State of IllinoisState Government

State Agency: Illinois Governor’s Office of Management and Budget (GOMB) Federal Agency: U.S. Department of Agriculture (USDA), U.S. Department of Justice (DOJ), U.S. Department of Labor (DOL), U.S. Department of Transportation (DOT), U.S. Department of the Treasury (TREAS), U.S. Department of Education (USDE), U.S. Department of Health and Human Services (USDHHS), U.S. Department of Homeland Security (USDHS) Program Name: WIC Special Supplemental Nutrition Program for Women, Infants and Children, Cild and Adult Care Food Program (CACFP), Crime Victims Assistance Program (CVA), WIOA Cluster (WIOA), Highway Planning and Construction (Highway Planning), Coronavirus State and Local Fiscal Recovery Funds (SLFRF),Title I Grants to Local Educational Agencies (Title I), Special Education Cluster (IDEA), Twenty-First Century Community Learning Centers (Twenty-First Century), Supporting Effective Instruction State Grants (SEISG) Education Stabilization Fund (ESF), Aging Cluster, Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Temporary Assistance for Needy Families (TANF), Child Support Services, Low-Income Home Energy Assistance (LIHEAP), Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant (SSBG), Block Grants for Prevention and Treatment of Substance Abuse (SAPT), Homeland Security Grant Program (Homeland Security) ALN and Program Expenditures: 10.557 ($181,526,312), 10.558 ($170,354,298), 16.575 ($53,095,634), 17.258/17.259/17.278 ($142,310,788), 20.205 ($2,192,857,212), 21.027 ($230,448,761), 84.010A ($696,900,040), 84.027/84.173 ($639,950,722), 84.287C ($61,131,992), 84.367A ($79,837,486), 84.425 ($2,176,294,000), 93.044/93.045/93.053 ($68,210,944), 93.323 ($94,269,102), 93.558 ($583,126,272), 93.563 ($135,029,923), 93.568 ($205,171,791), 93.575/93.596 ($747,612,292), 93.667 ($55,634,435), 93.959 ($114,897,412), 97.067 ($78,892,342) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-002: Inadequate Monitoring of Subrecipient Single Audit Reviews Condition Found: The State of Illinois did not establish adequate controls to monitor the completion and documentation of the review of single audit reports for its subrecipients of the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), Child and Adult Care Food Program (CACFP), Crime Victims Assistance Program (CVA), WIOA Cluster (WIOA), Highway and Planning Construction (Highway), Coronavirus State and Local Fiscal Recovery Funds (SLFRF), Title I Grants to Local Education Agencies (Title I), Special Education Cluster (IDEA), Twenty-First Century Community Learning Centers (Twenty-First Century), Supporting Effective Instruction State Grants (SEISG), Education Stabilization Funds (ESF), Aging Cluster (Aging), Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Temporary Assistance for Needy Families (TANF), Child Support Services (CSS), Low-Income Home Energy Assistance (LIHEAP), Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant (SSBG), Block Grants for Prevention and Treatment of Substance Abuse (SAPT), and Homeland Security Grant (Homeland Security) programs in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS). The State of Illinois established the Grant Accountability Transparency Unit (GATU) to implement the provisions of GATA on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning, to the applicable state agency, any findings attributable to amounts passed through to the subrecipient(s) by the State and working with program personnel to issue management decisions on findings. The State utilizes a contractor to perform the centralized functions of obtaining the single audit report, verifying the report meets the requirements, and assigning findings to the applicable State agency. During our testing of subrecipient single audit desk review files for our 2024 major programs, we noted instances where single audit desk reviews were still in process and had not been finalized within GATA ARRMS as of the date of our testing (July 10, 2025). Upon further review of data contained within GATA ARRMS, we identified 637 single audit reviews were identified as incomplete in GATA ARRMS for grantees who: (1) reported expenditures under fiscal year 2024 major programs, (2) had an audit report with a Federal Audit Clearinghouse acceptance date between January 2, 2023 and January 2, 2024 (requiring the report to be reviewed during fiscal year 2024) and (3) were not sanctioned (placed on the Illinois Stop Payment List) by the State for noncompliance with reporting requirements. These 637 reviews were in varying stages of completion with the majority (587 audits) pending documentation supporting the issuance of a final completion letter by the cognizant agency. The remaining 50 audits (7.8%) were pending receipt of documentation, pending a review, or had another error requiring follow-up. These 637 audits included 295 audits (46.3%) with one or more findings potentially requiring a management decision to be issued. We noted the cognizant agencies for the 637 incomplete single audit reviews in GATA ARRMS were as follows: "See Table in the Audit Report" The 637 incomplete single audit reviews in GATA ARRMS pertained to subrecipients of the following major programs: "See Table in the Audit Report" While in many instances there was evidence the State agencies had completed the necessary procedures outside of GATA ARRMS, the purpose of GATA ARRMS is to reduce the duplication of effort across State agencies and to provide a single submission point for the State’s subrecipients. The lack of monitoring controls around this centralized process may result in noncompliance with subrecipient single audit desk review requirements. The State’s subrecipient expenditures under the federal programs for the year ended June 30, 2024 were as follows: "See Table in the Audit Report" Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure the federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. Further, 2 CFR 200.332(d)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on audit findings within six months of acceptance of the audit report by the FAC and ensure that the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include implementing procedures to monitor whether single audit reports are reviewed, management decision letters are issued, and single audit desk review files are closed out in GATA ARRMS in a timely manner. Cause: In discussing these conditions with GOMB officials, management stated that the incompleteness of the State’s audit reviews in GATA ARRMS was due to oversight. Possible Asserted Effect: Failure to complete and document reviews of subrecipient single audit reports in GATA ARRMS in a timely manner may result in noncompliance with the State’s obligation as a pass-through entity to appropriately monitor its subrecipients. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-002. (Finding Code 2024-002, 2023-002) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend GOMB establish procedures to monitor the completion and documentation of single audit report reviews in GATA ARRMS to ensure the State complies with its obligation as a pass-through entity. Views of GOMB Officials: GOMB agrees with the finding.

State Agency: Illinois Governor’s Office of Management and Budget (GOMB) Federal Agency: U.S. Department of the Treasury (TREAS) Program Name: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN and Program Expenditures: 21.027 ($230,448,761) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-003: Failure to Accurately Prepare Performance Reports for the COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Program Condition Found: GOMB did not prepare accurate federal project and expenditure reports (Paperwork Reduction Act (PRA) 1505-0271) for the COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program. The State was required to prepare quarterly federal project and expenditure reports (PRA 1505-0271) for the CSLFRF program. To assist the State agencies, GOMB prepared these reports. According to the U.S. Treasury’s SLFRF Compliance and Reporting Guidance, expenditures may be reported on a cash or accrual basis, as long as the methodology is disclosed and consistently applied. During our testing of two quarterly PRA 1505-0271 reports submitted during State fiscal year ended June 30, 2024, we noted that GOMB did not consistently apply cash or accrual basis for reporting and noted the following errors on the cash basis: "See Table in the Audit Report" Supervisory review procedures of the PRA 1505-0271 reports have not been designed to operate at an appropriate level of precision to ensure the financial reports are accurately prepared. Criteria or Requirement: 2 CFR 200.328 requires grantees to submit PRA 1505-0271 reports with the frequency required by the terms and conditions of the federal award. The State and Local Fiscal Recovery Funds: Project and Expenditure Report User Guide requires grantees to submit quarterly reports with current financial information, including current period and cumulative obligations and expenditures. In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure financial information reported in required financial reports is complete and accurate prior to submission. Cause: In discussing these conditions with GOMB officials, management stated the reporting errors were a result of inaccurate information submitted to GOMB by other State agencies which were not detected. Possible Asserted Effect: Failure to prepare complete and accurate financial reports prevents the U.S. Treasury from effectively monitoring the CSLFRF program. Repeat Finding: A similar finding was reported in the prior year audit as finding code 2023-003. (Finding Code 2024-003, 2023-003) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend GOMB implement more precise review procedures to ensure the reports submitted to the U.S. Treasury are complete, accurate, and agree or reconcile to its financial records. Views of GOMB Officials: GOMB agrees with the recommendation. GOMB will continue to work with the State agencies to produce accurate financial reporting for the CSLFRF program.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of the Treasury (TREAS) Program Name: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN and Program Expenditures: 21.027 ($230,448,761) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-004: Inadequate Monitoring of Subrecipients of the CSLFRF Program Condition Found: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program during the year ended June 30, 2024. Multiple State agencies are involved in awarding, expending, and administering funding under the CSLFRF program in Illinois. As a result, each State agency is responsible for monitoring the subrecipients they award CSLFRF funding. As a pass-through entity of the CLSFRF program, IDHS was responsible for: • Identifying the awards and applicable requirements, • Evaluating each subrecipient’s risks of noncompliance for purposes of determining the appropriate monitoring procedures related to the subaward, • Monitoring the activities of each subrecipient as necessary to ensure the subaward is used for authorized purposes, the subrecipients comply with the terms and conditions of the subawards, and the subrecipients achieve performance goals, and • Issuing a management decision for audit findings pertaining to the federal award provided to each subrecipient, if applicable. IDHS requires CSLFRF subrecipients to provide periodic performance reports which contain performance measures and program accomplishments to permit IDHS to monitor CSLFRF program results. During our testing of documentation provided by IDHS for 28 CSLFRF grantees (with expenditures of $23,703,366), IDHS could not provide evidence periodic performance reports were obtained or reviewed during the audit period by IDHS for 26 of the subrecipients tested. Because the CSLFRF program funds a variety of State programs operated by various program areas and bureaus within IDHS, we noted a variety of report templates were received and methods were used to document reviews. Accordingly, we noted the date certain periodic performance reports were received and reviewed by IDHS could not be validated as they were documented electronically in a spreadsheet which can be modified. Amounts passed through by IDHS to CSLFRF subrecipients totaled $28,591,405 during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(c), a pass-through entity must evaluate each subrecipient's risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. 2 CFR 200.332(e)(3) requires pass-through entities to issue management decisions for applicable audit findings pertaining to the federal awards provided to the subrecipient and 2 CFR 200.332(e)(4) requires pass through entities to resolve audit findings through corrective action plans (CAP). In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include performing monitoring procedures in accordance with Uniform Guidance and program requirements. Cause: In discussing these conditions with IDHS officials, management stated IDHS was unable to produce all requested Periodic Performance Reports (PPR) and evidence of review due to inconsistency in applied procedures, staffing changes, and the lack of a central repository. Possible Asserted Effect: Failure to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Repeat Finding: 2024-004, 2023-018) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS implement subrecipient monitoring procedures in accordance with federal regulations. Views of IDHS Officials: The Department accepts the recommendation. IDHS recognizes the importance of performance monitoring and will implement additional controls to ensure evidence is maintained to support that PPRs are obtained from subrecipients and are appropriately reviewed by IDHS.