilitation Agency Acquisitions. Acquisitions of property that is provided by non-profit corporations and public agencies operating rehabilitation facilities serving the handicapped and disadvantaged and that is offered for sale at fair market price as determined by the administrator in accordance with these rules. The buyer must submit a written request to the administrator to purchase from a rehabilitation agency and a written approval from the administrator. The purchase must comply with the division’s policy for rehabilitation agency acquisitions. Condition: We identified a population of 75 vendors that were paid more than $25,000 in fiscal year 2024 by the Division. The total dollar value of that population is $7,366,145 and we also identified 18 vendors within that population that received total payments that were large enough to be considered individually significant, based on materiality. We reviewed all of those 18 vendors and also selected a random sample of 6 vendors from the remaining 57 vendors in our population to arrive at a total testing group of 24 vendors. We evaluated if the Division’s internal controls were properly designed, in place, and effective in preventing or detecting errors. We also assessed if the Division was in compliance with procurement policies, both as required by the Rehabilitation Services – Vocational Rehabilitation Grants to States program and the State. The main internal control that the Division relies on to ensure compliance is that appropriate personnel review the procurement documents and approve the contract or purchase made prior to payment. The Division could not provide evidence that the review and approval occurred for 3 of the 6 (or 50 percent) randomly sampled vendors, and for 2 of the 18 (or 11 percent) vendors that had significant payments. We also found that the Division could not provide documentation to show that State procurement policies were followed for 4 of the 6 (or 67 percent) sampled vendors and 4 of the 18 (or 22 percent) individually significant vendors. Cause: The Division misunderstood several purchasing requirements. It believed that an exemption for rehabilitation agencies applied to more vendors than just not-for-profit entities and public agencies. The Division also believed that the State purchasing policies did not apply to vendors with many small purchases that are individually below, but collectively exceed, the purchasing thresholds. This misunderstanding led to noncompliance with purchasing requirements. Effect: The State’s purchasing policies are designed to ensure that State and federal funds are expended efficiently to meet the goals of State and federal programs. By not following these policies, the Division could be overpaying for products and services and is not in compliance with federal grant requirements. Recommendation: We recommend that the Division design and implement procedures to ensure that State purchasing policies are followed. This should include training to ensure that staff understand what purchases require additional procedures. We further recommend that the Division design and implement procedures to ensure that appropriate documentation is retained to demonstrate compliance and that internal controls were operating as intended. Management’s View: The Division will ensure full compliance with Idaho Administrative Rules for Purchasing and applicable federal procurement standards by developing, implementing, and maintaining internal controls, procedures, and documentation of practices that verify all procurements, regardless of funding source or transaction size adhere to State and Federal purchasing requirements. Corrective Action: 4.1 Policy Alignment: Review and revise internal procurement policies and procedures to align with IDAPA 38.05.01, 2 CFR 200.317, and 2 CFR 200.303 requirements. 4.2 Training and Awareness: Provide training to all staff to ensure understanding of: 4.2.1 Purchasing thresholds and categories (small, informal, and formal purchases). 4.2.2 Documentation and approval requirements. 4.2.3 Process and documentation requirements for purchases requiring exemptions. 4.3 Internal Control Strengthening: Develop and implement internal control mechanisms to ensure compliance with State and Federal purchasing requirements. 4.4 Monitoring and Accountability: Establish a quality assurance and compliance monitoring process to perform monitoring of procurement transactions to verify compliance with Division policies and procedures. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

FINDING 2024-241 The Division did not verify that vendors receiving payments from the Rehabilitation Services – Vocational Rehabilitation Grants to States program, were not suspended or debarred prior to making federal grant payments. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Procurement and Suspension and Debarment Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) contains guidance that nonfederal entities must follow as a condition of receiving federal awards. This guidance in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR Part 180.300) requires grantees to verify an entity is not suspended or debarred or otherwise excluded before entering into a covered transaction. The verification is accomplished by (1) checking the System for Award Management (SAM) exclusions maintained by the General Services Administration and available online, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. Nonfederal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Covered transactions, as defined by 2 CFR 180.220, include contracts for goods and services awarded under a non-procurement transaction (for example, grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria. Condition: We identified 75 vendors that were paid more than $25,000 in total expenditures in fiscal year 2024 by the Division. The total dollar value of that population is $7,366,145 and we identified 18 vendors within that population that received total payments that were large enough to be considered individually significant, based on materiality. We reviewed those 18 vendors and selected a random sample of 6 vendors from the remaining 57 vendors in our population to arrive at a total testing group of 24 vendors. The Division relies on appropriate personnel reviewing the documents that support verification that the vendor is not suspended or disbarred, and then indicate approval by e-mail, as its primary internal control to assure compliance with federal regulations. Our testing found that the Division could not provide the documentation to show that the review and approval occurred for 5 of the 6 (or 83 percent) sampled vendors and for 7 of the 18 (or 39 percent) vendors identified as individually significant. Cause: The Division has procedures in place to retain documentation showing the suspension and debarment reviews were completed, reviewed, and approved for new vendors added during fiscal years 2022, 2023, and 2024. However, the Division could not provide documentation to show that vendors added prior to fiscal year 2022 were subject to this process. Further, the Division does not perform any subsequent checks to ensure that vendors did not become suspended or debarred after they were initially added to the current statewide accounting system (Luma) or prior statewide accounting system (STARS) which increases the risk that payments could be made to a suspended or disbarred vendor. Effect: We reviewed all vendors selected as part of our testing and verified that none of them were on the SAM list as suspended or debarred. However, the Division does not have adequate controls in place to ensure that they are not entering into covered transactions with suspended or debarred vendors. Vendors can be suspended or debarred for many reasons including financial crimes such as fraud, embezzlement, or bribery, and other issues such as consistently poor performance on previous contracts or violations of laws. Taking steps to ensure vendors are not suspended or debarred is important to prevent fraud, waste, and abuse. Recommendation: We recommend that the Division develop and implement procedures to ensure that they are regularly reviewing vendors with whom it is contracted to ensure compliance with suspension and debarment requirements. Management’s View: The Division will ensure full compliance with federal suspension and debarment requirements by establishing and maintaining effective internal controls and procedures that verify and document vendor eligibility prior to contract execution and throughout the vendor relationship. 5.1 Corrective Action: Policy Development and Alignment: Revise the Division’s procurement and grant management procedures to include mandatory ongoing verification and documentation of suspension and debarment status for all vendors involved in covered transactions. 5.2 Systematic Verification Process: Implement a standardized process to verify vendor eligibility by: 5.2.1 Checking the System for Award Management (SAM.gov) exclusion list. 5.2.2 Retaining a copy of the verification record or certification in the procurement or vendor file. 5.2.3 Incorporating a suspension/debarment verification clause into agreements, contracts, authorizations for purchase, and purchase orders. 5.3 Ongoing Monitoring: Establish a control to periodically re-verify vendor status at least annually to identify changes in eligibility after the initial onboarding. 5.4 Training and Accountability: Provide training to all fiscal staff on: 5.4.1 Federal suspension and debarment requirements. 5.4.2 Verification methods and documentation expectations. 5.4.3 Proper retention of evidence. 5.4.4 Compliance Reviews: Implement periodic internal compliance reviews to ensure continued adherence to suspension and debarment verification requirements. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

FINDING 2024-242 The Division did not accurately report federal grant expenditures on the Schedule of Expenditures of Federal Awards (SEFA) Closing Package. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b ) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Additionally, 2 CFR 200.510 requires the State to prepare the SEFA, which must include the total federal awards expended for each individual federal award program. The Office of the State Controller requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Division prepared the SEFA closing package as required but could not provide documentation to show that the closing package was reviewed for accuracy prior to submission. Additionally, amounts on the SEFA did not agree with the underlying accounting records in Luma, and Division staff could not provide an explanation for the differences. We identified the following errors based on expenditure transactions that were coded to specific grants in the Federal Grant Fund in Luma: Assistance Listing SEFA Amount Luma Amount Difference 84.126A $18,785,454 $18,285,440 $500,014 93.369 $282,568 $242,954 $39,614 Total Difference $539,628 The Federal Grant Fund also contained transactions that were not directly coded to any specific grant in the amount of $1,168,908. The Division could not provide documentation to show how these expenditures were allocated to individual programs. Cause: The Division has experienced a large amount of turnover in fiscal staff positions. Staff did not retain documentation to support amounts reported. Effect: The Division overstated expenditures, according to Luma, by $500,014 for the Rehabilitation Services-Vocational Rehabilitation Grants to States and also overstated expenditures, according to Luma, by $36,614 for the Independent Living State Grant. Additionally, expenditures in the amount of $1,168,908 were charged to the federal grant fund in Luma but are not identified by grant indicating that errors could be larger. Recommendation: We recommend that the Division design and implement procedures to accurately calculate the amounts reported in the SEFA closing package and to retain documentation supporting the amounts reported. Management’s View: The Division will ensure the accuracy, completeness, and appropriate documentation of all federal grant expenditures reported on the SEFA closing package by implementing effective reconciliation processes, internal review controls, and documentation retention procedures in compliance with 2 CFR 200.303 and 2 CFR 200.510. Corrective Action: 6.1 Develop and Implement Written SEFA Procedures: Create formal written procedures describing how SEFA amounts are compiled, reconciled, reviewed, and approved prior to submission within Grants Management Manual. 6.2 Strengthen Internal Controls and Oversight: Implement internal review and approval steps that require documented verification of SEFA amounts against Luma accounting records. 6.3 Ensure Accurate Grant Coding: Review and correct all federal grant fund transactions not assigned to specific grants, ensuring proper coding and allocation in Luma. 6.4 Training and Staff Development: Provide training to fiscal staff on SEFA preparation, reconciliation, and documentation requirements. 6.5 Establish Continuous Monitoring: Perform periodic reviews of federal expenditure coding and SEFA data to identify discrepancies before year-end reporting. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. We would like to clarify that the SEFA closing package for the state fiscal year 2025 contains several grant phases including, but not limited to, the federal fiscal year (FFY) 2024 award and was due prior to this progress note so it is unclear which SEFA preparation the Division intends to have the improved internal controls impact.

FINDING 2024-243 The Division did not properly evaluate costs related to the Rehabilitation Services-Vocational Rehabilitation Grants to States program resulting in direct costs incorrectly being recorded as indirect costs for the grant. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Allowable Costs/Cost Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 200.403(d) describes factors affecting the allowability of costs. Except where otherwise authorized by statute, costs must meet a consistency treatment criterion to be allowable under federal awards. A cost should not be assigned to a federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the federal award as an indirect cost. This also applies for misapplying indirect costs as direct costs. Condition: We tested a sample of 60 transactions, plus 15 individually significant transactions, from the population of indirect costs incurred in State fiscal year 2022. Those costs were used to calculate the indirect cost rate used in fiscal year 2024. We identified 2 transactions from the sample of 60 (or 3 percent) and 1 (or 7 percent) individually significant transactions that should have been charged as direct costs. The 2 sampled transactions were $30 for training and $269 for postage. The individually significant transaction was $46,922 for laptops. We also tested a sample of 60 employee payroll transactions from the population of direct costs in fiscal year 2024 to determine that the costs were allowable and the Division’s internal control procedures were operating as intended. The Division could not provide documentation to confirm that 2 transactions (or 3 percent) were approved prior to entry in Luma. Cause: The Division has experienced a large amount of turnover in fiscal staff positions. Prior staff did not retain documentation, and current staff was unable to produce documentation to support the expenditure transactions or verify controls were in place and operating. Effect: The 3 indirect cost transactions that should have been recorded as direct costs caused the Division to draw a lower amount of grant funds than allowed. We did not find any compliance errors in our testing of payroll transactions; however, if control procedures are not operating as designed, errors could occur and not be detected. Recommendation: We recommend that the Division provide training to employees to correctly distinguish direct costs and indirect costs and design and establish procedures to ensure that documentation is retained to support transactions. Management’s View: To ensure all costs charged to federal grants are accurately classified as direct or indirect in accordance with federal cost principles, and to maintain documentation supporting all expenditures, approvals, and internal control activities in compliance with 2 CFR 200.303 and 2 CFR 200.403(d). Corrective Action: 7.1 Establish and Document Clear Cost Classification Procedures: Develop written procedures defining and distinguishing between direct and indirect costs. 7.2 Strengthen Internal Controls Over Cost Allocation: Implement review and approval controls to verify proper cost classification before posting transactions to Luma or inclusion in the indirect cost pool. 7.3 Enhance Staff Training and Knowledge: Provide targeted training for fiscal staff to ensure understanding of allowable cost principles and consistent application of cost classification policies. 7.4 Ensure Documentation Retention and Review: Maintain complete documentation supporting all cost allocations, including approval records, cost pool calculations, and reconciliations. 7.5 Perform Regular Monitoring and Verification: Conduct periodic reviews of both direct and indirect cost transactions to confirm classification accuracy and identify any required adjustments. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

FINDING 2024-244 The Department’s original Schedule of Expenditures of Federal Awards submitted to the Office of the State Controller underreported the amount disbursed to subrecipients by $3,500,000 under the Coronavirus State and Local Fiscal Recovery Fund (CSLFRF) program. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), 2 CFR 200.510(b), requires that the State prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended. In addition, the total federal awards expended must be the total amount provided to subrecipients from each federal program. State agencies are required to report federal expenditures incurred for each federal program during the State fiscal year to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instruction on the completion of the closing package. The Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department failed to report one subrecipient of CSLFRF program on the SEFA in fiscal year 2024. Cause: The Department does not have sufficient controls in place to prevent or detect errors on the SEFA before submission to the Office. Program staff determined that one recipient of CSLFRF funding was a subrecipient. However, review procedures were not performed at the level of detail necessary to ensure amounts passed on to the subrecipient were appropriately identified on the SEFA closing package and did not report all funds passed through. Effect: The statewide SEFA amounts reported as disbursed to subrecipients were underreported by $3,500,000. Recommendation: We recommend that the Department improve training and the review process for the SEFA closing package to ensure appropriate reporting of subrecipient expenditures on the SEFA. Management’s View: The Department of Water Resources agrees with the finding. Corrective Action: The Department will improve training and the review process for the SEFA closing package to ensure appropriate reporting of subrecipient expenditures on the SEFA. The Department will review the FY 20025 SEFA closing package that was submitted to the Office of the State Controller to ensure the appropriate subrecipient expenditures were reported. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-201 The Coronavirus State and Local Fiscal Recovery Fund (CSLFRF) was understated by $18 million on the Schedule of Expenditures of Federal Awards (SEFA) Closing Package. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: State and Local Fiscal Recovery Fund Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: U.S. Code of Federal Regulations (CRF) 2 CFR 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The U.S. Code of Federal Regulations (CFR), 2 CFR 200.303, states that the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Additionally, 2 CFR 200.510 requires the State to prepare a SEFA, which must include the total federal awards expended for each individual federal award program. The Office of the State Controller requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department underreported $18 million in federal expenditures incurred under the CSLFRF program on the SEFA closing package. The expenditures were incurred for COVID-related claims covered under the State’s health plan using CSLFRF funds and should have been reported on the closing package. Cause: The CSLFRF funds were deposited to and expended from a non-federal fund. The SEFA closing package was prepared using similar procedures as the previous year by reporting federal expenditures included in federal funds. This approach did not consider that federal funds might have been expended through other means, and they were not reported. Additionally, there was staff turnover in a key financial position that contributed to this error. Effect: In the absence of the audit work completed and the resulting revised submission by the Department, the statewide SEFA would have included an understatement of $18 million for the Coronavirus State and Local Fiscal Recovery Fund, Assistance Listing number 21.027. Recommendation: We recommend that the Department strengthen the design and implementation of internal controls to ensure all federal funds are properly accounted for and those expenditures are included in the SEFA closing package. Management’s View: The Department of Administrations agrees that the SEF A was prepared using procedures similar to prior years, which failed to capture the expenditures related to the CSLFRF as those funds were deposited into a non-federal fund as directed by the legislature in HB752. Corrective Action: Prior to the issuance of this memo, the Department transferred the remaining $6,969,325.15 of CSLFRF funds into a separate reporting program. The Department will process quarterly reconciliations utilizing the quarterly reports from the insurance carrier. These transactions will then be queried each year, similar to other federal funding sources, and reported on the SEFA. Future federal awards will be deposited into a federal funding source or clearly delineated from non-federal funding sources to ensure proper reporting on the SEFA. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-202 Closing package submissions and revisions completed prior to the draft of the Schedule of Expenditures of Federal Awards (SEFA) being submitted for audit were not included in the schedule resulting in misstatements. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund; Medical Assistance Program; and Children’s Health Insurance Fund Assistance Listing Number: 21.027; 93.778; 93.767 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502. • Total amount provided to subrecipients from each federal program. Condition: The SEFA submitted for audit purposes included misstatements for Direct Awards for Assistance Listing (AL) number 21.027 (Coronavirus State and Local Fiscal Recovery Fund (CSLFRF)), 93.778 (Medical Assistance Program (Medicaid)), and 93.767 (Children’s Health Insurance Program (CHIP)). We noted the following errors in Direct Award Expenditures: • AL number 21.027 was understated $21,358,086 for Direct Award Expenditures reported by the Department of Health and Welfare and by an additional $500,000 reported by the Department of Correction. • AL number 93.778 was understated by $25,108,923 for Direct Expenditures reported by the Department of Health and Welfare. • AL number 93.767 was overstated by $3,469,677 for Direct Expenditures reported by the Department of Health and Welfare. Cause: Each year, State agencies report total federal awards expended on a closing package. The Office uses these closing packages to compile the SEFA. The Office’s review procedures over this process did not include the revised closing package submitted by the Department of Health and Welfare or the revisions communicated between the Office and the Department of Corrections. These revisions occurred prior to the draft of the SEFA submitted for audit. Effect: The SEFA submitted for audit contained misstatements; however, these errors have been corrected. In the absence of audit work completed, the statewide SEFA would have included an understatement of $21,858,086 for the CSLFRF program; an understatement of $25,108,923for the Medicaid program; and an overstatement of $3,469,677 for the CHIP program. Recommendation: We recommend that the Office design and implement procedures to ensure amounts reported on closing package submissions and later revisions are properly reviewed and reported on the statewide SEFA. Management’s View: The Office aAgrees with this finding. Corrective Action: An agency submitted a revised SEFA template in November 2023. We inadvertently excluded those revisions from the draft of the SEFA provided for audit. To prevent this error from happening again, we will document each agency that submits a revised SEFA template(s) on our SEFA review checklist. This will require the preparer and reviewer(s) to verify and sign off on changes made to the SEFA master file. Errors identified were corrected before issuance of the Single Audit report. Corrective actions will be implemented for fiscal year 2024 reporting. Auditor’s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit.

Finding 2023-203 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller did not properly report expenditures for the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), 2 CFR 200.510(b), requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended. State agencies are required to report federal expenditures incurred for each federal program during the State fiscal year to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a non-federal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department did not identify expenditures accurately when completing the schedule of expenditures of federal awards closing package. The closing package includes different tabs to report total expenditures and expenditures made to subrecipients. Reported expenditures to subrecipients should be a subset of total expenditures. However, The Department reported zero total expenditures related to the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program but $10.5 million of expenditures to subrecipients. However, $10 million of that were funds that had been transferred to the Division of Public Works for the Wastewater Lagoon project. Because they are transferred from one state agency to another, these funds have not yet been expended by the State and, as such, should not be reported as expenditures. Cause: The Department did not appear to fully understand how to prepare the closing package, and it was not reviewed with enough detail or knowledge to identify the error. Effect: The statewide SEFA was understated by $500,000 that was truly expended, but only reported as a subrecipient expenditure and thus not included in total expenditures for the CSLFRF program. Recommendation: We recommend that the Department improve training and the review process for the SEFA closing package to ensure all amounts are correctly reported. Management’s View: The Department agrees with this finding. Corrective Action: After management review the department will improve training and process review of preparation of the SEFA closing package to ensure all amounts are correctly reported. This lack of understanding of the SEFA was due to staff turnover and lack of subject matter experts regarding the SEFA for Fiscal Year 2023. The agency will implement the following to fix this issue: a) Financial Manager (or delegate) expenditure detail report shall include grant fund 344 (ARPA grants), 348 fund (grants), and any additional funds designated by the legislature or agency, for the specific purpose of tracking federal grant funding. b) Once prepared by the Financial Manager (or delegate), review of the SEFA by the Financial Officer for completeness, verifying all required grant federal funds appropriated to the agency are included on the SEFA closing package. c) Financial Manager and Financial Officer meet to review the SEFA for agreement of grant expenditure amounts reported on the SEFA. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-204 The Schedule of Expenditures of Federal Awards (SEFA) closing package understated the Education Stabilization Fund - Governor’s Emergency Education Relief (GEER II) by $1,039,753 and overstated the Education Stabilization Fund – Emergency Assistance to Non-Public Schools (EANS) program by the same amount. Related to Prior Finding: 2021-202 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Governors Emergency Education Relief Fund; Emergency Assistance for Non-Public Schools Assistance Listing Number: 84.425C; 84.425R Federal Award Number: S425C210043; S425R210024 Program Year: January 8, 2021 – September 30, 2023; February 11, 2021 – September 30, 2023 Federal Agency: Department of Education Compliance Requirement: SEFA MisstatementU.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions. It provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR § 200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR § 200.502, and • Total amount provided to subrecipients from each federal program The Office of Management and Budget (OMB) Compliance Supplement also indicates that the SEFA should include the individual subprograms the funds were expended under, including each separate Assistance Listing (AL) number with the applicable alpha character. Condition: The Board completed a SEFA closing package to report federal grant expenditures. This closing package included errors in reporting for the Education Stabilization Fund. The Governor’s Emergency Education Relief (GEER II, Assistance Listing number 84.425C) expenditures were understated by $1,039,753 and the Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (EANS, Assistance Listing number 84.425R) expenditures were overstated by $1,039,753. Cause: The State was given a specific period of time to obligate funds under the EANS program. Unobligated funds were then required to be reverted to the governor to be redistributed and used under the GEER II program. The Board had difficulty tracking available funds for each program. When preparing the SEFA, Board staff found errors in the total amounts reported for each program and made unsupported adjustments to these two programs. Effect: Total federal expenditures reported on the Board’s SEFA was correct. However, specific identification by program, as required, was understated by $1,039,753 for one program, and one program was overstated by the same amount. Recommendation: We recommend that the Board design and implement procedures to ensure federal expenditure amounts for each program are properly reported and proper adjustments are made prior to the reporting deadline. Management’s View: The Board agrees with the finding. Corrective Action: The Report states “the State was given a specific period of time to obligate funds under the EANS program. Unobligated funds were then required to be reverted to the governor to be redistributed and used under the GEER II program. The Board had difficulty tracking available funds for each program. When preparing the SEFA, Board staff found errors in the total amounts reported for each program and made unsupported adjustments to these two programs.” The Finding states that total federal expenditures reported on the Board’s SEFA was correct. However, specific identification by program, as required, was understated by $1,039,753 for one program, and overstated for another program, by the same amount. Patrick Coulson, Chief Financial Officer and Scott Christie, Financial Manager met with Amy Brown, LSO Audit Manager. Ms. Brown indicated that the EANS funds should have been moved from the State Department of Education (SDE) federal DoE G5 system to OSBE G5 system for better management of the funds. Mr. Christie asked Gideon Tolman, Chief Financial Officer for SDE whether the EANS funds in G5 would move to OSBE G5. Mr. Tolman said they would not. At this point OSBE was working with three PCAs used for the same Budget Unit and Fund for all GEER II funds: GEER II 29410, EANS 29710 and GEANS (which was created for the reverted EANS funds now GEER II funds). The GEER II PCA 29410 had a specific CFDA number based on the Grant Award Notification. EANS PCA 29710 had a specific CFDA number based on the example Grant Award Notification provided by SDE. OSBE was not aware of, nor was it provided, a unique CFDA number that should be used for the reverted EANS/GEER II funds. Mr. Christie considered the SDE EANS GEER funds the same as the OSBE GEER funds. In other words, once unobligated EANS moneys were reverted (by operation of law) to the Governor,1 all moneys in the GEER II fund were considered fungible.2 They were in the same OSBE appropriation, Budget Unit and Fund. The only distinction was that OSBE and SDE had access to separate buckets of GEER cash. When a large contract came up for payment on June 29th, Mr. Christie was also looking ahead at the implementation of the new statewide ERP Luma system. Mr. Christie wasn’t confident that Project Contracts had been set up correctly in Luma. Mr. Christie also understood that there would be considerably more work reconciling grant to cash balances in Luma compared to the legacy ERP system. For these reasons, on June 29th Mr. Christie drew down all the remaining GEER II funds to zero out that grant by the end of the fiscal year. When the coding for the contract payment came across, it was coded to PCA 29410, GEER II. OSBE could have coded the payment to either PCA 29450 or 29710, as they were now all considered GEER II funds. We do not believe that there were unsupported adjustments to these two programs. The adjustments were based on making sure the SEFA was accurate, and accuracy was confirmed in the Report: “total federal expenditures reported on the Board’s SEFA was [sic] correct.” We wanted to ensure we were not overstating the expenses for GEER II on the SEFA. We believe the adjustments can be, and have been, explained and are supported by the simple fact that one PCA was chosen instead of another for the same fungible GEER II funds. Nevertheless, we will agree with the audit finding. Corrective Action: The corrective action is to reclass any GEER II Project transactions in FY 2024 to EANS/GEER II Project. That will ensure there are no GEER II transactions in FY 2024 that would need to be adjusted. This was done on March 21, 2024. Auditor’s Concluding Remarks: We thank the Board for its cooperation and assistance throughout the audit. We continue to assert that the Board submitted the SEFA closing package with errors, and that it was not aware there were errors until the audit team identified them as part of the procedures completed for this audit. If adjustments were being made to ensure an accurate SEFA, they failed. Our statement that “total federal expenditures reported on the Board’s SEFA was correct” is related to the material accuracy of the SEFA as a whole. This finding identifies errors made in reporting required by the Office of Management and Budget, as communicated in the Compliance Supplement, where it states that that the SEFA should include the individual subprograms the funds were expended under, including each separate Assistance Listing number with the applicable alpha character. There are many requirements related to the presentation of the SEFA beyond total expenditures that are reviewed for accuracy, such as amounts paid to subrecipients, or COVID-19 and non-cash expenditures. The errors made by the Board were between programs with different applicable alpha characters, and those programs serve different purposes. Accurate reporting that meets all requirements is important to ensure compliance with the terms of the grant.

FINDING 2023-205 The Department understated total federal expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package by $24,824,862 and understated amounts passed through to subrecipients by $39,901,202. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds; Clean Water State Revolving Fund; Drinking Water State Revolving Fund; Water Pollution Control State, Interstate, and Tribal Program Support; State Public Water System Supervision; Nonpoint Source Implementation Grants; Pollution Prevention Grants; Deisel Emissions Reduction Act State Grants; Environmental Monitoring/Cleanup, Cultural and Resource Management, Emergency Response Research, Outreach, Technical Analysis Assistance Listing Number: 21.027; 66.458; 66.468; 66.419; 66.432; 66.460; 66.708; 66.040; 81.214 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended and the total amount provided to subrecipients from each federal program. State agencies are required to report this information to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies internal control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department completed a SEFA closing package to report various federal grant expenditures. We identified the following errors in the SEFA reporting that resulted in an understatement of $24,824,862 for total federal grant expenditures and an understatement of $39,901,202 in the amount reported as passed through to subrecipients: Cause: The Department has experienced significant turnover in fiscal personnel completing the closing packages. There were limited written instructions available to the new personnel to compile the correct information from the Department’s internal grant management system. Effect: The Statewide SEFA expenditures were understated by $24,824,862, and the amounts reported as disbursed to subrecipients were understated by $39,901,202. Recommendation: We recommend that the Department design and implement procedures to ensure the federal expenditures and amounts passed through to subrecipients are reported accurately for all federal programs. Management’s View: The department agrees with the audit findings that we under reported the total federal expenditures on the SEFA and the amounts passed through to subrecipients. Corrective Action: • Identify Root Causes: With the aid of LSO, we identified errors and are acting on a thorough analysis to pinpoint the root causes of the reporting errors on the Schedule of Expenditures of Federal Awards (SEFA) identified during the recent audit. As noted by the auditors, the errors were due to significant turnover-related knowledge gaps, staff being tasked with unfamiliar processes, lack of written desk manuals and other documentation, and issues with maintaining the internal reporting tool. This identification was completed by Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Supervisor, in tandem with the audit.   • Implement Training and Guidance: DEQ will provide comprehensive training sessions for staff involved in preparing and reviewing SEFA reports, considering the high turnover rate experienced in the department. We are in the process of developing detailed guidelines and documentation outlining SEFA reporting requirements, including specific instructions on categorizing federal awards, allowable expenditures, and reporting formats, to address any knowledge gaps resulting from turnover. As part of the statewide ERP move to LUMA from STARS, staff will utilize new reporting platforms and tools in LUMA to streamline SEFA reporting processes and mitigate potential errors associated with manual data entry or outdated systems. One significant improvement over our legacy reporting will be the use of front-end splits (FES) in LUMA that will automatically split out the state match from the federal component of our expenditures at the time in which they are spent, which was not as clearly defined under STARS. The new accounting system will be clearer to auditors and staff. Rob Sepich, Chief Financial Officer will create reconciliation reports for the SEFA by June 2024, with SEFA reporting compiled and completed in July 2024. • Enhance Internal Controls: Moving forward we will significantly strengthen internal controls and review processes to detect and prevent reporting errors in the future, particularly considering the turnover challenges. We anticipate requiring multiple additional review checkpoints and validation procedures within the new reporting platforms to verify the accuracy and completeness of SEFA data that will be reconciled before submission. We will also assign clear responsibilities and designate individuals responsible for overseeing SEFA reporting activities, ensuring continuity and consistency despite turnover and reduce the amount of unfamiliar work given to staff. This will include a review by Doug McRoberts, Grants Manager, Heather Hodges, Principal Budget Analyst, Rob Sepich, Chief Financial Officer, and Jeri Ann Fogg, Accounting Manager. Lastly, we are in the process of developing improved documentation on the new LUMA processes for our day-to-day operations so that we have up to date and accurate desk manuals should we experience additional turnover. These desk manuals are expected to be completed in June 2024. • Conduct Comprehensive Review: As part of the audit, we conducted a comprehensive review of the FY 2023 SEFA reports to identify any additional errors or discrepancies that may have been overlooked, considering the turnover-related knowledge gaps. The department was able to resubmit our SEFA closing package, including the list of sub recipients to the State Controller’s Office and LSO Auditors on March 9th, 2024 due to the efforts of Jeri Ann Fogg, Accounting Manager and Rob Sepich, Chief Financial Officer. • Continuous Monitoring and Improvement: We will establish a process for ongoing monitoring and periodic review of SEFA reporting activities, leveraging the capabilities of the new reporting platforms in LUMA to streamline processes and enhance accuracy. This will bring us closer to the work processes that other agencies do through the statewide reporting systems and reduce our dependency on reporting tools developed in-house that are unfamiliar to other state agencies. This should reduce the risk of losing key institutional knowledge during turnover and will make it easier for an employee with experience from another agency to be able to quickly pick up our reporting needs. To foster a culture of continuous improvement and knowledge sharing within the department, we will have additional meetings to encourage collaboration and communication to address SEFA reporting and ensure that we are not missing key input from staff. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

Finding 2023-206 The Department did not fully disclose required information to subrecipients, document subrecipient risk assessments, or ensure subrecipient audits were received for the Coronavirus State and Local Fiscal Recovery Fund. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 - December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administration Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. The requirements for pass-through entities are in 2 CFR 200.332, which states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and include the following information at the time of the subaward or if information changes. Required information includes: • Federal Award Identification 1. Subrecipient’s name (which must match the name associated with its unique entity identifier); 2. Subrecipient’s unique entity identifier; 3. Federal Award Identification Number (FAIN); 4. Federal award date of award to the recipient by the federal agency 5. Subaward period of performance start and end date; 6. Subaward budget period start and end date; 7. Amount of federal funds obligated by this action by the pass-through entity to the subrecipient; 8. Total amount of federal funds obligated to the subrecipient by the pass-through entity to the subrecipient; 9. Total amount of the federal award committed to the subrecipient by the pass-through entity; 10. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); 11. Name of awarding agency, pass-though entity, and contact information for awarding official of the pass-through entity; 12. Assistance Listings (AL) number and title; 13. Identification of whether the award is research and development (R&D); and 14. Indirect cost rate for the federal award • All requirements imposed by the pass-through entity on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the federal award. • Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the federal awarding agency, included identification of any required financial and performance reports. Pass-through entities must also: • Evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining the appropriate subrecipient monitoring. • Consider imposing specific subaward conditions upon a subrecipient, if appropriate. • Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subawards, and that subaward performance goals are achieved. • Verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, and follow up on the results of those audits. Condition: The Department received funds for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF, AL number 21.027) from the U.S. Department of Treasury through the Idaho Division of Financial Management. The Department passed through $18,941,327 from the SLFRF to 74 subrecipients. We selected a sample of 8 subrecipients to test compliance with these requirements. We found the Department complied with some, but not all, of the pass-through entity requirements. The Department did not provide the following required information in all 8 of the items tested: • Federal Award Identification Number (FAIN) • Federal award date of award to the recipient by the federal agency • Subaward period of performance start and end dates • Total amount of federal award committed to the subrecipient • Identification of whether the award is for (R&D) • Indirect cost rate for the federal award The Department did not provide the AL number to 3 of the 8 subrecipients tested and provided an incorrect AL number to 4 of the 8 subrecipients tested. The Department implemented the grant in the Waste Management and Remediation Division and the Grants and Loans Bureau. Single Audit reports are required to be submitted to pass-through entities no later than 9 months after the subrecipient’s fiscal year end or within 60 days of the issuance of the report. The Department passed funds through to subrecipients beginning in fiscal year 2023; therefore, no subrecipient Single Audit reports would be due during our audit period. However, we reviewed procedures the Department implemented to ensure that these audits would be collected when due. We found that the Grants and Loans Bureau had procedures in place that would be effective in collecting and evaluating the subrecipient reports; however, the Waste Management and Remediation Division did not have effective procedures to collect the reports. Cause: The Department used a basic template in creating an award letter and grant agreement. The template did not include all the required information. The FAIN was not communicated to the Department by the Division of Financial Management. The Department was also unaware that the FAIN and AL number were different. The period of performance was not included because the Department provided the budget period for the project and was concerned that subrecipients would be confused about the spending period for their grants. The Department did not identify whether the grant was for R&D because they felt it was sufficiently communicated that the funds were for planning, construction, or waste management projects and not for R&D. The indirect rate was not included because the Department communicated that the funds were for construction costs only, which does not include indirect costs. The Department did not have a formal documented risk assessment because they believed that this was sufficiently done during the application process and during the actual grant award period. However, these procedures are informal, and no documentation is retained that specifically identifies risks of noncompliance with federal grant rules for the purpose of determining monitoring procedures. The Waste Management and Remediation Division did not have procedures to collect subrecipient Single Audit reports because they believed that the fiscal operations division would perform that function. Our discussions with the fiscal operations found that there was a position with the assigned duties to collect subrecipient Single Audits, but that position was vacant during fiscal year 2023, and the Department had difficulty filling the position. Effect: Subrecipient monitoring is a critical requirement as part of accepting federal funds and ensuring that those funds are spent in compliance with allowable costs and other guidelines provided by the grantor. Subrecipients need the required grant information to properly implement, manage, and report the federal award. Without this information, subrecipients have an increased risk of noncompliance with the federal award requirements. Assessing the risk of subrecipient noncompliance enables a pass-through entity to determine the proper level of monitoring procedures. Without completing the risk assessment process, a pass-thought entity may increase the risk that appropriate monitoring procedures will not be performed at a sufficient level to detect noncompliance or that a subrecipient will not comply with the grant terms. There were no subrecipient Single Audit reports due during our audit period; however, a well-designed procedure for collecting these reports is an important pass-through entity responsibility. Subrecipient audit reports may identify internal control issues and noncompliance with federal award requirements. Reviewing these reports and ensuring that potential issues are addressed decreases the overall risk of noncompliance with the federal award requirements. Recommendation: We recommend that the Department design and implement appropriate procedures to ensure that all required information is communicated to subrecipients at the time of the award, subrecipient risk assessments are properly completed and documented, and subrecipient audits are completed and reviewed in accordance with federal grant regulations. Management’s View: The department agrees with the lack of certain required subrecipient information datapoints for the CSLFRF projects. Corrective Action: The department had an imperfect implementation of the initial subawards for CSLFRF documentation for subrecipients. Our general practice includes providing the identified federal award identification datapoints; however, this was not the case with the initial CSLFRF subrecipients. As an example, the period of performance was truncated to ensure that we were able to meet the aggressive timeline outlined in the American Rescue Plan Act; we will include both the true period of performance as set forth in the grant and the budgetary period in which the subrecipient will need to complete their work. Carrie Champlin, Contracts Manager, and Rob Sepich, Chief Financial Officer will implement these changes by April 15, 2024. The department had processes for evaluating the risk of subrecipients, however it could be improved and made clearer for auditors and we will implement a process used by other agencies to memorialize the risk factors outside of email in a clear and concise manner. Additionally, the department is currently implementing a new software system, Amplifund, to aid in registering subrecipients, monitoring them, and closing out subawards. This system will include all of the relevant information necessary for both the subrecipient and the department in one location and will provide consistency across the department. Amplifund implementation is currently underway and will be used department- wide by August 2024. Doug McRoberts, Grants Manager, Jeri Ann Fogg, Accounting Manager, Carrie Champlin, Contracts Manager are working on the integration of Amplifund. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-207 The Division overstated federal expenditures by incorrectly including $6.6 million expended under the State Small Business Credit Initiative (SSBCI) on the Schedule of Expenditures of Federal Awards (SEFA) closing package. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: State Small Business Credit Initiative Assistance Listing Number: 21.031 Federal Award Number: Not Applicable Program Year: Not Applicable Federal Agency: Department of Treasury Compliance Requirement: U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, 2 CFR 200.510, requires the State to prepare a SEFA, which must include the total federal awards expended for each individual federal award program. The Office of the State Controller requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. The SSBCI statute, 12 U.S.C. § 5702(c)(5), specifically states that capital funds transferred to jurisdictions are not considered federal financial assistance for the purposes of 31 U.S.C. subtitle V. As such, capital funds are not subject to the single audit requirements of the Single Audit Act or 2 CFR 200, Subpart F. Condition: The Division reported $6.6 million in federal expenditures incurred under the SSBCI program on the SEFA closing package. These SSBCI funds includes two programs: the Capital Program and the Technical Assistance (TA) Grant Program. Under the Capital Program, participating jurisdictions implement credit and equity/venture capital programs to provide capital to small businesses. The Division received funding under the Capital Program, these funds are not subject to the Single Audit requirements of 2 CFR Subpart F. Cause: The Division was unaware that the Capital Program funds should not have been included on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Division, the statewide SEFA would have included an overstatement of $6.6 million for the SSBCI program. Recommendation: We recommend that the Division improve training and the review process for the SEFA closing package to ensure appropriate reporting of federal expenditures on the SEFA. Management’s View: The Division of Financial Management concurs with the finding. Corrective Action: The agency will implement improved training and review for the SEFA closing package prior to submission to ensure appropriate reporting of federal expenditures on the SEFA. The SSBCI funds were included in an abundance of caution to ensure reporting of all federal funds received, as it is rare that federal monies are to be excluded from the SEFA. Moving forward, preparation of the SEFA will include an analysis of all new federal awards to be included to confirm if the amounts are to be included, and a side-by-side comparison of the prospective list to the prior year report to note any differences and investigation of any that exist. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