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Agriculture (USDA) Program Name: Food Distribution Cluster ALN and Program Expenditures: 10.565/10.568/10.569 ($67,875,839) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Accountability for USDA Foods Finding 2024-005: Inadequate Review of Recipient Agencies of the Food Distribution Cluster Program Condition Found: IDHS did not adequately review the recipient agencies of the Food Distribution Cluster (FDC) program. IDHS has entered into agreements with seven subrecipients (recipient agencies) that operate the FDC program locally across the State of Illinois. The USDA purchases and provides food and administrative funds to IDHS, which in turn provides the USDA foods and a portion of the administrative funds to the recipient agencies. IDHS has implemented procedures where FDC program staff perform annual reviews of the storage facilities operated by the recipient agencies. These annual reviews include inspecting the annual inventory records of USDA foods maintained by the recipient agency. During State fiscal year 2024, we noted IDHS did not perform annual reviews for five recipient agencies (with food commodities of $61,824,064), including the two largest recipients of USDA food commodities in the State (with food commodities of $40,050,222). Additionally, during our testing of the annual reviews for two recipient agencies (with food commodity expenditures of $5,786,867), we noted IDHS’ review procedures did not include a reconciliation of the annual inventory count performed by the recipient agency to USDA food records as required by program regulations. IDHS passed through $67,620,931 to the seven recipient agencies during the year ended June 30, 2024. Criteria or Requirement: In accordance with 7 CFR 247.28(b), a physical inventory of all USDA Foods must be conducted annually at each storage and distribution site where USDA Foods are stored. Results of the physical inventory must be reconciled with inventory records and maintained on file by the State or local agency. In addition, 7 CFR 250.12 states on an annual basis the distributing agency must conduct a physical review of donated food inventories at all storage facilities used by the distributing agency (or by a subdistributing agency), and must reconcile physical and book inventories of donated foods.2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to reconcile recipient agency food inventory records to USDA food records and ensure all recipient agencies are reviewed annually. Cause: In discussing these conditions with IDHS officials, management stated that IDHS was unaware of an annual requirement to obtain year-end inventory counts performed by recipient agencies and to reconcile the counts to USDA food records. IDHS was obtaining and reconciling inventory records during the on-site Quality Assurance Reviews. Possible Asserted Effect: Failure to obtain and reconcile physical inventory records for all recipient agencies could result in food commodities not being used in accordance with program requirements and results in noncompliance with federal program requirements. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-005) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS update procedures and controls to ensure the annual review of recipient agencies includes reconciling the inventory records of the recipient agency to USDA food records or establish a separate process to obtain and reconcile physical inventory records. Views of IDHS Officials: The Department accepts the recommendation. IDHS employees responsible for The Emergency Food Assistance Program (TEFAP) will update the current procedure manual to require annual inventory counts and reconciliation of inventory records be submitted for all recipient agencies at the end of each state fiscal year. IDHS will implement procedures to ensure that the records obtained from recipient agencies are reconciled to USDA Food records annually.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families, Child Care and Development Fund (CCDF) Cluster ALN and Program Expenditures: 93.558 ($583,126,272), 93.575/93.596 ($747,612,292) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Activities Allowed/Unallowed, Allowable Costs/Cost Principles Finding 2024-006: Inadequate Process for Monitoring Interagency Program Expenditures Condition Found: IDHS does not have an adequate process for monitoring interagency expenditures claimed under or used to meet maintenance of effort (MOE) requirements of the Temporary Assistance for Needy Families (TANF) and CCDF Cluster (CCDF) programs. Federal and State expenditures under the TANF and CCDF Cluster programs are comprised of programs operated by various State agencies. As the State agency responsible for administering these programs, IDHS has executed interagency agreements with each of the State agencies expending federal and/or State program funds. The interagency agreements require periodic reporting of a summary of the agency’s “allowable” expenditures to IDHS for preparation of the financial reports required for each program. As the State agencies expending program funds do not determine under which program IDHS reports their expenditures, IDHS is responsible for establishing procedures to ensure the expenditures reported by the expending State agencies meet the specific requirements applicable to the federal program. During the year ended June 30, 2024, IDHS reported expenditures from other agencies that were claimed for reimbursement or used to meet MOE requirements as follows: "See Table in the Audit Report" IDHS’ procedures to monitor other State agencies expending program funds reported by IDHS include the following: • Interagency agreements were reviewed and updated (where necessary) to include all State programs claimed under or used to meet MOE requirements of the TANF and CCDF Cluster programs in its interagency agreement. • Program questionnaires were updated where necessary and distributed to each of the State agencies to assist in documenting the nature of the expenditures provided to IDHS and the internal controls established to ensure compliance with the applicable federal regulations. • Quarterly certification reports were collected from each of the State agencies to support amounts reported in the federal reports required for each federal program. • Expenditure details were obtained from each of the State agencies and were reconciled to the quarterly certifications. However, during our test work over the documentation of the monitoring procedures discussed above, we noted the following deficiencies: • Program questionnaires describing internal control procedures for the CCDF program were not obtained by IDHS from the Illinois Student Assistance Commission, Illinois Board of Higher Education, and Illinois Community College Board. Rather, a more limited questionnaire was obtained in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS) which is used to complete risk assessments procedures for the State’s subrecipients. • Quarterly certification reports were not prepared during the period for the CCDF program by the Illinois Student Assistance Commission, Illinois Board of Higher Education, and Illinois Community College Board. IDHS did not perform a detailed review of costs claimed from expenditures reported by any of the other State agencies to ensure they met the specific program requirements. The other State agencies do not necessarily know which federal program or maintenance of effort requirement the costs they are providing to IDHS will be claimed or used and are not able to assess whether the costs are allowable. Further, IDHS did not assess whether the expenditures reported by other State agencies were paid during State fiscal year 2024 to ensure the amounts reported to the Illinois Office of Comptroller (IOC) and used to prepare the schedule of expenditures of federal awards (SEFA) were cash basis expenditures. • During our detailed testing over CCDF funds expended by the Illinois Student Assistance Commission and Illinois Community College Board, we noted the amounts passed through to ISAC that were initially reported on the final expenditure questionnaire received for audit did not reconcile to the amount of expenditures on a cash basis for SEFA reporting. Further, we noted the amounts were reported as subrecipient expenditures, however, ultimately were reclassified as beneficiary payments, resulting in a SEFA error. Criteria or Requirement: According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statement which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. Among other things required by 2 CFR 200.510(b), the SEFA must include the total amount provided to subrecipients from each Federal program. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures are accurately reported on the SEFA and to other State agencies, where applicable. Cause: In discussing these conditions with IDHS officials, management stated the current monitoring process was not adequate to ensure interagency expenditures and MOE of federal monies from other State agencies met applicable program regulations as they relate to TANF and CCDF. Possible Asserted Effect: Failure to properly monitor interagency expenditures may result in claiming of expenditures that are inconsistent with the objectives of the federal program and federal funds being expended for unallowable purposes. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-017. (Finding Code 2024-006, 2023-017) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its current process for identifying and reporting interagency expenditures and implement monitoring procedures to ensure that federal and state expenditures expended by other State agencies meet the applicable program regulations. Views of IDHS Officials: IDHS accepts the recommendation. IDHS will establish additional controls to ensure expenditures related to federal grants (including those made by other agencies and those made to subrecipients) are accurately reported. IDHS will implement additional monitoring procedures over interagency expenditures to include sampling and review of supporting documentation to ensure the expenditures meet federal program requirements.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families, Child Care Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 93.558 ($583,126,272), 93.575/93.596 ($747,612,292), 93.667 ($55,634,435), 93.959 ($114,897,412) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Subrecipient Monitoring Finding 2024-007: Failure to Follow Established Program Subrecipient Monitoring Procedures Condition Found: IDHS did not follow its established program monitoring policies and procedures for subrecipients of the Temporary Assistance for Needy Families (TANF), Child Care Development Fund Cluster (CCDF), Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. IDHS has implemented procedures whereby program staff perform periodic program on-site and desk reviews of IDHS subrecipient compliance with regulations applicable to the federal programs administered by IDHS. IDHS also has implemented procedures whereby staff perform periodic on-site and desk reviews of IDHS subrecipient compliance with fiscal and administrative requirements applicable to multiple State and federal programs. Generally, these reviews are formally documented and include the issuance of a report of the review results to the subrecipient summarizing the procedures performed, results of the procedures, and any findings or observations for improvement noted. IDHS’s policies require the subrecipient to respond to each finding by providing a written corrective action plan. Additionally, IDHS program staff perform reviews of expenditure reports submitted by subrecipients. IDHS subrecipient monitoring procedures are subject to the review and approval of a supervisor. During our test work over program on-site review procedures performed for 82 subrecipients of the TANF, CCDF, SSBG, and SAPT programs, we noted IDHS did not follow its established program monitoring procedures as follows: We tested the program on-site review procedures and fiscal administrative review procedures performed by IDHS during the year ended June 30, 2024 for a sample of subrecipients of the TANF, CCDF, SSBG, and SAPT programs comprised of the following: "See Table in the Audit Report" We noted the following exceptions in our testing of program on-site reviews performed during the year ended June 30, 2024: ● IDHS did not perform on-site monitoring reviews of subrecipients in fiscal year 2024 in accordance with IDHS’ planned monitoring schedule and/or could not provide support for the review. Specifically, we noted the following exceptions: "See Table in the Audit Report" ● IDHS did not provide timely notification (within 60 days) of the results of the programmatic on-site reviews. We noted the following exceptions: "See Table in the Audit Report" ● IDHS did not complete their quality review on a timely basis (within 60 days). We noted the following exceptions: "See Table in the Audit Report" ● IDHS did not receive a corrective action plan from the subrecipient after findings were identified during the review. We noted the following exceptions: "See Table in the Audit Report" During our testing of 31 fiscal and administrative reviews performed for subrecipients of all IDHS’ federal and State programs, we noted IDHS did not provide timely notification (within 180 days) of the results of the fiscal and administrative reviews. Specifically, we noted the delays in the reporting of results to two subrecipients tested ranged from 32 days to 50 days. IDHS could not provide documentation evidencing communication or follow up being performed for these subrecipients during the extended review period. In addition, we noted the SAPT program requires subrecipients to submit periodic reports to allow IDHS to monitor certain programmatic performance metrics. These reports are reviewed quarterly by IDHS program personnel. Any subrecipients who meet less than 80% of the performance metrics reported are also required to submit a corrective action plan to IDHS. During our testing, we noted IDHS was unable to provide documentation evidencing monitoring of the quarterly program reports for our sample of 25 subrecipients (with expenditures of $52,116,654 during the year ended June 30, 2024). Further, IDHS did not have adequate policies or procedures to ensure fiscal and administrative reviews were completed timely to detect potential non-compliance. Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. According to 2 CFR 200.332(b), a pass-through entity must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring on-site program procedures and expenditure reviews are performed in a timely manner and adequate documentation is maintained. Cause: In discussing these conditions with IDHS officials, management stated that the deficiencies noted are due to a combination of factors including operational constraints due to staffing, oversight, system transitions, and a need to strengthen governance over timeliness, monitoring and documentation controls. Possible Asserted Effect: Failure to adequately perform and document program on-site monitoring reviews of subrecipients and notify subrecipients of findings in a timely manner may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Failure to properly review subrecipient expenditures may result in inaccurate payments or unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-010. (Finding Code 2024-007, 2023-010, 2022-008, 2021-017, 2020-015, 2019-013, 2018-012, 2017-013, 2016-012, 2015-011, 2014-008, 2013-009, 12-07, 11-09) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS ensure programmatic on-site and expenditure report reviews are performed and documented for subrecipients in accordance with established policies and procedures. In addition, we recommend IDHS review its process for reporting and following up on program findings relative to subrecipient on-site reviews to ensure timely corrective action is taken. Views of IDHS Officials: The Department accepts the recommendation. IDHS will work to ensure programmatic on-site and expenditure report reviews are completed and documented in accordance with policies and procedures and review its process for reporting and follow up on program findings resulting from on-site reviews. IDHS will continue to work to fill vacancies, administer training programs, increase oversight, develop automated processes, and revise procedures to improve internal controls over these functions.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Social Services Block Grant ALN and Program Expenditures: 93.667 ($55,634,435) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-008: Inadequate Procedures to Determine Accuracy of the Post Expenditure Report Condition Found: IDHS failed to provide supporting documentation for the post-expenditure report including a key line item, the number of eligible individuals who received services paid for in part or in whole with federal funds under the Social Services Block Grant (Title XX) program. During our testing of the 2023 post-expenditure report, we noted the total individuals served was reported as 216,991. This line item represents services provided by various departments and third parties. In reviewing the summary schedule used to support these line items, we noted supporting documentation was not available to identify the individuals served for certain line items or did not match the individuals reported on the summary schedule. As a result, testing a sample of individuals to verify the individual was eligible for the service received could not be performed. We noted the following exceptions in our testing of the 2023 post-expenditure report: "See Table in the Audit Report" Internal controls have not been established to ensure required supporting documentation is maintained. Criteria or Requirement: 42 USC 1397e requires states to submit to the federal administering agency an annual post-expenditure report. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include retaining support for the post-expenditure report and a formalized methodology to ensure the reporting is consistent and accurate. Cause: In discussing these conditions with IDHS officials, management stated uniform procedures were still being implemented to track client listings and retain documentation supporting the annual report. Possible Asserted Effect: Failure to completely and accurately report SSBG individuals served could result in incomplete and/or inaccurate data being submitted to the federal administering agency. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-006. (Finding Code 2024-008, 2023-006) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures to maintain documentation supporting the post-expenditure report. IDHS should also establish supervisory review procedures to ensure the report is complete, accurate, and properly supported. Views of IDHS Officials: The Department accepts the recommendation. IDHS will work to establish uniform procedures to ensure the maintenance of documentation supporting the post-expenditure report. Additionally, IDHS will establish a supervisory review process to ensure the report is complete, accurate, and properly supported.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Agriculture (USDA) U.S. Department of Health and Human Services (USDHHS) Program Name: SNAP Cluster, Temporary Assistance for Needy Families, Children’s Health Insurance Program, Medicaid Cluster ALN and Program Expenditures: 10.551/10.561 ($4,687,993,367), 93.558 ($583,126,272), 93.767 ($510,412,808), 93.775/93.777/93.778 ($20,707,079,599) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Eligibility, Special Tests and Provisions – Penalty for Refusal to Work, Special Tests and Provisions – ADP System for SNAP Finding 2024-009: Missing Documentation in Beneficiary Files Condition Found: IDHS could not locate case file documentation supporting certain eligibility and special test requirements for beneficiaries of the Temporary Assistance for Needy Families (TANF) program and Children’s Health Insurance Program (CHIP). During our test work, we selected 50 TANF and 80 CHIP eligibility files to review for compliance with eligibility requirements and for the allowability of the related benefits provided. We also selected 40 Penalty for Refusal to Work (Refusal to Work) beneficiaries to review for compliance with the respective special test and provision requirements. We noted the following exceptions: • In one of 50 TANF cases (with a payment sampled of $255), IDHS could not provide the completed and signed redetermination by the beneficiary covering the payment date. Total TANF cash assistance paid to this beneficiary during the year ended June 30, 2024 totaled $590. • In six of 40 TANF Refusal to Work special test cases, IDHS could not provide evidence that a Responsibility Service Plan (RSP) was obtained and signed by the beneficiary. TANF cash assistance paid to these beneficiaries during the year ended June 30, 2024 totaled $30,309. • In one of 80 CHIP cases (with a sampled medical expenditure of $7,483), the case was classified as eligible due to the beneficiary having a disability; however, the case record did not include documentation supporting the determination of a disability. Total payments made on behalf of this beneficiary under the CHIP program were $14,229 during the year ended June 30, 2024. Details of the beneficiary payments selected in our samples for the TANF program are as follows: "See Table in the Audit Report" We also noted IDHS does not have adequate resources to perform and document eligibility determinations. Additionally, IDHS has not established appropriate monitoring procedures to ensure eligibility determinations are properly documented in accordance with program requirements. Because the State uses a single application and eligibility determination process for the Supplemental Nutrition Assistance Program Cluster (SNAP), TANF, Medicaid Cluster, and State Children’s Health Insurance Program (CHIP) programs, the TANF and CHIP eligibility compliance exceptions and the inadequate internal control matters discussed above also impact the SNAP Cluster and Medicaid Cluster programs. "See Table in the Audit Report" Criteria or Requirement: According to 42 USC 602(a)(1)(B)(iii) (the State Plan for TANF), IDHS is required to determine client eligibility in accordance with eligibility requirements defined in the approved State Plans. The TANF State Plan amended December 2022, Section L Personal Responsibility, requires all adults and minor parents applying for or receiving assistance be required to sign a RSP and follow through with its provisions. The TANF State Plan also required an application to be completed to apply for assistance. For refusal to work, the State must reduce or terminate the assistance payable to the family if an individual in a family receiving assistance refuses to work, subject to any good cause or other exemptions established by the State (42 USC 609(a)(14); 45 CFR sections 261.14, 261.16, and 261.54). In accordance with 42 CFR 435.948 through 435.956 and the OMB Compliance Supplement, dated May 2024, the State is required to verify financial and nonfinancial factors of eligibility in accordance with eligibility requirements defined in the approved State Plans for the CHIP and Medicaid programs. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include maintaining adequate controls over beneficiary case files to ensure all required documentation is obtained, and appropriate sanctions applied. Cause: In discussing these conditions with IDHS officials, IDHS management stated the exceptions noted were due to completing the TANF Responsibility and Service Plans (RSP’s) by telephone. The current process is to send a manual RSP signature page and manually track it for return. Possible Asserted Effect: Failure to maintain RSPs, applications, or other eligibility documentation may result in inadequate documentation of a recipient’s eligibility and in federal funds being paid to ineligible beneficiaries. Repeat Finding: A similar finding was reported in prior year audit as finding number 2023-007. (Finding Code 2024-009, 2023-007, 2022-005, 2021-011, 2020-010, 2019-005, 2018-004, 2017-004, 2016-004, 2015-004, 2014-004, 2013-004, 12-04, 11-04, 10-06, 09-06, 08-08, 07-19, 06-16, 05-30, 04-18, 03-20, 02-26, 01-15) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its current process for collecting and maintaining TANF/CHIP eligibility support and documentation to support the appropriate TANF application of sanctions. Views of IDHS Officials: IDHS accepts the recommendation and will work to ensure support for all eligibility items is properly retained in the record.