FINDING 2023-208 The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller (Office) included multiple errors. Related to Prior Finding: 2022-211; 2021-206 Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Supplemental Nutrition Assistance Program; Coronavirus State and Local Fiscal Recovery Funds; Guardianship Assistance; Temporary Assistance for Needy Families; Child Support Enforcement; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); Social Services Block Grant; Children's Health Insurance Program; Medical Assistance Program; Money Follows the Person Rebalancing Demonstration; Block Grants for Community Mental Health Services Assistance Listing Number: 10.561; 21.027; 93.090; 93.558; 93.563; 93.575; 93.658; 93.659; 93.667; 93.767; 93.778; 93.791; 93.958 Federal Award Number: Various Program Year: Various Federal Agency: Various Compliance Requirement: U.S. Code of Federal Regulations Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR §200.510(b)), which states it must include: • Total federal awards expended as determined in accordance with 2 CFR §200.502, and • Total amount provided to subrecipients from each federal program in accordance with 2 CFR 200.510(b)(4) The requirements included in 2 CFR 200.303 require that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Office requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department submitted multiple revisions of the fiscal year 2023 SEFA closing package to correct errors identified by the auditors and communicated to management during the audit process. The original submission included misstatements for the following programs: • Overstatement of $144,460 for the Supplemental Nutrition Assistance Program (Assistance Listing (AL) number 10.561) • Overstatement of $933 for the Guardianship Assistance program (AL 93.090) • Understatement of $1,300,232 for the Temporary Assistance for Needy Families program (AL 93.558) • Understatement of $230,034 for the Child Support Enforcement program (AL 93.563) • Understatement of $42,349 for the Foster Care Title IV-E program (AL 93.658) • Overstatement of $16,112 for the Adoption Assistance program (AL 93.659) • Overstatement of $1,036,549 for the Social Services Block Grant program (AL 93.667) • Overstatement of $3,469,677 for the Children's Health Insurance Program (AL 93.767) • Understatement of $25,108,923 for the Medical Assistance program (AL 93.778) • Understatement of $48,071 for the Money Follows the Person Rebalancing Demonstration program (AL 93.791) • Understatement of $676,806 for the Block Grants for Community Mental Health Services program (AL 93.958) • Understatement of $21,358,086 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) In addition, expenditures to subrecipients were misstated for the following programs: • Overstatement of $86,608,290 for the Child Care and Development Block Grant program (AL 93.575) • Understatement of $18,959,072 for the Coronavirus State and Local Fiscal Recovery Funds program (AL 21.027) Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2023 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. This issue was also reported as finding 2022-211 in the Single Audit Report for fiscal year 2022. Other factors impacting the Department’s accurate completion of the fiscal year 2023 SEFA, such as working with the implementation of a new statewide accounting system, Luma, that resulted in issues reconciling grant reports and SEFA reports. The Department also used SEFA reports that had been run before the budget team had completed all necessary grant uploads, which resulted in excluded information from the SEFA. The reports used to prepare the SEFA closing package were pre-built to pull the data from only the cooperative welfare fund (0220). Historically, this approach was successful because all the Department’s federal funds were coded to the cooperative welfare fund. The Department did not consider the spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) through the American Rescue Plan Act fund (0344) when preparing the SEFA closing package. This resulted in those expenditures being omitted from the original SEFA submitted. The spending for the Coronavirus State and Local Fiscal Recovery Funds (AL 21.027) was originally understated on the SEFA by $21,358,086. The SEFA was adjusted after inquiry during the audit process to include the American Rescue Plan Act fund (0344). The original amount reported was $2,856,346. The final amount reported was $24,214,432. In addition, $86,608,290 originally reported as expenditures to subrecipients for the Child Care and Development Block Grant program (AL 93.575) were payments to providers rather than subrecipients. The coding in the accounting system by the Department’s program staff lead to the erroneous inclusion of the funds in the subrecipient reporting on the SEFA. Effect: In the absence of the audit work completed and the resulting revised submission by the Department to the Office, the statewide SEFA would have included multiple misstatements. Recommendation: We recommend that the Department improve the process for gathering information to prepare the SEFA closing package, and to review it for accuracy, to include training and specific procedures at a level of detail sufficient to detect and correct errors in the SEFA closing package. Management’s View: The Department agrees with the finding. Corrective Action: Since the implementation of LUMA, the department has been cognizant of the systematic challenges and risks and is acutely attentive to monitoring and review efforts. For example, due to LUMA, finance now has a new chart of accounts structure, meaning previously used reports for compilation of the SEFA are no longer a concern. The department held a required training on March 12-13, 2024, for all employees involved with grant administration where the determination of contractor vs. subrecipient, as well as proper account coding, were reiterated. Finance has efforts underway to strengthen compliance through report building and monthly monitoring of proper coding. The department will be moving forward with the implementation of Grant Management Software in SFY25, which finance believes will provide further assurances of data accuracy. Finance will confirm all expenditures and adjustments are completed before running reports when preparing the SFY24 and future SEFA’s. This confirmation will be documented via an email to the Financial Manager of the Budget section. The email response will be retained with the SEFA preparation file for audit purposes. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-209 Monthly cost allocation statistics, used to allocate indirect costs to federal grants, were not reviewed and approved by the Department. Type of Finding: Significant Deficiency Assistance Listing Title: Supplemental Nutrition Assistance Program; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Coronavirus State And Local Fiscal Recovery Funds; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund; Foster Care Title IV-E; Adoption Assistance; State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 10.551; 10.561; 21.027; 93.391; 93.558; 93.568; 93.575; 93.596; 93.658; 93.659; 93.777; 93.778 Federal Award Number: 22ID35051692301; 23ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID7F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503; 237IDID4S2514; 237IDID5Q3903; 237IDID7F1003; 237IDID4S2520; 237IDID4Q7503; 237IDID4S2519; 20-1982-0-1-806; 1 NH75OT000105-01-00; 6 NH75OT000105-01-00; 2201IDTANF; 2301IDTANF; G-2001IDLIEA; 2001IDE5C3; 2101IDLWC6; 2201IDLIEA; 2201IDLIE4; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI; G1801IDCCDF; G1901IDCCDF; G2001IDCCC3; G2201IDCCDD; G2301IDCCDD; 2201IDFOST; 2301IDFOST; 2201IDADPT; 2301IDADPT; 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2505ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023; October 1, 2022 – September 30, 2024; March 3, 2021 – December 31, 2024; June 1, 2021 – May 31, 2024; May 28, 2021 – March 31, 2024; March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025 Federal Agency: Department of Agriculture; Department of Health and Human Services; Department of the Treasury Compliance Requirement: Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.416 states that for states, local governments and Indian tribes, certain services, such as motor pools, computer centers, purchasing, accounting, etc., are provided to operating agencies on a centralized basis. Since federal awards are performed within the individual operating agencies, there needs to be a process whereby these central service costs can be identified and assigned to benefitted activities on a reasonable and consistent basis. The central service cost allocation plan provides that process. Condition: The Department maintains a contract with an independent consulting firm that is responsible for updating the cost allocation plan each quarter and intermittently, as needed. The consulting firm is responsible for updating the statistics for each basis of allocation, done at varying intervals, with most of them being updated monthly. Statistical data is obtained from supervisory staff within relevant programs and from various computerized systems. Each statistic should be reviewed by an appropriate supervisor prior to being submitted to the consulting firm. We tested the cost allocation process for four out of the twelve months for fiscal year 2023. The applicable cost allocation statistics were not reviewed and approved by the Department’s Division of Welfare (division) supervisors for two of the four months tested. The Division of Welfare is aware of the issue and has retroactively reviewed and approved the statistical data. Cause: The Department explained that the cost allocating statistics were not reviewed and approved by the division supervisors due to staff turnover. Effect: If applicable cost allocation statistics are not reviewed consistently as required, there is an increased risk that the statistics could be inaccurate. Further, the calculated costs based on those statistics and incurred for specific grants could be inaccurate. Recommendation: We recommend that the Department strengthen controls over the review and approval of the cost allocation statistical data to ensure accurate data is used during the cost allocation process. Management’s View: The Department agrees with the finding. During two of the four months, one of the thirteen supervisors did not review the two statistics that are supervisory responsibility to review and approve. Corrective Action: With the implementation of Luma and the interfaced cost allocation module, finance has spent a significant amount of time assessing the best practices for cost allocation processing steps. Since going live on 7/1/23, each month, finance has reviewed, revised, and refined process steps. The department’s budget analysts who hold oversight of some cost allocation processes, use a spreadsheet to track processing. Finance has added a step in the process to ensure that finance reviews the cost allocation SharePoint site for review and signature of each supervisor responsible for each statistic. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-210 Low-Income Home Energy Assistance Program (LIHEAP) performance and special reports did not include a review for accuracy and compliance prior to submission. Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Federal Award Number: 2101IDLWC6; 2201IDLIEA; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI Program Year: May 28, 2021 – March 31, 2024; October 1, 2021 – September 30, 2023; October 1, 2022 – September 30, 2024 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: During fiscal year 2023, the LIHEAP program was required to submit one program performance report and six program special reports to the federal government. The Department’s LIHEAP program manager compiles the program performance report and program special reports. The reports are submitted by the same program manager to the Office of Community Services. The reviews and the approvals for all seven reports tested were not documented. There was no documented review for accuracy nor approval of the reports. In addition, three of the annual special reports were not submitted timely. Cause: The Department staff indicated that there is no official approval process as reports are submitted online and the data source is either collaborated or provided by internal sources and verified. The Department did not consider that documentation to support the review and the approval of these reports was necessary to ensure accuracy and compliance with reporting requirements. Effect: Three of the annual LIHEAP special reports were not submitted timely. We did not identify any other errors in the performance or special reports. However, in the absence of a documented appropriate internal control, there is an increased risk of errors occurring and going undetected. Further, the Department could submit the performance and special reports with incomplete or inaccurate information required by the grant agreement. Recommendation: We recommend that the Department design and implement internal controls to ensure sufficient documentation is maintained to support the completion of a review for accuracy and compliance for required LIHEAP reports, prior to submission. Management’s View: The Department agrees with the finding. Corrective Action: The Program will develop a process to work with the Information Management and Analysis Team (IMAT) within the division to compile the data for the Low-Income Home Energy Assistance Program (LIHEAP) reports. Program will review the completed reports for accuracy. All reports will then be submitted to the Bureau Chief, as a second review of accuracy, prior to submission to Federal Partners. Documentation will be maintained to support the preparation, review, and approval steps. The process outlines a timeline to have reports prepared and reviewed ahead of the established deadline. Program will communicate with our Federal Partner if circumstances arise that would prevent a report from being submitted by an established deadline to receive an extension. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-211 The review and approval of the annual updates to the Low-Income Home Energy Assistance Program (LIHEAP) benefits matrix were not documented. Type of Finding: Significant Deficiency Assistance Listing Title: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Federal Award Number: 2101IDLWC6; 2201IDLIEA; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI Program Year: May 28, 2021 – March 31, 2024; October 1, 2021 – September 30, 2023; October 1, 2022 – September 30, 2024 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The LIHEAP utilizes a software to determine eligibility and benefit amounts for applicants based on energy burden and qualifying factors. There is a benefits matrix within the software, which is updated annually. Each year, the Department’s LIHEAP program staff update the benefits matrix with any required changes. The review and approval of the changes were completed by program staff, who met in-person and completed testing scenarios to verify the accuracy of the information. After the test results were reviewed and no errors identified, the matrix information was uploaded into software production prior to the start of the heating season. The review and approval of the changes to the benefits matrix were not documented. Verbal confirmation was provided to the program manager. Cause: The Department did not consider that documentation to support the review and approval of the updates to the benefits matrix was necessary. Effect: We did not identify errors in the 60 approved and 60 denied eligibility determinations that we reviewed. However, without review (documented) there is an increased risk of errors in the matrix either because of erroneous changes or no changes occurring and then going undetected in eligibility determinations. Recommendation: We recommend that the Department design and implement procedures to ensure sufficient documentation is maintained that supports the review and approval of the updates to the benefits matrix. Management’s View: The Department agrees with the finding. Corrective Action: Testing of the updated benefits matrix will be completed by the Program annually, and the results will be documented using an established scenario testing script. Results of the testing will be documented and submitted to the Bureau Chief, as a second review of accuracy and compliance, prior to moving the updated matrix into the production environment. Documentation will be maintained to support the review and approval. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-212 The review of the Low-Income Home Energy Assistance Program (LIHEAP) earmarking compliance requirements was not documented. Type of Finding: Material Weakness Assistance Listing Title: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Federal Award Number: 2101IDLWC6; 2201IDLIEA; 2301IDLIEA; 2301IDLIEE; 2301IDLIEI Program Year: May 28, 2021 – March 31, 2024; October 1, 2021 – September 30, 2023; October 1, 2022 – September 30, 2024 Federal Agency: Department of Health and Human Services Compliance Requirement: Matching; LOE; Earmarking Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The LIHEAP requires earmarking which limits the percentage of grant funds that can be spent on administration, weatherization, and leveraging programs. The monitoring of LIHEAP earmarking requirements was completed by the program manager on a spreadsheet that tracked expenditures and appropriate limitations to ensure compliance was met. However, there was no documented review for accuracy nor approval of the tracking spreadsheet. Cause: The Department did not consider that documentation to support the review and approval of the earmarking tracking spreadsheet was necessary to ensure accuracy and compliance. Effect: We did not identify any errors in compliance with earmarking requirements during completion of audit procedures, but the lack of a documented review increases the risk of errors occurring and going undetected. Recommendation: We recommend that the Department design and implement procedures to ensure sufficient documentation is maintained that supports the review and approval of the earmarking tracking spreadsheet. Management’s View: The Department agrees with the finding. Corrective Action: The Program will document the current process regarding the preparation, review, and approval of the Low-Income Home Energy Assistance Program (LIHEAP) budget that includes maintaining the documentation of the earmarking reviews that are being completed. The program will prepare the Low-Income Home Energy Assistance Program (LIHEAP) budget. This budget will be submitted to the Bureau Chief, as a second review of accuracy and compliance, to include review of earmarking limits, prior to routing the Annual State Plan for review and submittal or the allocation of any funding. Documentation will be maintained to support the review and approval. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-213 The Department erroneously determined that two recipients of Temporary Assistance for Needy Families (TANF) funding were contractors instead of subrecipients resulting in noncompliance with the subrecipient monitoring requirements. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Temporary Assistance for Needy Families Assistance Listing Number: 93.558 Federal Award Number: 2201IDTANF; 2301IDTANF Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.331 describes the Department’s, a pass-through entity, responsibility for completing subrecipient and contractor determinations. The Uniform Guidance included in 2 CFR 200.332 (a) states that pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward. Also, if any of these data elements change, include the changes in subsequent subaward modification.   (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal award date (see the definition of federal award date in 2 CFR 200.1 of this part) of award to the recipient by the federal agency; (v) Subaward period of performance start and end date; (vi) Subaward budget period start and end date; (vii) Amount of federal funds obligated by this action by the pass-through entity to the subrecipient; (viii) Total amount of federal funds obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total amount of the federal award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of federal awarding agency, pass-through entity, and contact information for awarding official of the pass-through entity; (xii) Assistance Listings number and title; the pass-through entity must identify the dollar amount made available under each federal award and the Assistance Listings number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the federal award, including if the de minimis rate is charged per 2 CFR 200.414. If any of the required information is not available, the pass-through entity must provide the best information available to describe the federal award and subaward. The Uniform Guidance included 2 CFR 200.332(b) states that pass-through entities must evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a single audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of federal awarding agency monitoring (for example, if the subrecipient also receives federal awards directly from a federal awarding agency). Condition: The Department erroneously determined that two recipients of TANF funding were contractors instead of subrecipients. A contractor provides services or goods while a subrecipient has additional responsibilities related to the grant administration. Because of that, there are additional requirements when passing through funds to a subrecipient, rather than making a payment to a vendor. We tested one of the two subrecipients for compliance purposes. The award was not identified to the subrecipient as a subaward and did not include all the necessary information at the time of the subaward. In addition, the subrecipient's risk of noncompliance was not evaluated. Cause: During our analysis of the subrecipient monitoring compliance requirement, we learned that the Department’s program staff determined that some of the recipients of TANF funding were contractors. However, the Department’s financial staff reported the expenditures as payments to subrecipients on the SEFA. After investigation, we found that the expenditures were made to subrecipients, not contractors. Effect: The Department is exposed to increased risk of noncompliance related to subrecipients and improper payments in the TANF program. The Department provided a total amount of $1.4 million to subrecipients during fiscal year 2023. Recommendation: We recommend that the Department implement proper training of personnel involved in subrecipient and contractor determinations. In addition, we recommend that the Department design and implement effective internal control procedures to ensure all required information is provided to subrecipients at the time of subawards and that the Department complete the required evaluations of each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward. Management’s View: The Department agrees with the finding. Corrective Action: The Department has revised our training of personnel involved in subrecipient and contractor determinations. These contract managers and monitors completed grant training on March 12th-13th, 2024 which included sections about subrecipient and contractor determinations, risk assessment and documentation. All newly hired employees will be trained beginning April 2024 with an on-line module. For the impacted vendor, an updated Risk Assessment was completed and submitted to LSO. Additionally, the Department has started the work to effectively change the designation of the vendor and ensure all required information is provided to this subrecipient. This process will be completed by April 30th, 2024. The Department will develop internal control procedures to ensure all required information is provided to the subrecipients at the time of the subawards. These updated internal control procedures will be completed by June 30th, 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-214 The Department did not maintain sufficient documentation to support eligibility award decisions for the Community Partners Grants within the Child Care and Development Fund (CCDF) program. Type of Finding: Material Weakness Assistance Listing Title: Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund Assistance Listing Number: 93.575; 93.596 Federal Award Number: 2001IDCCC3; 2301IDCCDD; 2101IDCDC6 (ARPA); 2001IDCCDF; 2301IDCCDF Program Year: March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025; October 1, 2020 – September 30, 2024; October 1, 2019 – September 30, 2022; October 1, 2022 – September 30, 2025 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility; Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Child Care and Development Fund (CCDF) program received additional funding through the Coronavirus Aid, Relief, and Economic Security (CARES) Act and American Rescue Plan Act (ARPA). During testing for eligibility within the CCDF program, we reviewed ARPA provider applications to determine if they were properly reviewed and approved by appropriate personnel. For four of the sixty providers tested (or 6.67 percent), there was no documentation to show who completed the eligibility evaluation or when the evaluation was completed. All four providers were Community Partners Grant recipients. Cause: The Department did not design and properly document a review process that would identify who participated, what was evaluated, what each applicant scored on the evaluation criteria, and the final decision made for the Community Partners Grant recipients. The Department stated that review and approval of the grants was a group effort and agreed that the process was not properly documented. Additionally, there was an indication of high turnover during grant processing, which could have contributed to missing documentation. Effect: The Department did not maintain adequate support for the Community Partners Grant application approvals, which could have resulted in grant funds being awarded to ineligible recipients. Recommendation: We recommend that the Department ensure that internal controls are consistently performed to ensure adequate evaluations of grant applications are properly documented. Management’s View: The Department agrees with the finding. It should be noted that the Community Partner Grants have ended. Corrective Action: The division will: • All employees who administer grants will be required to complete training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. • The Division will work closely with the Division of Management Services to support the development and implementation of updated record retention policies and processes which will result in relevant documents being centrally retained. Estimated completion date December 31, 2024. Between now and when that central repository is available, individual rubrics and their supporting documents related to grant awards will be retained. • All employees will complete an annual employee conflict-of-interest disclosure and recertification process. Current completion of the new employee conflict of interest from will be completed by April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-215 The Department’s review of child care providers health and safety inspections for the Child Care and Development Fund (CCDF) were not completed timely. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Child Care and Development Block Grant; Child Care Mandatory and Matching Funds of the Child Care and Development Fund Assistance Listing Number: 93.575; 93.596 Federal Award Number: 2001IDCCC3; 2301IDCCDD; 2001IDCCDF; 2301IDCCDF Program Year: March 27, 2020 – September 30, 2023; October 1, 2022 – September 30, 2025; October 1, 2019 – September 30, 2022; October 1, 2022 – September 30, 2025 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Grant Guidance included in 42 USC 98859c(c)(2)(i) - (I) Health and Safety requirements states that the plan shall include a certification that there are in effect within the State, under State or local law, requirements designed to protect the health and safety of children that are applicable to child care providers that provide services for which assistance is made available in accordance with this subchapter. The Department has contracted with the Idaho Central District Health (ICDH) to complete required health and safety inspections. The Department’s policy is to monitor the contracted inspections. The Department’s Contracts and External Resource Management (CERM) team is tasked with conducting reviews of the monitoring completed by ICDH. The CERM team review includes randomly sampling the health and safety inspections based on a calculation per Department operating procedures. Contract monitoring done by the CERM team includes verifying compliance with contract requirements, such as reviewing expenditures, approving invoices for payment based on compliance to the contract terms, reviewing, performance standards, and ensuring compliance with record keeping provisions. Condition: During our audit, we determined that all eight of the monitoring reviews conducted by the CERM team, for health and safety inspections completed by the ICDH for fiscal year 2022, were completed on January 30, 2024. The Department reviews were completed after the audit of the program commenced. Based on our analysis, it appeared that the ICDH was properly completing the health and safety inspections. However, the Department cannot ensure that childcare providers serving children who receive subsidies meet applicable health and safety standards when monitoring the contracted reviews occurs so far after the date of review. Additionally, when the Department contracted these inspections out to the ICDH, they did not include a time frame to complete the reviews of the inspections in its policies and procedures. Completing reviews more than 12-months after the inspection greatly increases the risk of noncompliance and reduces the Department’s ability to enforce compliance. Cause: According to the Department, personnel staffing issues led to the delay of the Department’s reviews over the health and safety inspections. Effect: The CERM team did not review the providers’ health and safety inspections in a timely manner. Providers receiving subsidies could have been noncompliant with all applicable health and safety requirements and children could have been unduly at risk. Recommendation: We recommend that the Department complete reviews of the health and safety inspections in a timely manner. We also recommend that the Department define due dates for completion of these reviews within the program guidelines to provide an appropriate time to remediate issues raised during the inspections and ensure compliance. Management’s View: The Department agrees with the finding. The Department review of contracted health and safety inspections was not performed timely. Completion of childcare provider health and safety inspections is very important to the Department. Childcare providers are not certified for program subsidy participation without an inspection. Corrective Action: The division will complete reviews of the health and safety inspections in a timely manner. The division will review and update the existing process document to support this corrective action plan defining timeframes for completion of these reviews so that there is appropriate time to remediate issues raised during the inspections and ensure compliance. The updated process document will be in place and appropriate staff will implement by 9/30/2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-216 The Department did not have appropriate documentation to support allowability of transactions for the Foster Care Title IV-E program. Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Foster Care Title IV-E Assistance Listing Number: 93.658 Federal Award Number: 2201IDFOST; 2301IDFOST Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Costs Principles Questioned Costs: Known $4,555; Projected $213,387 Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 U.S. Code (USC) 675(4)(A) states that the term “foster care maintenance payments” means payments to cover the cost of (and the cost of providing) food, clothing, shelter, daily supervision, school supplies, a child’s personal incidentals, liability insurance with respect to a child, reasonable travel to the child’s home for visitation, and reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement. The Uniform Guidance included in 45 CFR 1356.60(c)(3) states that allowable administrative costs do not include the costs of social services provided to the child, the child's family or foster family, which provide counseling or treatment to ameliorate or remedy personal problems, behaviors, or home conditions. The Uniform Guidance states that costs claimed as foster maintenance payments that include medical, educational (except for school supplies and the cost of reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement in foster care), or other expenses not outlined in 42 USC 675(4)(A) are unallowed. Condition: We tested 61 expenditure transactions charged to the Foster Care - Title IV-E program. The sample included 4 expenditures that were for unallowable costs charged to the program or that were missing supporting documentation making it difficult to determine if the costs were allowable. We also identified one transaction that did not have evidence of review and approval prior to payment but appears to be for an allowable expenditure. The details for the 5 of 61, or 8 percent, transactions with exceptions is as follows: 1) We determined that 2 out of 61 transactions tested (or 3.2 percent) were unallowable. The first transaction was paid for the family therapy service. The total cost was $206. This type of activity is specifically unallowable under 45 CFR 1356.60(c)(3). The second transaction was paid for an intensive reading program for a child. The total cost was $3,200. This type of activity is unallowable under 42 USC 675(4)(A), which only allows for educational activities for school supplies and the cost of reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement in foster care. 2) For 2 out of 61 transactions tested (or 3.2 percent), we were not able to determine allowability due to missing support documentation. For the first transaction, we were unable to determine the purpose for a car rental and gasoline purchase totaling $780. The supporting documentation did not include enough detail to ensure allowability. For the second transaction, we were unable to determine the purpose and allowability for a travel expenditure totaling $349. The supporting documentation for the purchase of an airline ticket did not include a travel voucher or agenda. 3) The review and approval of 1 out of 61 transactions tested (or 1.6 percent) was not documented. The transaction totaled $61. Cause: The Department could not locate additional support documentation to justify the payments. In addition, the Department did not consider that additional support should be retained to ensure compliance. The Department considered the activities for the family therapy services and the intensive reading program as allowable. Effect: Federal funds were expended for unallowable activities. The total for unallowable activities and activities lacking supporting documentation was $4,555. The total projected questioned costs for allowable activities are $213,387. Further, other expenditures in our sample did not have appropriate supporting documentation which increases the likelihood of additional unallowable activities. Recommendation: We recommend that the Department strengthen internal control procedures to ensure that expenditures are allowable and that sufficient documentation is retained to support that determination. Management’s View: The Department agrees with the finding. Corrective Action: A new feature was added to ESPI on 1/9/24 to record the reason (purpose) for certain service types, including transportation. The system is programmed to disallow Title IV-E if the reason listed does not meet IV-E eligibility criteria (see image below). An additional control will be added to the system to have the same control procedure used for a medical service type and education service type. Further development is underway for additional control procedures and should be completed by April of 2025. P-card transactions do not process through ESPI. Quarterly reports will be obtained to review any P-card transactions that utilized Title IV-E to confirm appropriate documentation is on record. This will be completed by April 30, 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-217 The Department does not have documented internal controls for adjustments processed to the Foster Care -Title IV—E program. Type of Finding: Material Weakness Assistance Listing Title: Foster Care Title IV-E Assistance Listing Number: 93.658 Federal Award Number: 2201IDFOST; 2301IDFOST Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Foster Care - Title IV-E program maintenance payments are processed through the Ensuring Safety & Permanency in Idaho system (ESPI). Those payments include recurring, non-recurring, and adjustment transactions. Adjustments transactions are processed by the Department’s program personnel on a monthly basis. Adjustments are a function of the pace at which the Department is able to obtain the documents and information for eligibility determinations. Court documents can take extended periods to obtain. In addition, the intermittent nature of child support payments also drives adjustments in the program. We were not able to identify documented internal controls over the adjustment transactions for 60 out of 62 adjustment transactions (or 96.7 percent) that were processed through ESPI. Cause: The review and approval over the adjustment transactions were not documented within the program software. Effect: We did not identify any substantive or compliance errors during testing over adjustment transactions. However, without documentation of a review and approval, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department design and implement internal controls to document the review and approval of the adjustment transactions processed in ESPI. Management’s View: The Department agrees with the finding. Corrective Action: The Department will continue to record adjustment activity through Help Desk tickets, SharePoint documentation, and ESPI. The Department will ensure improved visibility to the adjustment and approval process and documentation by ensuring all roles who need access (including auditors), have access to all relevant systems and storage locations such as access to SharePoint and Help Desk tickets. This step will be completed by April 30, 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-218 The Department failed to provide necessary documentation to support the eligibility determination for two foster care providers within the Foster Care -Title IV—E program. Type of Finding: Noncompliance Assistance Listing Title: Foster Care Title IV-E Assistance Listing Number: 93.658 Federal Award Number: 2201IDFOST; 2301IDFOST Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Questioned Costs: Known $884; Projected $126,091 Criteria: Federal law 42 U.S. Code (USC) 672(b) states that foster care maintenance payments may be made under this part only on behalf of a child described in subsection (a) of this section who is: (1) in the foster family home of an individual, whether the payments therefor are made to such individual or to a public or private child-placement or child-care agency, or (2) in a child-care institution, whether the payments therefor are made to such institution or to a public or private child-placement or child-care agency, which payments shall be limited so as to include in such payments only those items which are included in the term “foster care maintenance payments” (as defined in section 475(4)).   Federal Law 42 USC 672(c) defines a foster family home as: (A) In general. The term “foster family home” means the home of an individual or family: (i) that is licensed or approved by the State in which it is situated as a foster family home that meets the standards established for the licensing or approval, and (ii) in which a child in foster care has been placed in the care of an individual, who resides with the child and who has been licensed or approved by the State to be a foster parent (I) that the State deems capable of adhering to the reasonable and prudent parent standard, (II) that provides 24-hour substitute care for children placed away from their parents or other caretakers, and (III) that provides the care for not more than six children in foster care. The Uniform Guidance included in 42 USC 671(a)(20)(A) states that the foster family home provider must have satisfactorily met a criminal records check, including a fingerprint-based check with respect to prospective foster and adoptive parents. The Uniform Guidance included in 42 USC 671(a)(20)(B) states that a Title IV-E agency must check, or request a check of, a state-maintained child abuse and neglect registry in each state the prospective foster and adoptive parent(s) and any other adult(s) living in the home have resided in the preceding five years before the State can license or approve a prospective foster or adoptive parent. Condition: During our review of the eligibility determination for foster care providers, the Department could not locate the foster home license documentation for 2 out of 65 foster homes reviewed (or 3 percent). For those same 2 foster homes, child abuse and neglect registry checks were not provided, and for 1 of those 2 foster homes a criminal record check and a fingerprint-based check were not provided. Cause: The Department was unable to locate the proper backup eligibility documentation. In addition, the Department mentioned that this situation was caused by the migration of data from an old system, iCare, to the new system, Ensuring Safety & Permanency in Idaho (ESPI), which was fully implemented on November 26, 2020. Effect: Foster families could be receiving subsidies without proper licensing and without passing background checks, fingerprint-based checks, and child abuse and neglect checks. This also increases the risk to the safety of the children placed in these homes. The total amount associated with the exceptions noted was $884. The total projected questioned costs for eligibility items are $126,091. Recommendation: We recommend that the Department design procedures to ensure that background, fingerprint-based, and child abuse and neglect checks are completed and properly maintained for Foster Care -Title IV—E eligibility determinations. Management’s View: The Department agrees with this finding. Corrective Action: The department agrees with the finding related to the critical importance of obtaining and maintaining documentation for all necessary background checks. Although the department was ultimately able to verify background checks were completed, we agree that we were unable to readily pull the needed documentation on these in a timely manner. To correct the issue, the department will add an additional point of verification that the Enhanced Criminal History Background Check clearance letter from the Background Check Unit’s system is uploaded to eCabinet, by having supervisors view the document within eCabinet prior to approving the initial foster care license. Supervisors will also confirm that all ICPC home studies address results of background checks for all adults in the home and any additional potential caregivers. This will be completed April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-219 The level of effort spending requirements for the Adoption Assistance Title IV-E program were not met. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Adoption Assistance Assistance Listing Number: 93.659 Federal Award Number: 2201IDADPT; 2301IDADPT Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Matching; LOE; Earmarking Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 USC 673(a)(8)(A) states that a state must calculate the adoption savings (if any) resulting from the application of different program eligibility rules (42 USC 673 (a)(2)(A)(ii)) to all applicable children for a fiscal year using methodology proposed by the state and approved by ACF. The Uniform Guidance included in 42 USC 673(a)(8)(D)(i) states that a state shall spend an amount equal to the amount of the savings (if any) in state expenditures under this part resulting from the application of paragraph (2)(A)(ii) to all applicable children for a fiscal year, to provide to children of families any service that may be provided under part B or this part. A state shall spend not less than 30 percent of any such savings on post-adoption services, post-guardianship services, and services to support and sustain positive permanent outcomes for children who otherwise might enter into foster care under the responsibility of the state, with at least two-thirds (2/3) of the spending by the state to comply with such 30 percent requirement being spent on post-adoption and post-guardianship services. Condition: During fiscal year 2023, the minimum spending amount to meet level of effort requirements for the Adoption Assistance Title IV-E program was $362,738. The Department only spent $276,658 of the required amount of adoption savings, calculated for federal fiscal year 2022, on post-adoption services, post-guardianship services, and services to support positive permanent outcomes for children at risk of entering foster care. The difference was $86,080. The amount spent was only 22.9 percent and the program requirement is 30 percent of adoption savings. Cause: Population growth, COVID impacts, staff turnover, and increasing residential treatment costs have reached a point that the Department’s budget was strained beyond capacity. The Department stated that the dollars to meet level of effort requirements come from its state General Fund appropriation, and the Department prioritized those limited General Fund dollars to emergent, critical, and safety related needs of kids in foster care over complying with the matching requirements for this program. Effect: Adoptive families in Idaho did not receive the full benefits of post-adoption services, post-guardianship services, and services to support positive permanent outcomes for children at risk of entering foster care that are required under this program. Recommendation: We recommend that the Department design, implement and maintain internal control procedures to ensure compliance with level of effort requirements for Adoption Assistance Title IV-E program. We further recommend that the Department improve budgeting and monitoring for General Fund spending plans and actual expenditures to ensure that they can comply with federal requirements. Management’s View: The Department agrees with the finding. Corrective Action: Beginning 07/01/2023, FACS implemented a monthly review of post-permanency services invoices and payments to support correct usage of adoption assistance funds including 30% spending of adoption savings for prevention. Progress toward fully effective integration of this process has been hindered by limited access to timely and accurate budget data from LUMA. FACS will refine the monthly review process to ensure current and accurate tracking and use of funds. This will be completed July 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-220 The Department failed to provide necessary supporting documentation for five Adoption Assistance Title IV-E eligibility determinations. Type of Finding: Material Noncompliance Assistance Listing Title: Adoption Assistance Assistance Listing Number: 93.659 Federal Award Number: 2201IDADPT; 2301IDADPT Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Questioned Costs: Known $2,249; Projected $711,238 Criteria: The Uniform Guidance included in 42 U.S. Code (USC) 671(a)(20)(A) states that the prospective adoptive parent(s) must have satisfactorily met a criminal record check, including a fingerprint-based check. The Uniform Guidance included in 42 USC 671(a)(20)(B) states that the prospective adoptive parent(s) and any other adult living in the home who has resided in the provider home in the preceding five years must satisfactorily have met a child abuse and neglect registry check. The Uniform Guidance in the 42 USC 675(3) states that the agreement for the subsidy was signed and was in effect before the final decree of adoption and contains information concerning the nature of services. Condition: The Department could not locate criminal records check, fingerprint-based check, and child abuse and neglect registry check for 3 out of 65 adoption cases reviewed (or 4.6 percent). In addition, the Department could not locate 2 of the 65 adoption agreements we tested (or 3 percent). Cause: The Department was unable to locate the proper supporting eligibility documentation. In addition, the Department mentioned that this situation was caused by the migration of data from an old system, iCare, to the new system, Ensuring Safety & Permanency in Idaho (ESPI), which was fully implemented on November 26, 2020. Effect: Adoption families could be receiving subsidies without proper adoption agreement and without passing background check, fingerprint-based check, and child abuse and neglect checks. The total amount associated with the exceptions noted was $2,249. The total projected questioned costs for eligibility items are $711,238. Recommendation: We recommend that the Department maintain supporting documentation for Adoption Assistance Title IV—E eligibility determinations. Management’s View: The Department agrees with the finding. Corrective Action: The department agrees with the finding related to the critical importance of obtaining and maintaining documentation for all necessary background checks. Although the department was ultimately able to verify background checks were completed, we agree that we were unable to readily pull the needed documentation on these in a timely manner. The department will assure supporting documentation for Adoption Assistance Title IV-E eligibility determinations are maintained within the electronic filing system by adding an additional verification to the current process. When a supervisor reviews a departmental adoption for finalization, they will verify that a copy of the Enhanced Criminal History Background clearance letter for all adults residing in the home is uploaded to the prospective adoptive parents’ profile in eCabinet (the electronic case management system), and the signed copy of the adoption assistance agreement is uploaded to the child’s profile. The application process for Adoption Assistance Title IV-E eligibility for private adoptions will be updated to include the addition of the Enhanced Criminal History Background clearance letters for all adults residing in the home to the child’s eCabinet file. When a supervisor approves an adoption assistance agreement for a private adoption, they will verify a copy of the signed adoption assistance agreement is uploaded to the adoptive child’s profile. This will be completed by August 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-221 The Department did not review subrecipient application information for the Coronavirus State and Local Fiscal Recovery Funds at a sufficient level to identify missing information. Related to Prior Finding: 2022-210 Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Number: 20-1982-0-1-806 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.332 describes the pass-through entities’ responsibility for administering necessary requirements on subrecipients so that the federal award is used in accordance with federal regulations. The Uniform Guidance included in 2 CFR 200.332(a)(1)(iii) states that pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the Federal Award Identification Number (FAIN) at the time of subaward. Condition: The Department used COVID State and Local Fiscal Recovery funds to respond to the public health and negative economic impacts resulting from the COVID-19 pandemic. The Division of Public Health and the Idaho Council on Domestic Violence and Victim Assistance were responsible for distributing these funds and created a process for their prospective recipients to apply and receive funding. During testing, we noted 2 applications out of our sample of 8 (25 percent) that did not include FAINs in application documentation, as required. Cause: The Department had review procedures in place; however, the reviews of subrecipient application documentation were not completed at a level sufficient to identify missing FAINs. Effect: The Department is exposed to increased risk of improper payments and noncompliance with federal requirements when applications do not meet all requirements for receiving funding. Recommendation: We recommend that the Department design and implement effective internal control procedures to ensure subrecipient applications are completed accurately and in compliance with federal requirements. Management’s View: The Department agrees with the finding. Corrective Action: The Division of Public Health and Idaho Council on Domestic Violence and Victim Assistance (ICDVVA) will take steps to ensure new staff receive training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. All newly hired employees will be trained beginning April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-222 Supporting documentation to demonstrate the completion of subrecipient risk assessments for the Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program was not available for review. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Number: 1 NH75OT000105-01-00; 6 NH75OT000105-01-00 Program Year: June 1, 2021 – May 31, 2024 Federal Agency: Department of Health and Human Services   Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.332(b) states that all pass-through entities must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Condition: The Department was unable to provide a subrecipient risk assessment for 1 out of 8 (or 12.5 percent) subrecipients we reviewed. The Department was compliant with all other aspects of the subrecipient monitoring compliance requirements for that subrecipient. Cause: During the time in which the missing documentation was supposed to be created, the Department’s program staff were in the process of being hired and trained. Responsibilities were also being transitioned to the newly onboarded staff from the other program staff that assisted in the implementation of the grant. Effect: The Department is exposed to increased risk of noncompliance related to subrecipients and improper payments in the Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program. Recommendation: We recommend that the Department strengthen internal controls to ensure required risk assessments are completed and supporting documentation is retained. Management’s View: The Department agrees with the finding. Corrective Action: The division will ensure new staff receive training related to awarding grants, to include components on appropriate internal controls, identifying required grant elements, detailing the grant process, and outlining record retention requirements. All current employees have been trained as of March 2024. All newly hired employees will be trained beginning April 2024. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-223 Managed Care providers lacked documentation to support continued eligibility within the Medicaid Program. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR section 431.107 states that providers must be licensed in accordance with federal, state and local laws, and regulations to participate in the Medicaid program and receive payments. The Uniform Guidance included in 42 CFR section 455.412 states that the Medicaid State Plan gives assurance that the State Medicaid Agency has a method for verifying providers licensed by the State and that such provider licenses have not expired or have no current limitations. Condition: Managed Care Organizations (MCO) providers are monitored by the Bureau of Care Management using a provider roster. The Department receives and tracks the provider roster for all MCO annually. We noted four of the sixty-two managed care providers tested (6.5 percent) did not have documentation to support their provider eligibility; however, those providers were included in the roster as of December 2023. The Department was not able to provide documentation that these providers had the applicable licenses and certifications, entered into a provider agreement, and have made the required disclosures to the State. The four providers did not have an active contract with MCO during the period, nor did they have any claim payments associated with the provider. However, a Medicaid recipient could possibly utilize a provider from the roster, including these four providers, and claim payments could be processed by an MCO and go undetected by the Department. Cause: Two of the four providers initiated the provider enrollment process, but ultimately did not fully enroll. This situation caused the provider to appear as being contracted with MCO. The other two providers were terminated by an MCO in the spring of 2023, but the providers remained on the roster through the end of the term. The provider roster as of December 2023 was not updated to reflect these changes. Effect: We reviewed the fiscal year 2023 expenditure data and confirmed that there were no claimant payments made to these providers during fiscal year 2023. However, there is increased risk surrounding managed care eligibility due to the reliability of the provider roster. Recommendation: We recommend that the Department strengthen internal controls to ensure required documentation is maintained for Managed Care providers, including applicable licenses and certifications, provider agreements, and required disclosures to the State.   Management’s View: The Department agrees with the finding. While a provider cannot be reimbursed without an active contract or an executed single case agreement, we agree that it is best practice to have a provider directory reflective of active, enrolled and fully credentialed providers. The Division has two efforts underway to address this finding. Corrective Action: The 21st Century Cures Act requires all states to enroll both fee-for-service and managed care providers. Idaho Medicaid is currently out of compliance with this requirement for most of the providers within managed care contractor networks. The state is also working to come into compliance with a requirement in the Affordable Care Act to revalidate all enrolled providers at least every 5 years. The Division has begun the systems work necessary to come into compliance with both of these requirements and anticipates working through enrollment and revalidation activities into CY2025. Once completed, the Division will have an accurate and complete provider file that will be shared with contracted managed care plans to support their contracting efforts. Any providers who contract with the managed care plans will be required to be fully enrolled and credentialed with Idaho Medicaid before rendering services and billing. Pursuant to the Consolidated Appropriations Act of 2023, states are required by July 2025 to have a searchable and regularly updated provider directory for both managed care plans and fee-for-service programs. Idaho Medicaid is working to develop processes to validate directories and ensure that providers are providing updates to their information as necessary. Through this effort, Idaho Medicaid will further bolster internal processes and controls to ensure accurate provider network information is shared with Medicaid participants and maintained within our systems. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-224 The required audited financial reports were not collected as required to ensure compliance with the Managed Care Organization contracts. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2205ID5000; 2205ID50C3; 2305ID5000; 2305ID50C3; 2305ID5CAA; 2205ID5MAP; 2205ID5ADM; 2205IDIMPL; 2305ID5MAP; 2305ID5ADM Program Year: October 1, 2021 – September 30, 2022; October 1, 2022 – September 30, 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR Section 438.3(m) requires the contract with Managed Care Organizations (MCO) to include the requirement to submit audited financial reports specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Condition: We reviewed all four MCO contracts that were active during fiscal year 2023. We noted that 3 out of 4 Managed Care Organization’s contracts tested did not have specific clauses clearly requiring the MCO to submit an audited financial report as required by 42 CFR Section 438.3(m). In addition, three of the four (or 75 percent) audited financial reports were not submitted until after the current single audit inquiry about the reports occurred. Cause: The contracts were not clearly written to directly require the MCO to submit an audited financial report. The Bureau of Care Management stated that the MCOs were not contractually obligated to submit the audited financial reports. However, the Department is obligated to comply with federal requirements, and we found a reference to the 42 CFR Section 438.3(m) requirement in two of the four MCO contracts, which would indicate some knowledge that the grantor required audited financial statements. However, only one of the contracts included the clear specific requirements included in the 42 CFR Section 438.3(m). The Department requested the reports from the MCOs after receiving the request for the reports from our auditors. Effect: Audited financial reports provide information about internal controls and compliance with laws, rules and regulations. Collecting these reports, and reviewing them, provides additional oversight and the ability to react to the risk of noncompliance occurring at the MCOs. Additionally, the Department is not in compliance with federal requirements to collect these reports. Recommendation: We recommend that the Department amend the MCO contracts to include a requirement to submit audited financial reports on an annual basis and design and implement internal controls to monitor the receipt and review of the reports. Management’s View: The Department agrees with the finding. Corrective Action: The Division will amend all current managed care contracts to include the requirement to submit an audited financial report annually. This contract language will also be incorporated into all future Medicaid managed care procurements. The Division will also review and confirm all required contract elements outlined in 42 CFR 438.3 are clearly outlined in Medicaid managed care contracts. Lastly, the Division intends to coordinate with the Department of Insurance to learn more about their review process of audited financial statements and determine if there is an opportunity to coordinate oversight efforts for Medicaid managed care contracts going forward. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-225 Review of federal suspension and debarment status is not adequately performed or documented to demonstrate compliance with the federal requirements for the Coronavirus State and Local Fiscal Recovery Funds program. Type of Finding: Significant Deficiency Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Fund Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: U.S. Code of Federal Regulations (CFR) 2 CFR Part 180.300) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR Part 180.300) requires grantees to verify an entity is not suspended or debarred or otherwise excluded before entering into a covered transaction. The verification is accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration and available online, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. Non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Covered transactions, as defined by 2 CFR 180.220, include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria. Also, 2 CFR 200.303 requires that the Department establish and maintain effective internal control over the federal award that provides reasonable assurance that the Department is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: During fiscal year 2023, the Department completed covered transactions and later verified that a vendor was not suspended or debarred when quarterly reporting was submitted to the Division of Financial Management (DFM). To document this verification, the Department listed the unique entity identifier (UEI) number on an excel workbook. However, this verification was performed after payments had been made to these vendors. Cause: The Department did not consider completing this verification prior to issuing payment and properly documenting the verification, such as printing a report or some other form of documentation to confirm that a check had been performed, since they are able to review this verification at any time. The Department did not consider any vendor to be a significant risk and indicated the timing of the check issuance, which was also impacted by the implementation of Luma (new ERP system) and staffing issues, may have factored into the late verification. Effect: We did not identify suspended or debarred vendors receiving federal funds during our testing. However, the Department does not have procedures in place to identify a suspended or debarred vendor prior to issuance of payment. Performing a verification after payment creates a risk that the Department may enter into covered transactions with suspended and debarred parties. Recommendation: We recommend that the Department ensure that sufficient documentation is maintained to comply with the suspension and debarment requirements and that a verification is performed before any payment is issued. Management’s View: The Department agrees with this finding. Corrective Action: In response to the Internal Control Deficiency identified as "Finding 1" in your letter, we have already implemented the following corrective action plan. 1. Our Development Bureau has revised their "Notice of Intent to Award" letter to include the collection of the Federally issued Unique Entity ID (UEI) for all projects funded with Federal funds. 2. The UEI information will be used to check the proposed contractor's exclusion status on the System for Award Management (SAM.gov) website and a printed report, or a printed screen shot of the exclusion status will be preserved prior to issuing the contract. 3. The person responsible for ensuring that this plan is followed is our Financial Officer, Steve Martin who can be reached by telephone at 208.514.2460, or by email at steve.martin@idpr.idaho.gov. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2023-226 The Department did not develop and execute a Value Engineering work plan in compliance with the regulations for the federal Highway Planning and Construction grant. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Highway Planning and Construction Grant Assistance Listing Number: 20.205 Federal Award Number: Various Program Year: Various Federal Agency: Department of Transportation Compliance Requirement: Special Tests – Value Engineering Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Title 23, Part 627 contains the regulations for Value Engineering (VE). Subsection c of 23 CFR part 627.7 states, “STAs (State Transportation Agencies) shall designate a VE Program Coordinator to promote and advance VE program activities and functions. The VE Coordinator's responsibilities should include establishing and maintaining the STA's VE policies and procedures; facilitating VE training; ensuring VE analyses are conducted on applicable projects; monitoring, assessing, and reporting on the VE analyses conducted and VE program; participating in periodic VE program and project reviews; submitting the required annual VE report to the Federal Highway Administration (FHWA); and supporting the other elements of the VE program.” The Department’s Value Engineering Manual contains the policies and procedures for the VE program. Section 1.4 of the manual contains the policies for the Statewide Value Engineering Work Plan and states, “The Districts are responsible to develop and execute an annual Value Engineering Work Plan. Upon completion of the Draft State Transportation Improvement Plan (STIP), the districts will identify projects that require VE studies and select additional projects for VE studies. The districts will also select the timing and schedule to complete VE studies for their district. The Statewide VE Work Plan will be compiled annually by the Headquarters (HQ) VE Coordinator upon submittal by the districts. The HQ VE Coordinator will prepare and submit an annual Value Engineering Program Summary Report to FHWA.” Section 6 of the Department’s VE manual, titled Reporting/Tracking, states, “The VE coordinator shall be responsible for monitoring program compliance and annually reporting to FHWA. Value engineering operations will be monitored for compliance with the policies, procedures and standards identified in the preceding sections. Specific areas to be monitored include District Value Engineering work plan and schedule, District Value Engineering accomplishments (accepted cost savings, return-on-investment, functional enhancements), documentation of value engineering activities, Economic analysis methods being used in cost/benefit determinations for project decisions, compliance with the provisions of the Value Engineering procedures.” Finally, 2 CFR 200.303 requires the Department to establish and maintain effective internal control over the federal award that provides reasonable assurance that the Department is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: While developing our understanding of the VE program, we found that the procedures described in the Department’s VE manual to monitor the Department’s VE programs were not being followed. The requirement to develop and execute a VE work plan has not been completed in the past two years, and the Department does not have a formal process for ensuring that the annual VE reporting to FHWA is completed. Cause: The Department was not aware of the CFR requirement to establish, maintain, and follow Value Engineering policies and procedures. The Department did not have a procedure to ensure the annual VE report was submitted to the FHWA and waited for the FHWA to request it. Effect: The goals of VE analysis are to ensure that projects are providing the needed functions while considering community and environmental commitments, safety, reliability, efficiency, overall life cycle, optimizing value and quality, and reducing the time to develop and deliver the project. Without an effective VE work plan in place, there is a risk that these goals will not be met. Recommendation: We recommend that the Department implement controls for monitoring and assessment of the Value Engineering Program to ensure the VE guidelines are being followed. Management’s View: The Idaho Transportation Department (ITD) concurs with the audit finding and recommendation. Corrective Action: ITD will develop a new standard operating procedure (SOP) to follow to ensure that the Districts develop an Annual Value Engineering Work Plan and that the Statewide Work Plan is compiled annually by the Headquarters Value Engineering Coordinator. This SOP will be developed in collaboration with FHWA staff to ensure 2 CFR 200.303 and 23 CFR Part 627 compliance. The SOP will include details as to who, what, where and when the specific tasks will occur so to provide clarity and control with regard to developing the work plan as well as monitoring, assessing and reporting on the Departments Value Engineering Program. The new SOP will be developed prior to FFY 2025, and statewide outreach and education will follow shortly thereafter. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2022-201The Commission did not complete the required Federal Financial SF-425 Report for the Aging Cluster Grant program in a timely manner.Type of Finding: Material Noncompliance, Material WeaknessAssistance Listing Title: Grants for Supportive Services and Senior Centers; Special Programs for the Aging; Title III, Part C, Nutrition Services; Nutrition Services Incentive ProgramAssistance Listing Number: 93.044; 93.045; 93.053Federal Award Number: 2001IDOASS; 2101IDOASS; 2201IDOASS; 2101IDOAHD; 2101IDOACM; 2201IDOAHD; 2101IDOANS; 2201IDOANSProgram Year: October 1, 2019 ? September 30, 2021; October 1, 2020 ? September 30, 2023; October 1, 2021 ? September 30, 2023; October 1, 2020 ? September 30, 2022; October 1, 2020 ? September 30, 2022; October 1, 2021 ? September 30, 2023; October 1, 2020 ? September 30, 2022; October 1, 2021 ? September 30, 2023Federal Agency: Health and Human ServicesCompliance Requirement: ReportingQuestioned Costs: NoneCriteria: The Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that non-federal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award.The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published the Internal Control Integrated Framework, which provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include control activities and information and communication.The grant award from the U.S. Department of Health and Human Services (HHS) issued under Older Americans Act of 1965 requires recipients to submit the Federal Financial SF-425 Reports on a semi-annual basis. Federal Financial SF-425 Reports are due within 30 days for the periods ending March 31 and September 30 (due April 30 and October 30), and a final report is due within 90 days after September 30 (due December 30). If a final report is submitted by December 30, a semi-annual report is not required to be filed by October 30.Condition: The Federal Financial SF-425 Reports for the Aging Cluster Grant program (Assistance Listing Numbers 93.044, 93.045, and 93.053) were not completed during State fiscal year 2022.The Federal Financial SF-425 Report should have been submitted for the periods ending September 30, 2021, and March 31, 2022, during our audit period. Prior Commission staff requested a filing extension from HHS for the September 2021 report. The HHS federal liaison approved the extension and requested specific dates of when to expect the report; however, the Commission was unable to provide additional details about the September extension or documentation of additional extensions for the March 2022 report.Cause: Commission staff did not complete the Federal Financial SF-425 Report during State fiscal year 2022 and did not receive or maintain appropriate documentation of extensions for past due reports. Commission staff stated that they believed the September 2021 e-mail approval covered all delinquent reports.Effect: The Federal Financial SF-425 Report is used to report the financial status of grant funds and expenditures of those funds and is generally supported by the underlying accounting records. Inaccurate or incomplete reporting could result in inaccurate information provided to users of the reports, including the federal funding agency, and could cause a disruption in federal funding due to noncompliance. The inability to complete and submit financial reports for an entire year also increases the risk of properly reconciling the data reported to the underlying records and ensuring that payments are only for allowable activities.Recommendation: We recommend that the Commission design and implement well-documented internal control procedures to ensure compliance with federal reporting requirements and accurate and timely completion and submission of the Federal Financial SF-425 Report.Management?s View: The Idaho Commission on Aging is in general agreement with the findings as stated by Legislative Services Office Single Audit Report for fiscal year 2022.Corrective Action: Actions have been taken to complete SF-425 reports as they come due for each grant.A reporting workbook has been created to track awards and reporting dates.Reporting period end dates and due dates will be added to fiscal staff calendars.A soft target date for completion of all past due reports is set for September 30, 2023, and a hard target date of December 31, 2023.We will continue to keep our federal partners appraised of our progress through completion.Auditor?s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit. We will review reporting procedures implemented as part of follow-up procedures completed in conjunction with the fiscal year 2023 Single Audit Report. We would like to emphasize that along with implementing a process for completing the past due and current reports, the Office should also include internal control activities that help ensure the processes are properly executed.