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families ALN and Program Expenditures: 93.558 ($583,126,272) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $78,162 Compliance Requirement: Eligibility Finding 2024-010: Improper TANF Beneficiary Payments Condition Found: IDHS made improper payments to beneficiaries of the Temporary Assistance for Needy Families (TANF) program. During our testing of 50 TANF program beneficiary payments (with total payments sampled of $19,049), we noted one beneficiary (with a sampled payment of $262) received supplemental payments that were improperly calculated using amounts inconsistent with information contained in the beneficiary’s case file. As a result of the calculation error, the beneficiary was not eligible to receive the monthly supplemental payment. Total supplemental payments made to this beneficiary under the TANF program totaled $2,358 during the year ended June 30, 2024. We also noted two TANF beneficiary payments sampled (totaling $581) that were improperly calculated due to a diverted income system error. Diverted income occurs in dependent eligible only TANF cases where an ineligible working adult in the household has income which is allocated to the eligible members of the household to determine the overall TANF program benefit payment. The State’s benefit system was erroneously excluding the ineligible working adult in the diverted income calculation potentially resulting in an overpayment of TANF benefits on cases with diverted income. As a result of this error, the monthly payments made to these two beneficiaries were overstated by $244. Total payments made to these two beneficiaries under the TANF program were $5,130 for the year ended June 30, 2024. In response to the error identified in our testing, IDHS identified benefit payments paid during the year ended June 30, 2024 for 1,956 beneficiaries (totaling $7,238,104) were calculated using diverted income. The system calculation error related to these benefit payments resulted in total TANF overpayments of $75,804 during the year ended June 30, 2024. The payment errors identified above had not been corrected by IDHS or refunded to USDHHS (if required) as of the date we communicated our findings to IDHS (December 22, 2025). We further noted IDHS did not establish control procedures at an adequate level of precision to ensure TANF program benefits were accurately calculated based on the beneficiary’s case file supporting documentation. Payments made to beneficiaries of the TANF cash assistance program totaled $45,021,831 during the year ended June 30, 2024. Criteria or Requirement: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable under federal awards, costs must meet certain general criteria. Those criteria require, among other things, that each expenditure must be necessary, reasonable, and supported by adequate documentation.In accordance with the OMB Compliance Supplement, dated May 2024, IDHS is required to determine eligibility in accordance with eligibility requirements defined in the approved State Plan. The current State Plan requires payments to be made to eligible beneficiaries in accordance with payment levels established within the State Plan. Further, the State Plan requires an excluded or ineligible individual’s income to be considered in the calculation of the payment level of the TANF unit. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing internal control at an appropriate level of precision to identify benefit payment errors in a timely manner. Cause: In discussing these conditions with IDHS officials, management stated the exceptions noted were due to an oversight to secure or upload supporting documentation adequately and case actions not being thoroughly reviewed. Possible Asserted Effect: Failure to properly calculate benefit payments may result in unallowable costs being charged to the TANF program. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-016. (Finding Code 2024-010, 2023-016) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its current process for calculating beneficiary payments and consider changes necessary to ensure payments are properly calculated and paid. Views of IDHS Officials: The Department accepts the recommendation. IDHS will review its current process for calculating beneficiary payments and make changes to ensure payments are properly calculated and paid.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families, Child Care and Development Fund (CCDF) Cluster ALN and Program Expenditures: 93.558 ($583,126,272), 93.575/93.596 ($747,612,292) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $1,317 (TANF Federal), $1,527 (TANF MOE), $1,174 (CCDF Federal), $372 (CCDF MOE) Compliance Requirement: Activities Allowed/Unallowed, Allowable Costs/Cost Principles Finding 2024-011: Unallowable Costs Charged to the TANF and CCDF Cluster Programs Condition Found: IDHS could not provide documentation to support payments made on behalf of beneficiaries of the Temporary Assistance for Needy Families (TANF) and Child Care and Development Fund (CCDF) Cluster programs. The State of Illinois operates the Child Care Assistance Program (CCAP) which provides eligible families child care services at approved, licensed providers. Payments are made by IDHS directly to the child care provider on behalf of an eligible family. Providers submit billings to IDHS detailing the name of the recipient of the services and the number of days for which services were received. IDHS performs monitoring reviews of childcare providers on a rotational basis. During these monitoring reviews, IDHS reviews provider records to ensure services billed are adequately documented. During our testing of CCAP beneficiary payments claimed under the TANF program (40 payments totaling $8,555 in federal claim and $34,968 in MOE claim) and CCDF (40 payments totaling $108,666 in federal claim and $3,882 in MOE claim), we noted four TANF payments and three CCDF payments for which IDHS could not provide documentation supporting the services provided to eligible beneficiaries which are unallowable costs. These unallowable expenditures were reported and claimed to federal programs as follows: "See Table in the Audit Report" Additionally, we noted IDHS has not performed a monitoring review in 2024 or either of the previous two fiscal years to ensure billing information provided by the child care providers is accurate for 50 of the 62 unique providers sampled. As a result, IDHS does not have adequate controls in place to ensure information provided by providers is accurate and the related child care payments made were appropriate. Criteria or Requirement: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable under federal awards, costs must meet certain general criteria. Those criteria require, among other things, that each expenditure must be necessary, reasonable, and supported by adequate documentation. Additionally, 45 CFR 98.67 requires lead agencies to expend and account for CCDF funds in accordance with their own laws and procedures, and for fiscal control and accounting procedures to be sufficient to permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of those laws and procedures. IDHS CCAP Policy Memo 07.10.01 requires the agency to perform monitoring reviews over all Child Care Resource and Referrals (CCR&Rs), site administered, and non-contracted child care providers who participate in the IDHS Child Care Assistance Program. These reviews are conducted to ensure that services billed to the Department are adequately documented and contractual obligations are fulfilled. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should be designed to ensure that supporting documentation for CCAP payments is obtained and maintained. Additionally, effective internal controls should be designed to ensure that billing information provided by providers is complete and accurate. Cause: In discussing these conditions with IDHS officials, management stated that submission of billing certificates to IDHS or its contracted agencies is not a condition of payment. Additionally, CCAP payments cited were entered by the providers through the IDHS Child Care Telephone Billing System - Integrated Voice Response (IVR) and IDHS did not have established procedures for monitoring these recipients. Possible Asserted Effect: Failure to maintain documentation that supports payments to TANF and CCDF beneficiaries of the Child Care Assistance Program and adequately monitor these beneficiaries results in noncompliance and unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-014. (Finding Code 2024-011, 2023-014) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review the process and procedures in place for collecting and maintaining documentation to support amounts paid to beneficiaries of the CCAP. Further, we recommend IDHS ensure monitoring reviews are performed for CCAP beneficiaries under the CCDF and TANF programs in accordance with established policies and procedures. Views of IDHS Officials: The Department accepts the recommendation. IDHS will review the processes and develop procedures for collecting and maintaining documentation supporting payments to CCAP beneficiaries. Additionally, IDHS will establish, review, and revise policies and procedures to ensure monitoring reviews are conducted with appropriate management oversight.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 93.959 ($114,897,412) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $472,620 Compliance Requirement: Level of Effort Finding 2024-012: Failure to Meet the SAPT MOE Requirement Condition Found: IDHS did not maintain the required aggregate State expenditures for the maintenance of effort (MOE) requirements for the Block Grants for Prevention and Treatment of Substance Abuse (SAPT) program. As a condition of receiving federal funding under the SAPT program, USDHHS requires the State to maintain the level of State and locally funded expenditures for substance abuse prevention and treatment activities at an amount that is at least equal to the average level of these same amounts for the prior two years. During the current fiscal year, we noted IDHS did not maintain the necessary aggregate expenditures to meet the SAPT MOE requirement. The table below illustrates the shortfall: "See Table in the Audit Report" In addition, IDHS has not established internal control procedures to monitor whether maintenance of effort requirements are met. Criteria or Requirement: According to 45 CFR 96.30(a), the fiscal control and accounting procedures of the State must be sufficient to permit tracing funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of the statute authorizing the block grant. Further, 45 CFR 96.134(a) states with respect to the principal agency of a State for carrying out authorized activities, the agency shall for each fiscal year maintain aggregate State expenditures by the principal agency for authorized activities at a level that is not less than the average level of such expenditures maintained by the State for the two-year period preceding the fiscal year for which the State is applying for the grant. In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing procedures to ensure MOE requirements are achieved with allowable expenditures. Cause: In discussing these conditions with IDHS officials, management stated that the review of the MOE to date was not occurring on a regular basis until reporting to the federal entity was complete. A revised methodology for calculating MOE was submitted and approved by SAMHSA in December 2023 and required updates to the MOE calculations were made between 2020 through 2024. Possible Asserted Effect: Failure to maintain required State expenditure levels for MOE results in noncompliance with program requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-008. (Finding Code 2024-012, 2023-008, 2022-006, 2021-012, 2020-012, 2019-009, 2018-007, 2017-008, 2016-008, 2015-009, 2014-010) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its process for identifying expenditures to achieve the SAPT MOE and implement controls to appropriately monitor whether the MOE requirement has been met. Views of IDHS Officials: The Department accepts the recommendation. Moving forward with the new methodology that was approved by SAMHSA, IDHS will be able to correctly calculate and meet the MOE in the coming fiscal years.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families, Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 93.558 ($583,126,272), 93.575/93.596 ($747,612,292), 93.667 ($55,634,435), 93.959 ($114,897,412) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-013: Failure to Report Subaward Information Required by FFATA Condition Found: IDHS failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Temporary Assistance for Needy Families (TANF), Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs.The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that IDHS did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. During our testing of 57 subawards and 25 amendments, we noted the following exceptions: "See Table in the Audit Report" Additionally, during our testing of 25 subawards (totaling $53,372,381) for the SAPT program, we noted FFATA reporting was not completed for any of the subawards. IDHS’s subrecipient expenditures under the federal programs for the year ended June 30, 2024 were as follows: "See Table in Audit Report" Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include complying with FFATA. Cause: In discussing these conditions with IDHS officials, management stated that FFATA reports cannot be submitted until the federal agency publishes the award and the award information is transmitted to FSRS/SAM.gov. The reporting of incorrect signature dates is due to a periodic delay between the day the contract is signed and the day the contract is recorded in the State’s financial records. A lack of appropriate oversight resulted in the SAPT subawards not being reported. Possible Asserted Effect: Failure to identify awards subject to FFATA and to report subawards in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-009. (Finding Code 2024-013, 2023-009, 2022-007, 2021-014, 2021-015) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures to identify awards subject to FFATA reporting requirements and report required subaward information in accordance with the FFATA. Views of IDHS Officials: The Department partially agrees with the findings. The late reporting of IDHS’s subaward contracts is due to a timing difference between the state fiscal year (July 1 to June 30), when subaward contracts are obligated, and the federal fiscal year (October 1 to September 30), when new federal awards are obligated. FFATA reports cannot be submitted until the federal agency publishes the award and the award information is transmitted to FSRS/SAM.gov. IDHS will revise its procedures to address the timely recording of contract signature dates in SAP and the reporting of new federal awards in FSRS/SAM.gov. Procedures will be reviewed to ensure the timely completion of FFATA reporting. Auditors' Comment: The State is required to report subcontracts no later than the last day of the month following the month in which the subaward was made or modified. The exceptions noted in our testing were not reported within required timeframes.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Agriculture (USDA), U.S. Department of Health and Human Services (USDHHS) Program Name: Supplemental Nutrition Assistance Program Cluster, Special Supplemental Nutrition Program for Women, Infants, and Children, Food Distribution Cluster, Rehabilitation Services – Vocational Rehabilitation, Temporary Assistance for Needy Families Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse, Disability Insurance/SSI Cluster ALN and Program Expenditures: 10.551/10.561 ($4,687,993,367), 10.557 ($181,526,312), 10.565/10.568/10.569 ($67,875,839), 84.126A ($138,992,957), 93.558 ($583,126,272), 93.575/93.596 ($747,612,292), 93.667 ($55,634,435), 93.959 ($114,897,412), 96.001/96.006 ($75,260,007) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: None Finding 2024-014: Inaccurate Reporting of Federal Expenditures Condition Found: IDHS did not accurately report Federal expenditures, including amounts provided to subrecipients, under the Supplemental Nutrition Assistance (SNAP) Cluster, Supplemental Nutrition for Women, Infants, and Children (WIC) programs, Food Distribution Cluster (FDC), Vocational Rehabilitation (VR), Temporary Assistance for Needy Families (TANF), Child Care Development Funds (CCDF) Cluster, Social Services Block Grants (SSBG), Block Grants for Prevention and Treatment of Substance Abuse (SAPT), and Disability Insurance/SSI (SSDI) Cluster.Federal expenditures, including amounts provided to subrecipients, reported to the Illinois Office of Comptroller (IOC) which were used to prepare the schedule of expenditure of federal awards (SEFA) did not agree to IDHS’ financial records provided for audit. Specifically, we noted the following differences between amounts provided for audit by IDHS and the SEFA amounts reported to the IOC for each program for the year ended June 30, 2024: "See Table in the Audit Report" The following differences were also identified relative to amounts provided to subrecipients for the following major programs: "See Table in the Audit Report" Additionally, we noted the cash basis expenditures provided by IDHS for our audit procedures included accrued (not paid) expenditures. We also noted these same amounts were reported to the IOC and were used to prepare the SEFA. Specifically, we noted expenditures that were not paid as of June 30, 2024, were erroneously reported as cash basis expenditures for the year ended June 30, 2024: "See Table in the Audit Report" We also noted the interagency expenditures provided by IDHS for our audit procedures included out of period expenditures. These same amounts were reported to the IOC and were used to prepare the SEFA. Specifically, we noted TANF Emergency Assistance (EA) payments which were claimed in fiscal year 2024 but reported in fiscal year 2023 totaling $14,275,633, and we noted EA payments which were claimed in fiscal year 2025 but were reported in fiscal year 2024 totaling $14,742,262. The net impact is an overstatement of TANF expenditures of $466,629 for the year ended June 30, 2024. Finally, we noted IDHS’ controls over reporting federal expenditures were not designed at a sufficient level of precision to ensure complete and accurate reporting in a timely manner. Criteria or Requirement: According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statement which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. Among other things required by 2 CFR 200.510(b), the SEFA must include the total amount provided to subrecipients from each Federal program. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures are accurately reported on the SEFA and to other State agencies, where applicable. Cause: In discussing these conditions with IDHS officials, management stated that the differences in the amounts of federal expenditures in IDHS’ records compared to the IDHS SEFA were due to inclusion of accrued expenditures in IDHS’ records and some slight differences related to vouchers in transit at the end of the fiscal year. Differences in the amounts passed through to subrecipients were also related to vouchers in transit at the end of the fiscal year, and IDHS’ records for one federal grant program did not initially include non-cash expenditures which had been included on the IDHS SEFA. Possible Asserted Effect: Failure to accurately report federal expenditures hinders the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal fund Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-012. (Finding Code 2024-014, 2023-012, 2022-010) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures to accurately report federal expenditures (including subrecipient expenditures) used to prepare the SEFA to the IOC. Views of IDHS Officials: The Department accepts the recommendation. IDHS will establish additional procedures to ensure federal expenditures (including subrecipient expenditures) are accurately reported.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Medicaid Cluster ALN and Program Expenditures: 93.775/93.777/93.778 ($20,707,079,599) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-015: Failure to Report Drug Rebates on the Medicaid CMS-64 Report in a Timely Manner Condition Found: DHFS did not accurately report certain Medicaid Cluster program drug rebates on quarterly federal financial (CMS-64) reports. DHFS is the State Medicaid agency and is responsible for calculating drug rebates, billing pharmaceutical companies for drug rebates, and reporting drug rebates on the quarterly CMS-64 reports. pharmaceutical companies which were reported on quarterly CMS-64 reports submitted to USDHHS. Specifically, DHFS determined the data used to calculate drug rebates beginning in the quarter ended September 30, 2019 through June 30, 2024 erroneously included Medicare Part D drug data which did not pertain to beneficiaries of the Medicaid Cluster program. The data error resulted in drug rebates billed to and paid by pharmaceutical companies reported on the quarterly CMS-64 reports being overstated. Consequently, Medicaid Cluster expenditures were understated on both the quarterly CMS-64 reports and on the State’s Schedule of Expenditures of Federal Awards (SEFA) for fiscal year 2024.DHFS management estimated the federal portion of the drug rebate error to be $815,984,264, of which $98,623,995 pertained to amounts reported in fiscal year 2024. The estimated impact of the drug rebate error on CMS-64 reports filed in or related to quarters within fiscal year 2024 are as follows: "See Table in the Audit Report" DHFS was unable to process and report drug rebates beginning in the quarter ended March 31, 2024 due to a cyberattack impacting a third party servicer for drug rebates. As a result, no drug rebates were reported for the quarter ended March 31, 2024 and limited drug rebates were reported for the quarter ended June 30, 2024. The State revised the Medicaid Cluster expenditures reported on the 2024 SEFA to increase the reported expenditures by the estimated drug rebate error related to the year ended June 30, 2024. A revised SEFA was provided in July 2025 to correct for this matter.We also noted adequate internal controls have not been established to ensure the data used to calculate drug rebates reported on the quarterly CMS-64 reports are complete and accurate. Specifically, the supervisory reviews and analytical procedures performed over the quarterly CMS-64 reports were not designed at an appropriate level of precision to detect the drug rebates errors. Criteria or Requirement: 42 CFR 430.30(c) requires States to submit Form CMS-64 (Quarterly Medicaid Statement of Expenditures for the Medical Assistance Program) to the central office not later than 30 days after the end of each quarter. This report is the State’s accounting of actual recorded expenditures. According to the Center for Medicaid and CHIP Services Information Bulletin dated July 24, 2014, CMS requires drug rebates to be reported in the quarter in which the State incurs the expenditure. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure information used in calculating drug rebates is complete and accurate and required financial reports are accurately prepared. Cause: In discussing these conditions with DHFS officials, they noted DHFS began receiving the impacted managed care encounter data files in 2019. IT programming to allow for the identification and exclusion of Medicare Part D drug claims from rebate invoices was not included. As a result, Medicare Part D drug claims that were not eligible for rebates were included in invoices DHFS sent to pharmaceutical manufacturers. Possible Asserted Effect: Failure to accurately report drug rebate amounts and program expenditures on the CMS-64 inhibits USDHHS’ ability to monitor the Medicaid Cluster program. Additionally, failure to accurately report federal expenditures in a timely manner inhibits the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal funding. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-019. (Finding Code 2024-015, 2023-019) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS evaluate its process for calculating drug rebates reported on the CMS-64 and implement the necessary procedures to ensure amounts reported in the quarterly CMS-64 reports are complete and accurate. Views of DHFS Officials: DHFS accepts the recommendation. DHFS identified and implemented the programming necessary to omit the Medicare Part D drugs in August 2024. DHFS continues to monitor quarterly variances within the drug rebates included in CMS-64. The Drug Rebate Unit verifies Form CMS-64.9R – Medicaid Drug Rebate Schedule (64.9R) using data from separately ran reports such as the Invoice Activity Summary Report, Rebate Summary Report, and Check Apply Summary Report to verify that amounts included in the 64.9R are accurate.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program ALN and Program Expenditures: 93.767 ($510,412,808) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $88,490,404 Compliance Requirement: Eligibility Finding 2024-016: Failure to Discontinue CHIP Benefits for Ineligible Individuals Condition Found: DHFS improperly continued providing benefits under the Children’s Health Insurance Program (CHIP) program to individuals who were over the age of 18. The CHIP program provides benefits to children under the age of 19 at an enhanced federal participation (FFP) rate. CHIP benefits should be discontinued when a beneficiary turns 19; however, if they meet all other eligibility criteria, these beneficiaries are allowed to transition to benefits under the Medicaid Cluster program. During our testing of 80 payments (totaling $145,446) made on behalf of CHIP beneficiaries during the year ended June 30, 2024, we identified nine individuals receiving CHIP benefits who were over the age of 18. DHFS performed a review of all medical payments made under the CHIP program during the year ended June 30, 2024 and identified 52,557 CHIP beneficiaries over the age of 18 for whom medical payments totaling $88,490,404 were made during the year ended June 30, 2024.In addition, we noted DHFS has not established adequate controls to identify and remove individuals over the age of 18 from the CHIP program and to determine if they are eligible for benefits under the Medicaid Cluster program.Medical payments made on behalf of CHIP beneficiaries during the year ended June 30, 2024 totaled $504,533,794. Criteria or Requirement: In accordance with 42 CFR 435.10 and the OMB Compliance Supplement, dated May 2024, the State is required to determine client eligibility in accordance with eligibility requirements defined in the approved State Plans for the CHIP program. Specifically, 42 CFR 457.320(a) requires the State CHIP agency to provide benefits for groups of children up to, but not including, the age 19 in addition to other eligibility criteria. State Plan Amendment IL-14-0009 includes general eligibility considerations which allows benefits to be provided for children up to the age of 19 which is consistent with 42 CFR 457.320(a). In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing and maintaining adequate controls over processes to perform and document beneficiary eligibility determinations. Cause: In discussing these conditions with IDHS officials, management stated they failed to identify and redetermine eligibility for 19-year-olds. Possible Asserted Effect: Failure to properly perform eligibility determinations in accordance with State Plans may result in federal funds being awarded to ineligible beneficiaries, which are unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-022. (Finding Code 2024-016, 2023-022, 2022-016) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS review its current process for performing eligibility decisions and consider changes necessary to ensure benefits are discontinued when individuals reach the age of 18 in accordance with program regulations and guidelines set forth by the State Plan. Views of DHFS Officials: DHFS agrees with the finding.