FINDING 2022-202The Commission did not complete required reports for the Federal Funding Accountability and Transparency Act (FFATA).Type of Finding: Material Noncompliance, Material WeaknessAssistance Listing Title: Grants for Supportive Services and Senior Centers; Special Programs for the Aging; Title III, Part C, Nutrition Services; Nutrition Services Incentive ProgramAssistance Listing Number: 93.044; 93.045; 93.053Federal Award Number: 2001IDOASS; 2101IDOASS; 2201IDOASS; 2101IDOAHD; 2101IDOACM; 2201IDOAHD; 2101IDOANS; 2201IDOANSProgram Year: October 1, 2019 ? September 30, 2021; October 1, 2020 ? September 30, 2023; October 1, 2021 ? September 30, 2023; October 1, 2020 ? September 30, 2022; October 1, 2020 ? September 30, 2022; October 1, 2021 ? September 30, 2023; October 1, 2020 ? September 30, 2022; October 1, 2021 ? September 30, 2023Federal Agency: Health and Human ServicesCompliance Requirement: ReportingQuestioned Costs: NoneCriteria: The Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that non-federal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award.The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published the Internal Control Integrated Framework, which provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include control activities and information and communication.Under the requirements of the FFATA (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the FFATA Subaward Reporting System.Condition: The FFATA was developed to provide better transparency over management of federal grants and contracts. Reporting is required on allocations of federal funding of $30,000 or more through the FFATA website. The Commission is the primary recipient of the Aging Cluster Grant program (Assistance Listing Numbers 93.044, 93.045, 93.053). The Commission issued six subawards in excess of $30,000 to the six Area Agencies on Aging that required reporting under the FFATA guidelines.When discussing FFATA reporting requirements with the Commission, current staff were not aware of the requirement to complete the FFATA reports. No FFATA reports were submitted during our audit period, and as far as the Commission staff were aware, no FFATA reports had ever been submitted for the Commission.Cause: Commission staff were not aware of the FFATA reporting requirements and did not implement internal controls to ensure the accurate and timely submission of the FFATA reports.Effect: The FFATA reports are required to be submitted to the FFATA Subaward Reporting System, which makes the information available to the public in a searchable database. Late reporting, or non-reporting, impacts the integrity of that information. Additionally, without effective internal controls in place, there is an increased risk that an error or misreporting could occur and remain undetected and uncorrected.Recommendation: We recommend that the Commission design and implement well-documented internal control procedures to ensure the compliance with federal reporting requirements and accurate and timely completion and submission of FFATA reports.Management?s View: The Idaho Commission on Aging is in general agreement with the findings as stated by Legislative Services Office Single Audit Report for fiscal year 2022.Corrective Action: Federal Funding Accountability and Transparency Act (FFATA) reporting for federal fiscal years 2021, and 2022 have been completed as of March 27, 2023.The agency will complete FFATA reporting as awards are administered to sub-awardees going forward.Auditor?s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit. These reports were completed after receiving the audit findings and we have not had an opportunity to review them. Additionally, the Office has not addressed the recommendation to improve internal controls over the reporting process for FFATA reporting and we continue to assert that improving the internal control activities around this process is critical to ensuring compliance with federal reporting requirements.

FINDING 2022-203Errors in the elimination process for federal grants between State agencies resulted in misstatements to the Schedule of Expenditures of Federal Awards (SEFA) totaling $14,656,928 for direct awards and $14,278,362 provided to subrecipients.Type of Finding: Significant Deficiency, SEFA MisstatementAssistance Listing Title: State and Local Fiscal Recovery Fund; Gaining Early Awareness and Readiness for Undergraduate ProgramsAssistance Listing Number: 21.027; 84.334SFederal Award Number: 20-1982-0-1-806; PS334S110016Program Year: March 3, 2021 - December 31, 2024; September 26, 2011 - September 25, 2018Federal Agency: Department of Treasury; Department of EducationCompliance Requirement: Code of Federal Regulations (CRF) 2 CFR 200.510(b)Questioned Costs: NoneCriteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions. It provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives.Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR ?200.510(b)), which states it must include:? Total federal awards expended as determined in accordance with 2 CFR ?200.502? Total amount provided to subrecipients from each federal programCondition: The SEFA submitted for audit purposes included misstatements for Direct Awards and Amounts Provided to Subrecipients for Assistance Listing (AL) Number 21.027 (Coronavirus State and Local Fiscal Recovery Fund (CSLFRF)) and 84.334S (Gaining Early Awareness and Readiness for Undergraduate Programs (GEARUP)). We noted the following errors:? Amounts for AL Number 21.027 were overstated by $12,534,055 for Direct Award Expenditures and by $12,171,845 for Amounts Provided to Subrecipients? Amounts for AL Number 84.334S were understated by $2,122,873 for Direct Expenditures and by $2,106,517 for Amounts Provided to SubrecipientsCause: Each year, State agencies report the total of federal awards expended on a closing package. The Office uses these closing packages to compile the SEFA. Federal funds received by one State agency and then passed on to another State agency get reported on both State agencies? SEFA closing package. The Office completes eliminations to avoid double counting expenditures for the same federal program. The Office?s review procedures over this process did not detect or prevent the duplicate expenditures for AL Number 21.027 and did not prevent the erroneous elimination of actual expenditures for AL Number 84.334S.Effect: The SEFA submitted for audit contained misstatements; however, these errors have been corrected.Recommendation: We recommend that the Office design and implement procedures to ensure amounts are properly reported and proper adjustments are made when federal funds are shared between State agencies.Management?s View: The Office agrees with this finding.Corrective Action: We will improve our elimination and reporting process by adding the following steps:? We will add an additional tab to our SEFA Master file to cross check all COVID-19 related funding to ensure agencies are not double reporting expenditures.? We will add additional steps to our SEFA preparation and review checklist outlining specific steps for completing the subrecipient elimination process, and identify higher risk areas that require the most scrutiny.? We will also improve our current elimination tab (awards received from other state agencies) and reconciliation procedures for subrecipients.Auditor?s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit.

FINDING 2022-204COVID-19 funds in the amount of $196,247,971 were not properly identified on the statewide Schedule of Expenditures of Federal Awards (SEFA), as required.Type of Finding: Noncompliance, Material Weakness, SEFA MisstatementAssistance Listing Title: Supplemental Nutrition Assistance Program (SNAP); WIC Special Supplemental Nutrition Program for Women, Infants, and Children; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Grants to States for Construction of State Home Facilities; Special Education - Grants for Infants and Families; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Community-Based Child Abuse Prevention Grants; Block Grants for Community Mental Health Services; Sexually Transmitted Diseases (STD) Prevention and Control Grants; Disaster Grants ? Public Assistance (Presidentially Declared Disasters)Assistance Listing Number: 10.551; 10.557; 10.561; 64.005; 84.181; 93.391; 93.497; 93.590; 93.958; 93.977; 97.036Federal Award Number: 22ID35051692301; 217IDID7W7003; 227IDID7F1003; FAI 16-012; FAI 16-013; H181X21016; NH75OT000105; 2202IDFSC6; 2101IDBCC6; B09SM083970; NH25PS005171; 4534DRIP00000001Program Year: October 1, 2021 ? September 30, 2022; October 1, 2020 ? September 30, 2021; October 1, 2021 ? September 30, 2021; May 8, 2021 ? June 30, 2022; June 28, 2021 ? June 30, 2022; July 1, 2021 ? September 30, 2022; June 1, 2021 ? May 31, 2023; October 1, 2020 ? September 30, 2025; October 1, 2020 ? September 30, 2025; March 15, 2021 ? March 14, 2023; January 1, 2019 ? December 31, 2023; May 8, 2020 ? June 30, 2022Federal Agency: Department of Agriculture; Department of Veterans Affairs; Department of Education; Health and Human Services; Department of Homeland SecurityCompliance Requirement: Code of Federal Regulations (CRF) 2 CFR 200.510(b)Questioned Costs: NoneCriteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions, and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives.Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR ?200.510(b)), which states it must include:? Total federal awards expended as determined in accordance with 2 CFR ?200.502? Total amount provided to subrecipients from each federal programAdditionally, the Office of Management and Budget (OMB) Memorandum M-20-26 instructed recipients and subrecipients to separately identify the COVID-19 Emergency Acts expenditures on the SEFA.Condition: Several assistance listings (AL) were not properly identified as COVID-19 funds on the SEFA submitted for audit. The following items were identified by the auditors and communicated to management during the audit process:? Supplemental Nutrition Assistance Program (AL Number 10.551) $38,370,588? Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises (AL Number 93.391) $3,387,573? Special Education - Grants for Infants and Families (AL Number 84.181) $265,777? Family Violence Prevention and Services/Sexual Assault/Rape Crisis Services and Supports (AL Number 93.497) $183,807? WIC Special Supplemental Nutrition Program for Women, Infants, and Children (AL Number 10.557) $1,547,158? State Administrative Matching Grants for the Supplemental Nutrition Assistance Program (AL Number 10.561) $354,983? Community-Based Child Abuse Prevention Grants (AL Number 93.590) $156,539? Block Grants for Community Mental Health Services (AL Number 93.958) $389,232? Sexually Transmitted Diseases (STD) Prevention and Control Grants (AL Number 93.977) $156,712? State Veterans Home Construction (AL Number 64.005) $1,513,996? Education Stabilization Fund - Emergency Assistance for Non-Public Schools (AL Number 84.425R) $3,145,463? Disaster Grants ? Public Assistance (Presidentially Declared Disasters) (AL Number 97.036) $146,776,143Cause: The Office has not developed procedures to ensure amounts reported by State agencies on closing packages properly identifies all funds related to COVID-19. The Office relies on State agencies to self-report federal expenditures, programs, and identify if these programs are related to COVID-19 funding through the closing package process. Current procedures do not include verifying that the COVID-19 designation is appropriately included.Additionally, review procedures did not identify an error that occurred while compiling the SEFA that did not include the COVID-19 designation for AL Number 84.425R. Internal reviews did not identify this error as this information was correctly included on the agency closing package.Effect: The SEFA submitted for audit did not properly identify $196,247,971 as COVID-19 funds on the SEFA; however, these errors have been corrected.Recommendation: We recommend that the Office implement procedures and controls to ensure funds related to the COVID-19 pandemic are properly identified on the SEFA.Management?s View: The Office agrees with this finding.Corrective Action: Since the State began receiving COVID-19 funding, we diligently provided training and resources to the agencies regarding the funding and how it should be reported on the SEFA closing package. This includes a discussion in our annual closing package training, online resources regarding COVID-19 funds, an FAQ document, and being available to discuss questions and concerns. In addition to the steps we are currently taking, we will reiterate the importance of designating COVID-19 related expenditures on the SEFA closing package during our annual closing package training. We will review STARS activity in the COVID-19 related funds and compare to the agency submitted closing packages for reasonableness. Recognizing that not all agencies utilize these specific funds, we will also review COVID-19 related expenditures on an external online source that reports federal grant expenditures. We will then use this information to compare to what is reported on agency closing packages for reasonableness.Auditor?s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit.

FINDING 2022-205An expenditure was made by the Department for unallowable activities from the Elementary and Secondary School Emergency Relief (ESSER) program.Type of Finding: Significant Deficiency, NoncomplianceAssistance Listing Title: Education Stabilization Fund - ARPA ESSER IIIAssistance Listing Number: 84.425UFederal Award Number: S425U210043Program Year: March 24, 2021 ? September 30, 2024Federal Agency: Department of EducationCompliance Requirement: Activities allowed or unallowedQuestioned Costs: Known: $2,270.65; Likely: $71,576Criteria: The Department awards and passes ESSER funds to school districts or local educational agencies (LEAs) in the State. The LEAs may use ESSER funds for a wide range of activities to address needs arising from the coronavirus pandemic. The ESSER funding is made available by the Coronavirus Aid, Relief, and Economic Security (CARES) Act, the Coronavirus Response and Relief Supplemental Appropriations (CRRSA) Act, and the American Rescue Plan (ARP) Act. The CARES Act (Section 18003 (d)) provides a broad list of LEA allowable activities. The CRRSA Act (Section 313(3)) includes additional LEA allowable uses of funds, in particular addressing learning loss; preparing schools for reopening; and testing, repairing, and upgrading projects to improve air quality in school buildings. The ARP Act (Section 2001(e)) further expands LEA allowable uses of funds to include providing mental health support, developing strategies, and implementing public health protocols on reopening and operating schools to effectively maintain the health and safety of students, educators, and staff.Condition: During our review of ESSER grant expenditures for allowable activities and costs, we selected a sample of 60 transactions to evaluate for compliance, substantive accuracy, and adequately designed and applied internal controls. We noted one transaction for $12,374.83 that included $2,270.65 for staff lunches, which are unallowable as a cost paid for by this grant.Cause: A subrecipient of the Department requested reimbursement from the ESSER grant in June 2022 for employee salaries and benefits, supplies, materials, and staff meals. Staff meals are unallowable to the ESSER grant. This unallowable activity was not identified during the Department?s review of the transaction. Department personnel reviewing and approving the reimbursement request believed that, based upon the wording in the request, the transaction was for different purposes and allowable under the ESSER grant. However, further review and inquiring to the LEA after the audit exception was identified supported that the expenditure was not allowed.Effect: The Department reimbursed unallowed costs of $2,271 which results in projected questioned costs of $71,576 for the ESSER program.Recommendation: We recommend that the Department strengthen control procedures to ensure all expenditures are allowable prior to approving reimbursement to LEAs.Management?s View: The Department agrees with this finding.Corrective Action: When the Elementary and Secondary School Emergency Relief Funds {ESSER) were first awarded, it was not required that districts attach any documentation to their Grant Reimbursement Application {GRA) requests. Federal Programs will start requiring that all requests coming in through the GRA system have supporting documentation attached as of July 1, 2023, which is the beginning of our next fiscal cycle. We will announce this new procedure through emails and during our state-wide Consolidated Federal and State Grant Application training in April and May 2023.Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We agree with the Department that it is important to provide the additional guidance received from the federal grantors to the subrecipients, we want to emphasize that it is the Department?s responsibility to ensure that only allowable costs are reimbursed to the LEAs, and to implement appropriate internal control activities, including adequate supporting documentation, to ensure compliance with this requirement.

FINDING 2022-206The Department did not complete required subrecipient monitoring of the Elementary and Secondary School Emergency Relief (ESSER) Fund of the Education Stabilization Fund.Type of Finding: Material Noncompliance, Material WeaknessAssistance Listing Title: Elementary and Secondary School Emergency Relief Fund; Emergency Assistance for Non-Public Schools; ARPA ESSER III; ARPA ESSER - Homeless Children and YouthAssistance Listing Number: 84.425D; 84.425R; 84.425U; 84.425WFederal Award Number: S425D210043; S425D200043; S425R210024; S425U210043; S425W210013Program Year: January 5, 2021 ? September 30, 2023; May 18, 2020 ? September 30, 2022; February 11, 2021 ? September 30, 2023; March 24, 2021 ? September 30, 2024; April 23, 2021 ? September 30, 2024Federal Agency: Department of EducationCompliance Requirement: Subrecipient MonitoringQuestioned Costs: NoneCriteria: The U.S. Code of Federal Regulations (CFR) 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, superseding the Office of Management and Budget (OMB) Circular A-102, Grants and Cooperative Agreements with State and Local Governments, describes the pass-through entity?s responsibility for administering necessary requirements on subrecipients so that the federal award is used in accordance with federal regulations.Specifically, 2 CFR 200.332(d) and 2 CFR 25.200 identify the requirements for the Department as the pass- through entity in providing subawards. This includes communication of certain information, such as the subrecipient?s unique entity identifier and required registration in the System for Award Management (SAM). In addition, the Department must evaluate each subrecipient?s risk of noncompliance with federal statutes and the terms and conditions of the subaward when determining the extent of subrecipient monitoring to be completed to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward, and that the subaward performance goals are achieved. In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, monitoring must include a review of financial and performance reports required by the pass-through entity, follow up on any deficiencies identified in the subrecipient that are detected through audits, on-site reviews and other means, and issuing a management decision for audit findings, as required by 2 CFR 200.521.Finally, 2 CFR 200.303 requires the Department to establish and maintain effective internal control over the federal award that provides reasonable assurance that the Department is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award.Condition: The Department initially received ESSER funding in fiscal year 2021 and integrated ESSER monitoring with the general subrecipient monitoring used for other federal programs. The Department?s 2020- 2021 Monitoring Tool included only one indicator related to the ESSER program and did not adequately address all subrecipient monitoring requirements. However, in fiscal year 2021, the Department determined that the existing monitoring procedures were not robust enough for the additional requirements associated with ESSER subrecipient monitoring and discontinued those procedures without implementing any alternative procedures during fiscal year 2022.This was a finding included in the Single Audit Report for the year ended June 30, 2021, and the Department provided a corrective action plan to monitor subrecipients. However, the Department did not implement the plan until after the audit period, in fiscal year 2023.Cause: The Department realized the current procedures were not sufficient to meet the monitoring requirements of ESSER and indicated a monitoring process specific to the ESSER program compliance requirements was being developed; however, it was not developed in a timely manner to comply with federal requirements.Effect: The Department is not in compliance with subrecipient monitoring requirements. Without adequate monitoring of subrecipients, the Department is exposed to an increased risk of making improper payments for unallowable or unsupported costs.Recommendation: We recommend that the Department implement procedures to ensure compliance with all requirements as a pass-through entity. We also recommend that the Department design and implement effective control procedures to ensure subrecipient monitoring activities are complete and appropriate.Management?s View: The Department agrees with this finding.Corrective Action: It was not until the end of the 2022 legislative session that spending authority was given to the State Department of Education to use ARP ESSER administrative funds to hire additional staff to meet the robust requirements identified by the U.S. Department of Education. Up to that point, only one full-time person was handling all of the needs associated with ESSER funds. Since then, two positions have been hired. The ESSER Data and Reporting Coordinator began in April 2022, and the ESSER Monitoring Coordinator began in June 2022. While developing the monitoring procedures began in July 2022, it was after the audit timeframe. The Department now has in place all ESSER monitoring policies and procedures and will complete year one monitoring before May 5, 2023.Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2022-207The amount reported as passed through to subrecipients on the Schedule of Expenditures of Federal Awards (SEFA) closing package was overstated by $331,500.Type of Finding: Significant DeficiencyAssistance Listing Title: Sport Fish Restoration; Wildlife Restoration and Basic Hunter EducationAssistance Listing Number: 15.605; 15.611Federal Award Number: F19AF00026; F19AF00093; F22AF00371; F14AF01014; F20AF11918; F22AF00372; F20AF11578; F21AF03374; F21AF03986; F21AF03986Program Year: January 1, 2019 ? December 31, 2021; January 1, 2019 ? December 31, 2021; January 1, 2022 ? December 31, 2024; August 1, 2014 ? June 30, 2022; July 1, 2020 ? June 30, 2021; January 1, 2022 ? December 31, 2024; July 1, 2020 ? June 30, 2021; July 1, 2021 ? June 30, 2023; July 1, 2021 ? June 30, 2022; July 1, 2021 ? June 30, 2022Federal Agency: Department of the InteriorCompliance Requirement: Code of Federal Regulations (CRF) 2 CFR 200.510(b)Questioned Costs: NoneCriteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions. It provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives.Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) 2 CFR ?200.510(b), which states it must include:? Total federal awards expended as determined in accordance with 2 CFR ?200.502, and? Total amount provided to subrecipients from each federal programCondition: The Department completed a SEFA closing package to report federal grant expenditures. The amount reported as passed through to subrecipients was overstated by a total of $331,500. The Sport Fish Restoration Program (Assistance Listing Number 15.605) payments to subrecipients were overstated by $10,513, and the Wildlife Restoration Program (Assistance Listing Number 16.611) payments to subrecipients were overstated by $320,987.Cause: The Department made payments to entities who received subawards under the grants and also provided specific vendor services for the grants. The person compiling the SEFA closing package was new to that process and included all payments to the entities as payments to subrecipients, even though some of the payments were for vendor services and should not have been included. The SEFA closing package was reviewed for accuracy prior to being submitted to the Office of the State Controller, but this review did not detect the error.Effect: The Department?s SEFA closing package overstated the amount passed through to subrecipients by $331,500. The total expenditures for the grant programs were $7,196,361 in the Sport Fish Restoration Program and $15,479,486 in the Wildlife Restoration Program. Subrecipient payments make up a small portion of the overall grant expenditures comprising $31,539 in the Sport Fish Restoration Program (0.44 percent of the total) and $520,630 in the Wildlife Restoration Program (3.36 percent of the total). The effect is limited because the trivial materiality for the statewide SEFA is $1.9 million. The Department submitted a corrected SEFA closing package to correct the error.Recommendation: We recommend that the Department design and implement procedures to ensure amounts passed through to subrecipients are accurately reported on the SEFA closing package.Management?s View: The Department has reviewed its reporting of subrecipient expenditures on the State Fiscal Year 2022 Schedule of Expenditure of Federal Awards (?SEFA?) and agrees with the finding that an overstatement was made.Corrective Action: The Department will provide additional training and update its procedural documentation to ensure that expenses are thoroughly vetted before they are reported as subrecipient expenditures on the SEFA. Each expenditure identified as a subrecipient expense will be tied back to a specific subaward, further limiting the possibility of non-subaward expenses being reported in the subrecipient portion of the SEFA. This corrective action plan will be implemented by the end of August 2023.Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2022-208State Opioid Response program performance progress reports did not have documentation to support completion of a review for accuracy and compliance prior to submission.Type of Finding: Material WeaknessAssistance Listing Title: Opioid STRAssistance Listing Number: 93.788Federal Award Number: H79TI083282; H79TI081727Program Year: September 30, 2020 ? September 29, 2023; September 30, 2018 ? September 29, 2021Federal Agency: Health and Human ServicesCompliance Requirement: ReportingQuestioned Costs: NoneCriteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award.The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties.Condition: During fiscal year 2022, the State Opioid Response program was required to submit 5 program performance reports to the grantor. A Department program specialist or project manager compiles the State Opioid Response program performance progress reports and a contract manager review and approves the reports. The approval of the performance progress reports for all five (5) reports tested under the State Opioid Response program was not documented. Department staff indicated that the approval process was verbal or through e-mails that were not retained, and we were unable to verify this process.Cause: The Department did not consider that documentation to support the review and approval of these performance progress reports was necessary to ensuring accuracy and compliance with reporting requirements.Effect: We did not identify errors in the performance progress reports we reviewed. However, without documentation of appropriate internal controls, there is an increased risk of errors occurring and going undetected, or errors being present in reports we did not review. Further, the Department could submit the performance progress reports with incomplete or inaccurate information required by the grant agreement.Recommendation: We recommend that the Department design and implement procedures to ensure sufficient documentation is maintained that supports the review and approval of the performance progress reports.Management?s View: The Department agrees with the finding.Corrective Action: Beginning April 1, 2023, all required federal reports will include the following statement, which will be signed and dated electronically by the approving reviewer before the report is submitted:? I, _______________________, have reviewed and approved this report prior to submission.Name, titleA copy of the approved and signed report will be retained in DBH?s electronic grant funding records.Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We appreciate the Department?s view that the contract manager did complete reviews to ensure accuracy, but without documentation available to the auditors at the time we are completing auditing procedures it is difficult to verify if errors were detected, if they were properly corrected, and if the final version was then reviewed again to ensure accuracy. A clear documentation trail is critical to support accurate reporting and can also provide insight into improving the process so that errors do not continue to occur.

FINDING 2022-209An annual physical inventory was not completed for all storage facilities used by subdistributing agencies for the Emergency Food Assistance Program as required by federal guidance.Type of Finding: Material Weakness, Material NoncomplianceAssistance Listing Title: Emergency Food Assistance ProgramAssistance Listing Number: 10.568Federal Award Number: 227IDID8P1103; 227IDID8Y8105; 227IDID2Q2204; 227IDID5Y8613Program Year: October 1, 2021 ? September 30, 2022; October 1, 2019 ? September 30, 2022; October 1, 2021 ? September 30, 2022; November 3, 2021 ? November 2, 2022Federal Agency: Department of AgricultureCompliance Requirement: Special Tests and ProvisionsQuestioned Costs: NoneCriteria: The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award.The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties.The Uniform Guidance included in 7 CFR 250.12(b) requires that State distributing agencies must conduct annual physical inventory of all storage facilities used by the distributing agency or the subdistirbuting agency. Such inventory must be reconciled annually with the storage facility?s inventory records and maintained on file by the agency which contracted with or maintained the storage facility.Condition: The Department staff only performed an annual physical inventory of 25 percent of the subdistributing agencies contracted with for the Emergency Food Assistance Program. Federal guidance requires that all State distributing agencies shall have an annual physical inventory and the Department currently partners with 5 subdistributing agencies. The inventory procedures have only been performed on 1 or 2 subdistributing agencies per fiscal year.Cause: The Department incorrectly interpreted the coverage requirements provided for State monitoring systems as also applicable for the physical inventory requirements related to subdistributing agencies. Those requirements are included in 7 CFR 251.10(e) and states that each State agency must monitor the operation of the program to ensure that it is being administered in accordance with Federal and State requirements. State agencies may not delegate this responsibility, and these reviews must cover at least 25 percent of all eligible recipient agencies. These reviews are separate from the guidance contained in 7 CFR 250.12(b) requiring annual physical inventory of all storage facilities.Effect: The Department did not properly design and implement internal controls to ensure compliance with the inventory requirements included in 7 CFR 250.12(b). The storage facilities not included in the annual physical inventory received commodity donations valued at $5,268,861 during the period of our audit.Recommendation: We recommend that the Department design and implement controls and procedures to ensure compliance with federal requirements covering the Emergency Food Assistance Program.Management?s View: The Department agrees with this finding.Corrective Action: With this knowledge, the Department will work with FNS to clarify requirements within the compliance supplement. If required by FNS and the compliance supplement, we will revise our control process in this program by July 2023.Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We appreciate the Department?s effort to reach out to the grantor and gain further guidance on the definition of the entities that were considered subdistributing agencies during the audit. Recognizing that an entity can be a subdistributing agency and a recipient agency, we continue to assert that inventory monitoring and compliance with the requirements in 7 CFR 250.12(b) to ensure accountability for goods at storage facilities is required by the program and was not completed at all facilities. We will re-evaluate that determination of compliance if the grantor provides definitive guidance that this is not their intent with the requirements.

FINDING 2022-210The Department did not review subrecipient application information for Coronavirus State and Local Fiscal Recovery Funds at a sufficient level to identify missing information from required documentation.Type of Finding: Significant Deficiency, NoncomplianceAssistance Listing Title: Coronavirus State and Local Fiscal Recovery FundsAssistance Listing Number: 21.027Federal Award Number: 20-1982-0-1-806Program Year: March 3, 2021 ? December 31, 2024Federal Agency: Department of TreasuryCompliance Requirement: Subrecipient MonitoringQuestioned Costs: NoneCriteria: The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award.The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective.The Uniform Guidance included in 2 CFR 200.332 describes the pass-through entities? responsibility for administering necessary requirements on subrecipients so that the federal award is used in accordance with federal regulations.In addition, 2 CFR 25.300 states that (a) a recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier and (b) a recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier, as described in paragraph (a) of this section.Condition: The Department used Coronavirus State and Local Fiscal Recovery funds to provide financial support to hospitals during the COVID-19 pandemic. The Department was responsible for distributing these funds and created a process for hospitals to apply and receive funding. During testing, we identified 2 applications out of 8 reviewed, or 25 percent, that did not have unique entity identifier numbers attached to the documentation provided for testing, as required by 2 CFR 25.300.Cause: The Department had review procedures in place, but the reviews of subrecipient application documentation failed to detect the absence of unique entity identifier numbers. This number is required as part of the subgranting process.Effect: The Department is exposed to increased risk of improper payments and noncompliance with federal requirements when applications do not meet all requirements for receiving funding.Recommendation: We recommend that the Department design and implement effective internal control procedures to ensure adequate subrecipient applications are completed accurately and in compliance with federal requirements.Management?s View: The Department agrees with this finding.Corrective Action: Corrective action is complete. Internal controls are in place as the Department procurement policy; staff are trained to check SAM.gov on all subrecipients. Additionally, internal forms needed to execute a subrecipient agreement require documentation of the Unique Identifier. If the Unique Identifier field is left blank, the Department Contracts and Procurement Unit will not process the agreement request. This finding was a result of a new process and untrained staff pulled into the rapid dispersal of COVID funds.Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2022-211The Schedule of Expenditures of Federal Awards (SEFA) closing package originally submitted to the Office of the State Controller did not properly identify COVID-19 Emergency Acts expenditures for multiple programs.Related to Prior Finding: 2021-206Type of Finding: Significant Deficiency, Noncompliance, SEFA MisstatementAssistance Listing Title: Supplemental Nutrition Assistance Program (SNAP); WIC Special Supplemental Nutrition Program for Women, Infants, and Children; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; Special Education - Grants for Infants and Families; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Community-Based Child Abuse Prevention Grants; Block Grants for Community Mental Health Services; Sexually Transmitted Diseases (STD) Prevention and Control GrantsAssistance Listing Number: 10.551; 10.557; 10.561; 84.181; 93.391; 93.497; 93.590; 93.958; 93.977Federal Award Number: 22ID35051692301; 217IDID7W7003; 227IDID7F1003; H181X21016; NH75OT000105; 2202IDFSC6; 2101IDBCC6; B09SM083970; NH25PS005171Program Year: October 1, 2021 ? September 30, 2022; October 1, 2020 ? September 30, 2021; October 1, 2021 ? September 30, 2021; July 1, 2021 ? September 30, 2022; June 1, 2021 ? May 31, 2023; October 1, 2020 ? September 30, 2025; October 1, 2020 ? September 30, 2025; March 15, 2021 ? March 14, 2023; January 1, 2019 ? December 31, 2023Federal Agency: Department of Agriculture; Department of Education; Health and Human ServicesCompliance Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b)Questioned Costs: NoneCriteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended. State agencies are required to report federal expenditures incurred for each federal program during the State fiscal year to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instructions on the completion of the closing package.The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award.The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties.The Office of Management and Budget (OMB) Memorandum 20-26, Appendix A, states that in order to provide adequate oversight of the COVID-19 Emergency Acts funding and programs, recipients and subrecipients must separately identify the COVID-19 Emergency Acts expenditures on the SEFA and audit report findings.Condition: The Department did not separately identify COVID-19 Emergency Acts related expenditures, as required by OMB Memorandum 20-26, on their SEFA submission for multiple programs. The specific programs include the following:? Supplemental Nutrition Assistance Program (Assistance Listing Number (AL) 10.551) for the amount of $38,370,588? Special Supplemental Nutrition Program for Women, Infants, and Children (AL 10.557) for the amount of $1,547,158? State Administrative Matching Grants for the Supplemental Nutrition Assistance Program (AL 10.561) for the amount of $354,983? Special Education-Grants for Infants and Families (AL 84.181) for the amount of $265,777? Activities to Support State, Tribal, Local and Territorial Health Department Response to Public Health or Healthcare Crises (AL 93.391) for the amount of $3,387,573? Family Violence Prevention and Services/Sexual Assault/Rape Crisis Services and Supports (AL 93.497) for the amount of $183,807? Community-Based Child Abuse Prevention Grants (AL 93.590) for the amount of $156,539? Block Grants For Community Mental Health Services (AL 93.958) for the amount of $389,232? Preventive Health Services-Sexually Transmitted Diseases Control Grants (AL 93.977) for the amount of $156,712The total amount of expenditures for each of the above listed programs were accurately reported; however, specific identification of COVID-19 Emergency Acts expenditures was not accurately identified.Cause: The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2022 SEFA closing package was not completed at a level of detail sufficient to properly identify COVID-19 Emergency Acts expenditures.Effect: The Department did not separately identify the COVID-19 Emergency Acts expenditures on their SEFA in order to maximize transparency and accountability. In total, $44,812,369 across 9 programs was not properly identified as COVID-19 Emergency Acts related expenditures, as required.After we identified this issue, the amounts were separated, and the COVID-19 identification was added to the programs in a subsequent submission of SEFA information.Recommendation: We recommend that the Department improve the review process for the SEFA closing package to include training and specific procedures at a level of detail sufficient to identify inaccuracies or omission of required information such as the COVID-19 Emergency Acts expenditures.Management?s View: The Department agrees with this finding but it is important to highlight that our internal controls and review processes are designed to detect and correct material inaccuracies or omissions of required information within the annual SEFA. As this does not constitute a material error, but rather a significant deficiency, the Department?s controls for this process worked as intended.Corrective Action: This corrective action plan is complete. Effective immediately, we will monitor awards for any new COVID-19 funding, but we don?t believe that there will be any new COVID-19 awards. All existing awards have been confirmed as being reported as COVID-19 funding.Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We would like to emphasize that internal controls should be designed to meet stated objectives. In this case, the objective is to provide requested information to the Office of the State Controller on closing packages that contain specific instructions, so that the Office can prepare the statewide Schedule of Expenditures of Federal Assistance (SEFA). The fact that the internal controls designed and implemented by the Department are only intended to identify material errors in the SEFA closing package significantly increases the risk that individually smaller errors will go undetected and uncorrected and potentially could result in an aggregated material misstatement. Additionally, minimalizing accuracy within reporting elements, such as the COVID-19 designation, increases the risk that these errors would go entirely undetected, even if they were material. We would also like to emphasize that including standard procedures to be alert for changing and new requirements is an important part of a strong internal control environment. While the COVID-19 funds may be in the process of being spent down, new very large programs are in process and could also have unique requirements that should be assessed.