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program Cluster, Medicaid Cluster ALN and Program Expenditures: 93.767 ($510,412,808), 93.775/93.777/93.778 ($20,707,079,599) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Eligibility Finding 2024-017: Inadequate Procedures to Determine and Document Beneficiary Eligibility Condition Found: DHFS does not have adequate procedures to determine and document eligibility for beneficiaries of the Children’s Health Insurance Program (CHIP) and the Medicaid Cluster programs. The CHIP and Medicaid programs provide medical benefits to individuals who meet certain eligibility criteria for each respective program. During our testing of 120 Medicaid and 80 CHIP beneficiaries, we identified the following exceptions: • One Medicaid beneficiary (with a sampled medical expenditure of $7,601) had their eligibility cancelled within the Integrated Eligibility System (IES) in 2019 but the individual was still receiving Medicaid payments through the Medicaid Management Information System (MMIS) due to human error inputting the incorrect eligibility end date within the transmission from IES to MMIS. Total payments made on behalf of this beneficiary under the Medicaid program were $14,453 during the year ended June 30, 2024. • One Medicaid beneficiary (with a sampled medical expenditure of $52) received benefits, but supporting documentation was not included in IES case record to support the eligibility determination was properly performed. Total payments made on behalf of this beneficiary under the Medicaid program were $99 during the year ended June 30, 2024. Details of the beneficiary payments selected in our samples for the CHIP and Medicaid programs are as follows: "See Table in the Audit Report" We also noted DHFS does not have adequate resources to perform and document eligibility determinations. Additionally, DHFS has not established appropriate monitoring procedures to ensure eligibility determinations are properly documented in accordance with program requirements. Medical payments made on behalf of CHIP and Medicaid beneficiaries during the year ended June 30, 2024 totaled $504,533,794 and $19,742,854,768, respectively. Criteria or Requirement: In accordance with 42 CFR 435.948 through 435.956 and the OMB Compliance Supplement, dated May 2024, the State is required to verify financial and nonfinancial factors of eligibility in accordance with eligibility requirements defined in the approved State Plans for the CHIP and Medicaid programs.In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing and maintaining adequate controls over processes to perform and document beneficiary eligibility determinations. Cause: In discussing these conditions with DHFS officials, management stated exceptions were the result of the inability of the system to reject claims when there is no match on full Medicaid coverage coding. Additionally, there was a lack of knowledge of the program staff at the waiver agency about being able to identify those codes that indicate no full Medicaid coverage. Possible Asserted Effect: Failure to properly perform eligibility determinations in accordance with State Plans may result in federal funds being awarded to ineligible beneficiaries, which are unallowable costs. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-017) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS review its current process for performing eligibility determinations and consider changes necessary to ensure all initial determinations and subsequent redeterminations are performed in accordance with guidelines set forth in the State Plan. Views of DHFS Officials: The Department accepts the recommendation. DHFS has reviewed its current process for performing eligibility determinations and setting controls to ensure they meet the guidelines set forth in all federal and state mandates. The corrective actions described within (system edits, monthly systematic reports and training) will assist with minimizing and identifying these case anomalies.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Names: Medicaid Cluster ALN and Program Expenditures: 93.775/93.777/93.778 ($20,707,079,599) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: $24,347,998 Compliance Requirement: Activities Allowed/Unallowed, Allowable Costs/Cost Principles, and Matching Finding 2024-018: Improper Calculation of Qualified Incentive Payments Claimed under the Medicaid Cluster Condition Found: DHFS incorrectly calculated qualified incentive payments charged to the Medicaid Cluster program using the enhanced federal medical assistance percentage (FMAP) rate applicable to payments under the Affordable Care Act (ACA) rather than its regular FMAP rate. Qualified incentive payments are financial incentive payments to healthcare providers to encourage improvements to the quality of and access to medical care. During our testing of over 40 payments to managed care organizations (totaling $349,112,247) charged to the Medicaid Cluster program, we identified one sampled expenditure (totaling $437,018) for a qualified incentive payment that was calculated using the enhanced ACA FMAP rate of 90% instead of the standard FMAP rate of 51.09% (Federal fiscal year 2024). In response to the exception noted in our testing, DHFS reviewed the population of qualified incentive payments calculated during the year ended June 30, 2024 (totaling $57,387,135) and determined a spreadsheet error caused the incorrect FMAP rate to be used to calculate the federal portion of qualified incentive payments claimed for certain quarters during State fiscal year 2024. As a result, DHFS overclaimed $24,347,998 of qualified incentive payments under the Medicaid Cluster as follows: "See Table in the Audit Report" Additionally, we noted the supervisory review procedures related to the calculation of the qualified incentive payments were not designed to and did not operate at a level of precision to identify an error of this nature. Criteria or Requirement: 2 CFR 200.400(b) sets forth the general allowable costs standards stating that recipients of federal awards are responsible for administering Federal funds in a manner consistent with Federal statutes, regulations and the terms and conditions of the Federal award. Additionally, 42 CFR 433.10(a) states sections 1903(a)(1), 1903(g), 1905(b), 1905(y), and 1905(z) provide for payments to States on the basis of a FMAP, for part of their expenditures for services under an approved State plan. FMAP percentages are published in the Federal Register each federal fiscal year. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing adequate supervisory review procedures to ensure the quarterly calculations of qualified incentive payments claimed under the Medicaid Cluster program are accurate. Cause: In discussing these conditions with DHFS officials, they stated the cause of this error was an oversight made when creating a new calculation spreadsheet for the Quality Incentive Payment add-on (QIP). The percentage for the ACA and FMAP were switched when adding to the spreadsheet causing calculated cells to be incorrect. The cause of this error was an oversight made when creating a new calculation spreadsheet for the Quality Incentive Payment add-on (QIP). The percentage for the ACA and FMAP were switched when adding to the spreadsheet causing calculated cells to be incorrect. Possible Asserted Effect: Failure to ensure payments to providers are properly calculated using the correct FMAP rate may result in noncompliance and unallowable costs being charged to the Medicaid Cluster program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-018) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS evaluate the level of precision of the supervisory review procedures over qualified incentive payments to ensure the payments are properly calculated using the correct FMAP rate. Views of DHFS Officials: The Department accepts the finding. DHFS has reviewed the process and implemented safeguards to ensure the calculations are accurate.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program, Medicaid Cluster ALN and Program Expenditures: 93.767 ($510,412,808), 93.775/93.777/93.778 ($20,707,079,599) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Managed Care Financial Audit Finding 2024-019: Failure to Ensure Managed Care Organizations Properly Prepare Financial Reports Condition Found: DHFS did not ensure the annual financial audits prepared during the year ended June 30, 2024 for Managed Care Organizations (MCOs) of the Children’s Health Insurance Program (CHIP) and Medicaid Cluster programs met the requirements of the MCO contracts and federal regulations. DHFS did not obtain audited annual financial reports for MCOs that meet the requirements of the federal Medicaid regulations as reported in the State’s single audit reports for fiscal years 2021, 2022, and 2023. While we noted DHFS obtained audited MCO financial reports during State fiscal year 2024 from each of the six Illinois MCOs, the auditors issued adverse opinions on the annual MCO financial reports for three of four MCOs sampled in our procedures. Accordingly, these MCO financial reports were not prepared in accordance with generally accepted accounting principles (GAAP) as required by program regulations and the provisions of the MCO contracts. The auditors’ reports noted the MCO annual financial reports were prepared on a statutory basis of accounting which is assumed to be materially different than GAAP. We also noted DHFS did not perform follow up procedures during fiscal year 2024 related to the MCO audit reports with adverse opinions. Accordingly, we noted DHFS has not established internal control procedures to ensure the financial reports are prepared in accordance with GAAP. Criteria or Requirement: According to 42 CFR 438.3(m), the State requires that contracts with MCOs must submit audited GAAP financial reports specific to the Medicaid contract on an annual basis. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to perform periodic audits of encounter and financial data submitted by, or on behalf of each of its MCOs. Cause: In discussing these conditions with DHFS officials, they stated the Department required the MCOs to submit GAAP reports in calendar year 2024. This was the Department’s initial experience with these reports and the review process was lengthy due to the effort to analyze and assess the information provided by each plan in comparison to the reported requirements Possible Asserted Effect: Failure to ensure the annual financial audits prepared for MCOs meet the requirements of the MCO contracts and federal regulations results in noncompliance with program requirements and may result in inaccurate capitation rate setting for the respective MCOs. Repeat Finding: While not considered a repeat of a prior year finding, a related finding was reported in the prior year audit as finding number 2023-020. (Finding Code 2024-019, 2023-020) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS evaluate its procedures for reviewing financial audit reports to ensure the reports comply with the stated requirements and implement the necessary procedures to ensure the financial reports are prepared in accordance with program regulations and contract requirements. Views of DHFS Officials: DHFS accepts the recommendation. Upon determination that calendar year 2024 MCO GAAP report submissions did not comply with the 42 CFR 438.3(m) reporting requirements, the Department issued a compliance reporting notice to the MCOs in January 2025. This notice identified the reporting noncompliance and provided confirmation of reporting expectations for calendar year 2025 GAAP reporting. In follow-up to that communication, all calendar year 2025 GAAP reports have been submitted by each MCO, reviewed by the Department's Financial Team, and all reports have been deemed to meet the filing requirements required by 42 CFR 438.3(m). In addition, in calendar year 2025, one MCO did not fully comply with the calendar year 2025 GAAP reporting submission due date. The Department issued sanctions to the MCO for lack of compliance with the reporting timeframes. The Department also conducted discussions with the MCO to identify the cause of the non-compliance and worked with the MCO to secure compliance with reporting requirements. The Department confirms it is actively receiving GAAP reports from all MCOs on an annual basis, MCO reports comply with reporting requirements, and the same process that was established for calendar year 2025 GAAP reporting will be followed for calendar year 2026 reporting. Should MCOs fail to comply with calendar year 2026 GAAP reporting, the Department will consider and apply corrective action and/or sanction penalties as permitted under Contract.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program (CHIP), Medicaid Cluster ALN and Program Expenditures: 93.767 ($510,412,808), 93.775/93.777/93.778 ($20,707,079,599) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Provider Eligibility (Screening and Enrollment) Finding 2024-020: Inadequate Procedures to Determine Provider Eligibility Condition Found: DHFS did not adequately screen providers of the Children’s Health Insurance Program (CHIP) and Medicaid Cluster programs to ensure Medicaid providers were not on the USDHHS Office of the Inspector General’s (OIG) List of Excluded Individuals/Entities (LEIE) at the time the services were performed. The Illinois Medicaid Program Advanced Cloud Technology (IMPACT) system is used by DHFS for the enrollment and screening of CHIP and Medicaid providers. On a monthly basis, IMPACT automatically checks providers enrolled within IMPACT to the LEIE to verify the provider is not on the LEIE. During our testing of 60 CHIP and 60 Medicaid beneficiary payments (totaling $188,646 and $264,110, respectively) to ensure the providers were not on the LEIE on the date of service performed, we identified 3 CHIP payments (totaling $39,136) and 2 Medicaid payments (totaling $10,824) to providers for services where the providers were not checked against the LEIE to verify they were not on the LEIE for the month when services were performed. Payments made to providers on behalf of beneficiaries of the CHIP and Medicaid Cluster programs totaled approximately $504,533,794 and $19,742,854,768, respectively, during the year ended June 30, 2024. Criteria or Requirement: 42 CFR 455.436(a) requires the State Medicaid agency to confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of a provider through routine checks of federal databases. Additionally, 42 CFR 455.436(b) requires the State Medicaid agency to check the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System, the LEIE, the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. 42 CFR 455.436(c) requires the State Medicaid agency to consult the appropriate databases to confirm identity upon enrollment and reenrollment and check the LEIE and EPLS no less frequently than monthly. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing adequate procedures to screen providers of the CHIP and Medicaid Cluster programs, specifically, to ensure the providers were not on the LEIE for the month when the voucher was paid or the month when services were provided. Cause: In discussing these conditions with DHFS officials, they stated DHFS management stated the issues with the identified monthly batch screenings was due to a system defect. Possible Asserted Effect: Failure to adequately screen CHIP and Medicaid Cluster program providers may result in federal funds being paid to providers that should have been denied, which are unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-021. (Finding Code 2024-020, 2023-021, 2022-015, 2021-006) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS address the IMPACT processing error for screening CHIP and Medicaid Cluster program providers, specifically, the process to check, on a monthly basis, that providers are not on the LEIE. Views of DHFS Officials: DHFS agrees with this finding.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Medicaid Cluster ALN and Program Expenditures: 93.775/93.777/93.778 ($20,707,079,599) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Utilization Control Finding 2024-021: Failure to Perform Reviews over Home and Community Based Waiver Services (HCBS) Condition Found: DHFS failed to conduct utilization reviews over HCBS services for five of the nine waivers contracted out to their vendor during fiscal year 2024. DHFS is required to follow the state plan’s methods and procedures to safeguard against unnecessary utilization of care and services. HCBS services are furnished to beneficiaries who would otherwise need inpatient care that is furnished in a hospital, nursing facility or other institutional setting which are reimbursable for Medicaid claims under the state plan. One of these requirements is to perform reviews over HCBS waiver services. There are nine total HCBS waivers and five of them are contracted out through a vendor. These five waivers are: Persons with Disabilities, People with HIV or AIDS, Persons with Brain Injury, Adults with Developmental Disabilities, and Persons who are Elderly. During our audit procedures and based on inquiries with DHFS officials, the vendor contract came to an end on February 28, 2023, and a new contract was not in place to cover July 1, 2023 through June 30, 2024 (fiscal year 2024). As a result, we identified no reviews performed during fiscal year 2024. The agency continued to provide reviews and monitoring over the other four HCBS waivers: Residential Waiver for Children and Young Adults with Developmental Disabilities, the Support Waiver for Children and Young Adults with Developmental Disabilities, the Medically Fragile/Technology Dependent Children waiver, and the Supportive Living Facility waiver. The failure to perform reviews from July 1, 2023 through June 30, 2024 resulted in $2,754,254,430 in Medicaid claims that were not subject to contractor reviews during fiscal year 2024. Payments made on behalf of beneficiaries of the Medicaid Cluster program totaled $19,742,854,768 during the year ended June 30, 2024. Criteria or Requirement: 42 CFR 456 discusses the entire utilization control program to help ensure appropriate care is being provided for Medicaid services. Specifically, 42 CFR 456.22 requires the State Medicaid agency to have a sampling plan in place to perform reviews over the quality of Medicaid services. Additionally, 42 CFR 456.4 discusses the responsibilities of the state Medicaid agency to monitor these requirements even if they are outsourced to a third-party to perform these reviews. Cause: In discussing these conditions with DHFS management, they stated the contract with the third-party servicer expired as of February 28, 2023. The intention was to have the contract extended to continue working on the HCBS waiver reviews, but there were issues extending the contract. DHFS posted a request for quote in attempt to hire another contractor but did not receive any responses. As a result, there were no reviews performed after the expiration of the contract. Possible Asserted Effect: Failure to properly review and monitor Medicaid services could result in inadequate services being provided and poor quality of care at the facilities. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-025 (Finding Code 2024-021, 2023-025). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS obtain a contractor for fiscal year 2025 or have a plan in place to perform reviews themselves if there are no contractors willing and able to perform these reviews. Views of DHFS Officials: DHFS agrees with the finding. An Invitation for Bid has been posted to procure a contractor to resume record reviews. The opening of bids occurred in January 2026. Contract execution is anticipated prior to June 30, 2026.

State Agency: Illinois Department of Children and Family Services (DCFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Foster Care – Title IV-E ALN and Program Expenditures: 93.658 ($157,279,978) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Activities Allowed/Unallowed and Allowable Costs/Cost Principles Finding 2024-022: Inadequate Process for Foster Care Daycare Maintenance Assistance Payments Condition Found: DCFS does not have an adequate process in place to ensure Foster Care daycare maintenance assistance payments are accurately paid based on its approved rate schedule. The foster care program provides funds to States for maintenance assistance payments to deliver substitute care for children who are under the jurisdiction of a Title IV-E agency and who need temporary placement or care outside their homes. Maintenance payments are made on behalf of eligible Title IV-E beneficiaries to individuals serving as foster family homes, to childcare institutions, or public or private child-placement or child-care agencies in accordance with the Title IV-E agency’s maintenance rate schedule. During our testing of foster care maintenance assistance payments, we reviewed 50 case files and related beneficiary payments (totaling $55,816) charged to the Foster Care program during the year ended June 30, 2024 for compliance with eligibility requirements and allowability of related benefits. We noted in our testing DCFS has not established adequate internal controls to ensure the daycare rates paid for Foster Care maintenance payments are consistent with the approved rate schedule. Specifically, we identified two day care maintenance assistance payments sampled (totaling $1,668) were not calculated using rates consistent with the approved DCFS day care rate schedule. The daily provider rates used to calculate the sampled payments were $40 and $44 respectively; whereas the rate that should have been used for both of these payments according to the approved DCFS day care rate schedule was $46. Accordingly, the payments calculated by DCFS were $172 less than what the payments should have been using the approved rate schedule. In response to the errors identified in our testing, we requested DCFS evaluate the population of daycare maintenance assistance payments made during the year ended June 30, 2024 to determine the cause of the errors in the payment rates used. Rather than evaluating the full population of daycare maintenance assistance payments, DCFS sampled 59 payments and identified 10 additional payments which were paid rates inconsistent with the approved rate schedule, but were not able to determine the extent of errors in the population. Accordingly, we were not able to quantify the magnitude of any noncompliance in the population to determine if material noncompliance occurred during the year ended June 30, 2024. Daycare maintenance assistance payments made on behalf of Foster Care beneficiaries totaled $2,055,171 during the year ended June 30, 2024. Payments made on behalf of beneficiaries of the Foster Care program totaled $33,332,268 during the year ended June 30, 2024. Criteria or Requirement: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable under federal awards, costs must meet certain general criteria. Those criteria require, among other things, that the expenditure be adequately documented. According to 42 USC 671(a)(11), which is implemented by 45 CFR 1356.21, the amount of payments made as foster care maintenance payments must be periodically reviewed to assure their appropriateness. Funds may be expended for foster care maintenance payments on behalf of eligible children, in accordance with the Title IV-E agency’s foster care maintenance payment rate schedule and in accordance with 45 CFR section 1356.21, to individuals serving as foster family homes, to childcare institutions, or public or private child-placement or child-care agencies. Such payments may include the cost of (and the cost of providing, including certain associated administrative and operating costs of a child care institution) food, clothing, shelter, daily supervision, school supplies, personal incidentals, liability insurance with respect to a child, and reasonable travel to the child’s home for visitation, as well as reasonable travel for the child to remain in the same school he or she was attending before placement in foster care (42 USC 672(b)(1) and (2), (c)(2), and 675(4)). In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure payments are made at the approved rates. Cause: In discussing these conditions with DCFS officials, they stated the issue was due to the certification rate forms that were filled out by childcare providers. Providers would sometimes fill out the forms using lower rates than they were entitled to charge. Possible Asserted Effect: Failure to ensure payment calculations are properly performed and approved provider rates are accurately entered in the system may result in unallowable costs. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding code 2024-022) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCFS implement procedures to ensure foster care maintenance payments are properly calculated and consistent with the approved DCFS payment rate schedules. Views of DCFS Officials: The Department agrees and has implemented corrective action. In July 2025, the daycare eligibility program discontinued the use of certification rate forms. As a result, all childcare providers now receive the State established reimbursement rate, regardless of the rate they charge private-paying families. This change ensures that all childcare providers receive the funding that they are entitled to.