FINDING 2022-212The Department did not maintain consistent operation of controls and compliance with Electronic Benefit Transfer (EBT) Card Security procedures for the Supplemental Nutrition Assistance Program (SNAP).Related to Prior Finding: 2021-210Type of Finding: Material Weakness, Material NoncomplianceAssistance Listing Title: Supplemental Nutrition Assistance Program (SNAP); State Administrative Matching Grants for the Supplemental Nutrition Assistance ProgramAssistance Listing Number: 10.551; 10.561Federal Award Number: 22ID35051692301; 227IDID4S2514; 227IDID5Q3903; 227IDID6F1003; 227IDID4S2519; 227IDID4S2520; 227IDID4Q7503Program Year: October 1, 2021 ? September 30, 2022; October 1, 2021 ? September 30, 2022; October 1, 2021 ? September 30, 2023; October 1, 2021 ? September 30, 2022; October 1, 2021 ? September 30, 2022; October 1, 2021 ? September 30, 2022; October 1, 2021 ? September 30, 2022Federal Agency: Department of AgricultureCompliance Requirement: Special Tests and ProvisionsQuestioned Costs: NoneCriteria: The Department is required to maintain adequate security over, and documentation/records for, EBT cards to prevent their theft, embezzlement, loss, damage, destruction, unauthorized transfer, negotiation, or use (7 CFR section 274.8(b)(3)).Further, 7 CFR 274.5(c) states that an EBT Card is considered an accountable document. The State agency is required, at minimum, to provide the following security and control procedures relating to these documents:? Secure storage,? Access limited to authorized personnel,? Bulk inventory control records,? Subsequent control records maintained through the point of issuance or use, and? Periodic review and validation of inventory controls and records by parties not otherwise involved in maintaining control records.The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award.The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective.Condition: The Department utilizes 19 field offices spread over 7 regions for distribution of EBT cards. Each office is required monthly to complete logbooks that include the Idaho Issuance Log for Blank EBT Cards, Destruction Log for EBT Cards, Card Usage Report, and the Month End EBT Card Count. The monthly records are reviewed by an EBT specialist to determine inventory accuracy and that cards are being tracked correctly.As part of implementing the corrective action plan for Finding 2021-210 from the State of Idaho Single Audit for fiscal year 2021, the Department?s EBT supervisor began reviewing the EBT specialist?s reviews of monthly records on a quarterly basis. However, the EBT supervisor?s quarterly reviews for fiscal year 2022 did not begin until September 2022, which is in fiscal year 2023.During our review, we identified 7 instances out of a sample of 25 months, or 28 percent, in which we could not verify that the EBT specialist?s review of monthly records was either documented or completed at a sufficient level to identify errors or omissions.Cause: The reviews of some office logs and reports by an EBT specialist were not documented or completed. Additionally, the supervisory oversight of the EBT specialist was not completed at a level sufficient to identify the lack of documentation or ensure completion of the required reviews. The Department began implementing a corrective action plan to address the Finding 2021-210 issued in April 2022, but changes in control procedures were not implemented during our audit period.Effect: The lack of proper card security and inventory monitoring increases the risk of improper EBT card distribution and management. Without effective internal controls in operation, there is also an increased potential for further noncompliance with federal requirements.Recommendation: We recommend that the Department continue to improve oversight regarding the regional offices and supplement internal controls and documentation to ensure compliance with the EBT security requirements.Management?s View: The Department agrees with the finding.Corrective Action: Immediately upon receiving the audit finding in March 2022, staff reviewed and revised procedures and fully implemented a corrective action plan by June 30, 2022. The entire EBT team was trained on the bulk card ordering and issuing process and modified security procedures to mitigate the risk of non-compliance in the future. The bulk card managers in the field offices review and reconcile card issuances monthly. Also, the EBT Supervisor documents the review of the previous quarter?s electronic card audits for accuracy and completeness.Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2021-201 The Schedule of Expenditures of Federal Awards (SEFA) was understated by $276,989,930 for amounts reported as provided to subrecipients. Type of Finding: Material Weakness, SEFA Misstatement Assistance Listing Title: Coronavirus Relief Fund, Emergency Rental Assistance Program, Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 21.019; 21.023; 97.036 Federal Award Number: SLT0074, SLT0030; ERA-0010; FEMA-4252_DR-ID; FEMA-4310-DR-ID; FEMA-4313-DR-ID; FEMA-4333-DR-ID; FEMA-4342-DR-ID; FEMA-4443-DR-ID; FEMA 4534-DR-ID; FEMA-4589-DR-ID Program Year: March 1, 2020 to December 31, 2021; January 14, 2021 to September 30, 2022; December 16, 2015 to December 2019; December 16, 2015 to December 2019; March 6, 2017 to March 2021; May 6, 2017 to May 2021; March 29, 2017 to March 2021; April 7, 2019 to April 2023; January 20, 2020 to Ongoing; January 13, 2021 to January 2025 Federal Agency: Department of Treasury; Department of Homeland Security Compliance Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions. It provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relates to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR ?200.510(b)), which states it must include: ? Total federal awards expended as determined in accordance with 2 CFR ?200.502, and ? Total amount provided to subrecipients from each federal program. In addition, the AICPA Audit and Accounting Guide Governmental Auditing Standards and Single Audit section 6.15 discusses circumstances in which it is appropriate for entity-wide financial statements to include departments, agencies, and other organizational units that have separate audits and prepare separate financial statements who are then excluded from the entity?s Uniform Guidance compliance audit and SEFA because a separate Uniform Guidance compliance audit was conducted for those departments, agencies, or other organizational units. An auditee is defined in 2 CFR 200.1 as any nonfederal entity that expends federal awards which must be audited under subpart F of the Uniform Guidance. 2 CFR 200.501 indicates a single audit must be completed for a nonfederal entity that expends federal awards of $750,000 or more during the fiscal year in accordance with 2 CFR 200.514. Condition: Amounts passed through to subrecipients was understated by $276,989,930 on the SEFA draft provided to auditors. ? The largest error was for Assistance Listing Number 21.019, Coronavirus Relief Fund (CRF) program, this program was understated by $226,571,766. ? Assistance Listing Number 97.036, Disaster Grants program, under reported subrecipient payments by $11,202,585. ? Finally, amounts passed through to colleges and universities and the Idaho Housing and Finance Association were not included in the subrecipient total. The total understatement from this error was $39,215,579. Cause: Each year, State agencies report the total of federal awards expended on closing package. The SCO uses these closing packages to compile the SEFA. Funds for the CRF program were initially received by the Office of the Governor, these funds were then sent to various State agencies. These State agencies then passed on some of the funds to subrecipients. When the State agencies submitted their SEFA closing packages, the amounts reported for the CRF program were eliminated between the State agencies to avoid double counting total expenditures for the CRF program. This elimination process did not account for the funds the State agencies subgranted but which should have been reported as passed through to subrecipients. Routinely, State agencies will submit revised closing packages. If this has occurred after a closing package has been closed by the SCO, the review process for these changes will occur once the SEFA has been drafted. These review procedures did not detect an error on the statewide SEFA for Assistance Listing Number 97.036, Disaster Grants, when the amount provided to subrecipients was revised on the agency closing package to be $11,202,585. Additionally, the Office was not aware that agencies receiving their own single audit that are included in the statewide Annual Comprehensive Financial Report (ACFR), but who are excluded from the statewide SEFA, should be considered subrecipients. Effect: The SEFA submitted for audit included an understatement of $$276,989,930 for the amount passed through to subrecipients. The amount in error was just below our materiality threshold and was corrected on the final SEFA submission. Recommendation: We recommend that the Office design and implement procedures to ensure amounts subgranted are correctly reported to ensure complete and accurate compliance with federal reporting requirements. Management?s View: The Office agrees with this finding. Errors identified were corrected before publishing the Single Audit. We are in the process of developing an internal review checklist for SEFA compliance. The checklist will outline compliance requirements associated with the preparation of the SEFA (i.e., subrecipient reporting), identify areas that are a higher risk for error, and what to look for when reviewing higher risk areas. This checklist will be completed by the preparer of the SEFA, as well as by the reviewer(s) to ensure the SEFA is accurate and in compliance with Uniform Guidance requirements. Auditor?s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-202 The Board underreported federal expenditures by $11,316,783 across three federal programs when completing the Schedule of Expenditures of Federal Awards (SEFA). Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus Relief Fund; Governor's Emergency Education Relief Fund; Gaining Early Awareness and Readiness for Undergraduate Programs Assistance Listing Number: 21.019; 84.425C; 84.334S Federal Award Number: SLT0074; SLT0030; S425C00043; P334S180012 Program Year: June 2, 2020 - September 30, 2021; October 1, 2018 - September 30, 2022 Federal Agency: Department of Treasury; Department of Education Compliance Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In addition, 2 CFR 200.510 requires the State to prepare a SEFA, which must include the total federal awards expended for each individual federal program. The Office of the State Controller (Office) requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: During our review, we noted discrepancies between the Board?s fiscal year 2021 SEFA closing package and the underlying STARS data. The Board expended funds from three federal programs in fiscal year 2021: ? Governor?s Emergency Education Relief (GEER) Fund, Assistance Listing (AL) 84.425C ? Coronavirus Relief Fund (CRF), AL 21.019 ? Gaining Early Awareness and Readiness for Undergraduate programs (GEAR UP), AL 84.334S The SEFA reported $0 expenditures to subrecipients for the GEER (AL 84.425C) and CRF (AL 21.019) programs. However, based on our review, GEER (AL 84.425C) had $11,178,679 and CRF (AL 21.019) had $121,454 in subrecipient expenditures. The SEFA also reported $3,323,363 in expenditures for GEAR UP (AL 84.334S). Based on our review, the amount reported should have been $3,340,013. This is a $16,650 difference. It was further noted that the GEAR UP prior fiscal year 2020 expenditures was understated by $2,277 when compared to the prior year SEFA. Cause: The SEFA compilation process included a review by a staff member independent of the staff member completing the work. The compilation and review procedures were not completed with enough attention to detail to detect the errors on the SEFA. The SEFA closing package instructions were not completely understood as to which amounts were reported in each column of the closing package. Board staff thought that reporting subrecipient amounts in both the federal award and subrecipient columns would double count the expenditures. The Board also unintentionally excluded a portion of federal expenditures related to $16,650 in personnel costs. Effect: The SEFA amounts were understated by the following: ? GEER (AL 84.425C) understated expenditures to subrecipients by $11,178,679 ? CRF (AL 21.019) understated expenditures to subrecipients by $121,454 ? GEAR UP (AL 84.334S) understated fiscal years 2021 and 2020 expenditures by $16,650 and $2,277, respectively Recommendation: We recommend that the Board strengthen internal controls to ensure federal funds are accurately and properly reported on the SEFA. Management?s View: We reported these funds in two out of three places in the Schedule of Expenditures of Federal Awards (SEFA) worksheet submitted to the State Controller?s Office (SCO). The first place was on the SEFA tab in column 13, and the second place was in the Subrecipients tab, which shows each subrecipient and totals by CFDA number. The information in the Subrecipients tab was listed by CFDA. While there was no subtotal by CFDA in the Subrecipients tab, the CFDA numbers do total to the same total shown in column 13. We did not include these totals in column 18 because we were under the impression SCO would obtain the necessary information from the Subrecipients tab. While we did include the necessary information for SCO to report the amount of 2021 Federal Expenditures to Subrecipients to the federal government in their statewide SEFA report, we acknowledge that we did not follow the explicit instructions of the SEFA worksheet, which would have resulted in reporting the amount of subrecipient expenditures in column 18. Corrective Action Plan Include required dollar amounts in all three locations in the worksheet. Auditor?s Concluding Remarks: We thank the Board for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-203 Internal controls over the review of Federal Funding Accountability and Transparency Act (FFATA) reports under the Governor?s Emergency Education Relief (GEER) Fund are not sufficiently documented. Type of Finding: Significant Deficiency Assistance Listing Title: Governor's Emergency Education Relief Fund Assistance Listing Number: 84.425C Federal Award Number: S425C00043 Program Year: June 2, 2020 ? September 30, 2021 Federal Agency: Department of Education Compliance Requirement: Reporting Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The FFATA was developed to provide better transparency over management of federal grants and contracts. Reporting is required on allocations of $30,000 through the FFATA website. The Board passes funds to subrecipients and reports on each subrecipient award. The financial manager completes the FFATA report based on information obtained from the subrecipient award documents. The reports are then reviewed by the chief financial officer. However, the approval is communicated verbally and no documented evidence is retained. Cause: The Board was unaware of the requirement to retain documentation of the review over the FFATA reports. In addition, the Board?s internal control procedures were not designed to include a secondary review of the information submitted on the FFATA reports. Effect: Audit procedures found no errors; however, without documentation of appropriate internal controls, there is an increased risk of errors occurring and going undetected. Further, the Board could submit FFATA reports with incomplete or inaccurate information required by the grant agreement. Recommendation: We recommend that the Board design and implement well-documented internal control procedures to ensure accurate and timely FFATA reports. Management?s View: We have robust internal controls for many of our financial and risk assessment processes by way of operationalizing SCO?s Financial Management Controls Checklists. We will ensure similar diligence is applied to federal funding as our corrective action. Auditor?s Concluding Remarks: We thank the Board for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-204 The Department did not complete subrecipient monitoring of the Elementary and Secondary School Emergency Relief (ESSER) Fund. Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Elementary and Secondary School Emergency Relief Fund Assistance Listing Number: 84.425D Federal Award Number: S425D210043 (ESSER II); S425D200043 (ESSER I) Program Year: January 5, 2021 ? September 30, 2022; May 18, 2020 ? September 30, 2021 Federal Agency: Department of Education Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, superseding the Office of Management and Budget (OMB) Circular A-102, Grants and Cooperative Agreements with State and Local Governments, describes the pass-through entity?s responsibility for administering necessary requirements on subrecipients so that the federal award is used in accordance with federal regulations. Specifically, 2 CFR 200.332(d) and 2 CFR 25.200 identify the requirements for the Department as the pass-through entity in providing subawards. This includes communication of certain information, such as the subrecipient?s unique entity identifier and required registration in the System for Award Management (SAM). In addition, the Department must evaluate each subrecipient?s risk of noncompliance with federal statutes and the terms and conditions of the subaward when determining the extent of subrecipient monitoring to be completed to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward, and that the subaward performance goals are achieved. In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, monitoring must include a review of financial and performance reports required by the pass-through entity, follow up on any deficiencies identified in the subrecipient that are detected through audits, on-site reviews, and other means, and issuing a management decision for audit findings, as required by 2 CFR 200.521. Finally, 2 CFR 200.303 requires the Department to establish and maintain effective internal control over the federal award that provides reasonable assurance that the Department is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Department initially integrated ESSER monitoring with the general subrecipient monitoring for other federal programs. The Department?s 2020-2021 Monitoring Tool included one indicator related to the ESSER program. The Department also monitors financial activity when reimbursement requests are submitted to ensure funds are used for allowable activities and that expenditures include the appropriate level of support. However, the Department determined that the existing procedures were not robust enough for the additional requirements associated with ESSER subrecipient monitoring and discontinued those procedures without implementing any additional procedures. Cause: The Department realized the current procedures were not sufficient to meet the monitoring requirements of ESSER and indicated they are developing a monitoring process specific to the ESSER program compliance requirements but did not complete it during the audit period. Effect: The Department is not in compliance with subrecipient monitoring requirements. Without adequate monitoring of subrecipients, the Department is exposed to an increased risk of expending funds for unallowable or unsupported costs. Recommendation: We recommend that the Department implement procedures to ensure compliance with all requirements as a pass-through entity. We also recommend that the Department design and implement effective control procedures to ensure subrecipient monitoring activities are complete and appropriate. Management?s View: The impact of the COVID-19 pandemic has significantly disrupted K-12 operations since spring 2020. Idaho was short on resources from the beginning, as we were all caught off guard with the immediate and on-going challenges related to COVID-19, the laws that followed the President?s emergency declaration, and the influx of funds to keep students and staff healthy and in school. After the initial closure in spring of 2020, all of Idaho?s schools have remained open except for temporary closures resulting from a surge in cases. The resource constraints we experienced from the outset of the pandemic became clearer after each ESSER allocation was made through the CARES Act, the CRRSA Act, and the ARP ESSER. All states were experiencing similar challenges, but most states had immediate access to administrative dollars to begin addressing requirements earlier. It wasn?t until the end of the 2022 legislative session, that the Superintendent was given approval and spending authority to use ARP ESSER administrative funds to hire additional staff to meet the robust requirements identified by the U.S. Department of Education. Since then, interviews have been conducted and two positions hired beginning in April. One of those positions is an ESSER Monitoring coordinator position. Staff are working with the Education Northwest Comprehensive Center #17 (technical assistance arm of the U.S. Department of Education) on an ESSER monitoring process and timeline. ESSER monitoring will consist of a fiscal section similar to ESEA and a program section that tracks baseline measures and outcome data three times a year on interventions to address the academic impact of lost instructional time and interventions to address social, emotional, and mental health needs of students. Data from the program tracking will be collected annually. A comprehensive desk review will be conducted at least once for each LEA with a self-assessment required in the off years. Monitoring the ARP Homeless Children & Youth (HCY) will also be incorporated into the ESSER monitoring process. ESSER monitoring will begin this spring prior to the 2021-2022 school year ending and continue through spring of 2025 as required by the U.S. Department of Education. Auditor?s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-205 Quarterly Financial Progress Reports for the Coronavirus Relief Fund (CRF) contained inaccuracies. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Coronavirus Relief Fund Assistance Listing Number: 21.019 Federal Award Number: SLT0074, SLT0030 Program Year: March 1, 2020 to December 31, 2021 Federal Agency: Department of Treasury Compliance Requirement: Reporting Questioned Costs: None Criteria: The Uniform Guidance given in the U.S. Code of Federal Regulations (CFR) 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The CRF grant award from the U.S. Treasury Department requires prime recipients to provide quarterly Financial Progress Reports that contain COVID-19 related costs incurred during the covered period to the Treasury Office of Inspector General using the Grant Solutions portal. The prime recipient?s quarterly Financial Progress Report submissions should be supported by the data in the prime recipient?s accounting system. Condition: We tested two of the four quarterly reports submitted during fiscal year 2021. We identified inconsistencies in both reports. The SCO has been delegated the responsibility to complete these quarterly reports and reported current quarter amount expenditures for the quarter ending March 31, 2021 of $408,265,322; however, the underlying accounting data in STARS reported CRF expenditures of $402,489,844. In reviewing the SCO?s supporting documentation, we noted the following errors: ? $3,064,836 was incorrectly excluded for Municipal Small Business Grants. These expenditures were identified as CRF expenditures in the STARS data. ? $10,000,000 was incorrectly included, this was a transfer of funds to the Idaho Housing and Finance Association for the Emergency Rental Assistance program. ? $1,334,529 was incorrectly excluded for funds reimbursed to the Division of Military. These expenditures were identified as CRF expenditures in the STARS data. For the quarterly report ending on June 30, 2021, a transfer of funds back to the Office incorrectly reduced the amount of current quarter CRF expenditures by $468,853. Additionally, cumulative expenditures reported for the quarter ending on June 30, 2021 were $1,100,990,248. We identified CRF expenditures in STARS of $1,098,623,833 leaving a discrepancy of $2,366,415. Cause: The SCO?s procedures and controls were insufficient to prevent and detect errors in the required quarterly reporting. Effect: Current quarter expenditures for the quarterly report ending March 31, 2021 were overstated by $5,775,478. Current quarter expenditures for the quarterly report ending June 30, 2021 were understated by $468,853. Cumulative expenditures were overstated for quarterly report ending June 30, 2021 by $2,366,415. These errors exceed our threshold of $368,263, below which errors are deemed to be inconsequential. Errors remain well below our compliance materiality threshold of $36,826,328. Without effective internal controls in place, the Office continues to risk incorrect amounts being reported that may be material to the accuracy or the financial statement. Recommendation: We recommend that the Office and the SCO design and implement internal s controls to ensure accurate quarterly reporting. Management?s View: We agree that the Finance Progress Report submissions tested by your office were not accurately supported by financial data within STARS. The corrective action plan includes making appropriate adjustments in the Finance Progress Report for the quarter ending March 31, 2022, to remove and add incorrectly included and excluded amounts. This will correct the cumulative total amount of expenditures reported for fiscal year 2021. Our office will coordinate more closely with DFM to ensure all applicable expenses are accurately reported on future progress reports. Auditor?s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-206 The original Schedule of Expenditures of Federal Awards submitted to the Office of the State Controller reported a total of $104.9 million to an incorrect Assistance Listing number and understatements totaling $71 million of pass-through amounts to subrecipients. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus Relief Fund Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 21.019; 97.036 Federal Award Number: SLT0074; SLT0030; FEMA-4252-DR-ID; FEMA-4310-DR-ID; FEMA-4313-DR-ID; FEMA-4333-DR-ID; FEMA-4342-DR-ID; FEMA-4443-DR-ID; FEMA 4534-DR-ID; FEMA-4589-DR-ID Program Year: March 1, 2020 to December 31, 2021; December 16, 2015 to December 2019; December 16, 2015 to December 2019; March 6, 2017 to March 2021; May 6, 2017 to May 2021; March 29, 2017 to March 2021; April 7, 2019 to April 2023; January 20, 2020 to Ongoing; January 13, 2021 to January 2025 Federal Agency: Department of Treasury; Department of Homeland Security Compliance Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended. State agencies are required to report federal expenditures incurred for each federal program during the State fiscal year to the Office of the State Controller (SCO) through the SEFA closing package. The SCO provides instructions on the completion of the closing package. Those instructions indicate that agencies should complete the SEFA closing package if the agency received and expended any direct or subrecipient federal awards during the fiscal year. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Coronavirus Relief Fund federal expenditures totaling $104.9 million was incorrectly reported under the Assistance Listing (AL) number 21.027 (Coronavirus State and Local Fiscal Recovery Funds) instead of 21.019 (Coronavirus Relief Fund) on the original SEFA that was submitted on August 24, 2021. Further, the amount on the original SEFA for the Coronavirus Relief Fund was understated by $26,000. Additionally, the total federal expenditures reported as pass through to subrecipients for fiscal year 2021 was originally understated by $71 million. The amount of expenditures to pass through to subrecipients on the original SEFA closing package was reported as $106 million and $177 million on a revised SEFA submission. The $71 million was an aggregate of $60 million from the Coronavirus Relief Fund and $11 million from the Disaster Grants - Public Assistance (Presidentially Declared Disasters) program. In a subsequent iteration of the SEFA, it was determined that the expenditures reported as pass through to subrecipients for the Coronavirus Relief Fund should have only been $58.3 million as $1.7 million in payments to a contractor were erroneously accounted for as payments to a subrecipient. Cause: While the internal controls over the review of the fiscal year 2021 SEFA closing packages functioned, the review was not completed at a level of detail sufficient to identify inaccuracies in the AL number and reported pass-through amounts to subrecipient expenditures on the original version of the SEFA. Effect: The original SEFA amounts provided to the SCO included a $104.9 million overstatement for the Coronavirus State and Local Fiscal Recovery Funds program and a corresponding $104.9 million understatement of the Coronavirus Relief Fund program. Additionally, federal expenditures reported as pass-through to subrecipients were originally understated by $71 million. The amounts were corrected in a subsequent submission of SEFA information. Recommendation: We recommend that the Department improve the review process for the SEFA to included procedures at a level of detail sufficient to identify inaccuracies. Management?s View: The Department agrees with the finding. The Department has acknowledged the risk around this area and had already planned to implement a new process where the SEFA closing package would be prepared by the Cash and Grants Supervisor and reviewed in detail by the Financial Manager ? Cash, Grants, and Revenue Operations. The Financial Executive Officer would still be responsible for final review and submission of the closing package. Unfortunately, as a result of staffing shortages and a significantly increased workload related to COVID-19 funding and reporting requirements, the Department had to make some concessions based on risks in many aspects of the business ? one such concession was to not implement the more detailed review process for SFY21 SEFA preparation and rely on the previously implemented controls. The Department intends to move forward with the implementation of the previously planned enhanced review procedures in the coming year. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We feel it is important to point out that the circumstances described by the Department in their response are exactly why it is so important to ensure appropriate internal controls are properly designed, in place, and consistently executed to ensure that reporting requirements are met. Staffing shortages are an often unavoidable situation, especially as part of the challenges presented by the COVID-19 pandemic. The Department made a conscious decision to abandon a critical, annually performed, internal control over the reporting of approximately $3.2 billion on the SEFA as a solution to that problem, and state that it was done as part of a risk based approach, is a misuse of the risk-assessment process. If properly implemented and consistently performed, the enhanced review procedures described in the corrective action plan should address the concern.

FINDING 2021-207 The Department did not complete periodic audits for the Managed Care Organizations in the Medicaid program to ensure accuracy, truthfulness, and completeness of the encounter and financial data submitted. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII); Medicare Medical Assistance Program (Medicaid; Title XIX) Assistance Listing Number: 93.777, 93.778 Federal Award Number: 2005ID5028; 2005ID5MAP; 2005ID5ADM; 2005IDINCT; 2005IDIMPL; 2105ID5MAP; 2105ID5ADM; 2105IDINCT; 2105IDIMPL Program Year: October 1, 2019 to March 31, 2021; October 1, 2020 to December 31, 2020; October 1, 2020 to December 31, 2021; January 1, 2021 to March 31, 2022 Federal Agency: Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 42 CFR 438.602(e) states, effective no later than for rating periods for contracts starting on or after July 1, 2017, that the State must periodically, but no less frequently than once every three years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by or on behalf of each Managed Care Organization (MCO), Prepaid Inpatient Health Plan, and Prepaid Ambulatory Health Plan and post the results of these audits on its website. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Condition: Each MCO is required to receive a periodic audit no less frequently than every three years for contracts with rating periods on or after July 1, 2017. We noted one MCO with a contract where rating periods were dated July 1, 2017, to June 30, 2019, resulting in a required periodic audit on or before June 30, 2021. The periodic audit is anticipated to be completed in June 2022. The Department did not implement internal controls to ensure that the periodic audits were completed and published on the Department website. The three remaining MCOs were not required to receive a periodic audit during the audit period under review. Cause: The Department began the process of engaging an independent firm to complete the audit work in March 2020; however, the Department did not complete that process and does not have procedures in place to ensure the periodic audit was completed in the required timeframe. Effect: The independent periodic audits of encounter and financial data submitted by each MCO are critical to ensuring information submitted by the MCO is accurate, truthful, and complete for encounter and financial data. Recommendation: We recommend that the Department conduct, or contract for the conduct of, periodic audits of MCOs no less frequently than once every three years to ensure the accuracy, truthfulness, and completeness of the encounter and financial data submitted by or on behalf of each MCO. Management?s View: The Department agrees with this finding. The Division of Medicaid is currently conducting the reviews of encounter data and financial information for the IBHP, Idaho Duals and MCNA Dental. The IBHP review will be completed by June 30, 2022. Idaho Duals and MCNA Dental are to follow during the 2023 state fiscal year. The Division of Medicaid requested ongoing funding to perform these reviews for applicable managed care plans during the 2022 budget cycle. This budget was approved and the appropriation was utilized during SFY2022. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-208 The Department utilized the incorrect National Correct Coding Initiative (NCCI) edit files in processing Medicaid payments that could result in improper payments because of outdated payment rates for procedures, changes in procedures allowed by Medicaid, and other changes to the edit files. Related to Prior Finding: 2020-210 Type of Finding: Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII); Medicare Medical Assistance Program (Medicaid; Title XIX) Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2005ID5028; 2005ID5MAP; 2005ID5ADM; 2005IDINCT; 2005IDIMPL; 2105ID5MAP; 2105ID5ADM; 2105IDINCT; 2105IDIMPL Program Year: October 1, 2019 to March 31, 2021; October 1, 2020 to December 31, 2020; October 1, 2020 to December 31, 2021; January 1, 2021 to March 31, 2022 Federal Agency: Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The Department is required to incorporate NCCI methodologies into the State Medicaid programs pursuant to the requirements of Section 6507 of the Affordable Care Act, section 1903(r) of the Social Security Act. The Medicaid Technical Guidance Manual 2020 section 7.0 requires the Department to download the NCCI edit files that are available through the Medicaid Integrity Institute (MII), a division of the Centers for Medicare and Medicaid Services (CMS), using a secure portal (RISSNET). The publicly available files located on the Medicaid NCCI webpage are not for use by states. Access to the complete quarterly NCCI edit files available through MII?s RISSNET portal is limited to a state?s Medicaid agency. These state-only NCCI edit files contain information that is not included in the publically available NCCI edit files, medically unlikely edits (MUE) that are no longer in effect, MUE effective dates and deletion dates, current MUE effective dates, and Correspondence Language Identification Number (CLEID) for procedure-to-procedure (PTP) edits. Condition: In paying Medicaid claims, the Department is required to implement NCCI methodologies to ensure that only proper payments of procedures are reimbursed. The Department is also required to download the correct quarterly edit files from the Medicaid Integrity Institute. Audit procedures included inquiries of Medicaid program personnel to ascertain if appropriate NCCI procedures were implemented. The Department contracted with DXC Technology Services for the processing of the NCCI edit files. DXC Technology Services contracted with Context 4 to receive the NCCI edit files. Inquiries found that the files received by Context 4 were the publically available edit files and not the state Medicaid agency edit files available through Medicaid Integrity Institute and the RISSNET portal, as required by the Medicaid Technical Guidance Manual. Gainwell Technologies purchased DXC Technology Services in October 2020 and took over existing contracts and agreements in place at the time, including the contract with Context 4. The Department began working with Gainwell Technologies in February 2021 with a goal to implement the appropriate edit files by July 1, 2021. The development of a procedure for data file transfers took longer than anticipated. Additionally, the Department and Gainwell were required to prioritize other projects and noncompliance continued through fiscal year 2021. The Department planned to complete a review of the payments to determine if any improper payments were made during the time when the incorrect NCCI edit file was in place, as recommended for fiscal year 2020, but that review has yet to be completed. The Medicaid Technical Guidance Manual was updated in February 2021 and the correct edit files were implemented in November 2021. Cause: The Department did not have procedures in place to ensure the correct NCCI edit file was utilized. The current contracts in place do not require or specify the use of the NCCI edit files available through the Medicaid Integrity Institute. Further, the Department was not aware that the contractor was using the incorrect NCCI edit files and not obtaining the correct edit file through Medicaid Integrity Institute using the RISSNET portal. Effect: Despite no improper payments being identified during audit testing procedures, the Department?s use of the public NCCI edit files, instead of the state Medicaid agency edit files, could lead to incorrect payment edits being processed and creating improper payments. Recommendation: We continue to recommend that the Department review payments processed under the incorrect NCCI edit files during fiscal year 2020 and 2021 to identify any incorrect payments. Management?s View: The Department partially agrees with this finding and recommendation. The state downloaded the RISSNET NCCI edit files and delivered to Gainwell Technologies for claims processing on November 18, 2021. Gainwell Technologies determined they can load the files directly and no longer need to involve their sub vendor, Context4. As of December 2021, the state setup a quarterly schedule with Gainwell Technologies to deliver the RISSNET NCCI edit files. The State is downloading the correct NCCI file from RISSNET and delivering it to the vendor, Gainwell Technologies, each quarter and it has been incorporated into claims processing. LSO has recommended review of payments processed under the incorrect NCCI edit files during fiscal years 2020 and 2021 to identify any incorrect payments. Upon further analysis, it has been determined that it is not feasible to conduct such a review. Medicaid NCCI files from those timeframes are not available from RISSNET to download and use. Medicaid is unable to obtain the information necessary to conduct such an analysis. Medicaid is conducting analysis of the current RISSNET NCCI file against the publicly available NCCI file to determine any differences between the two files. That analysis is in progress with an expected completion date of April 30, 2022. Once the analysis is complete, Medicaid will have a better idea if there are major differences between the two files that could potentially need to be addressed in the past. However, Medicaid does not have access to the historical files for a direct comparison. There are two main barriers to applying the RISSNET NCCI edits to SFY20 and SFY21 claims as recommended by LSO: the files for those timeframes are not available to Medicaid to use, and it would be not practical to reprocess every claim from SFY20 through the current date. This would impose an administrative and communication burden on both the State and the Medicaid provider community. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We are concerned that the proper edit files were not distributed to the contractor and properly included in the MES until seven months after we issued finding 2020-210 as part of the Single Audit Report for state fiscal year 2020, and five months after the date they indicated they would complete corrective action for the finding. Additionally, no analysis was performed to determine the impact of using the publicly available edit files instead of the required edit files. NCCI edit files available on the RISSNET secure portal contain additional information necessary for correct claims processing by the Department. As stated in the guidance from the Centers for Medicare and Medicaid Services (CMS) regarding NCCI edit files, the Department?s use of the publicly available files that do not contain edit history may result in improper payment or inappropriate denials. The public files do not contain the Correspondence Language Example Identifiers (CLEID) contained in the files on the RISSNET secure portal. CLEIDs support the rationale for each edit during the claims processing and adjudication process. While we understand the barriers to accessing prior edit files, we continue to assert that this is an important aspect of compliance, and encourage the Department to work with federal grantors to access the prior edit files so an analysis can be completed to ensure the minimization of improper payments, inappropriate denials, or paid claims at improper payment rates.

FINDING 2021-209 Confidentiality agreements in place with Medicaid contractors did not include all required elements to ensure compliance with the Medicaid program. Related to Prior Finding: 2020-211 Type of Finding: Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII); Medicare Medical Assistance Program (Medicaid; Title XIX) Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2005ID5028; 2005ID5MAP; 2005ID5ADM; 2005IDINCT; 2005IDIMPL; 2105ID5MAP; 2105ID5ADM; 2105IDINCT; 2105IDIMPL Program Year: October 1, 2019 to March 31, 2021; October 1, 2020 to December 31, 2020; October 1, 2020 to December 31, 2021; January 1, 2021 to March 31, 2022 Federal Agency: Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The Medicaid Technical Guidance Manual 2020 Section 7.1.2 requires that the following elements be included in the confidentiality agreements for any contracted party using the Medicaid NCCI files posted on the MII: ? Disclosure shall be limited to only those responsible for the implementation of the quarterly state Medicaid NCCI edit files. Disclosure shall not be made prior to the start of the new calendar quarter. ? After the start of the new calendar quarter, a Contracted Party may disclose only non-confidential information contained in the Medicaid NCCI edit files that is also available to the general public found on the Medicaid NCCI webpage. ? The Contracted Party agrees to use any non-public information from the quarterly state Medicaid NCCI edit files only for any business purposes directly related to the implementation of the Medicaid NCCI methodologies in the particular state. ? New, revised, or deleted Medicaid NCCI edits shall not be published or otherwise shared with individuals, medical societies, or any other entities unless it is a Contracted Party prior to the posting of the Medicaid NCCI edits on the Medicaid NCCI webpage. ? Implementation of New, revised, or deleted Medicaid NCCI edits shall not occur prior to the first day of the calendar quarter. ? Only a state Medicaid agency has the discretion to release additional information for selected individual edits or limited ranges of edits from the files posted on the MII. ? State Medicaid agencies must impose penalties, up to and including loss of contract, for violations of any confidentiality agreement relating to use of the MII edit files. Condition: The Department has a confidentiality agreement with DXC Technology Services; however, there was not a separate confidentiality agreement with Context 4, with whom DXC Technology Services contracts. In addition, the confidentiality agreement in place with DXC Technology Services does not include all the required elements per the Technical Guidance Manual. The Department began working with Gainwell Technologies in February 2021 with a goal to implement the appropriate edit files and sign the required confidentiality agreement by July 1, 2021. The development of a procedure for data file transfers too longer than anticipated. Additionally, the Department and Gainwell were required to prioritize other projects and noncompliance continued through fiscal year 2021. The Medicaid Technical Guidance Manual was updated in February 2021 and the correct edit files were implemented and a confidentiality agreement was signed in November 2021. Cause: The Department did not have procedures in place to ensure confidentiality agreements included all of the elements required by the Medicaid Technical Guidance Manual 2020. Further, the Department was not aware of the confidentiality agreement requirements for contracted parties working with the NCCI edit files. Effect: Without all parties understanding and agreeing to the required confidentiality agreement components, confidential Medicaid NCCI edit file data could be improperly released. Recommendation: We recommend that the Department ensure that confidentiality agreements are in place with the required parties and that the agreements contain all of the necessary components. Management?s View: The Department agrees with this finding. Vendor confidentiality agreement was executed with Gainwell Technologies on November 12, 2021. This agreement met all the required elements. As a result of the change of the State providing the NCCI edit file instead of Context 4, Context 4 no longer has a role in Medicaid NCCI editing and is not considered a party to the agreement. The State will continue to provide the NCCI edit file to Gainwell Technologies, and both parties will abide by the stipulations outlined in the executed confidentiality agreement. Department of Health and Welfare Single Audit Report for Fiscal Year 2021 In addition, the Bureau of Medicaid Enterprise Systems has incorporated contract monitoring activities to include monitoring for required changes to confidentiality agreements and making any necessary changes to existing agreements. Contract monitors will review any changes in accordance with the terms and conditions of the contract. Any procurement activities to secure new vendors will be subject to confidentiality agreements in accordance with the necessity of the work being performed and the terms and conditions of the contract. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-210 The Department did not maintain consistent operation of controls and compliance with Electronic Benefit Transfer (EBT) card security procedures for the Supplemental Nutrition Assistance Program (SNAP). Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Supplemental Nutrition Assistance Program, State Administrative Matching Grants for the Supplemental Nutrition Assistance Program Assistance Listing Number: 10.551 10.561 Federal Award Number: 21ID35051692301; 207ID4IDS8026; 207IDID4Q7503; 207IDID4S2514; 207IDID4S2519; 207IDID4S2520; 217IDID4S2514; 217IDID5Q3903; 217IDID6F1003; 217IDIDXE2518; 217IDID5S9018; 217IDID4S2520; 217IDID4S2519; 217IDID4Q7503; 217ID4IDS8036; 217ID4IDS8026 Program Year: October 1, 2019 to September 30, 2020; March 11, 2021 to September 30, 2021; October 1, 2020 to September 30, 2021; October 1, 2020 to September 30, 2022 Federal Agency: Department of Agriculture Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The Department is required to maintain adequate security over, and documentation/records for, EBT cards, to prevent their theft, embezzlement, loss, damage, destruction, unauthorized transfer, negotiation, or use (7 CFR section 274.8(b)(3)). Further, 7 CFR 274.5(c) states that an EBT card is considered an accountable document. The State agency is required, at minimum, to provide the following security and control procedures relating to these documents: ? Secure storage ? Access limited to authorized personnel ? Bulk inventory control records ? Subsequent control records maintained through the point of issuance or use ? Periodic review and validation of inventory controls and records by parties not otherwise involved in maintaining control records The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. Condition: The Department utilizes 19 field offices spread over 7 regions for distribution of EBT cards. Each office is required to complete logbooks monthly that include the Idaho Issuance Log for Blank EBT Cards, Destruction Log for EBT Cards, and the Month End EBT Card Count. The monthly records are reviewed by an EBT specialist to determine inventory accuracy and that cards are being tracked correctly. During our review, we identified 10 instances out of a sample of 23 months, or 43 percent, in which the review by the EBT specialist was not documented. We also noted during our review, 4 instances out of a sample of 23 months, or 17 percent, in which a Card Usage Report was not submitted. In addition, 18 instances out of a sample of 23 months, or 78 percent, in which the Destruction Log was not submitted. In some months, both types of noncompliance were identified. There were only 5 months out of a sample of 23, or 22 percent, where no form of noncompliance was identified in our testing. Cause: The reviews of some office logs and reports by an EBT Specialist were not documented or completed. Additionally, the supervisory oversight of the EBT Specialists was not completed at a level sufficient to identify the lack of documentation or completion of the required reviews. Effect: The lack of proper card security and inventory monitoring increases the risk of improper EBT card distribution and management. Without effective internal controls in operation, there is also an increased potential for further noncompliance with federal requirements. Recommendation: We recommend that the Department improve oversight with regard to the regional offices and supplement internal controls and documentation to ensure compliance with the necessary federal requirements. Management?s View: The Department agrees with the finding. The Department performed a comprehensive review of the EBT card security procedures and determined that proper procedures were not being appropriately performed and internal controls failed to be in compliance with EBT card inventory audit requirements. The Department will perform and complete the missing inventory audits by June 30, 2022 and the EBT Supervisor has reiterated the expectations of performing these audits. The entire EBT team has been trained on the bulk card ordering and issuing process and has modified security procedures to mitigate the risk of non-compliance in the future. Beginning in April of 2022, on a quarterly basis, the EBT Supervisor will review the previous quarter?s electronic card audits for accuracy, completeness and that the required documentation was submitted by each field office. The bulk card stock has been relocated to a central location, audited, and a new bulk card manifest spreadsheet is being implemented. The new spreadsheet will be complete and in use by June 30, 2022. Moving forward, the EBT card audit process will be reviewed on a regular basis and aligned with federal and state regulation. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-211 Subrecipient monitoring procedures were not adequate to ensure compliance with federal requirements for the Supplemental Nutrition Assistance Program (SNAP). Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Supplemental Nutrition Assistance Program, State Administrative Matching Grants for the Supplemental Nutrition Assistance Program Assistance Listing Number: 10.551; 10.561 Federal Award Number: 21ID35051692301; 207ID4IDS8026; 207IDID4Q7503; 207IDID4S2514; 207IDID4S2519; 207IDID4S2520; 217IDID4S2514; 217IDID5Q3903; 217IDID6F1003; 217IDIDXE2518; 217IDID5S9018; 217IDID4S2520; 217IDID4S2519; 217IDID4Q7503; 217ID4IDS8036; 217ID4IDS8026 Program Year: October 1, 2019 to September 30, 2020; March 11, 2021 to September 30, 2021; October 1, 2020 to September 30, 2021; October 1, 2020 to September 30, 2022 Federal Agency: Department of Agriculture Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 25.200 and 2 CFR 200.331 identify requirements for the Department when functioning as the pass-through entity providing subawards. The Department must evaluate each subrecipient?s risk of noncompliance with subaward requirements to determine the extent of subrecipient monitoring completed. In addition, monitoring must also include a review of financial and performance reports required by the pass-through entity; follow up on any deficiencies identified in the subrecipient that are detected through audits, on-site reviews, and other means; and issuing a management decision for audit findings, as required by 2 CFR 200.521. The Department must also verify that every subrecipient is audited, as required by Subpart F ? Audit Requirements of 2 CFR 200, when the subrecipient expends $750,000 or more in federal awards during the fiscal year. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Condition: No subrecipient monitoring activities occurred for 1 of 2 identified SNAP subrecipients. This includes the missing activities for the subrecipient as follows: ? A completed risk assessment for fiscal year 2021 subrecipient monitoring activities. ? Evidence the subrecipient monitoring included a review of the audit reports if the subrecipient exceeded $750,000 and required a single audit. ? The Department?s review of subrecipients? corrective actions on deficiencies noted in audits was not documented. Cause: At the time the initial subgrant agreement was executed with the subrecipient, the Department informally deemed the subrecipient to be low risk. Based on the low risk assessment, no monitoring procedures were implemented. The Department explained that a monitoring plan would have been developed and implemented if the subrecipient had chosen to continue the relationship. Effect: Without adequate monitoring of subrecipients, the Department is exposed to an increased risk of expending funds for unallowable costs and noncompliance with federal requirements. Recommendation: We recommend that the Department implement procedures to ensure compliance with all the requirements of a pass-through entity. We also recommend that the Department design and implement effective internal control procedures to ensure adequate subrecipient monitoring activities are completed. Management?s View: The Department agrees with this finding. At the time the contract was initiated, the Division of Welfare was following contract guidelines for monitoring subgrants. As discussed, the subgrant in question ended on September 30, 2021. Beginning with Federal Fiscal Year 2022 (FFY2022), the Division of Welfare put into place the following monitoring strategies for the SNAP-Ed program to meet compliance for these subgrants: ? Annually, a risk assessment is conducted for all subgrantees. The risk assessment looks at factors such as results from previous management evaluations, number of unresolved findings, changes in leadership and high staff turnover to determine if the subgrantee is high risk. The risk assessment identifies subgrantees that need additional monitoring. ? Following SNAP-Ed federal program guidance, financial reviews will be conducted annually. Onsite program reviews will be conducted every three years for low-risk entities. ? Management evaluation reports are prepared and shared with the subgrantee. Subgrantees are required to address all findings. The Division of Welfare may require performance improvement plans or corrective action plans, dependent upon the severity and frequency of findings. ? Conduct annual verification of a single audit for any subgrant receiving $750,000 in federal funding. Currently, there are no corrective action plans in place for any SNAP-ED subgrantees. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-212 The Department does not have internal control procedures in place to ensure the accuracy of performance reports for the Unemployment Insurance (UI) grant. Type of Finding: Significant Deficiency Assistance Listing Title: Unemployment Insurance Assistance Listing Number: 17.225 Federal Award Number: UI-34055-20-55-A-16, UI-35645-21-55-A-16 Program Year: October 1, 2019 to December 31, 2029; October 1, 1020 to December 31, 2023 Federal Agency: Department of Labor Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published the Internal Control Integrated Framework which provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. A component of this framework is control activities, which are the policies and procedures that help ensure the entity?s objectives are met. Condition: The Department compiles three monthly performance reports with information about the UI grant Employee Training and Assistance (ETA) programs and submits them to the United States Department of Labor (USDOL): ? ETA 9050 ? Time Lapse of All First Payments except Workshare ? ETA 9052 ? Nonmonetary Determination Time Lapse Detection ? ETA 9055 ? Appeals Case Aging ?Lower and Higher Authority Appeals The reports are data sets from the Department?s UI system. The USDOL has a data validation system designed to check the data sets for the correct elements and structure prior to final submission. If errors are identified, they are communicated to the Department and resolved prior to uploading the data sets to the USDOL reporting system. The Department has a procedure to use the data validation system for each report submission; however, only one employee at the Department is responsible for uploading the data and resolving any identified errors. This process is completed by only one employee. The Department has not identified any internal control procedures designed and in place, such as an independent review and approval of the data prior to submission, or of the USDOL review reports and corrections, that would ensure the accuracy of the reports. Cause: The Department believed that the federal data validation system check and error correction was sufficient to ensure the accuracy of the reports and, as a result, did not design or implement internal controls to ensure the accuracy and compliance of information included in the reports. Effect: We did not identify any errors in the performance reports reviewed; however, federal regulations require grant recipients to maintain and document internal controls to ensure the grants are being effectively managed. Without control procedures in place, there is an increased risk that an error could occur and remain undetected and uncorrected. Recommendation: We recommend that the Department design and implement internal control procedures to ensure reports are submitted accurately, timely, and in compliance with federal grant reporting requirements. We further recommend that the Department design and implement procedures to ensure that documentation is maintained to support the implementation of the control procedures. Management?s View: The Idaho Department of Labor agrees with the audit finding. The audit finding consists of one issue, that the department lacks adequate internal controls to mitigate risk of misreporting to an acceptable level for performance reports submitted to federal grantors. The auditors reviewed 3 monthly performance reports with information about the UI grant Employee Training and Assistance (ETA) programs and found that some have been submitted without an adequate review process prior to formal submission. The Department?s Corrective Action Plan: The department recognizes the need to incorporate adequate internal controls over reports submitted to our federal partners for the grants we administer. In order to ensure proper internal controls over federal reporting, the department will take the following steps: Step 1: ? Draft a policy to which all department staff who submit federal reports will adhere. The new policy shall include: ? A requirement for all staff who produce federal reports to draft a procedure for each report or groups of reports for which they are responsible. Although each report/group of reports has unique reporting requirements, the procedure shall, at a minimum, be in writing, require secondary review and sign-off prior to submission, and be routinely monitored by cost center managers as appropriate for the report/group of reports. ? A sign-off requirement of all report procedures by division administrators to ensure that the process incorporates adequate internal controls to mitigate risk of misreporting to an acceptable level. Step 2: ? Solicit feedback on the new policy from Cost Center managers, report producers, and administrators. Step 3 ? Implement the new policy department-wide. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-213 The Division did not perform subrecipient risk assessments, ensure subrecipient audits were received, or fully disclose required information to subrecipients for the Presidentially Declared Disaster Grant. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Federal Award Number: FEMA-4252-DR-ID; FEMA-4310-DR-ID; FEMA-4313-DR-ID; FEMA-4333-DR-ID; FEMA-4342-DR-ID; FEMA-4443-DR-ID; FEMA 4534-DR-ID; FEMA-4589-DR-ID Program Year: December 16, 2015 to December 2019; December 16, 2015 to December 2019; March 6, 2017 to March 2021; May 6, 2017 to May 2021; March 29, 2017 to March 2021; April 7, 2019 to April 2023; January 20, 2020 to Ongoing; January 13, 2021 to January 2025 Federal Agency: Department of Homeland Security Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administration Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. The requirements for pass-through entities are in 2 CFR 200.332, which states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward: ? Federal award identification: 1. Subrecipient name 2. Subrecipient?s unique entity identifier 3. Federal Award Identification Number (FAIN) 4. Federal award date of award to the recipient by the federal agency 5. Subaward period of performance state and end dates 6. Subaward budget period state and end date 7. Amount of federal funds obligated by this action by the pass-through entity to the subrecipient 8. Total amount of federal funds obligated to the subrecipient by the pass-through entity including the current obligation 9. Total amount of federal funds committed to the subrecipient by the pass-through entity 10. Federal award project description, as required to be response to the Federal Funding Accountability and Transparency Act (FFATA) 11. Name of federal awarding agency, pass-through entity, and contact information for awarding official of the pass-through entity 12. Assistance Listing Number (formerly Catalog of Federal Domestic Assistance Number) and title 13. Identification of whether the award is research and development (R&D) 14. Indirect cost rate for the federal award ? All requirements imposed by the pass-through entity on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the federal award ? Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the federal awarding agency, including identification of any required financial and performance reports Pass-through entities must also: ? Evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining the appropriate subrecipient monitoring ? Consider imposing specific subaward conditions upon a subrecipient, if appropriate ? Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved ? Verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, and follow up on the results of those audits Condition: The Division receives funds for Presidentially Declared Disasters (Assistance Listing Number 97.036) from the Federal Emergency Management Agency (FEMA). More than 99 percent of these funds are passed through to 72 subrecipients. The Division complied with some, but not all, of the pass-through entity requirements. Noncompliance was identified in the following areas: ? The Division did not disclose all of the required information at the time of the award. Five of the fourteen listed items were missing: federal award date, subaward budget period start and end date, title of Assistance Listing Number, identification of whether it is R&D, and the indirect cost rate. ? The Division did not document their evaluation of each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward ? The Division did not ensure that the subrecipients were audited as required by 2 CFR 200, Subpart F. Cause: Once the grant has been awarded, the Division uses a template for the obligation and award letter, which has not been updated to reflect current requirements. These documents did not contain all of the information required to be communicated to subrecipients. The Division did not identify whether the grant was for R&D because they felt it was sufficiently understood that it was specifically for disaster relief and not for R&D. This information is still required to be communicated. The Division also indicated that they communicated to the subrecipients during the application process that, under the grant, administrative (indirect) costs are allowed up to 5 percent of each obligation and charged to a separate project number but they neglected to provide documentation of that, or any other notification made after acceptance of the funds. The Division did not consider a formal documented risk assessment because they believed that this was sufficiently done during the application process. Many of the projects are already completed at the time of the application and the Division reviews the project costs and is able to identify and remove unallowed costs as part of the initial approval process. For these subrecipients, the risk of noncompliance is low; however, the Division did not formally document the risk assessment for any subrecipients, including those with ongoing projects. The Division was aware that they were required to communicate the 2 CFR 200, Subpart F, audit requirements to subrecipients, but was unaware of the additional requirements to ensure subrecipients? audits were completed and to review any findings related to the program. Effect: Subrecipient monitoring is a critical requirement as part of accepting federal funds and ensuring that those funds are spent in compliance with allowable costs and other guidelines provided by the grantor. Subrecipients need the required grant information to properly implement, manage, and report the federal award. Without this information, subrecipients have an increased risk of noncompliance with the federal award requirements. Assessing the risk of subrecipient noncompliance enables a pass-through entity to determine the proper level of monitoring procedures. Without completing the risk assessment process, a pass-through entity may increase the risk that appropriate monitoring procedures will not be performed at a sufficient level to detect noncompliance or that a subrecipient will not comply with the grant terms. Subrecipient audit reports may identify internal control issues and noncompliance with the federal award requirements. Reviewing these reports and ensuring that potential issues are addressed decreases the overall risk of noncompliance with the federal award requirements. Recommendation: We recommend that the Division design and implement appropriate procedures to ensure that all required information is communicated to subrecipients at the time of the award, subrecipient risk assessments are properly completed and documented, and subrecipient audits are completed and reviewed in accordance with federal grant regulations. Management?s View: The Idaho Office of Emergency Management will ensure all required information will be included in the Obligation Letters outlining the awards to Applicants. A revised Obligation Letter template containing all the required elements will serve as the basis for all Applicant obligation notifications. In addition to its current review of Applicant status on www.sam.gov prior to funding projects, IOEM Recovery Staff will perform a risk assessment based on the existing tool for Non-Disaster grants at the time of receipt of a Request for Public Assistance, to include a review of single- audits conducted during the prior year. The updated Request for Advance/Reimbursement (RFAR) will provide a "Yes/No" selection to indicate if a minimum of $750,000 in federal funds (all sources) was expended during the Applicant's fiscal year, and indicate the requirement for a single-audit to be provided and reviewed to IOEM Recovery if the response is in the affirmative. IOEM Recovery staff will calendar an appointment for follow-up to ensure compliance. Additionally, The IOEM Grants Management Branch Chief will review audit reports provided by the subrecipient or accessed through the Idaho State Controller's Office (SCO) Transparent Idaho website and assign a Finance or Recovery Specialist to identify subrecipients that are missing reports or have findings. The assigned Finance or Recovery Assistant will then correspond with the subrecipients to obtain missing audits or to ascertain audit finding resolutions. The IOEM Grants Management Branch Chief will also review audits not previously submitted to SCO from private non-profit entities and tribes, and address deficiencies and concerns in the manner described above. Unaddressed audit findings may result special conditions for grant awards or funding holds, depending on the severity of the findings. Auditor?s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-214 The Division did not properly submit two reports required under the Federal Funding Accountability and Transparency Act, and was lacking internal controls related to performance progress reports for the Presidentially Declared Disaster Grant. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Federal Award Number: FEMA-4252-DR-ID; FEMA-4310-DR-ID; FEMA-4313-DR-ID; FEMA-4333-DR-ID; FEMA-4342-DR-ID; FEMA-4443-DR-ID; FEMA 4534-DR-ID; FEMA-4589-DR-ID Program Year: December 16, 2015 to December 2019; December 16, 2015 to December 2019; March 6, 2017 to March 2021; May 6, 2017 to May 2021; March 29, 2017 to March 2021; April 7, 2019 to April 2023 January 20, 2020 to Ongoing; January 13, 2021 to January 2025 Federal Agency: Department of Homeland Security Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Disaster Grants ? Public Assistance (Presidentially Declared Disasters) grant awards require the Division to submit a Federal Funding Accountability and Transparency Act (FFATA) Special Report, and quarterly performance/progress reports. Appendix A to 2 CFR part 170 states that recipients must submit a FFATA report for each obligation action that equals or exceeds $30,000 in federal funds for a subaward to a nonfederal entity. The reports must be submitted no later than the end of the month following the month in which the obligation was made. The requirements for performance/progress reports are contained in 44 CFR 206.204(f), which states that quarterly progress reports must be submitted to the Federal Emergency Management Agency (FEMA) regional administrator. Reports are due 30 days after the first federal quarter following the federal award date: January 30, April 30, July 30, and October 30. Condition: We tested eight Disaster Grants-Public Assistance subawards and found one FFATA report that was submitted 27-days late, and one FFATA report that was not submitted as required resulting in an error rate of 25 percent. The Division submitted all required performance/progress reports timely; however, no documentation is retained to support that the reports were reviewed prior to submission. Cause: The Division has no documented controls in place to ensure the accurate and timely submission of FFATA and performance reports. The FFATA reporting group experienced almost 50 percent turnover during the audit period and did not design control procedures to ensure the reports were reviewed prior to submission. Multiple personnel were involved in the preparation of the performance/progress reports, but the Division said that the report reviews were verbal discussions that were not documented. Effect: FFATA reports are required to be submitted to the FFATA Subaward Reporting System (FSRS), which makes the information available to the public in a searchable database. Late reporting, or non-reporting, affects the integrity of that information. Our testing of the performance reports did not identify any errors; however, federal regulations require grant recipients to maintain and document internal controls to ensure the grants are being effectively managed, and the lack of controls increases the risk of errors or misreporting occurring and going undetected and uncorrected. Recommendation: We recommend that the Division design and implement internal control procedures to ensure reports are submitted accurately and timely and in compliance with federal grant reporting requirements. We further recommend that the Division design and implement procedures to ensure that documentation is maintained to support the implementation of the control procedures. Management?s View: The Division will update their FFATA procedure to include a verification process and proper documentation to ensure FFATA reporting is on time and accurate in accordance to federal grant reporting requirements. To eliminate the internal review documentation deficiencies identified, one Finance Specialist will be inputting the FFATA reporting, then emailing a second Financial Specialist when complete. The second Finance Specialist will review the FFATA submission for accuracy and timely submission in compliance with federal grant reporting requirements. The second Finance Specialist will send an email reply approving the FFATA report for the month if it is accurate, or notify the first Finance Specialist if there are errors that need to be corrected. Once the month's FFATA report is approved the email correspondence will be saved for the record. The Division is also developing an operations timeline for job duties in the Finance Section Chief's area. This will notify the finance section that FFATA is due on the 15thof every month, allowing the Division to ensure all reporting will be done on time and in compliance with federal grant reporting requirements. The Division will document the joint review currently in place through email correspondence, as well as the subsequent submission of Quarterly Performance Reports to FEMA by the Finance Section Chief and the IOEM Grants Branch Chief. Auditor?s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-215 The Commission did not report over $52 million of expenditures for inclusion in the Schedule of Expenditures of Federal Awards under the Coronavirus Relief Fund for fiscal year 2021. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus Relief Fund Assistance Listing Number: 21.019 Federal Award Number: SLT0074; SLT0030 Program Year: March 1, 2020 to December 31, 2021 Federal Agency: Department of Treasury Compliance Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published the Internal Control Integrated Framework, which provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. A component of this framework is control activities, which are the policies and procedures that help ensure the entity?s objectives are met. The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In addition, 2 CFR 200.510 requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA), which must include the total federal awards expended for each individual federal program. The State is directed to prepare a SEFA for the fiscal year that must include the total federal awards expended during that year. State agencies are required to report federal expenditures incurred for each federal program during the State fiscal year to the Office of the State Controller (SCO) through the SEFA closing package. The SCO provides instructions on the completion of the closing package. Condition: The Commission expended $52,766,893 in Coronavirus Relief Funds (CRF) in fiscal year 2021. However, the Commission?s originally submitted SEFA reported expenditures of only $145,115, an understatement of $52,621,779. The error was identified through our audit procedures, and after the understatement was communicated to the Commission, a corrected SEFA was submitted to the SCO. Cause: The SEFA closing package submitted by the Commission and the related attachments were prepared, submitted, reviewed, and approved by the same person. There was no review process in place when the SEFA was due to the SCO. Errors are also a result of the Commission?s lack of experience with federal funds, as well as significant turnover within the accounting department in recent years. Effect: A poorly designed submission process without appropriate internal controls including a complete lack of review of the completed SEFA closing package allowed errors to occur and go undetected and uncorrected. The Commission?s SEFA was understated by $52,621,779. There were also other errors that were less than a trivial amount on the SEFA. Recommendation: We recommend that the Commission design and implement internal control procedures to identify and gather needed information to ensure the accuracy and completeness of the federal funds reported on their SEFA closing package. Management?s View: LSO has recommended the Commission design and implement control procedures to identify and gather needed information to ensure the accuracy and completeness of the federal funds report on the SEFA closing package. Errors were the result of the Commission?s lack of experience with federal funds, as well as significant turnover within the accounting department including the Financial Executive Officer (FEO) position tasked with reviewing and submitting the closing packages. The balance of the federal funds was reverted in April 2021. In November 2021, the Commission worked closely with the State Controller?s Office (SCO) and submitted a corrected closing package which included the $52 million of expenditures. Since November 2021, the new accounting staff have completed closing package training provided by SCO. In addition, vacant positions have been filled which creates a multiple level system for the review process. Although the Commission is not currently participating in the distribution of federal funds, adjustments have been made to ensure accuracy and completeness of closing packages should opportunities arise in the future. Auditor?s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-216 Critical reviews and reconciliations were not completed for Rebound Idaho payments made from the Coronavirus Relief Fund for 9 out of the 12 months during fiscal year 2021. Type of Finding: Significant Deficiency Assistance Listing Title: Coronavirus Relief Fund Assistance Listing Number: 21.019 Federal Award Number: SLT0074; SLT0030 Program Year: March 1, 2020 to December 31, 2021 Federal Agency: Department of Treasury Compliance Requirement: Activities Allowed or Unallowed Questioned Costs: None Criteria: The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published the Internal Control Integrated Framework, which provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. A component of this framework is control activities, which are the policies and procedures that help ensure the entity?s objectives are met. These activities include segregation of duties, review and authorization of transactions, and maintaining supporting documentation. Condition: The Commission uses an End of Month Checklist to document the completion of month-end tasks, reconciliations, and associated reviews that are critical to ensuring these distributions and refunds are completed and recorded accurately. During our testing of internal controls, we noted portions of the End of Month Checklist in 9 out of the 12 months, or 75 percent, were not fully completed. The End of Month Checklist completion and review helps ensure that the Coronavirus Relief Fund that was distributed as Rebound Idaho payments are accurately accounted for in total and reconcile to the Statewide Accounting and Reporting System (STARS). Cause: The End of Month Checklist was not fully completed in July, August, October, November, February, March, April, May, or June. The reviewer?s initials on the checklist is how the agency chooses to document and verify that a control occurred and determine that a reconciliation was completed and reviewed at the end of the month. These checklists did not contain the reviewer?s initials, indicating that the full set of control procedures were not followed. The Commission asserts that the End of Month Checklist was not completed due to Commission staff turnover and the transition from paper to electronic checklists. Effect: While there were no errors noted in testing, the lack of consistency in completing the checklist increases the risk that errors would occur and go undetected and uncorrected. Recommendation: We recommend that the Commission ensure that internal control procedures are in place and consistently applied, including when work is completed remotely, and that they improve the documentation of control activities performed to ensure that reviews are completed accurately and in a timely manner. Management?s View: LSO has recommended the Commission ensure that internal control procedures are in place and consistently applied, including when work is completed remotely, and that proper documentation of control activities performed to ensure that reviews are complete accurately and in a timely manner. The Commission recently worked with LSO to build a cloud-based version of a checklist that requires footnotes from a Financial Specialist Senior and a Financial Specialist Principal. In addition, the checklist includes electronic dates and time stamps as a reference for LSO. The Commission has also adopted the LUMA models for risk mitigation through additional separation of duties. For example, staff can enter and create journal entries, but a secondary member must review and post the entries. This process has allowed the Commission to review work in progress and resulted in increased efficiencies during the month-end distribution process. These processes are the direct result of the collaborative working relationship between LSO and the Commission. Auditor?s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-217 The salaries and benefits costs for employees working on multiple federal grants are not supported by personnel activity reports or another approved system. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Formula Grants for Rural Areas; Enhanced Mobility of Seniors and Individuals with Disabilities Assistance Listing Number: 20.509 Federal Award Number: ID-2016-014-00; ID-2018-021-00 Program Year: August 29, 2016 to February 1, 2021; September 14, 2018 to March 3, 2023 Federal Agency: Department of Transportation Compliance Requirement: Allowable Costs/Cost Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations contains the principles to be applied in establishing the allowability of certain items of cost for federal awards. The U.S. Code of Federal Regulations (CFR), 2 CFR 200.430, contains the requirements for the compensation of personal services. Subsection (a) states that compensation for personal services includes all remuneration, paid currently or accrued for services of employees rendered during the period of performance under the federal award, including but not necessarily limited to wages and salaries. Compensation for personal services may also include fringe benefits. Subsection (i) contains the standards for documentation of personnel expenses and states that charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: ? Be supported by a system of internal control, which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; ? Be incorporated into the official records of the nonfederal entity; ? Reasonably reflect the total activity for which the employee is compensated by the nonfederal entity, not exceeding 100 percent of compensated activity; ? Support the distribution of the employee?s salary or wages among specific activities or cost objectives if the employee works on: more than one federal award, a federal award and a nonfederal award, an indirect cost activity and a direct cost activity, two or more indirect activities, which are allocated using different allocation bases, or an unallowable activity and a direct or indirect cost activity; Budget estimates, determined before the services are performed, alone do not qualify as support for charges to federal awards. Condition: The Department?s Public Transportation Office (PT) administers grants from the Federal Transit Administration (FTA). Six PT employees split their time between two grants; Assistance Listing Number (AL) 20.509 ? Formula Grants for Other than Urbanized Areas and AL 20.513 ? Capital Assistance Program for Elderly and Disabled Persons. The Department charges personnel costs to these two FTA grants by coding the salary and benefits costs for five employees to AL 20.509, and the salary and benefits costs of the one remaining PT employee to AL 20.513. The Department?s method for allocating personnel costs was not updated during fiscal year 2021 or supported by employee records. This method is a budget estimate, and the Department does not have a procedure to support the allocation of personnel charges to the FTA grants in accordance with 2 CFR 200.430. Cause: The Department used the budgeted costs to estimate and ultimately apply 5/6th of personnel costs from the PT employees, or 5 employees, to the AL 20.509 grant and 1/6th of the cost, or 1 employee, to the AL 20.513 grant. Using budgeted estimates is not an allowed technique for allocating personnel costs to various grants. The Department was unable to provide supporting documentation that using these percentages to allocate costs was accurate, and was unaware of the requirements of 2 CFR 200.430 to support the distribution of the employees? salaries and wages. Effect: The Department charged personnel costs of $306,256 to the AL 20.509 grant and $65,892 to the 20.513 grant and could not provide records to support the distribution of those costs. Without records to support the distribution of those costs, the Department is not in compliance with 2 CFR 200.430, and we cannot determine if the correct amount was charged to each grant. Recommendation: We recommend that the Department design and implement procedures to ensure that personnel costs are charged to PTA grants in compliance with 2 CFR 200.430 and to maintain documentation to support those costs. Management?s View: The Idaho Transportation Department (ITD) concurs with the audit finding and recommendation. ITD is developing a new standard operating procedure (SOP) for the employees of the Public Transportation Office to ensure proper recording of their time to the associated federal grant program. The purpose of this plan is to ensure consistency year over year in allocating costs, avoid duplication of costs, and to ensure a more accurate accounting of time spent on each grant program. This SOP will be developed in collaboration with FTA oversight staff to ensure 2CFR200 compliance. The SOP will include an annual reevaluation of tasks and associated time spent to ensure accurate allocation of hours. The evaluation will include an examination of all activities associated with the management of our grants programs, and sub-allocate percentage of time spent based on several factors including but not limited to; number of providers in each program, average number of invoices received, invoice complexity, technical assistance ratings, number of applications, attendee representation, etc. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-201 The Schedule of Expenditures of Federal Awards (SEFA) was understated by $276,989,930 for amounts reported as provided to subrecipients. Type of Finding: Material Weakness, SEFA Misstatement Assistance Listing Title: Coronavirus Relief Fund, Emergency Rental Assistance Program, Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 21.019; 21.023; 97.036 Federal Award Number: SLT0074, SLT0030; ERA-0010; FEMA-4252_DR-ID; FEMA-4310-DR-ID; FEMA-4313-DR-ID; FEMA-4333-DR-ID; FEMA-4342-DR-ID; FEMA-4443-DR-ID; FEMA 4534-DR-ID; FEMA-4589-DR-ID Program Year: March 1, 2020 to December 31, 2021; January 14, 2021 to September 30, 2022; December 16, 2015 to December 2019; December 16, 2015 to December 2019; March 6, 2017 to March 2021; May 6, 2017 to May 2021; March 29, 2017 to March 2021; April 7, 2019 to April 2023; January 20, 2020 to Ongoing; January 13, 2021 to January 2025 Federal Agency: Department of Treasury; Department of Homeland Security Compliance Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions. It provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relates to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR ?200.510(b)), which states it must include: ? Total federal awards expended as determined in accordance with 2 CFR ?200.502, and ? Total amount provided to subrecipients from each federal program. In addition, the AICPA Audit and Accounting Guide Governmental Auditing Standards and Single Audit section 6.15 discusses circumstances in which it is appropriate for entity-wide financial statements to include departments, agencies, and other organizational units that have separate audits and prepare separate financial statements who are then excluded from the entity?s Uniform Guidance compliance audit and SEFA because a separate Uniform Guidance compliance audit was conducted for those departments, agencies, or other organizational units. An auditee is defined in 2 CFR 200.1 as any nonfederal entity that expends federal awards which must be audited under subpart F of the Uniform Guidance. 2 CFR 200.501 indicates a single audit must be completed for a nonfederal entity that expends federal awards of $750,000 or more during the fiscal year in accordance with 2 CFR 200.514. Condition: Amounts passed through to subrecipients was understated by $276,989,930 on the SEFA draft provided to auditors. ? The largest error was for Assistance Listing Number 21.019, Coronavirus Relief Fund (CRF) program, this program was understated by $226,571,766. ? Assistance Listing Number 97.036, Disaster Grants program, under reported subrecipient payments by $11,202,585. ? Finally, amounts passed through to colleges and universities and the Idaho Housing and Finance Association were not included in the subrecipient total. The total understatement from this error was $39,215,579. Cause: Each year, State agencies report the total of federal awards expended on closing package. The SCO uses these closing packages to compile the SEFA. Funds for the CRF program were initially received by the Office of the Governor, these funds were then sent to various State agencies. These State agencies then passed on some of the funds to subrecipients. When the State agencies submitted their SEFA closing packages, the amounts reported for the CRF program were eliminated between the State agencies to avoid double counting total expenditures for the CRF program. This elimination process did not account for the funds the State agencies subgranted but which should have been reported as passed through to subrecipients. Routinely, State agencies will submit revised closing packages. If this has occurred after a closing package has been closed by the SCO, the review process for these changes will occur once the SEFA has been drafted. These review procedures did not detect an error on the statewide SEFA for Assistance Listing Number 97.036, Disaster Grants, when the amount provided to subrecipients was revised on the agency closing package to be $11,202,585. Additionally, the Office was not aware that agencies receiving their own single audit that are included in the statewide Annual Comprehensive Financial Report (ACFR), but who are excluded from the statewide SEFA, should be considered subrecipients. Effect: The SEFA submitted for audit included an understatement of $$276,989,930 for the amount passed through to subrecipients. The amount in error was just below our materiality threshold and was corrected on the final SEFA submission. Recommendation: We recommend that the Office design and implement procedures to ensure amounts subgranted are correctly reported to ensure complete and accurate compliance with federal reporting requirements. Management?s View: The Office agrees with this finding. Errors identified were corrected before publishing the Single Audit. We are in the process of developing an internal review checklist for SEFA compliance. The checklist will outline compliance requirements associated with the preparation of the SEFA (i.e., subrecipient reporting), identify areas that are a higher risk for error, and what to look for when reviewing higher risk areas. This checklist will be completed by the preparer of the SEFA, as well as by the reviewer(s) to ensure the SEFA is accurate and in compliance with Uniform Guidance requirements. Auditor?s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-202 The Board underreported federal expenditures by $11,316,783 across three federal programs when completing the Schedule of Expenditures of Federal Awards (SEFA). Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus Relief Fund; Governor's Emergency Education Relief Fund; Gaining Early Awareness and Readiness for Undergraduate Programs Assistance Listing Number: 21.019; 84.425C; 84.334S Federal Award Number: SLT0074; SLT0030; S425C00043; P334S180012 Program Year: June 2, 2020 - September 30, 2021; October 1, 2018 - September 30, 2022 Federal Agency: Department of Treasury; Department of Education Compliance Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In addition, 2 CFR 200.510 requires the State to prepare a SEFA, which must include the total federal awards expended for each individual federal program. The Office of the State Controller (Office) requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: During our review, we noted discrepancies between the Board?s fiscal year 2021 SEFA closing package and the underlying STARS data. The Board expended funds from three federal programs in fiscal year 2021: ? Governor?s Emergency Education Relief (GEER) Fund, Assistance Listing (AL) 84.425C ? Coronavirus Relief Fund (CRF), AL 21.019 ? Gaining Early Awareness and Readiness for Undergraduate programs (GEAR UP), AL 84.334S The SEFA reported $0 expenditures to subrecipients for the GEER (AL 84.425C) and CRF (AL 21.019) programs. However, based on our review, GEER (AL 84.425C) had $11,178,679 and CRF (AL 21.019) had $121,454 in subrecipient expenditures. The SEFA also reported $3,323,363 in expenditures for GEAR UP (AL 84.334S). Based on our review, the amount reported should have been $3,340,013. This is a $16,650 difference. It was further noted that the GEAR UP prior fiscal year 2020 expenditures was understated by $2,277 when compared to the prior year SEFA. Cause: The SEFA compilation process included a review by a staff member independent of the staff member completing the work. The compilation and review procedures were not completed with enough attention to detail to detect the errors on the SEFA. The SEFA closing package instructions were not completely understood as to which amounts were reported in each column of the closing package. Board staff thought that reporting subrecipient amounts in both the federal award and subrecipient columns would double count the expenditures. The Board also unintentionally excluded a portion of federal expenditures related to $16,650 in personnel costs. Effect: The SEFA amounts were understated by the following: ? GEER (AL 84.425C) understated expenditures to subrecipients by $11,178,679 ? CRF (AL 21.019) understated expenditures to subrecipients by $121,454 ? GEAR UP (AL 84.334S) understated fiscal years 2021 and 2020 expenditures by $16,650 and $2,277, respectively Recommendation: We recommend that the Board strengthen internal controls to ensure federal funds are accurately and properly reported on the SEFA. Management?s View: We reported these funds in two out of three places in the Schedule of Expenditures of Federal Awards (SEFA) worksheet submitted to the State Controller?s Office (SCO). The first place was on the SEFA tab in column 13, and the second place was in the Subrecipients tab, which shows each subrecipient and totals by CFDA number. The information in the Subrecipients tab was listed by CFDA. While there was no subtotal by CFDA in the Subrecipients tab, the CFDA numbers do total to the same total shown in column 13. We did not include these totals in column 18 because we were under the impression SCO would obtain the necessary information from the Subrecipients tab. While we did include the necessary information for SCO to report the amount of 2021 Federal Expenditures to Subrecipients to the federal government in their statewide SEFA report, we acknowledge that we did not follow the explicit instructions of the SEFA worksheet, which would have resulted in reporting the amount of subrecipient expenditures in column 18. Corrective Action Plan Include required dollar amounts in all three locations in the worksheet. Auditor?s Concluding Remarks: We thank the Board for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-203 Internal controls over the review of Federal Funding Accountability and Transparency Act (FFATA) reports under the Governor?s Emergency Education Relief (GEER) Fund are not sufficiently documented. Type of Finding: Significant Deficiency Assistance Listing Title: Governor's Emergency Education Relief Fund Assistance Listing Number: 84.425C Federal Award Number: S425C00043 Program Year: June 2, 2020 ? September 30, 2021 Federal Agency: Department of Education Compliance Requirement: Reporting Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The FFATA was developed to provide better transparency over management of federal grants and contracts. Reporting is required on allocations of $30,000 through the FFATA website. The Board passes funds to subrecipients and reports on each subrecipient award. The financial manager completes the FFATA report based on information obtained from the subrecipient award documents. The reports are then reviewed by the chief financial officer. However, the approval is communicated verbally and no documented evidence is retained. Cause: The Board was unaware of the requirement to retain documentation of the review over the FFATA reports. In addition, the Board?s internal control procedures were not designed to include a secondary review of the information submitted on the FFATA reports. Effect: Audit procedures found no errors; however, without documentation of appropriate internal controls, there is an increased risk of errors occurring and going undetected. Further, the Board could submit FFATA reports with incomplete or inaccurate information required by the grant agreement. Recommendation: We recommend that the Board design and implement well-documented internal control procedures to ensure accurate and timely FFATA reports. Management?s View: We have robust internal controls for many of our financial and risk assessment processes by way of operationalizing SCO?s Financial Management Controls Checklists. We will ensure similar diligence is applied to federal funding as our corrective action. Auditor?s Concluding Remarks: We thank the Board for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-204 The Department did not complete subrecipient monitoring of the Elementary and Secondary School Emergency Relief (ESSER) Fund. Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Elementary and Secondary School Emergency Relief Fund Assistance Listing Number: 84.425D Federal Award Number: S425D210043 (ESSER II); S425D200043 (ESSER I) Program Year: January 5, 2021 ? September 30, 2022; May 18, 2020 ? September 30, 2021 Federal Agency: Department of Education Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, superseding the Office of Management and Budget (OMB) Circular A-102, Grants and Cooperative Agreements with State and Local Governments, describes the pass-through entity?s responsibility for administering necessary requirements on subrecipients so that the federal award is used in accordance with federal regulations. Specifically, 2 CFR 200.332(d) and 2 CFR 25.200 identify the requirements for the Department as the pass-through entity in providing subawards. This includes communication of certain information, such as the subrecipient?s unique entity identifier and required registration in the System for Award Management (SAM). In addition, the Department must evaluate each subrecipient?s risk of noncompliance with federal statutes and the terms and conditions of the subaward when determining the extent of subrecipient monitoring to be completed to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward, and that the subaward performance goals are achieved. In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, monitoring must include a review of financial and performance reports required by the pass-through entity, follow up on any deficiencies identified in the subrecipient that are detected through audits, on-site reviews, and other means, and issuing a management decision for audit findings, as required by 2 CFR 200.521. Finally, 2 CFR 200.303 requires the Department to establish and maintain effective internal control over the federal award that provides reasonable assurance that the Department is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Department initially integrated ESSER monitoring with the general subrecipient monitoring for other federal programs. The Department?s 2020-2021 Monitoring Tool included one indicator related to the ESSER program. The Department also monitors financial activity when reimbursement requests are submitted to ensure funds are used for allowable activities and that expenditures include the appropriate level of support. However, the Department determined that the existing procedures were not robust enough for the additional requirements associated with ESSER subrecipient monitoring and discontinued those procedures without implementing any additional procedures. Cause: The Department realized the current procedures were not sufficient to meet the monitoring requirements of ESSER and indicated they are developing a monitoring process specific to the ESSER program compliance requirements but did not complete it during the audit period. Effect: The Department is not in compliance with subrecipient monitoring requirements. Without adequate monitoring of subrecipients, the Department is exposed to an increased risk of expending funds for unallowable or unsupported costs. Recommendation: We recommend that the Department implement procedures to ensure compliance with all requirements as a pass-through entity. We also recommend that the Department design and implement effective control procedures to ensure subrecipient monitoring activities are complete and appropriate. Management?s View: The impact of the COVID-19 pandemic has significantly disrupted K-12 operations since spring 2020. Idaho was short on resources from the beginning, as we were all caught off guard with the immediate and on-going challenges related to COVID-19, the laws that followed the President?s emergency declaration, and the influx of funds to keep students and staff healthy and in school. After the initial closure in spring of 2020, all of Idaho?s schools have remained open except for temporary closures resulting from a surge in cases. The resource constraints we experienced from the outset of the pandemic became clearer after each ESSER allocation was made through the CARES Act, the CRRSA Act, and the ARP ESSER. All states were experiencing similar challenges, but most states had immediate access to administrative dollars to begin addressing requirements earlier. It wasn?t until the end of the 2022 legislative session, that the Superintendent was given approval and spending authority to use ARP ESSER administrative funds to hire additional staff to meet the robust requirements identified by the U.S. Department of Education. Since then, interviews have been conducted and two positions hired beginning in April. One of those positions is an ESSER Monitoring coordinator position. Staff are working with the Education Northwest Comprehensive Center #17 (technical assistance arm of the U.S. Department of Education) on an ESSER monitoring process and timeline. ESSER monitoring will consist of a fiscal section similar to ESEA and a program section that tracks baseline measures and outcome data three times a year on interventions to address the academic impact of lost instructional time and interventions to address social, emotional, and mental health needs of students. Data from the program tracking will be collected annually. A comprehensive desk review will be conducted at least once for each LEA with a self-assessment required in the off years. Monitoring the ARP Homeless Children & Youth (HCY) will also be incorporated into the ESSER monitoring process. ESSER monitoring will begin this spring prior to the 2021-2022 school year ending and continue through spring of 2025 as required by the U.S. Department of Education. Auditor?s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-205 Quarterly Financial Progress Reports for the Coronavirus Relief Fund (CRF) contained inaccuracies. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Coronavirus Relief Fund Assistance Listing Number: 21.019 Federal Award Number: SLT0074, SLT0030 Program Year: March 1, 2020 to December 31, 2021 Federal Agency: Department of Treasury Compliance Requirement: Reporting Questioned Costs: None Criteria: The Uniform Guidance given in the U.S. Code of Federal Regulations (CFR) 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The CRF grant award from the U.S. Treasury Department requires prime recipients to provide quarterly Financial Progress Reports that contain COVID-19 related costs incurred during the covered period to the Treasury Office of Inspector General using the Grant Solutions portal. The prime recipient?s quarterly Financial Progress Report submissions should be supported by the data in the prime recipient?s accounting system. Condition: We tested two of the four quarterly reports submitted during fiscal year 2021. We identified inconsistencies in both reports. The SCO has been delegated the responsibility to complete these quarterly reports and reported current quarter amount expenditures for the quarter ending March 31, 2021 of $408,265,322; however, the underlying accounting data in STARS reported CRF expenditures of $402,489,844. In reviewing the SCO?s supporting documentation, we noted the following errors: ? $3,064,836 was incorrectly excluded for Municipal Small Business Grants. These expenditures were identified as CRF expenditures in the STARS data. ? $10,000,000 was incorrectly included, this was a transfer of funds to the Idaho Housing and Finance Association for the Emergency Rental Assistance program. ? $1,334,529 was incorrectly excluded for funds reimbursed to the Division of Military. These expenditures were identified as CRF expenditures in the STARS data. For the quarterly report ending on June 30, 2021, a transfer of funds back to the Office incorrectly reduced the amount of current quarter CRF expenditures by $468,853. Additionally, cumulative expenditures reported for the quarter ending on June 30, 2021 were $1,100,990,248. We identified CRF expenditures in STARS of $1,098,623,833 leaving a discrepancy of $2,366,415. Cause: The SCO?s procedures and controls were insufficient to prevent and detect errors in the required quarterly reporting. Effect: Current quarter expenditures for the quarterly report ending March 31, 2021 were overstated by $5,775,478. Current quarter expenditures for the quarterly report ending June 30, 2021 were understated by $468,853. Cumulative expenditures were overstated for quarterly report ending June 30, 2021 by $2,366,415. These errors exceed our threshold of $368,263, below which errors are deemed to be inconsequential. Errors remain well below our compliance materiality threshold of $36,826,328. Without effective internal controls in place, the Office continues to risk incorrect amounts being reported that may be material to the accuracy or the financial statement. Recommendation: We recommend that the Office and the SCO design and implement internal s controls to ensure accurate quarterly reporting. Management?s View: We agree that the Finance Progress Report submissions tested by your office were not accurately supported by financial data within STARS. The corrective action plan includes making appropriate adjustments in the Finance Progress Report for the quarter ending March 31, 2022, to remove and add incorrectly included and excluded amounts. This will correct the cumulative total amount of expenditures reported for fiscal year 2021. Our office will coordinate more closely with DFM to ensure all applicable expenses are accurately reported on future progress reports. Auditor?s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-206 The original Schedule of Expenditures of Federal Awards submitted to the Office of the State Controller reported a total of $104.9 million to an incorrect Assistance Listing number and understatements totaling $71 million of pass-through amounts to subrecipients. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus Relief Fund Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 21.019; 97.036 Federal Award Number: SLT0074; SLT0030; FEMA-4252-DR-ID; FEMA-4310-DR-ID; FEMA-4313-DR-ID; FEMA-4333-DR-ID; FEMA-4342-DR-ID; FEMA-4443-DR-ID; FEMA 4534-DR-ID; FEMA-4589-DR-ID Program Year: March 1, 2020 to December 31, 2021; December 16, 2015 to December 2019; December 16, 2015 to December 2019; March 6, 2017 to March 2021; May 6, 2017 to May 2021; March 29, 2017 to March 2021; April 7, 2019 to April 2023; January 20, 2020 to Ongoing; January 13, 2021 to January 2025 Federal Agency: Department of Treasury; Department of Homeland Security Compliance Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended. State agencies are required to report federal expenditures incurred for each federal program during the State fiscal year to the Office of the State Controller (SCO) through the SEFA closing package. The SCO provides instructions on the completion of the closing package. Those instructions indicate that agencies should complete the SEFA closing package if the agency received and expended any direct or subrecipient federal awards during the fiscal year. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Coronavirus Relief Fund federal expenditures totaling $104.9 million was incorrectly reported under the Assistance Listing (AL) number 21.027 (Coronavirus State and Local Fiscal Recovery Funds) instead of 21.019 (Coronavirus Relief Fund) on the original SEFA that was submitted on August 24, 2021. Further, the amount on the original SEFA for the Coronavirus Relief Fund was understated by $26,000. Additionally, the total federal expenditures reported as pass through to subrecipients for fiscal year 2021 was originally understated by $71 million. The amount of expenditures to pass through to subrecipients on the original SEFA closing package was reported as $106 million and $177 million on a revised SEFA submission. The $71 million was an aggregate of $60 million from the Coronavirus Relief Fund and $11 million from the Disaster Grants - Public Assistance (Presidentially Declared Disasters) program. In a subsequent iteration of the SEFA, it was determined that the expenditures reported as pass through to subrecipients for the Coronavirus Relief Fund should have only been $58.3 million as $1.7 million in payments to a contractor were erroneously accounted for as payments to a subrecipient. Cause: While the internal controls over the review of the fiscal year 2021 SEFA closing packages functioned, the review was not completed at a level of detail sufficient to identify inaccuracies in the AL number and reported pass-through amounts to subrecipient expenditures on the original version of the SEFA. Effect: The original SEFA amounts provided to the SCO included a $104.9 million overstatement for the Coronavirus State and Local Fiscal Recovery Funds program and a corresponding $104.9 million understatement of the Coronavirus Relief Fund program. Additionally, federal expenditures reported as pass-through to subrecipients were originally understated by $71 million. The amounts were corrected in a subsequent submission of SEFA information. Recommendation: We recommend that the Department improve the review process for the SEFA to included procedures at a level of detail sufficient to identify inaccuracies. Management?s View: The Department agrees with the finding. The Department has acknowledged the risk around this area and had already planned to implement a new process where the SEFA closing package would be prepared by the Cash and Grants Supervisor and reviewed in detail by the Financial Manager ? Cash, Grants, and Revenue Operations. The Financial Executive Officer would still be responsible for final review and submission of the closing package. Unfortunately, as a result of staffing shortages and a significantly increased workload related to COVID-19 funding and reporting requirements, the Department had to make some concessions based on risks in many aspects of the business ? one such concession was to not implement the more detailed review process for SFY21 SEFA preparation and rely on the previously implemented controls. The Department intends to move forward with the implementation of the previously planned enhanced review procedures in the coming year. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We feel it is important to point out that the circumstances described by the Department in their response are exactly why it is so important to ensure appropriate internal controls are properly designed, in place, and consistently executed to ensure that reporting requirements are met. Staffing shortages are an often unavoidable situation, especially as part of the challenges presented by the COVID-19 pandemic. The Department made a conscious decision to abandon a critical, annually performed, internal control over the reporting of approximately $3.2 billion on the SEFA as a solution to that problem, and state that it was done as part of a risk based approach, is a misuse of the risk-assessment process. If properly implemented and consistently performed, the enhanced review procedures described in the corrective action plan should address the concern.

FINDING 2021-207 The Department did not complete periodic audits for the Managed Care Organizations in the Medicaid program to ensure accuracy, truthfulness, and completeness of the encounter and financial data submitted. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII); Medicare Medical Assistance Program (Medicaid; Title XIX) Assistance Listing Number: 93.777, 93.778 Federal Award Number: 2005ID5028; 2005ID5MAP; 2005ID5ADM; 2005IDINCT; 2005IDIMPL; 2105ID5MAP; 2105ID5ADM; 2105IDINCT; 2105IDIMPL Program Year: October 1, 2019 to March 31, 2021; October 1, 2020 to December 31, 2020; October 1, 2020 to December 31, 2021; January 1, 2021 to March 31, 2022 Federal Agency: Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 42 CFR 438.602(e) states, effective no later than for rating periods for contracts starting on or after July 1, 2017, that the State must periodically, but no less frequently than once every three years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by or on behalf of each Managed Care Organization (MCO), Prepaid Inpatient Health Plan, and Prepaid Ambulatory Health Plan and post the results of these audits on its website. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Condition: Each MCO is required to receive a periodic audit no less frequently than every three years for contracts with rating periods on or after July 1, 2017. We noted one MCO with a contract where rating periods were dated July 1, 2017, to June 30, 2019, resulting in a required periodic audit on or before June 30, 2021. The periodic audit is anticipated to be completed in June 2022. The Department did not implement internal controls to ensure that the periodic audits were completed and published on the Department website. The three remaining MCOs were not required to receive a periodic audit during the audit period under review. Cause: The Department began the process of engaging an independent firm to complete the audit work in March 2020; however, the Department did not complete that process and does not have procedures in place to ensure the periodic audit was completed in the required timeframe. Effect: The independent periodic audits of encounter and financial data submitted by each MCO are critical to ensuring information submitted by the MCO is accurate, truthful, and complete for encounter and financial data. Recommendation: We recommend that the Department conduct, or contract for the conduct of, periodic audits of MCOs no less frequently than once every three years to ensure the accuracy, truthfulness, and completeness of the encounter and financial data submitted by or on behalf of each MCO. Management?s View: The Department agrees with this finding. The Division of Medicaid is currently conducting the reviews of encounter data and financial information for the IBHP, Idaho Duals and MCNA Dental. The IBHP review will be completed by June 30, 2022. Idaho Duals and MCNA Dental are to follow during the 2023 state fiscal year. The Division of Medicaid requested ongoing funding to perform these reviews for applicable managed care plans during the 2022 budget cycle. This budget was approved and the appropriation was utilized during SFY2022. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-208 The Department utilized the incorrect National Correct Coding Initiative (NCCI) edit files in processing Medicaid payments that could result in improper payments because of outdated payment rates for procedures, changes in procedures allowed by Medicaid, and other changes to the edit files. Related to Prior Finding: 2020-210 Type of Finding: Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII); Medicare Medical Assistance Program (Medicaid; Title XIX) Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2005ID5028; 2005ID5MAP; 2005ID5ADM; 2005IDINCT; 2005IDIMPL; 2105ID5MAP; 2105ID5ADM; 2105IDINCT; 2105IDIMPL Program Year: October 1, 2019 to March 31, 2021; October 1, 2020 to December 31, 2020; October 1, 2020 to December 31, 2021; January 1, 2021 to March 31, 2022 Federal Agency: Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The Department is required to incorporate NCCI methodologies into the State Medicaid programs pursuant to the requirements of Section 6507 of the Affordable Care Act, section 1903(r) of the Social Security Act. The Medicaid Technical Guidance Manual 2020 section 7.0 requires the Department to download the NCCI edit files that are available through the Medicaid Integrity Institute (MII), a division of the Centers for Medicare and Medicaid Services (CMS), using a secure portal (RISSNET). The publicly available files located on the Medicaid NCCI webpage are not for use by states. Access to the complete quarterly NCCI edit files available through MII?s RISSNET portal is limited to a state?s Medicaid agency. These state-only NCCI edit files contain information that is not included in the publically available NCCI edit files, medically unlikely edits (MUE) that are no longer in effect, MUE effective dates and deletion dates, current MUE effective dates, and Correspondence Language Identification Number (CLEID) for procedure-to-procedure (PTP) edits. Condition: In paying Medicaid claims, the Department is required to implement NCCI methodologies to ensure that only proper payments of procedures are reimbursed. The Department is also required to download the correct quarterly edit files from the Medicaid Integrity Institute. Audit procedures included inquiries of Medicaid program personnel to ascertain if appropriate NCCI procedures were implemented. The Department contracted with DXC Technology Services for the processing of the NCCI edit files. DXC Technology Services contracted with Context 4 to receive the NCCI edit files. Inquiries found that the files received by Context 4 were the publically available edit files and not the state Medicaid agency edit files available through Medicaid Integrity Institute and the RISSNET portal, as required by the Medicaid Technical Guidance Manual. Gainwell Technologies purchased DXC Technology Services in October 2020 and took over existing contracts and agreements in place at the time, including the contract with Context 4. The Department began working with Gainwell Technologies in February 2021 with a goal to implement the appropriate edit files by July 1, 2021. The development of a procedure for data file transfers took longer than anticipated. Additionally, the Department and Gainwell were required to prioritize other projects and noncompliance continued through fiscal year 2021. The Department planned to complete a review of the payments to determine if any improper payments were made during the time when the incorrect NCCI edit file was in place, as recommended for fiscal year 2020, but that review has yet to be completed. The Medicaid Technical Guidance Manual was updated in February 2021 and the correct edit files were implemented in November 2021. Cause: The Department did not have procedures in place to ensure the correct NCCI edit file was utilized. The current contracts in place do not require or specify the use of the NCCI edit files available through the Medicaid Integrity Institute. Further, the Department was not aware that the contractor was using the incorrect NCCI edit files and not obtaining the correct edit file through Medicaid Integrity Institute using the RISSNET portal. Effect: Despite no improper payments being identified during audit testing procedures, the Department?s use of the public NCCI edit files, instead of the state Medicaid agency edit files, could lead to incorrect payment edits being processed and creating improper payments. Recommendation: We continue to recommend that the Department review payments processed under the incorrect NCCI edit files during fiscal year 2020 and 2021 to identify any incorrect payments. Management?s View: The Department partially agrees with this finding and recommendation. The state downloaded the RISSNET NCCI edit files and delivered to Gainwell Technologies for claims processing on November 18, 2021. Gainwell Technologies determined they can load the files directly and no longer need to involve their sub vendor, Context4. As of December 2021, the state setup a quarterly schedule with Gainwell Technologies to deliver the RISSNET NCCI edit files. The State is downloading the correct NCCI file from RISSNET and delivering it to the vendor, Gainwell Technologies, each quarter and it has been incorporated into claims processing. LSO has recommended review of payments processed under the incorrect NCCI edit files during fiscal years 2020 and 2021 to identify any incorrect payments. Upon further analysis, it has been determined that it is not feasible to conduct such a review. Medicaid NCCI files from those timeframes are not available from RISSNET to download and use. Medicaid is unable to obtain the information necessary to conduct such an analysis. Medicaid is conducting analysis of the current RISSNET NCCI file against the publicly available NCCI file to determine any differences between the two files. That analysis is in progress with an expected completion date of April 30, 2022. Once the analysis is complete, Medicaid will have a better idea if there are major differences between the two files that could potentially need to be addressed in the past. However, Medicaid does not have access to the historical files for a direct comparison. There are two main barriers to applying the RISSNET NCCI edits to SFY20 and SFY21 claims as recommended by LSO: the files for those timeframes are not available to Medicaid to use, and it would be not practical to reprocess every claim from SFY20 through the current date. This would impose an administrative and communication burden on both the State and the Medicaid provider community. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We are concerned that the proper edit files were not distributed to the contractor and properly included in the MES until seven months after we issued finding 2020-210 as part of the Single Audit Report for state fiscal year 2020, and five months after the date they indicated they would complete corrective action for the finding. Additionally, no analysis was performed to determine the impact of using the publicly available edit files instead of the required edit files. NCCI edit files available on the RISSNET secure portal contain additional information necessary for correct claims processing by the Department. As stated in the guidance from the Centers for Medicare and Medicaid Services (CMS) regarding NCCI edit files, the Department?s use of the publicly available files that do not contain edit history may result in improper payment or inappropriate denials. The public files do not contain the Correspondence Language Example Identifiers (CLEID) contained in the files on the RISSNET secure portal. CLEIDs support the rationale for each edit during the claims processing and adjudication process. While we understand the barriers to accessing prior edit files, we continue to assert that this is an important aspect of compliance, and encourage the Department to work with federal grantors to access the prior edit files so an analysis can be completed to ensure the minimization of improper payments, inappropriate denials, or paid claims at improper payment rates.