State Agency: Illinois Department of Children and Family Services (DCFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Foster Care – Title IV-E Adoption Assistance, Temporary Assistance for Needy Families ALN and Program Expenditures: 93.658 ($157,279,978) 93.659 ($103,674,138), 93.558 ($583,126,272) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Activities Allowed/Unallowed and Allowable Costs/Cost Principles Finding 2024-023: Failure to Provide Supporting Documentation for Payroll and Related Costs Condition Found: DCFS could not provide adequate supporting documentation to substantiate payroll and related costs claimed for federal reimbursement under the Foster Care – Title IV-E (Foster Care), Adoption Assistance, and Temporary Assistance for Needy Families (TANF) programs. On a weekly basis, DCFS employees complete and sign timesheets to report and certify their time. These timesheets are then reviewed and approved by the employee’s immediate supervisor. The supervisor approves the timesheets based on their knowledge of the employee’s hours worked during the pay period. Timesheets are scanned for archiving once a month by the payroll department. Timesheets are manually entered into the time reporting system (Employee Monthly Time Report) which is used to accumulate the costs related to each cost center. Cost pool data from the time reporting system is used to identify personal service expenditures attributable to DCFS’s State and federal programs and to calculate and allocate the related fringe benefit charges and indirect costs. During our testing of 25 direct payroll expenditures charged to the cost pools allocated to the Foster Care, Adoption Assistance, and TANF programs (totaling $127,344) during the year ended June 30, 2024, we noted the following: • The timesheet for one employee (supporting cost pool payroll expenditures sampled of $3,735) could not be provided for testing. DCFS personnel stated they were unable to locate the timesheet for this employee for the sampled period. Upon further review, DCFS personnel noted timesheets were unable to be located for this employee and all employees within the same department (totaling four additional employees) for the entire fiscal year, resulting in approximately 120 missing timesheets (related to payroll, fringe benefits, and indirect costs included in the cost pool totaling $497,277, $399,834, and $194,253, respectively). As a result, the personal service (payroll and fringe benefit) expenditures, as well as related indirect costs, were not appropriately supported in accordance with the requirements of the applicable cost principles. Accordingly, the personal service expenditures and indirect costs were not allowable. • The hours reported for three employees (with sampled personal services expenditures from the cost pool of $15,727) in the timekeeping system used to allocate personal services expenditures to Foster Care, Adoption Assistance, TANF, and other programs operated by the agency exceeded the hours reported on manual timesheets prepared by the employees and approved by supervisors. The unsupported hours reported in the timekeeping system ranged from half an hour to 13.2 hours resulting in unsupported personal service expenditures from the cost pool of $783. Additionally, we noted the controls to ensure required documentation is obtained to support payroll and related costs and maintained to evidence management approval of payroll information were not operating effectively. We also noted adequate internal controls have not been established to ensure the data included in the timekeeping system and used to allocate personal services expenditures to Foster Care, Adoption Assistance, TANF, and other programs operated by DCFS is consistent with the hours reported on manual timesheets prepared by the employees and approved by supervisor. Personal service (payroll and fringe benefit) expenditures and related indirect costs charged to the Foster Care, Adoption Assistance, and TANF programs for the year ended June 30, 2024, were as follows: "See Table in the Audit Report" Criteria or Requirement: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable under federal awards, costs must meet certain general criteria. Those criteria require, among other things, that the expenditure be adequately documented. According to 2 CFR 200.430(g), charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be, among other things, supported by a system of internal control, comply with the established accounting policies and practices of the non-Federal entity, and support the distribution of the employee’s salary or wages amount across specific activities or cost objectives if the employee works on more than one federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure required documentation is obtained to support payroll and related costs and to maintain documentation evidencing management approval of payroll information. Cause: In discussing these conditions with DCFS officials, they stated these exceptions were due to human error and the limitations of keeping a complete file record for the paper-based overtime approval and timesheet process. Possible Asserted Effect: Failure to accurately document and maintain required timesheets results in noncompliance with federal regulations and unallowable costs. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding code 2024-023) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCFS review its current procedures and consider any changes necessary to ensure supporting documentation for payroll and related costs is maintained and accurately reflects work performed in accordance with the applicable federal regulations. Views of DCFS Officials: The Department has improved communication with and the training of its timekeepers to ensure accurate and consistent timekeeping standards. The Department has also instituted new quality control procedures to identify and correct errors. All timesheets are digitally archived to ensure proper record retention. The Department is also actively pursuing modernization efforts for both payroll and timekeeping, whether it is e-Time and CMS Payroll or the statewide ERP solutions.

State Agency: Illinois Department of Public Health (IDPH) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: COVID-19 – Immunization Cooperative Agreements (ICA), COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) ALN and Program Expenditures: 93.268 ($162,117,529), 93.323 ($94,269,102) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-024: Failure to Maintain Documentation to Evidence Timely Reporting of Subaward Information Required by Federally Funded Accountability and Transparency Act (FFATA) Condition Found: IDPH did not maintain documentation to evidence information required to reported by the Federal Funding Accountability and Transparency Act (FFATA) was submitted within required timeframes for awards granted to subrecipients of the Immunization Cooperative Agreements (ICA) and Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) programs. The State is required to report certain key elements related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing of two and three subrecipients of the ICA and ELC programs (with expenditures of $250,000 and $440,000, respectively), we noted IDPH did not maintain evidence supporting information required by FFATA was submitted within required timeframes. Upon further review, we noted that the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) was decommissioned and replaced with a new reporting system (SAM.gov) effective March 8, 2025. As a result of this system change and the limited historical data transferred between these federal reporting systems, we noted evidence supporting the date information required by FFATA was submitted was not available for FFATA reporting required during the year ended June 30, 2024 for any of IDPH’s subrecipients of the ICA and ELC programs. Additionally, we noted IDPH did not have adequate internal controls in place over FFATA reporting to retain evidence all subawards were reported within required time frames. IDPH’s subrecipient expenditures under its federal programs for the year ended June 30, 2024, were as follows: "See Table in the Audit Report" Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro‑purchase threshold and publish the required information on a public‑facing, OMB‑designated, governmentwide website. Agencies must follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Regulation (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. In addition, the OMB Compliance Supplement, dated May 2024, requires the auditor to compare the award information in FSRS to the subaward documents maintained by the recipient to assess if the key data elements were accurately reported and the action was reported in FSRS no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made. Further, 2 CFR 200.303 requires non‑Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to maintain adequate documentation to substantiate information required by FFATA was reported within required timeframes. Cause: In discussing these conditions with IDPH officials, they stated IDPH did not retain documentation from the FSRS system prior to the system being decommissioned. Possible Asserted Effect: Failure to maintain adequate documentation to evidence information required to be reported by FFATA was submitted within required timeframes inhibits the ability of the auditor to perform required compliance testing. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-032. (Finding Code 2024-024, 2023-032, 2022-020, 2021-021). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDPH establish procedures to maintain documentation to evidence information required by FFATA is reported within required timeframes. Views of IDPH Officials: IDPH agrees the decommission of FSRS.gov and FFATA reporting being transitioned to SAM.gov resulted in evidence of FFATA reporting submission dates being lost.

State Agency: Illinois State Board of Education (ISBE) Federal Agency: U.S. Department of Education (USDE) Program Name: Twenty-First Century Community Learning Centers (21st Century) ALN and Program Expenditures: 84.287 ($61,131,992) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-025: Inadequate Monitoring of 21st Century Subrecipients Condition Found: ISBE did not adequately monitor and document program monitoring procedures performed over subrecipients of the 21st Century Community Learning Centers (21st Century) program. The 21st Century program operates to provide State educational agencies and local educational agencies (LEAs) with funding specific to rural and inner-city public schools. To monitor the 21st Century program activities performed by Illinois elementary and secondary schools, ISBE has established Tier I, Tier II, and Tier III monitoring activities which are applied to each subrecipient (LEA or school district) depending upon the annual risk score determined by ISBE. ISBE’s 21st Century program subrecipient monitoring manual outlines the risk assessment procedures to determine the tier of monitoring required, the methods used for tier determination, and documentation required for each tier of monitoring. Because the size and scope of each subrecipient can vary greatly, ISBE has further subdivided subrecipients into cohorts and sites (individual schools) for purposes of applying certain monitoring procedures. Tier I subrecipient monitoring procedures apply to all subrecipients, with no consideration of the risk assessment score they have received and consist of a twice-a-year call in which ISBE personnel discuss enrollment and registration statistics, progression towards goals specific to the district, and budgetary changes. A notification email is sent twice a year, alerting the subrecipient that a call is required to be scheduled. Once the call is scheduled, a call form detailing the responses to the discussion points is completed by ISBE personnel during the call to evidence the call was conducted and any matters for follow up. documentation provided by the subrecipient to address each portion of review. ISBE documents the completion of its desk review procedures with a letter to the subrecipient communicating any noncompliance and requesting corrective action, if applicable. Any required corrective action plans are reviewed and formally accepted by ISBE in a letter to the subrecipient. Tier III applies to specific subrecipient sites who receive a high-risk assessment score and consists of an on-site review including interviews with the project director and site coordinators, and observations of the academics and academic enrichment taking place at each site. ISBE personnel complete monitoring checklists to evidence the completion of its on-site procedures and a summary checklist is completed after the on-site visit to summarize all areas of noncompliance. A letter is sent to the subrecipient communicating the completion of the on-site review, any noncompliance, and requesting corrective action, if applicable. Any required corrective action plans are reviewed and formally accepted by ISBE in a letter to the subrecipient. During the year ended June 30, 2024, ISBE identified 33 Tier III high-risk subrecipients