FINDING 2021-209 Confidentiality agreements in place with Medicaid contractors did not include all required elements to ensure compliance with the Medicaid program. Related to Prior Finding: 2020-211 Type of Finding: Noncompliance Assistance Listing Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII); Medicare Medical Assistance Program (Medicaid; Title XIX) Assistance Listing Number: 93.777; 93.778 Federal Award Number: 2005ID5028; 2005ID5MAP; 2005ID5ADM; 2005IDINCT; 2005IDIMPL; 2105ID5MAP; 2105ID5ADM; 2105IDINCT; 2105IDIMPL Program Year: October 1, 2019 to March 31, 2021; October 1, 2020 to December 31, 2020; October 1, 2020 to December 31, 2021; January 1, 2021 to March 31, 2022 Federal Agency: Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The Medicaid Technical Guidance Manual 2020 Section 7.1.2 requires that the following elements be included in the confidentiality agreements for any contracted party using the Medicaid NCCI files posted on the MII: ? Disclosure shall be limited to only those responsible for the implementation of the quarterly state Medicaid NCCI edit files. Disclosure shall not be made prior to the start of the new calendar quarter. ? After the start of the new calendar quarter, a Contracted Party may disclose only non-confidential information contained in the Medicaid NCCI edit files that is also available to the general public found on the Medicaid NCCI webpage. ? The Contracted Party agrees to use any non-public information from the quarterly state Medicaid NCCI edit files only for any business purposes directly related to the implementation of the Medicaid NCCI methodologies in the particular state. ? New, revised, or deleted Medicaid NCCI edits shall not be published or otherwise shared with individuals, medical societies, or any other entities unless it is a Contracted Party prior to the posting of the Medicaid NCCI edits on the Medicaid NCCI webpage. ? Implementation of New, revised, or deleted Medicaid NCCI edits shall not occur prior to the first day of the calendar quarter. ? Only a state Medicaid agency has the discretion to release additional information for selected individual edits or limited ranges of edits from the files posted on the MII. ? State Medicaid agencies must impose penalties, up to and including loss of contract, for violations of any confidentiality agreement relating to use of the MII edit files. Condition: The Department has a confidentiality agreement with DXC Technology Services; however, there was not a separate confidentiality agreement with Context 4, with whom DXC Technology Services contracts. In addition, the confidentiality agreement in place with DXC Technology Services does not include all the required elements per the Technical Guidance Manual. The Department began working with Gainwell Technologies in February 2021 with a goal to implement the appropriate edit files and sign the required confidentiality agreement by July 1, 2021. The development of a procedure for data file transfers too longer than anticipated. Additionally, the Department and Gainwell were required to prioritize other projects and noncompliance continued through fiscal year 2021. The Medicaid Technical Guidance Manual was updated in February 2021 and the correct edit files were implemented and a confidentiality agreement was signed in November 2021. Cause: The Department did not have procedures in place to ensure confidentiality agreements included all of the elements required by the Medicaid Technical Guidance Manual 2020. Further, the Department was not aware of the confidentiality agreement requirements for contracted parties working with the NCCI edit files. Effect: Without all parties understanding and agreeing to the required confidentiality agreement components, confidential Medicaid NCCI edit file data could be improperly released. Recommendation: We recommend that the Department ensure that confidentiality agreements are in place with the required parties and that the agreements contain all of the necessary components. Management?s View: The Department agrees with this finding. Vendor confidentiality agreement was executed with Gainwell Technologies on November 12, 2021. This agreement met all the required elements. As a result of the change of the State providing the NCCI edit file instead of Context 4, Context 4 no longer has a role in Medicaid NCCI editing and is not considered a party to the agreement. The State will continue to provide the NCCI edit file to Gainwell Technologies, and both parties will abide by the stipulations outlined in the executed confidentiality agreement. Department of Health and Welfare Single Audit Report for Fiscal Year 2021 In addition, the Bureau of Medicaid Enterprise Systems has incorporated contract monitoring activities to include monitoring for required changes to confidentiality agreements and making any necessary changes to existing agreements. Contract monitors will review any changes in accordance with the terms and conditions of the contract. Any procurement activities to secure new vendors will be subject to confidentiality agreements in accordance with the necessity of the work being performed and the terms and conditions of the contract. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-210 The Department did not maintain consistent operation of controls and compliance with Electronic Benefit Transfer (EBT) card security procedures for the Supplemental Nutrition Assistance Program (SNAP). Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Supplemental Nutrition Assistance Program, State Administrative Matching Grants for the Supplemental Nutrition Assistance Program Assistance Listing Number: 10.551 10.561 Federal Award Number: 21ID35051692301; 207ID4IDS8026; 207IDID4Q7503; 207IDID4S2514; 207IDID4S2519; 207IDID4S2520; 217IDID4S2514; 217IDID5Q3903; 217IDID6F1003; 217IDIDXE2518; 217IDID5S9018; 217IDID4S2520; 217IDID4S2519; 217IDID4Q7503; 217ID4IDS8036; 217ID4IDS8026 Program Year: October 1, 2019 to September 30, 2020; March 11, 2021 to September 30, 2021; October 1, 2020 to September 30, 2021; October 1, 2020 to September 30, 2022 Federal Agency: Department of Agriculture Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The Department is required to maintain adequate security over, and documentation/records for, EBT cards, to prevent their theft, embezzlement, loss, damage, destruction, unauthorized transfer, negotiation, or use (7 CFR section 274.8(b)(3)). Further, 7 CFR 274.5(c) states that an EBT card is considered an accountable document. The State agency is required, at minimum, to provide the following security and control procedures relating to these documents: ? Secure storage ? Access limited to authorized personnel ? Bulk inventory control records ? Subsequent control records maintained through the point of issuance or use ? Periodic review and validation of inventory controls and records by parties not otherwise involved in maintaining control records The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. Condition: The Department utilizes 19 field offices spread over 7 regions for distribution of EBT cards. Each office is required to complete logbooks monthly that include the Idaho Issuance Log for Blank EBT Cards, Destruction Log for EBT Cards, and the Month End EBT Card Count. The monthly records are reviewed by an EBT specialist to determine inventory accuracy and that cards are being tracked correctly. During our review, we identified 10 instances out of a sample of 23 months, or 43 percent, in which the review by the EBT specialist was not documented. We also noted during our review, 4 instances out of a sample of 23 months, or 17 percent, in which a Card Usage Report was not submitted. In addition, 18 instances out of a sample of 23 months, or 78 percent, in which the Destruction Log was not submitted. In some months, both types of noncompliance were identified. There were only 5 months out of a sample of 23, or 22 percent, where no form of noncompliance was identified in our testing. Cause: The reviews of some office logs and reports by an EBT Specialist were not documented or completed. Additionally, the supervisory oversight of the EBT Specialists was not completed at a level sufficient to identify the lack of documentation or completion of the required reviews. Effect: The lack of proper card security and inventory monitoring increases the risk of improper EBT card distribution and management. Without effective internal controls in operation, there is also an increased potential for further noncompliance with federal requirements. Recommendation: We recommend that the Department improve oversight with regard to the regional offices and supplement internal controls and documentation to ensure compliance with the necessary federal requirements. Management?s View: The Department agrees with the finding. The Department performed a comprehensive review of the EBT card security procedures and determined that proper procedures were not being appropriately performed and internal controls failed to be in compliance with EBT card inventory audit requirements. The Department will perform and complete the missing inventory audits by June 30, 2022 and the EBT Supervisor has reiterated the expectations of performing these audits. The entire EBT team has been trained on the bulk card ordering and issuing process and has modified security procedures to mitigate the risk of non-compliance in the future. Beginning in April of 2022, on a quarterly basis, the EBT Supervisor will review the previous quarter?s electronic card audits for accuracy, completeness and that the required documentation was submitted by each field office. The bulk card stock has been relocated to a central location, audited, and a new bulk card manifest spreadsheet is being implemented. The new spreadsheet will be complete and in use by June 30, 2022. Moving forward, the EBT card audit process will be reviewed on a regular basis and aligned with federal and state regulation. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-211 Subrecipient monitoring procedures were not adequate to ensure compliance with federal requirements for the Supplemental Nutrition Assistance Program (SNAP). Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Supplemental Nutrition Assistance Program, State Administrative Matching Grants for the Supplemental Nutrition Assistance Program Assistance Listing Number: 10.551; 10.561 Federal Award Number: 21ID35051692301; 207ID4IDS8026; 207IDID4Q7503; 207IDID4S2514; 207IDID4S2519; 207IDID4S2520; 217IDID4S2514; 217IDID5Q3903; 217IDID6F1003; 217IDIDXE2518; 217IDID5S9018; 217IDID4S2520; 217IDID4S2519; 217IDID4Q7503; 217ID4IDS8036; 217ID4IDS8026 Program Year: October 1, 2019 to September 30, 2020; March 11, 2021 to September 30, 2021; October 1, 2020 to September 30, 2021; October 1, 2020 to September 30, 2022 Federal Agency: Department of Agriculture Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR 25.200 and 2 CFR 200.331 identify requirements for the Department when functioning as the pass-through entity providing subawards. The Department must evaluate each subrecipient?s risk of noncompliance with subaward requirements to determine the extent of subrecipient monitoring completed. In addition, monitoring must also include a review of financial and performance reports required by the pass-through entity; follow up on any deficiencies identified in the subrecipient that are detected through audits, on-site reviews, and other means; and issuing a management decision for audit findings, as required by 2 CFR 200.521. The Department must also verify that every subrecipient is audited, as required by Subpart F ? Audit Requirements of 2 CFR 200, when the subrecipient expends $750,000 or more in federal awards during the fiscal year. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Condition: No subrecipient monitoring activities occurred for 1 of 2 identified SNAP subrecipients. This includes the missing activities for the subrecipient as follows: ? A completed risk assessment for fiscal year 2021 subrecipient monitoring activities. ? Evidence the subrecipient monitoring included a review of the audit reports if the subrecipient exceeded $750,000 and required a single audit. ? The Department?s review of subrecipients? corrective actions on deficiencies noted in audits was not documented. Cause: At the time the initial subgrant agreement was executed with the subrecipient, the Department informally deemed the subrecipient to be low risk. Based on the low risk assessment, no monitoring procedures were implemented. The Department explained that a monitoring plan would have been developed and implemented if the subrecipient had chosen to continue the relationship. Effect: Without adequate monitoring of subrecipients, the Department is exposed to an increased risk of expending funds for unallowable costs and noncompliance with federal requirements. Recommendation: We recommend that the Department implement procedures to ensure compliance with all the requirements of a pass-through entity. We also recommend that the Department design and implement effective internal control procedures to ensure adequate subrecipient monitoring activities are completed. Management?s View: The Department agrees with this finding. At the time the contract was initiated, the Division of Welfare was following contract guidelines for monitoring subgrants. As discussed, the subgrant in question ended on September 30, 2021. Beginning with Federal Fiscal Year 2022 (FFY2022), the Division of Welfare put into place the following monitoring strategies for the SNAP-Ed program to meet compliance for these subgrants: ? Annually, a risk assessment is conducted for all subgrantees. The risk assessment looks at factors such as results from previous management evaluations, number of unresolved findings, changes in leadership and high staff turnover to determine if the subgrantee is high risk. The risk assessment identifies subgrantees that need additional monitoring. ? Following SNAP-Ed federal program guidance, financial reviews will be conducted annually. Onsite program reviews will be conducted every three years for low-risk entities. ? Management evaluation reports are prepared and shared with the subgrantee. Subgrantees are required to address all findings. The Division of Welfare may require performance improvement plans or corrective action plans, dependent upon the severity and frequency of findings. ? Conduct annual verification of a single audit for any subgrant receiving $750,000 in federal funding. Currently, there are no corrective action plans in place for any SNAP-ED subgrantees. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-212 The Department does not have internal control procedures in place to ensure the accuracy of performance reports for the Unemployment Insurance (UI) grant. Type of Finding: Significant Deficiency Assistance Listing Title: Unemployment Insurance Assistance Listing Number: 17.225 Federal Award Number: UI-34055-20-55-A-16, UI-35645-21-55-A-16 Program Year: October 1, 2019 to December 31, 2029; October 1, 1020 to December 31, 2023 Federal Agency: Department of Labor Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published the Internal Control Integrated Framework which provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. A component of this framework is control activities, which are the policies and procedures that help ensure the entity?s objectives are met. Condition: The Department compiles three monthly performance reports with information about the UI grant Employee Training and Assistance (ETA) programs and submits them to the United States Department of Labor (USDOL): ? ETA 9050 ? Time Lapse of All First Payments except Workshare ? ETA 9052 ? Nonmonetary Determination Time Lapse Detection ? ETA 9055 ? Appeals Case Aging ?Lower and Higher Authority Appeals The reports are data sets from the Department?s UI system. The USDOL has a data validation system designed to check the data sets for the correct elements and structure prior to final submission. If errors are identified, they are communicated to the Department and resolved prior to uploading the data sets to the USDOL reporting system. The Department has a procedure to use the data validation system for each report submission; however, only one employee at the Department is responsible for uploading the data and resolving any identified errors. This process is completed by only one employee. The Department has not identified any internal control procedures designed and in place, such as an independent review and approval of the data prior to submission, or of the USDOL review reports and corrections, that would ensure the accuracy of the reports. Cause: The Department believed that the federal data validation system check and error correction was sufficient to ensure the accuracy of the reports and, as a result, did not design or implement internal controls to ensure the accuracy and compliance of information included in the reports. Effect: We did not identify any errors in the performance reports reviewed; however, federal regulations require grant recipients to maintain and document internal controls to ensure the grants are being effectively managed. Without control procedures in place, there is an increased risk that an error could occur and remain undetected and uncorrected. Recommendation: We recommend that the Department design and implement internal control procedures to ensure reports are submitted accurately, timely, and in compliance with federal grant reporting requirements. We further recommend that the Department design and implement procedures to ensure that documentation is maintained to support the implementation of the control procedures. Management?s View: The Idaho Department of Labor agrees with the audit finding. The audit finding consists of one issue, that the department lacks adequate internal controls to mitigate risk of misreporting to an acceptable level for performance reports submitted to federal grantors. The auditors reviewed 3 monthly performance reports with information about the UI grant Employee Training and Assistance (ETA) programs and found that some have been submitted without an adequate review process prior to formal submission. The Department?s Corrective Action Plan: The department recognizes the need to incorporate adequate internal controls over reports submitted to our federal partners for the grants we administer. In order to ensure proper internal controls over federal reporting, the department will take the following steps: Step 1: ? Draft a policy to which all department staff who submit federal reports will adhere. The new policy shall include: ? A requirement for all staff who produce federal reports to draft a procedure for each report or groups of reports for which they are responsible. Although each report/group of reports has unique reporting requirements, the procedure shall, at a minimum, be in writing, require secondary review and sign-off prior to submission, and be routinely monitored by cost center managers as appropriate for the report/group of reports. ? A sign-off requirement of all report procedures by division administrators to ensure that the process incorporates adequate internal controls to mitigate risk of misreporting to an acceptable level. Step 2: ? Solicit feedback on the new policy from Cost Center managers, report producers, and administrators. Step 3 ? Implement the new policy department-wide. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-213 The Division did not perform subrecipient risk assessments, ensure subrecipient audits were received, or fully disclose required information to subrecipients for the Presidentially Declared Disaster Grant. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Federal Award Number: FEMA-4252-DR-ID; FEMA-4310-DR-ID; FEMA-4313-DR-ID; FEMA-4333-DR-ID; FEMA-4342-DR-ID; FEMA-4443-DR-ID; FEMA 4534-DR-ID; FEMA-4589-DR-ID Program Year: December 16, 2015 to December 2019; December 16, 2015 to December 2019; March 6, 2017 to March 2021; May 6, 2017 to May 2021; March 29, 2017 to March 2021; April 7, 2019 to April 2023; January 20, 2020 to Ongoing; January 13, 2021 to January 2025 Federal Agency: Department of Homeland Security Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administration Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. The requirements for pass-through entities are in 2 CFR 200.332, which states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward: ? Federal award identification: 1. Subrecipient name 2. Subrecipient?s unique entity identifier 3. Federal Award Identification Number (FAIN) 4. Federal award date of award to the recipient by the federal agency 5. Subaward period of performance state and end dates 6. Subaward budget period state and end date 7. Amount of federal funds obligated by this action by the pass-through entity to the subrecipient 8. Total amount of federal funds obligated to the subrecipient by the pass-through entity including the current obligation 9. Total amount of federal funds committed to the subrecipient by the pass-through entity 10. Federal award project description, as required to be response to the Federal Funding Accountability and Transparency Act (FFATA) 11. Name of federal awarding agency, pass-through entity, and contact information for awarding official of the pass-through entity 12. Assistance Listing Number (formerly Catalog of Federal Domestic Assistance Number) and title 13. Identification of whether the award is research and development (R&D) 14. Indirect cost rate for the federal award ? All requirements imposed by the pass-through entity on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the federal award ? Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the federal awarding agency, including identification of any required financial and performance reports Pass-through entities must also: ? Evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining the appropriate subrecipient monitoring ? Consider imposing specific subaward conditions upon a subrecipient, if appropriate ? Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved ? Verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, and follow up on the results of those audits Condition: The Division receives funds for Presidentially Declared Disasters (Assistance Listing Number 97.036) from the Federal Emergency Management Agency (FEMA). More than 99 percent of these funds are passed through to 72 subrecipients. The Division complied with some, but not all, of the pass-through entity requirements. Noncompliance was identified in the following areas: ? The Division did not disclose all of the required information at the time of the award. Five of the fourteen listed items were missing: federal award date, subaward budget period start and end date, title of Assistance Listing Number, identification of whether it is R&D, and the indirect cost rate. ? The Division did not document their evaluation of each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward ? The Division did not ensure that the subrecipients were audited as required by 2 CFR 200, Subpart F. Cause: Once the grant has been awarded, the Division uses a template for the obligation and award letter, which has not been updated to reflect current requirements. These documents did not contain all of the information required to be communicated to subrecipients. The Division did not identify whether the grant was for R&D because they felt it was sufficiently understood that it was specifically for disaster relief and not for R&D. This information is still required to be communicated. The Division also indicated that they communicated to the subrecipients during the application process that, under the grant, administrative (indirect) costs are allowed up to 5 percent of each obligation and charged to a separate project number but they neglected to provide documentation of that, or any other notification made after acceptance of the funds. The Division did not consider a formal documented risk assessment because they believed that this was sufficiently done during the application process. Many of the projects are already completed at the time of the application and the Division reviews the project costs and is able to identify and remove unallowed costs as part of the initial approval process. For these subrecipients, the risk of noncompliance is low; however, the Division did not formally document the risk assessment for any subrecipients, including those with ongoing projects. The Division was aware that they were required to communicate the 2 CFR 200, Subpart F, audit requirements to subrecipients, but was unaware of the additional requirements to ensure subrecipients? audits were completed and to review any findings related to the program. Effect: Subrecipient monitoring is a critical requirement as part of accepting federal funds and ensuring that those funds are spent in compliance with allowable costs and other guidelines provided by the grantor. Subrecipients need the required grant information to properly implement, manage, and report the federal award. Without this information, subrecipients have an increased risk of noncompliance with the federal award requirements. Assessing the risk of subrecipient noncompliance enables a pass-through entity to determine the proper level of monitoring procedures. Without completing the risk assessment process, a pass-through entity may increase the risk that appropriate monitoring procedures will not be performed at a sufficient level to detect noncompliance or that a subrecipient will not comply with the grant terms. Subrecipient audit reports may identify internal control issues and noncompliance with the federal award requirements. Reviewing these reports and ensuring that potential issues are addressed decreases the overall risk of noncompliance with the federal award requirements. Recommendation: We recommend that the Division design and implement appropriate procedures to ensure that all required information is communicated to subrecipients at the time of the award, subrecipient risk assessments are properly completed and documented, and subrecipient audits are completed and reviewed in accordance with federal grant regulations. Management?s View: The Idaho Office of Emergency Management will ensure all required information will be included in the Obligation Letters outlining the awards to Applicants. A revised Obligation Letter template containing all the required elements will serve as the basis for all Applicant obligation notifications. In addition to its current review of Applicant status on www.sam.gov prior to funding projects, IOEM Recovery Staff will perform a risk assessment based on the existing tool for Non-Disaster grants at the time of receipt of a Request for Public Assistance, to include a review of single- audits conducted during the prior year. The updated Request for Advance/Reimbursement (RFAR) will provide a "Yes/No" selection to indicate if a minimum of $750,000 in federal funds (all sources) was expended during the Applicant's fiscal year, and indicate the requirement for a single-audit to be provided and reviewed to IOEM Recovery if the response is in the affirmative. IOEM Recovery staff will calendar an appointment for follow-up to ensure compliance. Additionally, The IOEM Grants Management Branch Chief will review audit reports provided by the subrecipient or accessed through the Idaho State Controller's Office (SCO) Transparent Idaho website and assign a Finance or Recovery Specialist to identify subrecipients that are missing reports or have findings. The assigned Finance or Recovery Assistant will then correspond with the subrecipients to obtain missing audits or to ascertain audit finding resolutions. The IOEM Grants Management Branch Chief will also review audits not previously submitted to SCO from private non-profit entities and tribes, and address deficiencies and concerns in the manner described above. Unaddressed audit findings may result special conditions for grant awards or funding holds, depending on the severity of the findings. Auditor?s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-214 The Division did not properly submit two reports required under the Federal Funding Accountability and Transparency Act, and was lacking internal controls related to performance progress reports for the Presidentially Declared Disaster Grant. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Federal Award Number: FEMA-4252-DR-ID; FEMA-4310-DR-ID; FEMA-4313-DR-ID; FEMA-4333-DR-ID; FEMA-4342-DR-ID; FEMA-4443-DR-ID; FEMA 4534-DR-ID; FEMA-4589-DR-ID Program Year: December 16, 2015 to December 2019; December 16, 2015 to December 2019; March 6, 2017 to March 2021; May 6, 2017 to May 2021; March 29, 2017 to March 2021; April 7, 2019 to April 2023 January 20, 2020 to Ongoing; January 13, 2021 to January 2025 Federal Agency: Department of Homeland Security Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Disaster Grants ? Public Assistance (Presidentially Declared Disasters) grant awards require the Division to submit a Federal Funding Accountability and Transparency Act (FFATA) Special Report, and quarterly performance/progress reports. Appendix A to 2 CFR part 170 states that recipients must submit a FFATA report for each obligation action that equals or exceeds $30,000 in federal funds for a subaward to a nonfederal entity. The reports must be submitted no later than the end of the month following the month in which the obligation was made. The requirements for performance/progress reports are contained in 44 CFR 206.204(f), which states that quarterly progress reports must be submitted to the Federal Emergency Management Agency (FEMA) regional administrator. Reports are due 30 days after the first federal quarter following the federal award date: January 30, April 30, July 30, and October 30. Condition: We tested eight Disaster Grants-Public Assistance subawards and found one FFATA report that was submitted 27-days late, and one FFATA report that was not submitted as required resulting in an error rate of 25 percent. The Division submitted all required performance/progress reports timely; however, no documentation is retained to support that the reports were reviewed prior to submission. Cause: The Division has no documented controls in place to ensure the accurate and timely submission of FFATA and performance reports. The FFATA reporting group experienced almost 50 percent turnover during the audit period and did not design control procedures to ensure the reports were reviewed prior to submission. Multiple personnel were involved in the preparation of the performance/progress reports, but the Division said that the report reviews were verbal discussions that were not documented. Effect: FFATA reports are required to be submitted to the FFATA Subaward Reporting System (FSRS), which makes the information available to the public in a searchable database. Late reporting, or non-reporting, affects the integrity of that information. Our testing of the performance reports did not identify any errors; however, federal regulations require grant recipients to maintain and document internal controls to ensure the grants are being effectively managed, and the lack of controls increases the risk of errors or misreporting occurring and going undetected and uncorrected. Recommendation: We recommend that the Division design and implement internal control procedures to ensure reports are submitted accurately and timely and in compliance with federal grant reporting requirements. We further recommend that the Division design and implement procedures to ensure that documentation is maintained to support the implementation of the control procedures. Management?s View: The Division will update their FFATA procedure to include a verification process and proper documentation to ensure FFATA reporting is on time and accurate in accordance to federal grant reporting requirements. To eliminate the internal review documentation deficiencies identified, one Finance Specialist will be inputting the FFATA reporting, then emailing a second Financial Specialist when complete. The second Finance Specialist will review the FFATA submission for accuracy and timely submission in compliance with federal grant reporting requirements. The second Finance Specialist will send an email reply approving the FFATA report for the month if it is accurate, or notify the first Finance Specialist if there are errors that need to be corrected. Once the month's FFATA report is approved the email correspondence will be saved for the record. The Division is also developing an operations timeline for job duties in the Finance Section Chief's area. This will notify the finance section that FFATA is due on the 15thof every month, allowing the Division to ensure all reporting will be done on time and in compliance with federal grant reporting requirements. The Division will document the joint review currently in place through email correspondence, as well as the subsequent submission of Quarterly Performance Reports to FEMA by the Finance Section Chief and the IOEM Grants Branch Chief. Auditor?s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-215 The Commission did not report over $52 million of expenditures for inclusion in the Schedule of Expenditures of Federal Awards under the Coronavirus Relief Fund for fiscal year 2021. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus Relief Fund Assistance Listing Number: 21.019 Federal Award Number: SLT0074; SLT0030 Program Year: March 1, 2020 to December 31, 2021 Federal Agency: Department of Treasury Compliance Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published the Internal Control Integrated Framework, which provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. A component of this framework is control activities, which are the policies and procedures that help ensure the entity?s objectives are met. The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In addition, 2 CFR 200.510 requires the State to prepare a Schedule of Expenditures of Federal Awards (SEFA), which must include the total federal awards expended for each individual federal program. The State is directed to prepare a SEFA for the fiscal year that must include the total federal awards expended during that year. State agencies are required to report federal expenditures incurred for each federal program during the State fiscal year to the Office of the State Controller (SCO) through the SEFA closing package. The SCO provides instructions on the completion of the closing package. Condition: The Commission expended $52,766,893 in Coronavirus Relief Funds (CRF) in fiscal year 2021. However, the Commission?s originally submitted SEFA reported expenditures of only $145,115, an understatement of $52,621,779. The error was identified through our audit procedures, and after the understatement was communicated to the Commission, a corrected SEFA was submitted to the SCO. Cause: The SEFA closing package submitted by the Commission and the related attachments were prepared, submitted, reviewed, and approved by the same person. There was no review process in place when the SEFA was due to the SCO. Errors are also a result of the Commission?s lack of experience with federal funds, as well as significant turnover within the accounting department in recent years. Effect: A poorly designed submission process without appropriate internal controls including a complete lack of review of the completed SEFA closing package allowed errors to occur and go undetected and uncorrected. The Commission?s SEFA was understated by $52,621,779. There were also other errors that were less than a trivial amount on the SEFA. Recommendation: We recommend that the Commission design and implement internal control procedures to identify and gather needed information to ensure the accuracy and completeness of the federal funds reported on their SEFA closing package. Management?s View: LSO has recommended the Commission design and implement control procedures to identify and gather needed information to ensure the accuracy and completeness of the federal funds report on the SEFA closing package. Errors were the result of the Commission?s lack of experience with federal funds, as well as significant turnover within the accounting department including the Financial Executive Officer (FEO) position tasked with reviewing and submitting the closing packages. The balance of the federal funds was reverted in April 2021. In November 2021, the Commission worked closely with the State Controller?s Office (SCO) and submitted a corrected closing package which included the $52 million of expenditures. Since November 2021, the new accounting staff have completed closing package training provided by SCO. In addition, vacant positions have been filled which creates a multiple level system for the review process. Although the Commission is not currently participating in the distribution of federal funds, adjustments have been made to ensure accuracy and completeness of closing packages should opportunities arise in the future. Auditor?s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-216 Critical reviews and reconciliations were not completed for Rebound Idaho payments made from the Coronavirus Relief Fund for 9 out of the 12 months during fiscal year 2021. Type of Finding: Significant Deficiency Assistance Listing Title: Coronavirus Relief Fund Assistance Listing Number: 21.019 Federal Award Number: SLT0074; SLT0030 Program Year: March 1, 2020 to December 31, 2021 Federal Agency: Department of Treasury Compliance Requirement: Activities Allowed or Unallowed Questioned Costs: None Criteria: The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published the Internal Control Integrated Framework, which provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. A component of this framework is control activities, which are the policies and procedures that help ensure the entity?s objectives are met. These activities include segregation of duties, review and authorization of transactions, and maintaining supporting documentation. Condition: The Commission uses an End of Month Checklist to document the completion of month-end tasks, reconciliations, and associated reviews that are critical to ensuring these distributions and refunds are completed and recorded accurately. During our testing of internal controls, we noted portions of the End of Month Checklist in 9 out of the 12 months, or 75 percent, were not fully completed. The End of Month Checklist completion and review helps ensure that the Coronavirus Relief Fund that was distributed as Rebound Idaho payments are accurately accounted for in total and reconcile to the Statewide Accounting and Reporting System (STARS). Cause: The End of Month Checklist was not fully completed in July, August, October, November, February, March, April, May, or June. The reviewer?s initials on the checklist is how the agency chooses to document and verify that a control occurred and determine that a reconciliation was completed and reviewed at the end of the month. These checklists did not contain the reviewer?s initials, indicating that the full set of control procedures were not followed. The Commission asserts that the End of Month Checklist was not completed due to Commission staff turnover and the transition from paper to electronic checklists. Effect: While there were no errors noted in testing, the lack of consistency in completing the checklist increases the risk that errors would occur and go undetected and uncorrected. Recommendation: We recommend that the Commission ensure that internal control procedures are in place and consistently applied, including when work is completed remotely, and that they improve the documentation of control activities performed to ensure that reviews are completed accurately and in a timely manner. Management?s View: LSO has recommended the Commission ensure that internal control procedures are in place and consistently applied, including when work is completed remotely, and that proper documentation of control activities performed to ensure that reviews are complete accurately and in a timely manner. The Commission recently worked with LSO to build a cloud-based version of a checklist that requires footnotes from a Financial Specialist Senior and a Financial Specialist Principal. In addition, the checklist includes electronic dates and time stamps as a reference for LSO. The Commission has also adopted the LUMA models for risk mitigation through additional separation of duties. For example, staff can enter and create journal entries, but a secondary member must review and post the entries. This process has allowed the Commission to review work in progress and resulted in increased efficiencies during the month-end distribution process. These processes are the direct result of the collaborative working relationship between LSO and the Commission. Auditor?s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2021-217 The salaries and benefits costs for employees working on multiple federal grants are not supported by personnel activity reports or another approved system. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Formula Grants for Rural Areas; Enhanced Mobility of Seniors and Individuals with Disabilities Assistance Listing Number: 20.509 Federal Award Number: ID-2016-014-00; ID-2018-021-00 Program Year: August 29, 2016 to February 1, 2021; September 14, 2018 to March 3, 2023 Federal Agency: Department of Transportation Compliance Requirement: Allowable Costs/Cost Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations contains the principles to be applied in establishing the allowability of certain items of cost for federal awards. The U.S. Code of Federal Regulations (CFR), 2 CFR 200.430, contains the requirements for the compensation of personal services. Subsection (a) states that compensation for personal services includes all remuneration, paid currently or accrued for services of employees rendered during the period of performance under the federal award, including but not necessarily limited to wages and salaries. Compensation for personal services may also include fringe benefits. Subsection (i) contains the standards for documentation of personnel expenses and states that charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: ? Be supported by a system of internal control, which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; ? Be incorporated into the official records of the nonfederal entity; ? Reasonably reflect the total activity for which the employee is compensated by the nonfederal entity, not exceeding 100 percent of compensated activity; ? Support the distribution of the employee?s salary or wages among specific activities or cost objectives if the employee works on: more than one federal award, a federal award and a nonfederal award, an indirect cost activity and a direct cost activity, two or more indirect activities, which are allocated using different allocation bases, or an unallowable activity and a direct or indirect cost activity; Budget estimates, determined before the services are performed, alone do not qualify as support for charges to federal awards. Condition: The Department?s Public Transportation Office (PT) administers grants from the Federal Transit Administration (FTA). Six PT employees split their time between two grants; Assistance Listing Number (AL) 20.509 ? Formula Grants for Other than Urbanized Areas and AL 20.513 ? Capital Assistance Program for Elderly and Disabled Persons. The Department charges personnel costs to these two FTA grants by coding the salary and benefits costs for five employees to AL 20.509, and the salary and benefits costs of the one remaining PT employee to AL 20.513. The Department?s method for allocating personnel costs was not updated during fiscal year 2021 or supported by employee records. This method is a budget estimate, and the Department does not have a procedure to support the allocation of personnel charges to the FTA grants in accordance with 2 CFR 200.430. Cause: The Department used the budgeted costs to estimate and ultimately apply 5/6th of personnel costs from the PT employees, or 5 employees, to the AL 20.509 grant and 1/6th of the cost, or 1 employee, to the AL 20.513 grant. Using budgeted estimates is not an allowed technique for allocating personnel costs to various grants. The Department was unable to provide supporting documentation that using these percentages to allocate costs was accurate, and was unaware of the requirements of 2 CFR 200.430 to support the distribution of the employees? salaries and wages. Effect: The Department charged personnel costs of $306,256 to the AL 20.509 grant and $65,892 to the 20.513 grant and could not provide records to support the distribution of those costs. Without records to support the distribution of those costs, the Department is not in compliance with 2 CFR 200.430, and we cannot determine if the correct amount was charged to each grant. Recommendation: We recommend that the Department design and implement procedures to ensure that personnel costs are charged to PTA grants in compliance with 2 CFR 200.430 and to maintain documentation to support those costs. Management?s View: The Idaho Transportation Department (ITD) concurs with the audit finding and recommendation. ITD is developing a new standard operating procedure (SOP) for the employees of the Public Transportation Office to ensure proper recording of their time to the associated federal grant program. The purpose of this plan is to ensure consistency year over year in allocating costs, avoid duplication of costs, and to ensure a more accurate accounting of time spent on each grant program. This SOP will be developed in collaboration with FTA oversight staff to ensure 2CFR200 compliance. The SOP will include an annual reevaluation of tasks and associated time spent to ensure accurate allocation of hours. The evaluation will include an examination of all activities associated with the management of our grants programs, and sub-allocate percentage of time spent based on several factors including but not limited to; number of providers in each program, average number of invoices received, invoice complexity, technical assistance ratings, number of applications, attendee representation, etc. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2020-201 Federal expenditures reported by the Commission to the Office of the State Controller (SCO) were understated by $1.4 million. Type of Finding: Significant Deficiency, SEFA Misstatement CFDA Title: Vocational Rehabilitation Grants to States CFDA Number: 84.126 Federal Award Number: H126A190017, H126A200017, 1901IDILSG, 2001IDILSG Program Year: October 1, 2018 to September 30, 2019; October 1, 2019 to September 30, 2020; October 1, 2018 to September 30, 2019; October 1, 2019 to September 30, 2020 Federal Agency: Department of Education Compliance Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published the Internal Control Integrated Framework which provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. A component of this framework is Control Activities, which are the policies and procedures that help ensure the entity?s objectives are met. The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The requirements for preparing a Schedule of Expenditures of Federal Awards (SEFA) are at 2 CFR 200.510 (b). The State is directed to prepare a SEFA for the fiscal year that must include the total federal awards expended during that year. State agencies are required to report federal expenditures incurred for each federal program during the State fiscal year to the Office of the State Controller (SCO) through the Schedule of Expenditures of Federal Awards (SEFA) closing package. The SCO provides instructions on the completion of the closing package. Condition: The amounts reported by the Commission on the SEFA submitted to the SCO were understated by $1,411,873. The Commission reported expenditures by grant award in columns 2020 and 2019 instead of total expenditures incurred in fiscal year 2020 and fiscal year 2019. The error was identified through our audit procedures, after the understatement was communicated to the Commission a corrected SEFA was submitted to the SCO. This submission also contained errors and expenditures for CFDA 93.369 were understated by $13,055. Cause: The Commission misinterpreted the SEFA instructions provided by the SCO, and the review process did not identify or correct the errors. Effect: Amounts reported on the SEFA were understated for the Rehabilitation Services - Vocational Rehabilitation Grants to States (CFDA 84.126) by $1,339,014 and understated for the Independent Living ?State Grants (CFDA 93.369) by $72,859, a net understatement of expenditures on the SEFA closing package of $1,411,873. This amount is considered a material error for the agency SEFA and a material error for CFDA 84.126, but not material for the statewide SEFA. The Commission was able to resubmit the initial closing package to the SCO. This resubmission resulted in an understatement of $13,055 for CFDA 93.369. This amount is less than material, but is above the trivial threshold for the agency. The Commission did not resubmit a correction for this error. Recommendation: We recommend that the Commission implement procedures to ensure that federal expenditures are reported accurately on the SEFA closing package. Management?s View: The Commission does not agree that this should be a finding or significant deficiency, due to the fact that it was corrected prior to the CAFR being published. The Commission does acknowledge that a mistake was made, initially. Therefore, the Commission has implemented the following procedures to ensure that federal expenditures are reported accurately on the SEFA closing package. Procedures and controls: ? The Senior Financial Technician will run the DAFR 7850 reports to complete the SEFA. ? The Administrative Services Manager will review the SEFA, using the DAFR 7850 to ensure accuracy. ? Next, the Administrative Services Manager will review the SEFA with the Administrator. If there are not errors, they will each approve the SEFA and it will be submitted. Auditor?s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit. While the Commission did submit a corrected SEFA closing package to the State Controller?s Office prior to the Single Audit report being issued, the error was identified during our audit procedures. This demonstrates that internal controls in place were ineffective or inappropriately designed to detect and correct the error in a timely manner. We further assert that a willingness and opportunity to resubmit the closing package does not absolve the agency from the responsibility to have adequate controls in place, had the Commission not been audited the error would have gone uncorrected. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2020-202 The Commission does not have controls in place to ensure that the Case Service Report (RSA-911) for the Vocational Rehabilitation Grants to States is submitted with accurate data. Type of Finding: Significant Deficiency CFDA Title: Vocational Rehabilitation Grants to States CFDA Number: 84.126 Federal Award Number: H126A190017, H126A200017 Program Year: October 1, 2018 to September 30, 2019; October 1, 2019 to September 30, 2020 Federal Agency: Department of Education Compliance Requirement: Reporting Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: Each quarter, the Commission prepares and submits the RSA-911. The RSA-911 is a set of data elements that the Commission must submit to the federal Department of Education electronically. The data is pulled from the Commission?s system, Orion, and uploaded into a federal database. The federal database validates the data before the submission can be completed. If any errors are found, these must be cleared before the submission can be completed. The process for preparing and submitting the RSA-911 is automated and completed by one staff member. There are no internal controls in place to ensure that the information submitted electronically for the RSA- 911 is accurate and supported by underlying records. Cause: The Commission did not design and implement an effective internal control structure that includes a secondary review and approval of federal reports to ensure accuracy and compliance with federal regulations. Effect: Our testing of the RSA-911 found no errors; however, without appropriate internal controls, the Commission may submit performance reports with incomplete or inaccurate information required by the grant agreement. Recommendation: We recommend that the Commission implement and document internal controls to ensure compliance with federal grant reporting requirements. Management?s View: The Commission does not agree with this finding. Submission of the RSA-911 is an automated process, however, the completion of the report is done by field staff. When errors are found in the internal edit checker, the error reports are given to the Vocational Rehabilitation Assistants (VRAs), who correct the information. The case records used to complete the information contained in the RSA-911 are audited randomly by the Rehabilitation Services Chief. The Commission plans to follow the recommendation and has therefore, implemented the following internal controls. In addition, the documentation (error reports) will be saved to demonstrate the process of the editing and correcting and re-running of the edit checker. The RSA 911 Edit Checker open-source program developed for use by state VR agencies and is based on Policy Directive (PD) 19-03. This program is used by the Commission check our quarterly RSA 911 reports for Federal compliance. Procedures and internal controls: ? The field staff enter the 911 data information for each case. ? The Rehabilitation Field Chief is responsible for staff training and maintaining the RSA 911 Field Services Manual. ? The Financial Technician runs the 911 edit checker and receives an error report. He then sends that report back to the VRAs for corrections (with field staff input). The Financial Technician then re-runs the report and this process will continue until there are no errors. Once there are no errors, the 911 data is submitted to RSA. ? The error reports will now be saved for documentation purposed to demonstrate this process. In addition to conducting random annual audits of participant?s record of services, the Rehabilitation Services Chief has recently developed an instrument for conducting internal audits of 911 data reporting by field staff. These random audits are performed on a quarterly basis by the RSC or designated staff member. Auditor?s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit. Federal grantors require recipients of grant funds to establish and maintain effective internal controls over the award. Without documentation of that evidences a review of the report, and any issues found and corrected, we are unable to determine if adequate internal control processes are in place. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2020-203 The Division does not perform subrecipient risk assessments or monitor subrecipient activities as required for the Career and Technical Education (Perkins V) grant. Type of Finding: Material Weakness, Material Noncompliance CFDA Title: Career and Technical Education ? Basic Grants CFDA Number: 84.048 Federal Award Number: V048A190012, V048A180012, V048A170012 Program Year: July 1, 2019 to September 30, 2020; July 1, 2018 to September 30, 2019; July 1, 2017 to September 30, 2018 Federal Agency: Department of Education Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, describes the pass-through entity?s responsibility for administering the necessary requirements on subrecipients so that the federal award is used in accordance with federal regulations. The Division?s requirements as the pass-through entity in providing subawards are identified in 2 CFR 200.331. The Division must evaluate each subrecipient?s risk of noncompliance with federal statutes and the terms and conditions of the subaward when determining the extent of subrecipient monitoring to be completed to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward, and that the subaward performance goals are achieved. The Division is required by 2 CFR 200.303 to establish and maintain effective internal control over the federal award that provides reasonable assurance that the Division is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Additionally, Perkins V requires that each state evaluate annually, using the local adjusted levels of performance described in Section 113(b)(4) of Perkins V (20 USC 2323(b)(4), the career and technical education activities of each subrecipient receiving funds under sections 131 and 132 of Perkins V. Condition: The Division did not perform any risk assessments or monitor subrecipients for any of the subawards made during fiscal year 2020. Cause: The Division was in a transition phase from Perkins IV to Perkins V in fiscal year 2020 and, as such, was developing processes and controls for subrecipient monitoring. Additionally, in March 2020, the Division received notification from the U.S. Department of Education, Office for Civil Rights, to conduct site visits as part of its Vocational Education Methods of Administration civil rights compliance reviews. Combining these reviews allows the Division to visit each subrecipient annually, rather than biannually. With these additional requirements, the Division was unable to implement subrecipient monitoring and risk assessment procedures. Effect: The Division is not in compliance with subrecipient risk assessment and monitoring requirements. During fiscal year 2020, the Division had total expenditures related to Perkins V of $6,432,716; of this, $5,564,960 was distributed to subrecipients. Without adequate monitoring, the Division is exposed to an increased risk of expending funds for unallowable or unsupported costs. Recommendation: We recommend that the Division implement procedures to ensure compliance with all of the requirements as a pass-through entity. We also recommend that the Division design and implement effective internal control procedures to ensure subrecipient monitoring activities are complete and appropriate. Management?s View: The Idaho Division of Career Technical Education (IDCTE) agrees with this finding. Prior to fiscal year 2021, IDCTE was in the process of developing a risk assessment and subrecipient monitoring program with the intent of implementation during state fiscal year 2021. As mentioned in the cause for finding 1, on February 6, 2020, the U.S. Department of Education, Office for Civil Rights (OCR) determined the need for all states to develop a new Methods of Administration (MOA) state plan with a connection to the Perkins V state plan. States had the option to conduct subrecipient monitoring for Perkins V and MOA reviews separately or as a combined process. IDCTE chose to combine the two in an effort to conduct onsite reviews more efficiently. Auditor?s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2020-204 The Division did not meet the minimum maintenance of effort requirements for the Career and Technical Education (Perkins V) grant. Type of Finding: Material Weakness, Material Noncompliance CFDA Title: Career and Technical Education ? Basic Grants CFDA Number: 84.048 Federal Award Number: V048A190012 Program Year: July 1, 2019 to September 30, 2020 Federal Agency: Department of Education Compliance Requirement: Matching, Level of Effort, Earmarking Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Additionally, Section 223(a) of Perkins V (20 USC 2413(a)) requires that a state must provide, from nonfederal sources for state administration under Perkins V, an amount that is not less than the amount provided by the state from nonfederal sources for state administrative costs for the preceding fiscal or program year. Condition: We reviewed the state administration costs spent in fiscal year 2020 compared to the same costs spent in fiscal 2019. In fiscal year 2019, the Division had total administration costs of $486,985; in fiscal year 2020, these costs totaled $444,355. The Division did not meet the maintenance of effort requirement for fiscal year 2020 and underspent administrative costs by $42,630 or 8 percent. The Division uses a spreadsheet to track general costs used to meet some of the maintenance of effort requirements. However, this document does not adequately track compliance with maintenance of effort for administrative costs. Cause: The Division was unaware of the requirement to ensure maintenance of effort was sustained for state administrative costs. Effect: The Division was 8 percent, or $42,630 short of meeting its maintenance of effort requirement for the Perkins V grant. Recommendation: We recommend that the Division develop and implement internal control procedures to ensure maintenance of effort requirements are met. Management?s View: IDCTE is in partial agreement with this finding. IDCTE agrees controls can be strengthened to include a review and signature process. However, IDCTE disagrees with the materiality of the difference in administrative costs year-over-year. IDCTE?s administrative costs at the state level related to Perkins V are all tied to salaries and benefits except for an occasional onetime transaction. In fiscal year 2020, IDCTE experienced a staffing change resulting in $11,007.19 in salary savings. At the same time, IDCTE restructured the organization and effectively minimized the impact of those salary savings. Total salary and benefit expenditures during fiscal year 2020 were $444,355 compared to $446,385 for fiscal year 2019 for a difference of $2,630 (0.6%). Fiscal year 2019 also reflects a higher expenditure amount than fiscal year 2020 due to a one-time transaction for review and expansion of the Technical Skills Assessment system paid to the vendor, Career and Technical Education Consortium of States (CTECS), at a cost of $40,000. One-time expenditures are not required to be included in the Maintenance of Effort (MOE) total in accordance with Sec. 211.(b)(1)(B) of the Perkins V Act. Auditor?s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. As discussed in the condition and the cause section of the finding, the Division used a spreadsheet to track costs in general, but was unaware of this specific requirement and did not have a control in place to ensure MOE requirements for administrative costs were met or that costs were monitored. The classification for a material weakness is based on the fact that the Department had not adequately designed and implemented internal controls to reduce the risk of a material noncompliance. 2 CFR 200.514 (c) (4) further requires that when internal control over some or all of the compliance requirements for a major program are likely to be ineffective in preventing or detecting noncompliance, the auditor must report a significant deficiency or material weakness in accordance with 2 CFR 200.516. 2 CFR 200.516(a)(1) and (2) both provide further guidance that an auditor?s determination of whether a deficiency is a significant deficiency or material weakness, and/or a material noncompliance, is in relation to the type of compliance requirement for a major program, not the entire program. Not only was the identified compliance error in excess of our materiality percentage for this compliance requirement, without appropriately designed and implemented internal controls the Division continues to risk incurring a material noncompliance that goes undetected and corrected. Section 211 (b)(1)(B) of the Perkins V act establishes the computation of the fiscal effort required by the state and it notes that the Secretary shall, at the request of the State may exclude one-time expenditures. The Division has not indicated they requested an exception or provided any documentation of the request to exclude one-time expenditures. It should be noted that Section 211 seemingly only applies to the Divisions requirement to maintain spending for general costs for career and technical education. Section 211(b)(1)(A) states that for a State to receive their full allotment of funds, that the State?s fiscal effort per student or in the aggregate, with respect to career and technical education, for the preceding fiscal year is not less than the fiscal effort for the second preceding fiscal year. Section 223 (a) states that for each fiscal year the State shall provide, from non- Federal sources for the costs for the administration, an amount that is not less than the amount provided by the State from non-Federal sources for such costs for the preceding fiscal year. Section 223 does not provide for exclusions of one-time costs. These sections discuss the different level of effort requirements for general and administrative costs and illustrate different rules for these costs. As such, we have determined that the classification of material noncompliance to be accurate and that the exception noted in the corrective action plan does not apply to these administrative costs.

FINDING 2020-205 Internal controls over the review of match requirements for the Career and Technical Education (Perkins V) grant are not sufficiently documented. Type of Finding: Significant Deficiency CFDA Title: Career and Technical Education ? Basic Grants CFDA Number: 84.048 Federal Award Number: V048A170012 Program Year: July 1, 2017 to September 30, 2018 Federal Agency: Department of Education Compliance Requirement: Matching, Level of Effort, Earmarking Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Division is required to submit interim and final financial reports for the Perkins V grants. The Division typically verifies that the state match compliance has been met during the review and approval of the final financial report. The review and approval of the report is not retained. During fiscal year 2020, the Division finalized the fiscal year 2018 grant award. We reviewed the final report for the fiscal year 2018 grant award and found no evidence of a review. We also noted the Division did not retain support from the preparation of the report that supports the amounts reported as match. Cause: The Division?s internal control procedures were not properly designed to include retention of evidence of the review and supporting documentation to verify compliance with match requirements. Effect: During testing of the fiscal year 2018 award, we found the match requirement was met; however, without appropriate internal controls, the Division risks noncompliance with match requirements. Recommendation: We recommend that the Division design and implement controls over ensuring the match requirement is met to ensure compliance with federal requirements. Management?s View: IDCTE agrees with the finding. Review and approval are currently performed prior to the Chief Fiscal Officer (CFO) entering their personal identification number into the Perkins Web Portal (designed and operated by OCTAE) for the Consolidated Annual Report. Unfortunately, the audit trail provided by the portal only includes the IDCTE Administrator?s timestamped approval and not that of the CFO. Additionally, internal controls include budgeting and system limit controls based on the federal grant allocation as submitted via the Perkins Web Portal, which includes the administrative match. Subsequently and throughout the grant period, internal reporting and review is completed at least monthly. Auditor?s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

FINDING 2020-206 The Office?s internal review process did not identify errors in the Schedule of Expenditures of Federal Awards (SEFA). Type of Finding: Material Weakness, SEFA Misstatement CFDA Title: Coronavirus Relief Fund CFDA Number: 21.019 Federal Award Number: 20-1892-0-1-806 Program Year: March 1, 2020 to December 30, 2020 Federal Agency: Department of Treasury Compliance Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions. It provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relates to obtaining quality information and effective internal and external communication of that information to achieve management objectives. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in the Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR ?200.510(b)), which states it must include: ? Total federal awards expended as determined in accordance with 2 CFR ?200.502, ? The total amount provided to subrecipients from each federal program. Condition: Expenditures reported on the SEFA for the Coronavirus Relief Fund program, CFDA 21.019, were overstated by $243,162,252. The Office of the Governor included $300,000,000 advanced to the Idaho State Tax Commission as a subrecipient; however, not all the amount was expended during fiscal year 2020 by the Idaho State Tax Commission. The amount expended in fiscal year 2020 by the Idaho State Tax Commission was $56,837,748, resulting in a variance of $243,162,252. The Office completes a reconciliation process for the SEFA closing packages to adjust for inter-agency activities. In this instance, the amount included on the SEFA for this portion of the Coronavirus Relief Fund program should have been limited to the $56,837,748 actually expended by the Idaho State Tax Commission. The SEFA error was neither identified in the reconciliation process during the compilation of the SEFA nor during the review of the SEFA compilation. In addition, through our audit work at the Department of Labor and Idaho Commission for the Blind and Visually Impaired, we noted that the amounts of federal expenditures reported by those agencies to the Office for the SEFA were understated. For further information about the understatement from the Department of Labor, see finding number 2020-2015, and from the Idaho Commission for the Blind and Visually Impaired, see finding number 2020-201. Each of the understated amounts were individually immaterial to the statewide SEFA and corrected amounts were submitted by the agencies to the Office, which were included in the final statewide SEFA. Cause: The compilation process used for the SEFA included a review by a staff member independent of the staff member completing the work. However, these review procedures did not detect an error on the SEFA related to the Coronavirus Relief Fund program expenditures for the Office of the Governor when the SEFA closing package was submitted to the Office. Effect: The SEFA submitted for audit included an overstatement of $243,162,252 for the Coronavirus Relief Fund program, CFDA 21.019. The amount in error was material and was also corrected on the final SEFA submission. Recommendation: We recommend that the Office strengthen the review process over the compilation of the SEFA to ensure complete and accurate compliance with the federal reporting requirements. Management?s View: The State Controller?s Office acknowledges and agrees with the error identified by the auditors. The error was corrected prior to the issuance of the SEFA. The office will improve the review process to ensure any discrepancies between workpapers are looked at critically to determine the correct reporting. Auditor?s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit.

FINDING 2020-207 Five of the twenty-two capital assets purchased or constructed with Bonneville Power Administration and Lower Snake River Compensation Plan grant funds were not recorded in the State of Idaho Fixed Asset System (FAS), which is not in compliance with State and federal equipment and real property management requirements. Type of Finding: Significant Deficiency, Noncompliance CFDA Title: Lower Snake River Compensation Plan; Miscellaneous Bonneville Power Administration Grants CFDA Number: 15.661; 81.U17 Federal Award Number: FA16AC00028, 81380, Contract 2007-39-00 Exp Up Salmon Scree Trib Pass Program Year: December 9, 2015 through September 30, 2020; February 1, 2019 to January 1, 2020 Federal Agency: Department of Interior; Department of Energy Compliance Requirement: Equipment and Real Property Management Questioned Costs: None Criteria: The Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards 2 CFR 200.313 contains the provisions for purchasing, utilizing, and disposing equipment acquired under a federal award. Equipment is defined as tangible personal property, including information technology systems, having a useful life of more than one year and a per-unit acquisition cost which equals or exceeds the capitalization threshold level established by the nonfederal entity for financial statement purposes or $5,000. In general, equipment acquired under a federal award will vest in the nonfederal entity subject to certain conditions, including that a state must use, manage, and dispose of equipment acquired under a federal award by the state in accordance with state laws and procedures. The fiscal policies of the State of Idaho, including those related to capital assets such as equipment are established by the Office of the State Controller (SCO) in accordance with Idaho Code, Title 67, Chapter 10. The SCO created the Fiscal Policy Advisory Committee to establish uniform administrative, accounting, and reporting standards and guidelines for State agencies. Applicable capital asset policies are as follows: ? State agencies must use the statewide Fixed Asset System (FAS) or another system approved by the SCO to keep track of fixed assets. ? Managers of each State agency have the responsibility to record, at a minimum, all inventoriable capital assets with a capitalizable threshold of $5,000. The CFR Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards 2 CFR 200.303 states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Department uses FAS as its capital asset record system. The Department obtains capital assets through both direct purchases and construction. Purchased assets are entered into a FAS holding file to await review and release into FAS. When assets are constructed, the expenses are tracked separately until completion. Upon completion, these expenses are summarized to determine the total value of the assets, and this amount is entered into FAS. During fiscal year 2020, the Department purchased six recordable capital assets with Lower Snake River Compensation Plan (LSRCP) grant funds, but only five were recorded in FAS. The Department also purchased or constructed sixteen recordable capital assets with Bonneville Power Administration (BPA) grant funds, but only twelve were recorded in FAS. Cause: The Department?s procedure for entering assets into FAS includes a review of the hold file to identify all purchased items. However, during fiscal year 2020, a purchased asset was removed from the hold file without documentation to alert a reviewer that this had occurred. Additionally, there is no automated reminder or other review control to ensure that constructed fixed assets are properly recorded. Effect: One capital asset valued at $17,378 in the LSRCP and four capital assets valued at $54,889 in BPA were not properly recorded in FAS, as required by the State policies. Proper recording and tracking of capital assets is essential to ensure compliance with federal grant requirements. Recommendation: We recommend that the Department strengthen its control procedures to ensure all capital assets are correctly entered to FAS in compliance with State policies. Management?s View: The Department has reviewed the purchase and construction projects referenced in the finding and agrees with the auditors' assertion that these were not properly recorded in the Fixed Asset System (FAS). The construction projects consisted of fabrication and installation of 5 fish screens that were installed on privately held properties during Fiscal Year 2020. Our judgment at the time of recording the expense was that, since these are long-term fixtures on privately owned property, they did not need to be recorded in FAS. However, in reviewing the applicable Idaho statute and fiscal policies, we concur with the auditors that these should have been recorded, regardless of ownership. Regarding the capital asset valued at $17,378 in the Lower Snake River Compensation Plan (LSRCP) program, the Department asserts that it appropriately identified the asset for entry in FAS and took the initial steps to record it. However, the entry was inadvertently deleted from the FAS hold file before it could be processed. The Department believes the deletion was an isolated incident and is not a systemic issue. In response to the finding, the Department will enter the FY20 assets identified into FAS. In addition, it will develop a periodic secondary review procedure to ensure assets are recorded in the capital asset record system when appropriate. We anticipate both the entry and the procedure will be implemented by June 30, 2021. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2020-208 The Department did not provide access to program personnel to allow auditors to obtain sufficient appropriate audit evidence that control, accountability, and required safeguarding procedures are in place for vaccines received through the Immunization Cooperative Agreements Program. Type of Finding: Disclaim Opinion CFDA Title: Immunization Cooperative Agreements CFDA Number: 93.268 Federal Award Number: NH23IP922633 Program Year: July 1, 2019 to June 30, 2024 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The Department is required to maintain effective control and accountability for all vaccines under the Vaccines for Children (VFC) program. Regulations under U.S. Code Title 42 Subchapter 1396 require vaccines to be adequately safeguarded and used solely for authorized purposes of the program. This includes administration only to VFC program-eligible children, regardless of the child?s parent?s ability to pay. The Department is also responsible to provide oversight of program enrolled providers to ensure that proper control and accountability is maintained for the vaccine, the vaccine is properly safeguarded according to the Centers for Disease Control and Prevention (CDC) guidance, and VFC-eligibility screening is conducted. Condition: During our audit, we were unable to obtain sufficient appropriate audit evidence to support an opinion on compliance with Special Test #1 from the Compliance Supplement issued by the Office of Management and Budget for CFDA 93.268 Immunization Cooperative Agreements. The Department did not provide access to program personnel so that the necessary audit procedures and documentation could be completed to determine compliance with federal requirements. On multiple occasions from November 2020 through February 2021 we requested access to meet with program personnel to review the oversight procedures and internal controls the Department used to comply with the special test requirement. Information needed included identifying the oversight procedures the Department utilized to ensure proper control and accountability is maintained for vaccines, that the vaccine is properly safeguarded based on guidance provided by the CDC, and that eligibility screening is conducted. Cause: Department management met with us on several occasions from November 2020 through February 2021 and stated that the demands of the ongoing COVID-19 pandemic have significantly increased the Immunization Program workload and there is not capacity to accommodate auditor requests to meet with key staff members that would assist us in obtaining sufficient, appropriate audit evidence related to this compliance requirement. As a consequence of the limitation to obtain sufficient, appropriate evidence, it was not possible for conclusions to be drawn about the implementation, operation, or effectiveness of internal controls. In addition, we were unable to determine compliance with federal requirements identified in the Special Tests section of the Compliance Supplement. Effect: The possible effects of this inability to obtain sufficient appropriate audit evidence is deemed to be material to this compliance requirement and an opinion on compliance cannot be provided relative to this compliance requirement. Recommendation: We recommend that the Department provide accurate and timely information, including access to key staff members, to allow the auditors to obtain sufficient appropriate audit evidence to evaluate internal controls as they relate to the Immunizations Program and to support an opinion on compliance with federal requirements. Management?s View: The department agrees with this finding. The department assessed the risk of diverting resources from coordinating the COVID-19 vaccine distribution to fulfilling audit requests and determined the higher priority was to focus on the critical COVID-19 vaccine rollout. We anticipate this finding to be a one-time occurrence since the current effort to vaccinate as many Idahoans as possible for COVID-19 is expected to be a one time event. Going forward, the department's focus on COVID-19 vaccine distribution will evolve into a normal governance, distribution and monitoring process similar to other vaccines, allowing the department Immunization Program staff to respond to future audit requests in a timely manner. Auditor?s Concluding Remarks: We thank the Department for the response provided for this finding.

FINDING 2020-209 The Department did not provide access to program personnel to allow auditors to obtain sufficient appropriate audit evidence to support an opinion on compliance with requirements related to immunization records. Type of Finding: Disclaim Opinion CFDA Title: Immunization Cooperative Agreements CFDA Number: 93.268 Federal Award Number: NH23IP922633 Program Year: July 1, 2019 to June 30, 2024 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The Department is required to maintain a record of vaccine administered in each person?s permanent medical record, according to 42 USC 300aa-25, that includes the date of vaccine administration; vaccine manufacturer and lot number; and name, address, title of the health care provider administering the vaccine. The Department is also responsible for the oversight of vaccinating providers to ensure that the required information has been recorded for vaccine recipients. Condition: During our audit, we were unable to obtain sufficient appropriate audit evidence to support an opinion on compliance with Special Test #2 from the Compliance Supplement issued by the Office of Management and Budget for CFDA 93.268 Immunization Cooperative Agreements. Despite several requests communicated from November 2020 through February 2021, we were unable to access program personnel so that the necessary audit procedures could be completed to assess internal controls and determine compliance with federal requirements. Cause: Department management met with us on several occasions and stated that the demands of the ongoing COVID-19 pandemic have significantly increased the Immunization Program workload and there is not capacity to accommodate auditor requests to meet with key staff members that would assist us in obtaining sufficient, appropriate audit evidence related to this compliance requirement. As a consequence of the limitation to obtain sufficient, appropriate evidence, it was not possible for conclusions to be drawn about the implementation, operation, or effectiveness of internal controls. In addition, we were unable to determine compliance with federal requirements as identified in the Special Tests section of the Compliance Supplement. Effect: The possible effects of this inability to obtain sufficient appropriate audit evidence is deemed to be material and an opinion on compliance cannot be provided relative to this compliance requirement. Recommendation: We recommend that the Department provide accurate and timely information, including access to key staff members, to allow the auditors to obtain sufficient appropriate audit evidence to evaluate internal controls as they relate to the Immunizations Program and to support an opinion on compliance with federal requirements. Management?s View: The department agrees with this finding. The department assessed the risk of diverting resources from coordinating the COVID-19 vaccine distribution to fulfilling audit requests and determined the higher priority was to focus on the critical COVID-19 vaccine rollout. We anticipate this finding to be a one-time occurrence since the current effort to vaccinate as many Idahoans as possible for COVID-19 is expected to be a one time event. Going forward, the department's focus on COVID-19 vaccine distribution will evolve into a normal governance, distribution and monitoring process similar to other vaccines, allowing the department Immunization Program staff to respond to future audit requests in a timely manner. Auditor?s Concluding Remarks: We thank the Department for the response provided for this finding.

FINDING 2020-210 The Department utilized the incorrect National Correct Coding Initiative (NCCI) edit files in processing Medicaid payments that could result in improper payments because of outdated payment rates for procedures, changes in procedures allowed by Medicaid, and other changes to the edit files. Type of Finding: Noncompliance CFDA Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII); Medicare Medical Assistance Program (Medicaid; Title XIX) CFDA Number: 93.777; 93.778 Federal Award Number: 1905ID5000, 1905ID5002, 1905IDPACT, 1905ID5ADM, 1905ID5028, 1905ID5MAP, 1905IDIMPL, 1905IDINCT, 2005ID5000, 2005ID5002, 2005ID50C3, 2005IDPACT, 2005ID5ADM, 2005ID5028, 2005ID5MAP, 2005IDIMPL, 2005IDINCT Program Year: October 1, 2018 to September 30, 2019; October 1, 2019 to September 30, 2020; October 1, 2019 to December 31, 2019; January 1, 2020 to March 31, 2020 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The Department is required to incorporate NCCI methodologies into the State Medicaid programs pursuant to the requirements of Section 6507 of the Affordable Care Act, section 1903(r) of the Social Security Act. The Medicaid Technical Guidance Manual 2020 section 7.0 requires the Department to download the NCCI edit files that are available through the Medicaid Integrity Institute (MII), a division of the Centers for Medicare and Medicaid Services (CMS), using a secure portal (RISSNET). The publicly available files located on the Medicaid NCCI webpage are not for use by states. Access to the complete quarterly NCCI edit files available through MII?s RISSNET portal is limited to a state?s Medicaid agency. These state-only NCCI edit files contain information that is not included in the publicly available NCCI edit files, medically unlikely edits (MUE) that are no longer in effect, MUE effective dates and deletion dates, current MUE effective dates, and Correspondence Language Identification Number (CLEID) for procedure-to-procedure (PTP) edits. Condition: In paying Medicaid claims, the Department is required to implement NCCI methodologies to ensure that only proper payments of procedures are reimbursed. The Department is also required to download the correct quarterly edit files from the Medicaid Integrity Institute. Audit procedures included inquiries of Medicaid program personnel to ascertain if appropriate NCCI procedures were implemented. The Department contracted with DXC Technology Services for the processing of the NCCI edit files. DXC Technology Services contracted with Context 4 to receive the NCCI edit files. Inquiries found that the files received by Context 4 were the publicly available edit files and not the state Medicaid agency edit files available through Medicaid Integrity Institute and the RISSNET portal, as required by the Medicaid Technical Guidance Manual. Gainwell Technologies purchased DXC Technology Services in October 2020 and took over existing contracts and agreements in place at the time, including the contract with Context 4. Cause: The Department did not have procedures in place to ensure the correct NCCI edit file was utilized. The current contracts in place do not require or specify the use of the NCCI edit files available through the Medicaid Integrity Institute. Further, the Department was not aware that the contractor was using the incorrect NCCI edit files and not obtaining the correct edit file through Medicaid Integrity Institute using the RISSNET portal. Effect: Despite no improper payments being identified during audit testing procedures, the Department?s use of the public NCCI edit files, instead of the state Medicaid agency edit files, could lead to incorrect payment edits being processed and creating improper payments. Recommendation: We recommend that the Department review payments processed under the incorrect NCCI edit files to identify any incorrect payments, modify contracts with outside vendors to ensure all compliance requirements are specified in contract language, and implement review procedures of contractor?s work to ensure the appropriate NCCI edit files are utilized in accordance with the Medicaid Technical Guidance Manual requirements. Management?s View: The Department agrees with the finding as noncompliance. The Division's Medicaid Enterprise System (MES) operations team has already gained access to the RISSNET portal and downloaded the correct NCCI edit file. The team is currently working on a method to deliver the file to Gainwell Technologies (formerly DXC Technology Services) and their sub vendor, Context4. The file will need to be delivered to Context4 to be formatted for ingestion into the claims adjudication engine. Upon receipt, Context4 will need time to evaluate and format the file to be used by the claims engine. Once Context4 has the file they will be able to compare the publicly available file to the Medicaid file. This will allow us to evaluate if there were claims paid in error. The MES team is engaged with both vendors and it is anticipated that this process should be complete by July 1, 2021. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2020-211 Confidentiality agreements in place with Medicaid contractors did not include all required elements to ensure compliance with the Medicaid program. Type of Finding: Noncompliance CFDA Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII); Medicare Medical Assistance Program (Medicaid; Title XIX) CFDA Number: 93.777; 93.778 Federal Award Number: 1905ID5000, 1905ID5002, 1905IDPACT, 1905ID5ADM, 1905ID5028, 1905ID5MAP, 1905IDIMPL, 1905IDINCT, 2005ID5000, 2005ID5002, 2005ID50C3, 2005IDPACT, 2005ID5ADM, 2005ID5028, 2005ID5MAP, 2005IDIMPL, 2005IDINCT Program Year: October 1, 2018 to September 30, 2019; October 1, 2019 to September 30, 2020; October 1, 2019 to December 31, 2019; January 1, 2020 to March 31, 2020 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The Medicaid Technical Guidance Manual 2020 Section 7.1.2 requires that the following elements be included in the confidentiality agreements for any contracted party using the Medicaid NCCI files posted on the MII: ? Disclosure shall be limited to only those responsible for the implementation of the quarterly state Medicaid NCCI edit files. Disclosure shall not be made prior to the start of the new calendar quarter. ? After the start of the new calendar quarter, a Contracted Party may disclose only nonconfidential information contained in the Medicaid NCCI edit files that is also available to the general public found on the Medicaid NCCI webpage. ? The Contracted Party agrees to use any non-public information from the quarterly state Medicaid NCCI edit files only for any business purposes directly related to the implementation of the Medicaid NCCI methodologies in the particular state. ? New, revised, or deleted Medicaid NCCI edits shall not be published or otherwise shared with individuals, medical societies, or any other entities unless it is a Contracted Party prior to the posting of the Medicaid NCCI edits on the Medicaid NCCI webpage. ? Implementation of New, revised, or deleted Medicaid NCCI edits shall not occur prior to the first day of the calendar quarter. ? Only a state Medicaid agency has the discretion to release additional information for selected individual edits or limited ranges of edits from the files posted on the MII. ? State Medicaid agencies must impose penalties, up to and including loss of contract, for violations of any confidentiality agreement relating to use of the MII edit files. Condition: The Department has a confidentiality agreement with DXC Technology Services; however, there was not a separate confidentiality agreement with Context 4, with whom DXC Technology Services contracts. In addition, the confidentiality agreement in place with DXC Technology Services does not include all the required elements per the Technical Guidance Manual. Cause: The Department did not have procedures in place to ensure confidentiality agreements included all of the elements required by the Medicaid Technical Guidance Manual 2020. Further, the Department was not aware of the confidentiality agreement requirements for contracted parties working with the NCCI edit files. Effect: Without all parties understanding and agreeing to the required confidentiality agreement components, confidential Medicaid NCCI edit file data could be improperly released. Recommendation: We recommend that the Department ensure that confidentiality agreements are in place with the required parties and that the agreements contain all of the necessary components. Management?s View: The Department agrees with the finding as noncompliance. The Division's Medicaid Enterprise System (MES) operations team will draft and execute a new NCCI Edit Confidentiality Agreement to address the missing required elements specific to NCCI editing with all applicable contractors. It is anticipated that this should be complete by July 1, 2021. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2020-212 Subrecipient monitoring procedures are not adequate to ensure compliance with federal requirements for the Crime Victim Assistance program. Type of Finding: Material Weakness, Material Noncompliance Related to Prior Finding: 2019-206 CFDA Title: Crime Victim Assistance CFDA Number: 16.575 Federal Award Number: 2016-VA-GX-060, 2017-VA-GX-056, 2018-V2-GX-0002, 2019-V2-GX- 0066, 2020-V2-GX-0065 Program Year: October 1, 2015 to September 30, 2019; October 1, 2016 to September 30, 2020; October 1, 2017 to September 30, 2021; October 1, 2018 to September 30, 2022; October 1, 2019 to September 30, 2023 Federal Agency: Department of Justice Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The Code of Federal Regulations (CFR) 2 CFR 25.200 and 2 CFR 200.331 identify requirements for the Department when functioning as the pass-through entity providing subawards. The Department must evaluate each subrecipient?s risk of noncompliance with subaward requirements to determine the extent of subrecipient monitoring completed. In addition, monitoring must also include a review of financial and performance reports required by the pass-through entity; follow up on any deficiencies identified in the subrecipient that are detected through audits, on-site reviews, and other means; and issuing a management decision for audit findings as required by 2 CFR 200.521. The Department must also verify that every subrecipient is audited, as required by Subpart F ? Audit Requirements of 2 CFR 200, when the subrecipient expends $750,000 or more in federal awards during the fiscal year. Additionally, the Victims of Crime Act (VOCA) Victim Assistance Program Guidelines require the State to develop and implement a monitoring plan, which must include a risk assessment. The Victim Assistance Program Guidelines also require the State to conduct on-site monitoring at least once every two years. Condition: We reviewed the Department?s monitoring of subrecipients for fiscal year 2020 and found one subrecipient monitored in fiscal year 2020. Three subrecipients were monitored in fiscal year 2019, bringing the total to 4 out of 46 subrecipients, or 9 percent, for the fiscal year 2019-2020 two-year period. Further review found that the subrecipient monitoring did not include a review of the audit reports if the subrecipient exceeded $750,000 and required a single audit. Cause: The Department adopted new policies and procedures for subrecipient monitoring in March 2020 that were implemented with the next round of annual subrecipient awards in the beginning of fiscal year 2021. However, full implementation of the subrecipient monitoring was delayed due to significant staff turnover and staff medical leave. As soon as new staff were hired and trained, continued plans for on-site monitoring visits were derailed due to the COVID-19 pandemic. The federal Office of Victims of Crime provided guidance in December 2020 that allows for remote monitoring. The Department modified monitoring procedures to allow for a remote environment and implemented a remote monitoring schedule to review all sub-recipients in 2021. Effect: Without adequate monitoring of subrecipients, the Department is exposed to an increased risk of expending funds for unallowable or unsupported costs. Recommendation: We recommend that the Department implement procedures to ensure compliance with all of the requirements of a pass-through entity. We also recommend that the Department design and implement effective internal control procedures to ensure subrecipient monitoring activities are complete and appropriate. Management?s View: The Council [Idaho Council on Domestic Violence and Victim Assistance] acknowledges that monitoring was not done; in 2019 this was a capacity issue and in 2020, the pandemic prevented monitoring. The Council adopted an enhanced desk review policy to allow for virtual monitoring October 30, 2020. Thereafter we adapted our monitoring tools and checklists and adopted a monitoring plan which includes monitoring of all subrecipients, as well as checking for audit compliance and updating risk assessments as part of that process. The monitoring plan is available on request and all subrecipients will be monitored by the end of 2021. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2020-213 Subrecipient eligibility is not adequately documented or reviewed for compliance with federal requirements of the Crime Victim Assistance program. Type of Finding: Significant Deficiency, Noncompliance Related to Prior Finding: 2019-205 CFDA Title: Crime Victim Assistance CFDA Number: 16.575 Federal Award Number: 2016-VA-GX-060, 2017-VA-GX-056, 2018-V2-GX-0002, 2019-V2-GX- 0066, 2020-V2-GX-0065 Program Year: October 1, 2015 to September 30, 2019; October 1, 2016 to September 30, 2020; October 1, 2017 to September 30, 2021; October 1, 2018 to September 30, 2022 October 1, 2019 to September 30, 2023 Federal Agency: Department of Justice Compliance Requirement: Eligibility Questioned Costs: None Criteria: The Uniform Guidance given in the U.S. Code of Federal Regulations (CFR) 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The terms and conditions of the grant award requires the State and its subrecipients to comply with the conditions of the Victims of Crime Act (VOCA). Any organization funded with VOCA assistance funding must meet eligibility criteria, which includes: a. being operated by a public agency or nonprofit organization that provides services to victims of crime; b. demonstrating effective victim services with financial support from non-VOCA funding; and c. using volunteers to provide crime victim services. Condition: Crime Victim Assistance grant activities are carried out through subrecipients that submit applications to the Department that include information to support compliance with the subrecipient eligibility requirements. There were 46 subrecipients identified as receiving grant funding; however, there are no documented controls procedures over the evaluation of each subrecipient application before funding was awarded. The Department has developed policies and procedures to ensure subrecipients receiving VOCA funding meet eligibility criteria, which were implemented for the fiscal year 2021 grant cycle. Cause: There are no internal control procedures in place to ensure that the eligibility of subrecipients is correctly determined and documented in fiscal year 2020. High employee turnover in prior years contributed to a lack of procedures being developed to ensure funding was awarded to eligible subrecipients. This was identified as a compliance issue in the prior year audit report finding 2019-205, however, subrecipient eligibility and award determinations were made for the fiscal year 2020 grant cycle prior to program personnel learning of this compliance requirement. Effect: Federal funds could be passed through to subrecipients that do not meet the eligibility requirements applicable to the federal program. Recommendation: We recommend that the Department implement internal control procedures to ensure an adequate review and determination of subrecipient eligibility is completed and documented in compliance with federal grant requirements. Management?s View: The Council [Idaho Council on Domestic Violence and Victim Assistance] acknowledges that prior to FY21, there was not an established eligibility verification procedure in place. An eligibility checklist was developed and implemented for the FY21 grant cycle (subawards correspond with the state fiscal year) and the checklist is available upon request. Eligibility will be verified prior to the awarding of grants in FY22 as well, and moving forward. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2020-214 Special reports and performance reports required for the Crime Victim Assistance grant were submitted after the due date, and dates of original report submission were not documented. Type of Finding: Significant Deficiency, Noncompliance Related to Prior Finding: 2019-208 CFDA Title: Crime Victim Assistance CFDA Number: 16.575 Federal Award Number: 2016-VA-GX-060, 2017-VA-GX-056, 2018-V2-GX-0002, 2019-V2-GX- 0066, 2020-V2-GX-0065 Program Year: October 1, 2015 to September 30, 2019; October 1, 2016 to September 30, 2020; October 1, 2017 to September 30, 2021; October 1, 2018 to September 30, 2022; October 1, 2019 to September 30, 2023 Federal Agency: Department of Justice Compliance Requirement: Reporting Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The Uniform Guidance given in the U.S. Code of Federal Regulations (CFR) 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The federal Victims of Crime Act (VOCA) grant award from the Office of Victims of Crime (OVC) requires the State to submit a Subgrant Award Report for each subgrantee within 90 days of awarding funds to subgrantees. The award terms and conditions require the State to submit quarterly performance reports on the performance metrics identified by OVC within 45 day of the quarter end date. The State is also required to submit a final performance report within 90 days after the end date of the award. Condition: The following conditions are related to reporting for the Crime Victim Assistance grant: ? Special Reporting o The Department had no documented control to ensure accurate and timely submission for special reporting. The same staff member completed and approved the subgrant award reports on the OVC application with no documentation indicating another staff member completed a review or approval. o We tested the subgrant award reports and noted 7 out of 7 subgrant award reports, or 100 percent, were submitted past the deadline. All of the reports were due September 30, 2019, and some were not submitted until November 2019 and others submitted in July 2020. ? Performance Reporting o There was no documented review for accuracy of the quarterly performance reports. Quarterly performance reports are submitted to the OVC, which accumulate information for the annual performance report and the final performance report at the end of the grant period. o We reviewed the Department?s 4 quarterly performance reports and noted 3 out of 4 reports, or 75 percent, were submitted late. Cause: The Department did not have an effective internal control structure in place during fiscal year 2020 that included a secondary review and approval of federal reports to help ensure accuracy and compliance with federal regulations. The Department has since implemented new policies and procedures there were implemented in fiscal year 2021. The Department also relied on the federal reporting system to document and retain information related to report submission dates; however, the report filing dates in the federal system appear to update when report amounts are edited or updated. The OVC has since confirmed that the federal reporting system should not be relied on for official tracking and that the Department should maintain their own system of tracking. Effect: Reports were submitted late and the lack of internal control procedures over reporting resulted in noncompliance that went undetected by the Department. The lack of review over reporting increases the risk that misstatements and noncompliance could occur and go undetected by the Department. Recommendation: We recommend that the Department implement, strengthen, and document internal controls to ensure compliance with federal grant reporting requirements. We further recommend that the Department implement procedures to document and maintain dates that all reports are submitted. Management?s View: The Council [Idaho Council on Domestic Violence and Victim Assistance] acknowledges that it relied on the federal PMT system to document when reports were submitted, and it turns out that program should not be relied upon for submission dates as it reflects a "change" in the date when a report is reviewed. The SARs and performance reports were submitted on time, but unfortunately this was not separately documented. The Council has now devised a spreadsheet to tack the dates of submission of both the SARs and the performance reports, and included the review of a second staff person (and the date of review). The new controls were in place for the performance reports due in February of 2021and will be used thereafter. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2020-215 The Schedule of Expenditures of Federal Awards (SEFA) was understated by $98,754,522 for the Unemployment Insurance grant. Type of Finding: Significant Deficiency, SEFA Misstatement CFDA Title: Unemployment Insurance (UI) Programs CFDA Number: 17.225 Federal Award Number: UI-32596-19-55-A-16, UI34055-20-55-A-16 Program Year: October 1, 2018 to December 31, 2021, October 1, 1019 to December 31, 2022 Federal Agency: U.S. Department of Labor ? Employment and Training Administration (DOL/ETA) Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a SEFA for the fiscal year that must include the total federal awards expended. State agencies are required to report federal expenditures incurred for each federal program during the State fiscal year to the Office of the State Controller (Office) through the SEFA closing package. The SCO provides instructions for the completion of the closing package. The instructions state that agencies should complete the SEFA closing package if the agency received and expended any direct or subrecipient federal awards during the year. Management is responsible for establishing a process for preparing accounting information based on relevant, sufficient, and reliable data. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. These activities include adequate review and authorization of financial reporting and using the general ledger or other reliable records as the basis for reports. Information and communication is the identification, capture, and exchange of information, including adequate source documentation to support financial transactions. Condition: The Department receives federal funding from the Federal Department of Labor for the Unemployment Insurance program. The initial amounts reported in the SEFA closing package as federal expenditures for the Unemployment Insurance program was $608,127,750. Our audit procedures determined the correct amount should have been $706,882,272. Cause: There are three separate causes for the understatement on the SEFA closing package. The Department runs monthly reports and reconciles them to the internal system. Once this is completed, the reports are saved in a public folder to allow other Department employees access for various uses, including closing package reporting. During the last quarter of the fiscal year, an error was detected and corrected in one of the reports posted to the public folder; however, the erroneous report was not replaced with the corrected report in the public folder. Department personnel used the erroneous report to create the schedules that were sent to the Office in the closing packages, causing an understatement of $92,684,920. Some Disaster Unemployment Assistance (DUA) expenditures were coded to an incorrect account number in the Department?s internal system. The total expenditures coded to the correct DUA account number were used to complete the SEFA closing package. The omission of the incorrectly coded expenditures caused an understatement of $819,790. During the COVID-19 pandemic, the Department agreed to waive the requirement that an applicant must wait one week before receiving benefits, and in return, the federal Department of Labor reimbursed the State for the cost of the first week of Unemployment Insurance benefits. The Department did not consider the reimbursements to be federal grant funds and incorrectly omitted them from the SEFA closing package, causing an understatement of $5,249,792. The Department has a control procedure in place to review the closing package information before submitting it to the Office. Our testing found that this review occurred, but did not detect the errors. During the fiscal year, the Department had turnover within its accounting group resulting in a new reviewer assigned to this closing package. The reviewer ensured that the closing package schedule tied to the supporting reports, but was unaware that the reports contained errors and omissions. Effect: The amount reported as federal expenditures for the Unemployment Insurance program on the original SEFA closing package was understated by $98,754,522. The Department submitted a revised closing package to correct the $92,684,920 and $5,249,792 errors. The $819,790 error was discovered later and a correction was not submitted. Recommendation: We recommend that the Department design and implement internal control procedures to ensure the accuracy and completeness of the information used to compile the SEFA closing package. Management?s View: The Idaho Department of Labor agrees with the audit finding. The audit finding consists of three parts: 1) Erroneous/non-finalized report was used to report on the SEFA closing package resulting in the underreporting on the closing package of $92,684,920. Internal process changed to direct staff to the federal system to retrieve reported amounts to eliminate the possibility that a preliminary or non- finalized report will be used to gather necessary SEFA information. 2) Miscoded transactions in Programmatic system caused misreported amounts for one UI program resulting in the underreporting on the closing package of $819,790. The issue was discovered less than 2 weeks into administering a new Pandemic Program. The coding was fixed in the Programmatic system moving forward. In the month of April 2021, the account coding will be corrected by the IT staff who maintain the programmatic system to bring the account balances correct by Unemployment program. 3) Misinterpretation of Federal guidance on treatment of waiting week (first week) reimbursements caused underreporting of reimbursement of Federal grant funds resulting in the underreporting on the closing package of $5,249,792. The Department?s misinterpretation of Federal Guidance regarding waiting week (first week) reimbursements has been addressed. Moving forward, the Department will report federal reimbursement of waiting week payments as federal awards for SEFA reporting purposes. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2020-216 The Department has not implemented internal control procedures to ensure the accuracy of cases investigated by the Benefits Accuracy Measurement (BAM) program. Type of Finding: Material Weakness CFDA Title: Unemployment Insurance (UI) Programs CFDA Number: 17.225 Federal Award Number: UI-32596-19-55-A-16, UI34055-20-55-A-16 Program Year: October 1, 2018 to December 31, 2021; October 1, 1019 to December 31, 2022 Federal Agency: U.S. Department of Labor ? Employment and Training Administration (DOL/ETA) Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The structure of the federal-state Unemployment Insurance (UI) program partnership is based on federal statute; however, it is implemented through state law. State UI program operations are conducted by the State Workforce Agency (SWA), which is the generic name for the agency that has responsibility for the state?s Employment Security function. In Idaho, the SWA is the Department of Labor. The SWAs are required by the Code of Federal Regulations (CFR) at 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is the Department?s quality control system designed to assess the accuracy of UI benefit payments and denied claims. Specifically, the SWA?s BAM unit is required to draw a weekly sample of payments and denied claims, and complete prompt and in-depth investigations to determine the degree of accuracy in the administration of the State unemployment compensation and federal law (20 CFR section 602.21(d)). The U.S. Department of Labor (USDOL) has promulgated investigational requirements and instructions in the Employment Training (ET) Handbook No. 395, pursuant to 20 CFR section 602.30(a). The Uniform Administrative Requirements, Costs Principles, and Audit Requirements for Federal Awards contained in 2 CFR 200.303 states that nonfederal entities must establish and maintain effective internal control over the federal award that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions of the federal award. Condition: The Department operates a BAM program in accordance with the federal requirements. Each week, the USDOL selects the cases they want the Department to investigate. The BAM personnel complete the investigations, which involves reviewing records, and contacting the claimant, employers, and third parties to complete standard questionnaires and conducting new and original fact-finding to assess all of the information pertinent to the paid or denied claim that was sampled. Individual investigators perform the required work on the selected cases and record the results. During fiscal year 2020, 587 cases were investigated and 563 were determined to have no improper payments. Those determinations were not reviewed for compliance with the established review procedures that are intended to ensure a correct determination. The Department stated that they did have a procedure to review the 24 cases that were determined to have improper payments, but this review was not consistently implemented and only 8 of the 24 cases had evidence of a review. Cause: At the beginning of fiscal year 2020, the Department did not have an established procedure to ensure that the BAM cases were reviewed for accuracy and compliance. The regional office of the USDOL performed a Methods and Procedures review of the Department?s BAM procedures and delivered the results in November 2019. That review found that BAM cases were not being reviewed and suggested that the Department at least review the cases that resulted in improper payments. The Department implemented a review of the improper payments cases after November 2019, but documentation was not consistently retained to support that this review occurred. Effect: Without a consistently and comprehensively implemented procedure to ensure the accuracy of all BAM investigations, the cases could be closed with incorrect results. This could cause a UI recipient to incorrectly lose their benefits or allow a recipient to incorrectly receive their benefits. Recommendation: We recommend that the Department design and consistently implement internal control procedures to ensure the accuracy of the BAM investigations. Management?s View: The audit finding consists of one issue, that the Department did not implement adequate internal controls, in the form of supervisory review of BAM investigation cases to ensure the accuracy of said investigations. USDOL has no set guidelines for number of BAM cases required to be reviewed by a supervisor, but rather encourages states to review 100% of the cases deemed to be improper (either improperly paid or improperly denied). After a Federal review in Fall of 2019, the Department agreed that it would begin a consistent practice of reviewing 100% of cases coded improper. Four months after the completion of the Federal review, the Covid-19 Pandemic changed operations for the Idaho Department of Labor. Applications for unemployment benefits skyrocketed overnight and all available staff were redirected to help the Benefits unit process claims. The BAM unit within the Idaho Department of Labor consists of some of the most skilled and seasoned staff in the agency, so their skillset was desperately needed to help in this effort. Due to the magnitude of the pandemic and the impact it had on the Department, USDOL temporarily suspended some of its established processes and procedures to support State Workforce Agencies? efforts to keep up with the demand from increased claims processing. This included a suspension of the supervisory review of BAM cases. As of April 2021, the review of denied cases is still suspended. The review of paid cases has resumed, as has the review of all improper cases. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2020-217 Internal controls over the review of the financial reports for the Rehabilitation Services - Vocational Rehabilitation Grants to States (CFDA 84.126) are not operating effectively. Type of Finding: Significant Deficiency CFDA Title: Vocational Rehabilitation Grants to States CFDA Number: 84.126 Federal Award Number: H126A190016, H126A200016 Program Year: October 1, 2018 to September 30, 2019; October 1, 2019 to September 30, 2020 Federal Agency: Department of Education Compliance Requirement: Reporting Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Division is required to submit biannual financial reports for each open grant award. Documentation is retained for the review process completed by the Division for these reports. This documentation includes any errors or concerns identified during the review process. During fiscal year 2020, the Division submitted five SF-425 reports. Testing of these reports indicated that two of the financial reports did not have a sufficient review performed prior to submission to the federal grantor. The review for these two reports was documented through email. However, this documentation indicated that only a high level review was performed prior to submission and the reviewer noted that a more thorough review needed to be completed. This subsequent review was not documented. Cause: The Division did not allow for sufficient time to perform a detailed review prior to the submission of the report, as evidenced by their email communication and approval. Effect: Without a documented and detailed review, the Division may submit financial reports with incomplete or inaccurate information required by the grant agreement. Recommendation: We recommend that the Division strengthen controls and improve procedures to allow for a detailed review in order to ensure accurate information is included on financial reports. Management?s View: We accept and agree to the finding as stated in the Audit Update. It should be noted that there were no errors in the report, but as stated above the internal controls specific to the review of the report were not adequate. IDVR has already taken corrective action. Currently, the Financial Specialist, Sr. is working in the office and all reports are reviewed and approved by the Financial Manager, signified by signing and dating the report. In a work-from-home scenario, the Financial Manager will signify review and approval by e-mail. Auditor?s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. The suggested procedures included in the corrective action plan should address the concern, if properly implemented.

The Department did not perform subrecipient risk assessments, ensure subrecipient audits were received, or perform subrecipient monitoring procedures as required for the Specialty Crop Block Grant. Type of Finding: Significant Deficiency, Noncompliance CFDA Title: Specialty Crop Block Grant Program ? Farm Bill CFDA Number: 10.170 Federal Award Number: 15SCGPID0015, 16SCBGPID0034, AM170100XXXXG010, AM180100XXXXG013 Program Year: September 30, 2015 through September 29, 2018; September 30, 2016 through September 29, 2019; September 30, 2017 through September 29, 2020; September 30, 2018 through September 39, 2021 Federal Agency: Department of Agriculture Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The Code of Federal Regulations (CFR) Uniform Administration Requirements, Costs Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The following relevant definitions are in 2 CFR 200: ? Pass-through entity: A nonfederal entity that provides a subaward to a subrecipient to carry out part of a federal program. ? Subaward: An award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. ? Subrecipient: A nonfederal entity that receives a subaward from the pass-through entity to carry out part of a federal program. The requirements for pass-through entities are in 2 CFR 200.331, which states that all pass-through entities must, among other requirements, perform the following: ? Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward. o Federal award identification o Federal Award Identification Number (FAIN) o Federal award date of award to the recipient by the federal agency o Subaward period of performance start and end dates o Amount of federal funds obligated by this action by the pass-through entity to the subrecipient o Total amount of federal funds obligation to the subrecipient by the pass-through entity, including the current obligation o Total amount of federal award committed to the subrecipient by the pass-through entity o Federal award project description o Name of federal awarding agency, pass-through entity, and contact information for awarding office of the pass-through entity o Catalog of Federal Domestic Assistance (CFDA) number and name o Identification of whether the award is research and development o Indirect cost rate for the federal award ? Evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward. ? Consider imposed specific subaward conditions upon a subrecipient, if appropriate, as described in 2 CFR 200.207. ? Monitor activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes; in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. ? Verify that every subrecipient is audited as required by Subpart F ? Audit Requirement, and follow-up on the results of those audits. Condition: The Department receives federal funds from the United States Department of Agriculture (USDA) under the Specialty Crop Block Grant program, and a portion of this grant is allocated for research and development (R&D). All of the Department?s R&D funds are passed through to subrecipients, including other State agencies or affiliated organizations that are included in the State of Idaho Single Audit reporting entity. These subrecipients in turn pass through these funds to other subrecipients. These subgrants establish the Department as a pass-through entity and its subrecipients, because they also subgrant the funds as pass-through entities as well and subject them all to the requirements included in 2 CFR 200.331. The Department is in compliance with some, but not all, of the pass-through entity requirements. Noncompliance was identified for the following reasons: ? The Department did not document their evaluations of each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward. ? The Department did not ensure that the subrecipients were audited as required by 2 CFR 200, subpart F. ? The Department has monitoring procedures in place to ensure its subrecipients are using the subaward for authorized purposes. However, the Department?s procedures do not include monitoring its subrecipients to ensure they are providing the required information to and monitoring their subrecipients to ensure the subaward is used in compliance with applicable laws and regulations. Cause: The Department has had the same subrecipients for several years and discussed risk factors, but was unaware of the requirement to formally document subrecipient risk assessments for State fiscal year 2019. In federal fiscal year 2020, the USDA informed the Department of the subrecipient risk assessment requirement, and the Department has since implemented formal risk assessments and procedures to maintain the documentation. The Department was also unaware of the requirement to ensure subrecipients comply with audit requirements and to review the audit reports and issue management decisions on related findings. The Department?s monitoring procedures include on-site visits, quarterly reviews of financial ledgers, and annual reviews of project performance reports. The Department believed these monitoring procedures were sufficient and was unaware of the requirement to ensure that their subrecipients were also following the requirements for pass-through entities. Effect: Assessing the risk of subrecipient noncompliance enables a pass-through entity to determine the proper level of monitoring procedures. Without completing the risk assessment process, a pass-through entity may increase the risk that they will not conduct monitoring procedures at a sufficient level to detect noncompliance. Subrecipient audit reports may identify internal control issues and noncompliance with the requirements of the pass-through federal program. If the Department does not ensure these audits are taking place, review them for findings, and issue a management decision based on their evaluation of the finding, they also take on an additional risk of noncompliance with the grant agreement. Subrecipients may pass through the federal funds to other subrecipients. The original recipient must monitor its subrecipients to ensure they are also complying with the requirements of pass-through entities. Without this monitoring, noncompliance may occur and remain undetected. Recommendation: We recommend that the Department design and implement appropriate procedures to ensure compliance with pass-through entity requirements, including documenting risk assessment, obtaining and reviewing required audits from subrecipients, and ensuring subrecipients comply with all pass-through entity requirements. Management?s View: The Idaho State Department of Agriculture (ISDA) accepts this finding and will design and implement internal controls and procedures to comply with 2 CFR 200 and all applicable subparts included in the regulations. ISDA will also create tracking forms that document evaluations of each subrecipient?s risk of non-compliance and ensure that the subrecipients were audited by June 30, 2020. ISDA will review all required audit reports from pass through entities and subrecipients and document any identified risks on grant related findings. ISDA will also ensure that all pass-through entities also comply with obtaining, reviewing and identifying any risks identified from findings of subrecipients in compliance with 2 CFR 200 and all applicable subparts included in the regulations by June 30, 2020. ISDA will implement these internal controls and procedures on the current grants and the new grants that will be awarded this summer will have these procedures in place at part of the award and distribution process. A risk assessment checklist has already been developed and implemented and steps to obtain audits and document the review of the obtained audits will be included to the checklist included and tracked for each grant recipient. Training and implementation of these same steps for all pass-through entities on subrecipient monitoring will also be completed after internal implementation. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

Purchases were made with Lower Snake River Compensation Plan grant funds for $746,709 from three vendors without obtaining bids or a documented exemption, which is not in compliance with federal and State procurement rules. Type of Finding: Significant Deficiency, Material Noncompliance CFDA Title: Lower Snake River Compensation Plan CFDA Number: 15.661 Federal Award Number: F16AC00027, F16AC00028 Program Year: October 1, 2015 to September 30, 2020; October 1, 2015 to September 30, 2020 Federal Agency: Department of the Interior Compliance Requirement: Procurement and Suspension and Debarment Questioned Costs: $746,709 Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. According to 2 CFR 200.317, when procuring property and services, states must use the same policies and procedures for procurements from their nonfederal funds. Idaho Administrative Rules (IDAPA) section 38.05.01.041 states that property exceeding one hundred thousand dollars ($100,000) shall be purchased by the formal sealed bid procedure. Additionally, IDAPA 38.05.01.42.10 notes that, by written policy, the administrator may exempt purchases from the formal sealed procedure or the requirement for competitive solicitation that property for which bidding is impractical, disadvantageous or unreasonable under the circumstances. Condition: During fiscal year 2019, the Department used three vendors to purchase fish food. Expenditures for each vendor was in excess of $100,000 for the year, with $746,709 in total expenditures incurred. The Department did not obtain bids or retain documentation exempting them from obtaining bids. Cause: The Department indicated that these purchases were made based on an exemption provided by the Division of Purchasing (DOP); however, the Department could not provide documentation of the exemption. The Department also did not have internal controls in place to ensure documentation for exemptions was retained. Effect: State purchasing rules exist to maximize value received by State agencies and the public in the acquisition of property through a competitive process. The Department failed to adhere to federal and State purchasing rules, increasing the risk that the State spends more than necessary to acquire the goods. Recommendation: We recommend that the Department design and implement controls to ensure compliance with federal and State procurement rules. Management?s View: In reviewing this finding, the Department believed it had an exemption in place from the Division of Purchasing for the fish food it purchased for the Lower Snake River Compensation Plan (LSRCP) grant program in 2019. Unfortunately, we were unable to locate and provide the written documentation to support the exemption. In October of 2019, prior to the commencement of the audit, the Department worked with the Division of Purchasing to secure its fish food exemption for Fiscal Year 2020. This new exemption was approved, finalized, and documented in October of 2019. In summary, the Department concurs with the finding to the extent that we were unable to produce the supporting documentation for the 2019 fish food exemption. The Department has already resolved this issue for 2020 and is in the process of reviewing its purchasing procedures to ensure that documentation is properly retained for any future bidding exemptions that we receive from the Division of Purchasing. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

Internal controls over the review of performance reports for the Lower Snake River Compensation Plan and Pacific Coast Salmon Recovery grants are not sufficiently documented. Type of Finding: Significant Deficiency Related to Prior Finding: 2018-204 CFDA Title: Lower Snake River Compensation Plan, Pacific Coast Salmon Recovery ? Pacific Salmon Treaty Program CFDA Number: 15.661, 11.438 Federal Award Number: F16AC00027, F16AC00028, NA18NMF4380068 (direct), NA13NMF4380253, NA14NMF4380304, NA15NMF4380233, NA16NMF4380334, NA17NMF4380178, NA18NMF4380270 (sub-grant) Program Year: October 1, 2015 to September 30, 2020; October 1, 2015 to September 30, 2020; July 1, 2018 to June 30, 2019 (direct); July 1, 2013 to June 30, 2018; July 1, 2014 to June 30, 2019; July 1, 2015 to June 30, 2020; July 1, 2016 to June 30, 2021; July 1, 2017 to June 30, 2022; July 1, 2018 to June 30, 2023 (sub-grant) Federal Agency: Department of the Interior, Department of Commerce Sub-Grant Agency: Idaho Office of Species Conservation Compliance Requirement: Procurement and Suspension and Debarment Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Department is required to submit semi-annual performance reports for each open project and a final performance report for each closed project to the respective grantor. Documentation is not retained for the review process completed by the Department for these reports. The Department uses an online application to submit the Pacific Coast Salmon Recovery (PCSR) performance reports. The online system notifies the reviewer when reports are submitted and ready for review; however, the system does not retain a record of the review. Performance reports for the Lower Snake River Compensation Plan (LSRCP) grant are reviewed by management; however, this review is not documented. Cause: Department management believed that the online submission system was documenting their review of PCSR reports and was unaware of the requirement to retain documentation of their review of the LSRCP grant. Effect: Without appropriate internal controls, the Department may submit performance reports with incomplete or inaccurate information required by the grant agreement. Recommendation: We recommend that the Department design and implement internal controls over the review of performance reports that will ensure accuracy and compliance with federal requirements. Management?s View: The Department reviewed its procedures and agrees with the auditors' finding that the performance reports for the Pacific Coast Salmon Recovery Fund (PCSRF) and Lower Snake River Compensation Plan (LSRCP) grant programs were reviewed and approved by management, but that documentation of such review was not consistently generated and retained. In the case of PCSRF, the performance reports were reviewed within a federal online grant reporting system. However, we later discovered that the reporting system did not adequately document that the review had occurred. The Department is evaluating its documentation processes, and will implement appropriate procedural changes to ensure that we are capturing and retaining evidence documenting the management review of performance reports for these programs. We anticipate these changes will be implemented during Fiscal Year 2021. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

The Department did not meet the minimum earmarking requirements for the Crime Victim Assistance grant that was finalized during State fiscal year 2019 grant. Type of Finding: Material Weakness, Material Noncompliance CFDA Title: Crime Victim Assistance CFDA Number: 16.575 Federal Award Number: VAGX-030, VAGX-060, VAGX-056, V2GX-0002, V2GX-0066 Program Year: October 1, 2014 to September 30, 2018; October 1, 2015 to September 30, 2019; October 1, 2016 to September 30, 2020; October 1, 2017 to September 30, 2021; October 1, 2018 to September 30, 2022 Federal Agency: Department of Justice Compliance Requirement: Matching, Level of Effort, Earmarking Questioned Costs: Known $1,560,498 Criteria: The Uniform Guidance given in the Code of Federal Regulations (CFR) 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The grant award?s terms and conditions and the Victims of Crime Act (VOCA) Victim Assistance Program Guidelines require the State to allocate a minimum of 10 percent of each year?s VOCA grant to each of the following four priority victim categories: (1) sexual assault, (2) domestic violence (also referred to as spousal abuse), (3) child abuse, and (4) underserved victims. Underserved victim groups include children; persons with disabilities; older adults; historically marginalized communities; men of color; individuals with Limited English Proficiency (LEP); formerly incarcerated individuals; and lesbian, gay, bisexual, transgender, queer, or questioning (LGBTQ) individuals. Condition: We reviewed the Crime Victim Assistance 2015 grant that was awarded October 1, 2014 and concluded September 30, 2018, which allowed us to evaluate if the earmarking percentages were met for the four required groups of victims. We found that the Department did not properly allocate the funds based on the earmarking requirements, failing to meet the 10 percent minimum amount for 3 out of 4 priority victim categories. The Department allocated only $600,828, or 5.8 percent, to child abuse victims; $621,525, or 6 percent, to sexual assault victims; and $301,701, or 2.9 percent, to underserved victims. Domestic violence victims was the only priority victim category from which the Department met the federal earmarking requirement. Cause: There were no policies and procedures in place during the audit period to ensure grant funds were allocated based on the priority victim categories. Effect: The Department is not in compliance with earmarking requirements of the grant award?s terms and conditions and the VOCA Victim Assistance Program Guidelines. The following schedule identifies the amount expended for priority victim categories compared to the amount that was required. See Schedule of Findings and Questioned Costs for chart/table Recommendation: We recommend that the Department develop and implement internal control procedures to ensure the correct allocation of funds to priority victim categories in compliance with federal grant requirements. Management?s View: The Council on Domestic Violence and Victim Assistance (?Council?) concurs with the finding. The Council developed policy and procedures to ensure VOCA funds are disbursed in accordance with the priority category funding requirement. The policy and procedures are available and will be provided upon request. While the Council did ensure the VOCA priority categories were met for FY2020 grant allocations, the policy and procedure were not approved by the Council until December 6, 2020. The policies and procedures will be implemented for the state fiscal year 2021 grant cycle and will be implemented with each subsequent funding cycle. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

Subrecipient eligibility is not adequately documented or reviewed for compliance with federal requirements of the Crime Victim Assistance program. Type of Finding: Material Weakness, Noncompliance CFDA Title: Crime Victim Assistance CFDA Number: 16.575 Federal Award Number: VAGX-030, VAGX-060, VAGX-056, V2GX-0002, V2GX-0066 Program Year: October 1, 2014 to September 30, 2018; October 1, 2015 to September 30, 2019; October 1, 2016 to September 30, 2020; October 1, 2017 to September 30, 2021; October 1, 2018 to September 30, 2022 Federal Agency: Department of Justice Compliance Requirement: Eligibility Questioned Costs: None Criteria: The Uniform Guidance given in the Code of Federal Regulations (CFR) 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The terms and conditions of the grant award requires the State and its subrecipients to comply with the conditions of the Victims of Crime Act (VOCA). Any organization funded with VOCA assistance funding must meet eligibility criteria, which includes: a. being operated by a public agency or nonprofit organization that provides services to victims of crime; b. demonstrating effective victim services with financial support from non-VOCA funding; and c. using volunteers to provide crime victim services. Condition: Crime Victim Assistance grant activities are carried out through subrecipients that submit applications to the Department that include information to support compliance with the subrecipient eligibility requirements. There were 36 subrecipients identified as receiving grant funding. However, there are no documented controls procedures over the evaluation of each subrecipient application before funding was awarded. We identified one subrecipient application that included a request to waive the volunteer eligibility requirement for award funding. There was no documentation that the waiver was evaluated or approved prior to the subrecipient being awarded funds. Cause: There are no internal control procedures in place to ensure that the eligibility of subrecipients is correctly determined and documented. A portion of this is due to significant turnover at the Department during the audit period, including the executive director. Effect: Federal funds could be passed through to subrecipients that do not meet the eligibility requirements applicable to the federal program. Recommendation: We recommend that the Department implement internal control procedures to ensure an adequate review and determination of subrecipient eligibility is completed and documented in compliance with federal grant requirements. Management?s View: The Council concurs with the finding. The Council developed policy and procedures to ensure eligibility requirements are reviewed and the process is documented to be compliant with federal requirements. The policy and procedures and the Eligibility Checklist are available and will be provided upon request. The policy will be implemented for the FY2021 grant cycle and implemented with each subsequent funding cycle. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

Subrecipient monitoring procedures are not adequate to ensure compliance with federal requirements for the Crime Victim Assistance program. Type of Finding: Material Weakness, Material Noncompliance CFDA Title: Crime Victim Assistance CFDA Number: 16.575 Federal Award Number: VAGX-030, VAGX-060, VAGX-056, V2GX-0002, V2GX-0066 Program Year: October 1, 2014 to September 30, 2018; October 1, 2015 to September 30, 2019; October 1, 2016 to September 30, 2020; October 1, 2017 to September 30, 2021; October 1, 2018 to September 30, 2022 Federal Agency: Department of Justice Compliance Requirement: Subrecipient Monitoring Questioned Costs: None The Code of Federal Regulations (CFR) 2 CFR 25.200 and 2 CFR 200.331 identify requirements for the Department when functioning as the pass-through entity providing subawards. The Department must evaluate each subrecipient?s risk of noncompliance with subaward requirements to determine the extent of subrecipient monitoring completed. In addition, monitoring must also include a review of financial and performance reports required by the pass-through entity; follow up on any deficiencies identified in the subrecipient that are detected through audits, on-site reviews, and other means; and issuing a management decision for audit findings as required by 2 CFR 200.521. The Department must also verify that every subrecipient is audited, as required by Subpart F ? Audit Requirements of 2 CFR 200, when the subrecipient expends $750,000 or more in federal awards during the fiscal year. Additionally, the Victims of Crime Act (VOCA) Victim Assistance Program Guidelines require the State to develop and implement a monitoring plan, which must include a risk assessment. The Victim Assistance Program Guidelines also require the State to conduct on-site monitoring at least once every two years. Condition: We reviewed the Department?s monitoring of subrecipients for fiscal year 2019 and noted the following issues: ? On-site monitoring visits were only completed for 14 of 36 subrecipients, or 39 percent, for the fiscal year 2018-2019 two-year period. ? There were no risk assessments completed for the fiscal year 2019 subrecipient monitoring activities. ? While there was evidence of reviews over the subrecipients? performance report process, it was not clear what was reviewed, or that the reports were reviewed for accuracy. ? Monitoring documentation did not provide evidence of an adequate review of each subrecipients? compliance with matching requirements to ensure that 20 percent of the funding comes from nonfederal sources. We also noted that 4 out of 6, or 67 percent, of the subrecipients tested did not meet the required 20 percent match. ? There was no evidence that the subrecipient monitoring included a review of the audit reports if the subrecipient exceeded $750,000 and required a single audit. ? The Department?s review of subrecipients? corrective actions on deficiencies noted in audits was not documented. The Department also could not locate documentation to indicate a management decision on audit findings. Cause: The Department did not have sufficient written policies and procedures related to subrecipient monitoring activities and the employees were not well educated in the program compliance requirements for this grant. High personnel turnover and the replacement of an executive director in January 2019 also contributed to the lack of structure and procedures that could prevent these errors from occurring. Effect: Without adequate monitoring of subrecipients, the Department is exposed to an increased risk of expending funds for unallowable or unsupported costs. Poor subrecipient monitoring contributed to the reimbursement of unsupported or unallowable costs to subrecipients totaling $35,902. Recommendation: We recommend that the Department implement procedures to ensure compliance with all of the requirements of a pass-through entity. We also recommend that the Department design and implement effective internal control procedures to ensure subrecipient monitoring activities are complete and appropriate. Management?s View: The Council concurs with the finding. The Council has enhanced its monitoring procedures and are available upon request. The monitoring procedures are effective as of March 6, 2020. Council Grant Managers will follow the policy and procedure outlined to monitor subrecipients receiving Council funds. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

The Crime Victims Assistance grant was charged $35,902 of expenditures that were for unallowable activities and lacked appropriate supporting documentation. Type of Finding: Significant Deficiency, Noncompliance CFDA Title: Crime Victim Assistance CFDA Number: 16.575 Federal Award Number: VAGX-030, VAGX-060, VAGX-056, V2GX-0002, V2GX-0066 Program Year: October 1, 2014 to September 30, 2018; October 1, 2015 to September 30, 2019; October 1, 2016 to September 30, 2020; October 1, 2017 to September 30, 2021; October 1, 2018 to September 30, 2022 Federal Agency: Department of Justice Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Questioned Costs: Known $35,902; Projected $342,646 Criteria: The Uniform Guidance given in the Code of Federal Regulations (CFR) 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Additionally, 2 CFR 200.53 describes an improper payment as any payment made for an incorrect amount or any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Condition: We tested a sample of 61 transactions and found 12, or 19.7 percent, were for unallowed or unsupported activities. One expenditure of $952 was intended for another federal program, but was incorrectly coded to the Crime Victim Assistance program. Another expenditure of $117 was miscalculated and did not agree to supporting documentation. Additionally, there were 10 expenditures totaling $34,833 that did not agree to the supporting documentation submitted by subrecipients for reimbursement. The unsupported reimbursement requests ranged from $165 to $10,715. Cause: The Department?s internal control procedures were properly designed but not performed with a degree of accuracy necessary to prevent, or detect and correct, errors and unsupported portions within the reimbursement requests. Effect: The Department reimbursed amounts to subrecipients that were not allowable or not adequately supported. The total value of unsupported or unallowable reimbursement identified in our sample is $35,902, which projects to questioned costs of $342,646. Recommendation: We recommend that the Department strengthen internal controls over the processing of reimbursement requests to ensure reimbursements are adequately supported and for allowable activities. Management?s View: The Council concurs with the finding. The Council strengthened its monitoring policies to ensure financial reimbursements submitted are accurate, allowable, and supported. A copy of the policy is available and will be provided upon request. The policies were approved by the Council on December 6, 2019; however, Council staff has been adhering to the policies since September 2019. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

Special reports and performance reports required for the Crime Victim Assistance grant were not reviewed for accuracy, contained errors, and were submitted after the due date. Type of Finding: Significant Deficiency, Noncompliance CFDA Title: Crime Victim Assistance CFDA Number: 16.575 Federal Award Number: VAGX-030, VAGX-060, VAGX-056, V2GX-0002, V2GX-0066 Program Year: October 1, 2014 to September 30, 2018; October 1, 2015 to September 30, 2019; October 1, 2016 to September 30, 2020; October 1, 2017 to September 30, 2021; October 1, 2018 to September 30, 2022 Federal Agency: Department of Justice Compliance Requirement: Reporting Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The Uniform Guidance given in the Code of Federal Regulations (CFR) 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The federal Victims of Crime Act (VOCA) grant award from the Office of Victims of Crime (OVC) requires the State to submit a Subgrant Award Report for each subgrantee within 90 days of awarding funds to subgrantees. The award terms and conditions require the State to submit quarterly performance reports on the performance metrics identified by OVC. The terms and conditions also require the State to submit a final performance report within 90 days after the end date of the award. Condition: The following conditions related to reporting for the Crime Victim Assistance grant: ? Special Reporting o The Department had no documented control to ensure accurate and timely submission for special reporting. The same staff member completed and approved the subgrant award reports on the OVC application with no documentation indicating another staff member completed a review or approval. o We tested the subgrant award reports and noted 6 out of 6 subgrant award reports, or 100 percent, were submitted past the deadline. All of the reports were due September 30, 2018, and were not submitted until early November 2018. ? Performance Reporting o There was no documented review for accuracy of the quarterly or annual performance reports. Quarterly performance reports are submitted to the OVC, which accumulate information for the annual performance report and the final performance report at the end of the grant period. o We reviewed the 2018 annual performance report and the final report for the 2015 grant. Both the annual and final report deadlines were December 30, 2018; however, the reports were not submitted until February 27, 2019. o We reviewed the Department?s 4 quarterly performance reports and noted 1 out of 4 reports, or 25 percent, was submitted late. The deadline was November 15, 2018, but the report was not submitted until December 26, 2018. o We reviewed 24 subrecipient reports and noted 2, or 8 percent, contained data entry errors that affect federal earmarking requirements: ? One report had incorrect crime numbers for 5 of the victim categories. ? Another report incorrectly reported 0 victims of Domestic or Family Violence instead of the 2 victims reported by the subrecipient. Cause: The Department did not design and implement an effective internal control structure that includes a secondary review and approval of federal reports to help ensure accuracy and compliance with federal regulations. Additionally, the Department experienced significant turnover in program personnel during the audit period, including the executive director position. Effect: Reports were submitted late and contained inaccurate information that does not represent the true picture of victims and categories of crime victims served by the program. The lack of internal control procedures over reporting resulted in noncompliance that went undetected by the Department. Additionally, inaccurate reporting of victim categories served further distorts the level of earmarking requirements achieved or not achieved by the program. Recommendation: We recommend that the Department implement, strengthen, and document internal controls to ensure compliance with federal grant reporting requirements. Management?s View: The Council concurs with the finding. The Council has developed policies and procedures to ensure that data is reviewed for accuracy and submitted timely. The policy and procedures are available and will be provided upon request. The policy was approved December 6, 2019. Due to Council staff shortages, the policy will be effective at the next VOCA quarterly due date (April 15, 2020) however, the Council employees will retroactively review and approve data submitted for FY2020. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

The Bureau of Facility Standards within the Department of Health and Welfare (Department) failed to complete health and safety surveys of long-term care facilities in a timely manner to ensure compliance with the Medicaid program. Type of Finding: Noncompliance CFDA Title: Medical Assistance Program (Medicaid) CFDA Number: 93.777, 93.778 Federal Award Number: 1805ID5ADM, 1805ID5MAP, 1805IDIMPL, 1805IDINCT, 1905ID5ADM, 1905ID5MAP, 1905IDIMPL, 1905IDINCT Program Year: October 1, 2017 to September 30, 2018; October 1, 2018 to September 30, 2019 Federal Agency: Health and Human Services Compliance Requirement: Special Tests and Provisions #5 Provider Health and Safety Standards Questioned Costs: None Criteria: In the Social Security Act, Sections 1819 and 1919 establish requirements for the State to survey facilities to determine whether the facilities meet the requirements for participation in the Medicaid program. A survey is an evaluation tool used by the State that indicates whether or not Medicaid providers meet the prescribed health and safety standards. Specifically, 42 Code of Federal Regulations (CFR) 488.330 gives the responsibility for certification to the State to perform surveys of long-term care facilities. Additionally, 42 CFR 488.308(a) indicates that the State must conduct a survey of each nursing facility not later than 15 months after the last day of the previous survey. Condition: The Bureau of Facility Standards, a Bureau under the Division of Licensing and Certification for the Department, is responsible for conducting health and safety surveys for Medicaid providers within the required timeframes set by the Uniform Guidance and the Idaho Medicaid State Plan. We identified 2 out of 19, or 11 percent, of providers reviewed did not have a survey completed within 15 months of the previous survey as required. The Bureau of Facility Standards completed one provider survey 20 months after the previous survey, while completing the other provider survey 18 months after the previous survey. Cause: While the Bureau of Facility Standards attempts to ensure all facilities are surveyed within a period of time ranging from 12 to 15 months from the previous survey, they did not meet that goal. Completing surveys for each facility is an intensive and cumbersome process that takes considerable personnel resources. The limited resources combined with the necessity to prioritize unexpected follow-up surveys resulted in the two surveys being completed beyond the date anticipated to maintain compliance. Effect: Delays in the completion of health and safety surveys increases the risk that a Medicaid provider may not be complying with critical health and safety standards, thus putting clients at risk. Additionally, this type of noncompliance could allow a provider to remain eligible and continue to receive payments for Medicaid claims that would otherwise be denied if the provider were rendered ineligible. Recommendation: We recommend that the Department ensure that provider health and safety surveys are completed in 15-month timeframe required by the Uniform Guidance 42 CFR 448.308(a) and the Idaho State Medicaid Plan. Management?s View: The Department agrees with this finding. As indicated in the legislative auditor?s comments about the cause of this finding, the Bureau of Facility Standards within the Department?s Licensing and Certification Division attempts to ensure all facilities are surveyed within a period of time ranging from 12 to 15 months from the previous survey. There are times, however, that limited resources combined with the necessity to prioritize unexpected follow-up surveys or complaint investigations can occasionally result in surveys being completed beyond the date anticipated to maintain compliance. We have taken several steps to improve performance in this area. The goal of the steps we have taken is to find alternative ways to get report review and other survey-related activities accomplished so we free as much surveyor time as possible to concentrate on conducting the on-site surveys. ? The Department maintains a contract with Healthcare Management Solutions to provide Survey Minimum Qualifications Tested (SMQT) survey staff to help supplement the bureau?s survey teams with contracted surveyors. The Centers for Medicare and Medicaid Services (CMS) requires that all staff conducting federal certification surveys on behalf of CMS are SMQT-qualified. SMQT consists of courses and a test that surveyors must pass in order to survey on behalf of CMS. ? We hired a part-time supervisor who is assisting with the review of survey reports and providing additional help to the Long-Term Care (LTC) Supervisors. ? We continue to work with staff and, with the assistance of CMS Seattle survey staff, are exploring methods to improve efficiency on survey with the hope of completing surveys in less time without compromising the quality of the survey. ? We hired a part-time, former LTC supervisor, with extensive experience, assisting with Plan of Correction review and the performance of phone/mail follow-ups to free SMQT qualified survey staff to survey. ? We hired two part-time RNs to handle the Certified Nurse Aid abuse case work to free SMQT qualified survey staff to survey. ? We are cross training two surveyors from another program to assist with complaint investigations and revisit surveys to help us complete regular recertification surveys on time when unexpected complaints or follow-up surveys occur. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

Two federal reimbursement requests were submitted for the Crime Victim Assistance program for a total of $92,294 in excess of immediate cash needs as identified on the supporting documentation. Type of Finding: Significant Deficiency, Noncompliance CFDA Title: Crime Victim Assistance CFDA Number: 16.575 Federal Award Number: VAGX-030, VAGX-060, VAGX-056, V2GX-0002, V2GX-0066 Program Year: October 1, 2014 to September 30, 2018; October 1, 2015 to September 30, 2019; October 1, 2016 to September 30, 2020; October 1, 2017 to September 30, 2021; October 1, 2018 to September 30, 2022 Federal Agency: Department of Justice Compliance Requirement: Cash Management Questioned Costs: Known $92,294; Projected $401,703 Criteria: The Code of Federal Regulations (CFR) 31 CFR 205.11 requires the State to minimize the time elapsing between the transfer of funds from the United States Treasury and the State?s payout of funds for federal assistance program purposes. The State must limit the amount of funds transferred to the minimum required to meet the State?s actual and immediate cash needs. The Uniform Guidance given in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Condition: We identified 2 out of 15, or 13 percent, cash draws reviewed that did not reconcile to the amount of immediate cash needs for the Crime Victim Assistance program. This is a reimbursement grant, and weekly cash requests must be supported by evidence of expended funds. These draws requested payment in excess of the program?s needs by a total of $92,294. The Department detected one error of $92,194 that occurred on October 18, 2018 in the process of preparing the next program cash draw request. Correction of the error was accomplished with an offset to future draws between November 9, 2018 and December 13, 2018. The $100 error was not detected by the Department, but was resolved with the proceeding cash draw request. Cause: The amount of each cash draw is calculated by taking different variables into considerations, such as total program expenditures, program income, State match requirements, cash clearance patterns, and prior cash draws requested. While the cash draw calculations are initially reviewed, there is no review completed of the cash draw request data entry. Errors are often detected and corrected with subsequent cash draws, but not all errors may be corrected in a timely manner depending on the timing of the cash draw requests and the error amounts. Effect: The total known noncompliance and questioned costs are $92,294, which projects to $401,703. Without effective internal controls in place, there is an increased risk of unsupported requests for payment resulting in noncompliance with federal requirements. Recommendation: We recommend that the Department implement or strengthen the cash draw control procedures to ensure that draws are accurate and compliant with federal requirements. Management?s View: The Department disagrees with this finding. The Department believes the internal controls established and maintained do provide reasonable assurance that the Department complies with federal award requirements. This is demonstrated by the fact that the errors referenced, were detected and corrected. Further, the Department disputes the questioned cost amount as the funds that were pre-drawn in error have already been returned. This is stated in the Condition above. Auditor?s Concluding Remarks: While the Department did identify and correct these errors when completing subsequent draw down requests, it took a period of 8 weeks to correct the overdrawn amount and controls intended to ensure the request is completed accurately and with adequate supporting documentation failed. Further, projected questioned costs are intended to provide an estimate of the potential impact of the weakness, by applying the sample error rate to the total population resulting in estimated errors of $401,703 had 100% of the transactions been reviewed.

The Commission is not performing subrecipient risk assessments, monitoring subrecipient activities, or reviewing subrecipient audits as required for the Specialty Crop Block Grant program. Type of Finding: Material Weakness, Noncompliance CFDA Title: Specialty Crop Block Grant Program ? Farm Bill CFDA Number: 10.170 Federal Award Number: 15SCGPID0015, AM170100XXXXG010, AM180100XXXXG013 Program Year: September 30, 2015 through September 29, 2018; September 30, 2017 through September 29, 2020; September 30, 2018 through September 30, 2021 Federal Agency: Department of Agriculture Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The Code of Federal Regulations (CFR) Uniform Administration Requirements, Costs Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The following relevant definitions are in 2 CFR 200: ? Pass-through entity: A nonfederal entity that provides a subaward to a subrecipient to carry out part of a federal program. ? Subaward: An award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. ? Subrecipient: A nonfederal entity that receives a subaward from the pass-through entity to carry out part of a federal program. The requirements for pass-through entities are in 2 CFR 200.331, which states that all pass-through entities must, among other requirements, perform the following: ? Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward. o Federal award identification o Federal Award Identification Number (FAIN) o Federal award date of award to the recipient by the federal agency o Subaward period of performance start and end dates o Amount of federal funds obligated by this action by the pass-through entity to the subrecipient o Total amount of federal funds obligation to the subrecipient by the pass-through entity, including the current obligation o Total amount of federal award committed to the subrecipient by the pass-through entity o Federal award project description o Name of federal awarding agency, pass-through entity, and contact information for awarding office of the pass-through entity o Catalog of Federal Domestic Assistance (CFDA) number and name o Identification of whether the award is research and development o Indirect cost rate for the federal award ? Evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward. ? Consider imposed specific subaward conditions upon a subrecipient, if appropriate, as described in 2 CFR 200.207. ? Monitor activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes; in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. ? Verify that every subrecipient is audited as required by Subpart F ? Audit Requirement, and follow-up on the results of those audits. Condition: The Idaho State Department of Agriculture (ISDA) receives federal funds from the United States Department of Agriculture (USDA) under the Specialty Crop Block Grant Program. A portion of this grant is identified as research and development (R&D) and a portion of that R&D amount is subgranted to the Commission, who in turn subgrants it to the University of Idaho where the related research is actually performed. This arrangement establishes the Commission as a pass-through entity. The Commission is in compliance with some, but not all, of the pass-through entity requirements as follows: ? The Commission has only one subrecipient and is familiar with its personnel and operations, but does not have a formal procedure in place to document the risk of noncompliance with federal statutes, regulations, and the terms and conditions of the award, as required. ? The Commission stated that they review subrecipient quarterly and annual reports and regularly checks on the progress of the R&D project, but no documentation was available to support that these activities occurred. ? The Commission does not verify that its subrecipient was audited as required or complete a review of findings and issuance of a management decision. Cause: The Commission was not aware of the subrecipient monitoring requirements associated with being a federal grant pass-through entity. Effect: Assessing the risk of subrecipient noncompliance allows a pass-through entity to determine the proper level of monitoring activities. Without the risk assessment, a pass-through entity may not conduct monitoring procedures at a sufficient level to detect noncompliance. We also obtained a copy of the University of Idaho fiscal year 2019 audit report and confirmed there were no findings related to this federal program; however, subrecipient audit reports may identify internal control issues and noncompliance with the requirements of the pass-through federal program. If the Commission does not collect and review these reports, the issues would remain unresolved. Recommendation: We recommend that the Commission design and implement procedures to ensure compliance with pass-through entity requirements, including documenting risk assessment, obtaining required audits from subrecipients, and performing other required monitoring procedures. Management?s View: In reviewing the finding, Idaho Potato Commission agrees there is not a risk assessment, or monitoring of activities, or review of subrecipient audit reviews. Idaho Potato Commission received a risk assessment report and questionnaire from Idaho State Department of Agriculture that we will be implementing at the start of each project prior to rewarding the grant. This will review the institutions size and complexity of the program, prior compliance and experience, their management systems, and single audits. At this time the terms and conditions of each individual grant will be discussed and have a written agreement signed between University of Idaho and Idaho Potato Commission. The Industry Relations Director will go through the forms with the University of Idaho researcher in person to get the answers. These forms and agreements will be placed in each grants file to be reviewed when needed. We are implementing a procedure regarding the review process of the quarterly and annual reports and checks on the progress of the project. We will originally have it sent to the legal/finance assistant for review and finalized by the Industry Relations Director. Auditor?s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit.

The Commission does not have procedures in place to ensure that subrecipients are complying with the cost principles for federal awards for the Specialty Crop Block Grant program. Type of Finding: Material Weakness CFDA Title: Specialty Crop Block Grant Program ? Farm Bill CFDA Number: 10.170 Federal Award Number: 15SCGPID0015, AM170100XXXXG010, AM180100XXXXG013 Program Year: September 30, 2015 through September 29, 2018; September 30, 2017 through September 29, 2020; September 30, 2018 through September 30, 2021 Federal Agency: Department of Agriculture Compliance Requirement: Allowable Costs/Cost Principles Questioned Costs: Projected $7,355 Criteria: The Code of Federal Regulations (CFR) Uniform Administration Requirements, Costs Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The basic cost principles for federal grants are in 2 CFR 200.400, which states that the application of these cost principles is based on the fundamental premises that: (a) The nonfederal entity is responsible for the efficient and effective administration of the federal award through the application of sound management practices and (b) The nonfederal entity assumes responsibility for administering federal funds in a manner consistent with underlying agreements, program objectives, and the terms and conditions of the federal award. Condition: The Commission receives a subgrant from the Idaho State Department of Agriculture for research and development (R&D) activities under the Specialty Crop Block Grant program. The Commission then passes these funds through to a subrecipient, the University of Idaho (University), where the related research is performed. The University incurs costs related to the grant and sends the Commission requests for reimbursement. The Commission has procedures in place to review the requests to ensure that supporting ledgers agree to the total amount requested, the dates of the costs requested for reimbursement are within the approved period, and the total dollar amount reimbursed is within the approved budget. However, reimbursement requests are not reviewed to ensure that the costs are in compliance with the cost principles for federal awards in 2 CFR 200. Cause: The Commission was unaware of the requirement, as a federal grant pass-through entity, to ensure that subrecipients are complying with the cost principles for federal awards. Effect: The Commission processed nine subrecipient reimbursement transactions in State fiscal year 2019. We tested five transactions and identified one in which there was no documentation to support some of the expenditures requested for reimbursement. This error projected to $7,355 in possible questioned costs. Without procedures in place to identify compliance with federal cost principles, the Commission increases the risk that it may reimburse a subrecipient for costs that are unallowable for the federal program. Recommendation: We recommend that the Commission design and implement procedures to detect and prevent reimbursement of unallowable costs. Management?s View: In reviewing the finding, we agree Idaho Potato Commission needs to strengthen the internal control in reviewing the expenditures to ensure that the costs are in compliance with the cost principles for federal awards in CFR 200. To ensure this, the Legal/Finance Assistant will review each receipt along with the cost principles and terms and conditions for each grant. Any questions or concerns regarding any expenditures will be relayed back to University of Idaho for better explanations or corrections. After corrections, the backup and ledger will be further reviewed by the Industry Relations Director who will sign off on the agreement to send University of Idaho payment and finalized documents to Idaho State Department of Agriculture for reimbursement. Auditor?s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit.

The Commission does not have procedures in place to ensure that subrecipients are not suspended or debarred from participation in federal grants prior to entering into a subaward contract. Type of Finding: Significant Deficiency, Noncompliance CFDA Title: Specialty Crop Block Grant Program ? Farm Bill CFDA Number: 10.170 Federal Award Number: 15SCGPID0015, AM170100XXXXG010, AM180100XXXXG013 Program Year: September 30, 2015 through September 29, 2018; September 30, 2017 through September 29, 2020; September 30, 2018 through September 30, 2021 Federal Agency: Department of Agriculture Compliance Requirement: Procurement and Suspension and Debarment Questioned Costs: None Criteria: The Code of Federal Regulations (CFR) Uniform Administration Requirements, Costs Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The CFR at 2 CFR 200.213 states that nonfederal entities are subject to the non-procurement debarment and suspension regulations in 2 CFR part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in federal assistance programs or activities. A covered transaction is defined in 2 CFR 180.200 as a non-procurement or procurement transaction that is subject to the prohibitions of this part. It may be a transaction at (a) the primary tier, between a federal agency and a person, or (b) a lower tier, between a participant in a covered transaction and another person. The suspension and debarment requirements in 2 CFR 180.300 state that, when entering into a covered transaction with another person at the next lower tier, entities must verify that the person with whom you intend to do business is not excluded or disqualified. This can be accomplished by (a) checking the System for Award Management (SAM) for exclusions, (b) collecting a certification from that person, or (c) adding a clause or condition to the covered transaction with that person. Condition: The Commission receives a subgrant from the Idaho State Department of Agriculture for research and development (R&D) activities under the Specialty Crop Block Grant program. The Commission then passes these funds through to a subrecipient, the University of Idaho (University), where the related research is performed. The Commission passed through the federal awards to a subrecipient, which is a covered non-procurement transaction, and the suspension and debarment requirements apply. The Commission did not verify that the University was not suspended or debarred prior to entering into a subaward contract. Cause: The Commission was unaware of the requirement, as a federal grant pass-through entity, to ensure that subrecipients are not suspended or debarred prior to entering into a subaward contract. Effect: Our testing found that the Commission?s subrecipient was not suspended or debarred, so no federal funds were paid in error; however, without procedures in place to ensure subrecipients are checked before the Commission enters into a subaward contract, federal grant funds could be paid to a suspended or debarred party. Recommendation: We recommend that the Commission design and implement procedures to ensure that subrecipients are checked for suspension or debarment prior to entering into a subaward contract. Management?s View: Idaho Potato Commission has reviewed the findings and agrees there is no documentation stating the Commission verified that the University of Idaho was not suspended or debarred prior to entering into a subaward contract. Idaho Potato Commission will use the website SAM.gov for a printed document stating they are active and show the expiration date for the file. This will ensure compliance with the suspension and debarment. Auditor?s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit.

The Office of Species Conservation did not comply with State procurement guidelines or appropriation laws by paying subgrantee vendors $681,043 directly on behalf of another State agency during fiscal years 2018 and 2019. Type of Finding: Significant Deficiency, Noncompliance CFDA Title: Pacific Coast Salmon Recovery ? Pacific Salmon Treaty Program CFDA Number: 11.438 Federal Award Number: NA14NMF4380304, NA15NMF4380233, NA16NMF4380334, NA17NMF4380178; NA18NMF4380270 Program Year: July 1, 2014 to June 30, 2019; July 1, 2015 to June 30, 2020; July 1, 2016 to June 30, 2021; July 1, 2017 to June 30, 2022; July 1, 2018 to June 30, 2023 Federal Agency: Department of Commerce Compliance Requirement: Procurement and Suspension and Debarment Questioned Costs: None Criteria: The Code of Federal Regulations (CFR) 2 CFR 200.317 requires a state to follow the same policies and procedures it uses for procurements from its nonfederal funds. Additionally, 2 CFR 200.318 requires the state to maintain oversight to ensure that contractors perform in accordance with the terms, conditions, and specifications of their contracts. Idaho Code, Section 67-5711C, requires all construction contracts for public works to be awarded to the lowest responsible and responsive bidder in a competitive sealed bidding procedure. Additionally, Idaho Code, Section 67-3516(1), states that the Legislature passes an appropriation that provides an agency with spending authority and creates a fixed budget beyond which the agency may not expend. Also, 2 CFR 200.303 states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Office passed federal funds through to another State agency as a sub-grantee from the Pacific Coast Salmon Recovery grant. The sub-grantee requested that the Office pay certain vendors directly to aid in the timely completion of a project at the end of fiscal year 2018 and into fiscal year 2019. At that time, the Office entered into a contract with the sub-grantee to pay the vendors directly on behalf of the sub-grantee. The Office paid vendors a total of $504,595 in fiscal year 2018 and $176,448 in fiscal year 2019 on behalf of the sub-grantee State agency. The Office paid vendors based on the request of the sub-grantee, and there was no evidence that the Office ensured competitive sealed bidding procedures were followed prior to paying the vendors. Competitive sealed bidding procedures may have been followed by the sub-grantee, but there is no evidence that the Office verified those procedures were completed prior to making payment to the vendors. The sub-grantee also continued to manage the contract and related project. The Office did not monitor the performance of the work completed prior to paying the vendors. Cause: The Office made the payments directly to the vendors ?solely to get around limitations imposed by the subgranted agency?s appropriation? enacted by the Legislature. This was viewed by agency personnel as an acceptable alternative method ?to get the job done? instead of the sub-grantee requesting a supplemental appropriation. Effect: The Office did not comply with 2 CFR 200.317 to follow State procurement guidelines or 2 CFR 200.318 that requires the State to maintain oversight to ensure that contractors perform according to the contracted terms. Additionally, the Office?s actions assisted the sub-grantee agency in noncompliance with the Idaho Code, Section 67-3516(1), appropriation law. Recommendation: We recommend that the Office discontinue making payments on behalf of their sub-grantees for which they have not contracted with the vendor nor monitored the contract for compliance with the grant agreement as a way to circumvent appropriation limitations. We further recommend that the Office implement policies to ensure compliance with State procurement requirements. Management?s View: In order to ensure that OSC ?discontinue[s] making payments on behalf of their subgrantees for which they have not contracted with the vendor nor monitored the contract for compliance?, OSC will establish communications and processes that comply with 2 CFR 200.303, 317, 318, and Idaho Code Sections 67-3516(1), 67-571l C. OSC will ensure adequate training in State procurement practices, Internal Controls, and Uniform Guidance under 2 CRF 200 related to the management of grant pass through funds is provided to all relevant staff. OSC will continue to evaluate all payment requests to ensure adherence to State procurement policies and Federal Uniform Guidance as noted in the codes listed above. This process is currently being done through an internal control process which requires oversight by the Financial Officer and Administrator, with Legal Counsel guidance as needed, into any requests from other agencies and vendors. OSC will neither process nor pay for any invoices that are outside the scope of its own contracts. Auditor?s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit.

Required procedures for ensuring the Office does not enter into a covered transaction with a suspended or debarred subrecipient or vendor were not documented sufficiently to demonstrate compliance for a portion of the fiscal year. Type of Finding: Significant Deficiency, Noncompliance Related to Prior Finding: 2018-213 CFDA Title: Pacific Coast Salmon Recovery ? Pacific Salmon Treaty Program CFDA Number: 11.438 Federal Award Number: NA14NMF4380304, NA15NMF4380233, NA16NMF4380334, NA17NMF4380178, NA18NMF4380270 Program Year: July 1, 2014 to June 30, 2019; July 1, 2015 to June 30, 2020; July 1, 2016 to June 30, 2021; July 1, 2017 to June 30, 2022; July 1, 2018 to June 30, 2023 Federal Agency: Department of Commerce Compliance Requirement: Procurement and Suspension and Debarment Questioned Costs: None Criteria: The Code of Federal Regulations (CFR) (2 CFR 180) prohibits nonfederal entities from entering into covered transactions with parties that are suspended or debarred. All nonprocurement transactions entered into by a recipient (i.e., subawards to subrecipients), irrespective of award amount, are considered covered transactions, unless they are exempt as provided in 2 CFR section 180.215. Under 2 CFR 180.300, before entering into such a transaction, the entity must do one of the following: 1) check the federal System for Award Management (SAM) exclusions, 2) collect a certification from the party that they are not suspended or debarred, or 3) add a clause or condition to the transaction documents. Also, 2 CFR 200.303 states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: We reviewed three sub-awards for which there was not sufficient evidence demonstrating the Office had verified subrecipients were not suspended or debarred prior to entering into a covered transaction for the Pacific Coast Salmon Recovery grant. Documentation was provided that indicated the Office checked the SAM website for each of the subrecipients; however, we could not verify from the documentation provided that this review occurred prior to entering into the covered transaction. Sub-awards were made in November 2018, and the Office put new procedures into place in March 2019 for suspension and debarment. Cause: Prior to the 2018 single audit, the Office was unaware of the requirement to retain documentation to provide evidence that SAM verifications were performed prior to entering into a covered transaction with an entity at a lower tier. The Office provided corrective action plans with the 2018 Single Audit Report that included the new procedures implemented in March 2019; however, subawards for State fiscal year 2019 were made in November 2018 prior to implementation of new procedures. Effect: We did not identify suspended or debarred vendors receiving federal funds during our testing. However, the lack of procedures and consistent internal controls intended to identify suspended or debarred vendors before federal payments are made increases the risk that the Office may enter into covered transactions with suspended and debarred parties. Recommendation: A corrective action plan has already been implemented by the Office. We recommend that the Office continue to follow new procedures to ensure sufficient documentation is maintained to comply with suspension and debarment requirements. Management?s View: In March 2019, OSC implemented a SAM status check through www.sam.gov for each subrecipient. The status and expiration date are recorded in a spreadsheet and timestamped PDFs to document these actions are saved to a DUNS folder. While a SAM status check was done in the past, saving a timestamped PDF is a confirmation of this practice and provides documentation of the timing of the check. Auditor?s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit.

Internal control procedures are not designed or implemented effectively to ensure compliance with the suspension and debarment requirements of the Federal Highway Administration (FHWA) Research and Development (R&D) grant. Type of Finding: Significant Deficiency, Noncompliance CFDA Title: Highway Planning & Construction CFDA Number: 20.205 Federal Award Number: N4510.819, N4510.831 Program Year: October 1, 2017 to September 30, 2018; October 1, 2018 to September 30, 2019 Federal Agency: Department of Transportation Compliance Requirement: Procurement and Suspension and Debarment Questioned Costs: None Criteria: The Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR Part 180.300) requires grantees to verify an entity is not suspended or debarred or otherwise excluded before entering into a covered transaction. Covered transactions, as defined by 2 CFR 180.220, are those procurement contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria. Also, 2 CFR 200.303 states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Department could not provide evidence that R&D contracts included a certification clause or demonstrate that they verified the vendors were not suspended or debarred prior to entering into covered transactions with the vendors. There were a total of 16 covered transactions, 12 were not verified. Cause: The staff over the R&D contracts were not aware of the suspension and debarment compliance requirements. Effect: We did not identify suspended or debarred vendors receiving federal funds during our testing; however, the lack of implemented controls intended to identify suspended or debarred vendors before federal payments are made increases the risk that the Department may enter into covered transactions and make payments to vendors that are suspended or debarred. Recommendation: We recommend that the Department strengthen internal controls over suspension and debarment by implementing control policies and procedures to verify that vendors are eligible to enter into agreements with the Department and that they are not suspended or debarred prior to entering into covered transactions. Management?s View: The Idaho Transportation Department (ITD) concurs with the audit finding and recommendation. ITD has updated the Research Program Manual to include both the policy and procedure to ensure that all Research & Development grants are checked against the federal database "System for Awards Management" (SAM). This information will be retained in the contract file for that entity in ProjectWise. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

The Schedule of Expenditures of Federal Awards (SEFA) was understated by $775,322 for the Pacific Coast Salmon Recovery grant. Type of Finding: Significant Deficiency CFDA Title: Pacific Coast Salmon Recovery ? Pacific Salmon Treaty Program CFDA Number: 11.438 Federal Award Number: NA14NMF4380304, NA15NMF4380233, NA16NMF4380334, NA17NMF4380178, NA18NMF4380270 (subgrant) Program Year: July 1, 2014 to June 30, 2019; July 1, 2015 to June 30, 2020; July 1, 2016 to June 30, 2021; July 1, 2017 to June 30, 2022; July 1, 2018 to June 30, 2023 (subgrant) Federal Agency: Department of Commerce Sub-Grant Agency: Idaho Office of Species Conservation Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The Code of Federal Regulations (CFR) 2 CFR 200.510(b) requires the State to prepare a SEFA for the fiscal year that must include the total federal awards expended. State agencies are required to report federal expenditures incurred for each federal program during the State fiscal year to the Office of the State Controller (SCO) through the SEFA closing package. The SCO provides instructions on the completion of the closing package. Those instructions indicate that agencies should complete the SEFA closing package if the agency received and expended any direct or subrecipient federal awards during the fiscal year. Condition: The Department receives federal funding from the Office of Species Conservation for the Pacific Coast Salmon Recovery grant. A total of $236,783 in expenditures was reported in fiscal year 2019 for the Pacific Coast Salmon Recovery grant. The Department also received an additional $775,322 in federal funding to purchase water rights; however, the Department did not include this additional amount on the total SEFA amount reported. Cause: The Department?s current process used to compile the SEFA involves a review of only the Federal Grant Fund expenditures; however, the Department recorded the water rights purchase using the Water Resources Board Revolving Development Fund. This fund is used for the purpose of tracking expenditure decisions by the Idaho Water Resources Board. In the process, the Department failed to include the water rights purchase expenditure in the SEFA compilation. Effect: The Department understated the Pacific Coast Salmon Recovery grant expenditures by $775,322. This does not have an effect on the statewide SEFA. Recommendation: We recommend that the Department work to obtain a better understanding of the reporting requirements for federal funds and establish policies and procedures to ensure federal dollars spent by the Department are accurately reported. Management?s View: Idaho Department of Water Resources (IDWR) received an update memo regarding this finding on March 9, 2020. After receiving the update memo, IDWR reviewed all open federal awards to verify all expenditures are recorded or tracked through spreadsheets and reconciled with the State Controller's Office (SCO) monthly reports. Prior to submitting the Schedule of Expenditures of Federal Awards (SEFA) IDWR's fiscal staff will create a memo requesting all federal award managers verify purchases that were made using federal funds. Federal funds transferred to the Idaho Water Resource Board (IWRB) Revolving Development Fund will be tracked on the monthly IWRB balance sheets to ensure compliance with federal fund reporting requirements. IDWR will include the understatement of $775,322 in FY 2019 on the FY 2020 SEFA and include a note disclosing the misstatement on the FY 2019 SEFA. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

Internal controls over the review of performance reports for the Pacific Coast Salmon Recovery grant are not sufficiently documented. Type of Finding: Significant Deficiency CFDA Title: Pacific Coast Salmon Recovery ? Pacific Salmon Treaty Program CFDA Number: 11.438 Federal Award Number: NA14NMF4380304, NA15NMF4380233, NA16NMF4380334, NA17NMF4380178, NA18NMF4380270 (subgrant) Program Year: July 1, 2014 to June 30, 2019; July 1, 2015 to June 30, 2020; July 1, 2016 to June 30, 2021; July 1, 2017 to June 30, 2022; July 1, 2018 to June 30, 2023 (subgrant) Federal Agency: Department of Commerce Sub-Grant Agency: Idaho Office of Species Conservation Compliance Requirement: Reporting Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: The Department is required to submit semi-annual performance reports for each open project and a final performance report for each closed project. These reports are completed by the program manager and reviewed by the section manager; however, evidence showing the review of the performance reports was not retained. Cause: The Department?s internal control procedures were not designed to retain evidence of the review performed over performance reports. Effect: Without appropriate internal controls, the Department may submit performance reports with incomplete or inaccurate information required by the grant agreement. Recommendation: We recommend that the Department design and implement internal controls to improve the documentation of the review of performance reports. Management?s View: IDWR will implement the following processes as agency controls for reporting performance/progress for grant awards from the Pacific Coast Salmon Recovery Fund and for all federal awards: ? Award manager creates a draft version of the performance/progress report. ? Award manager emails the draft version to the manager's supervisor for review. ? Supervisor includes edits and offers comments on the draft version. ? Supervisor emails the draft version back to the award manager. ? Award manager incorporates edits and comments from supervisor. ? Award manager completes the performance report and sends it on to the awarding agency for review. Copy of email is sent to supervisor. ? Award manager notifies their supervisor that the awarding agency has reviewed and accepted the performance report. This review process will be implemented for all federal awards requiring performance/progress reports submitted to the awarding agency. Auditor?s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION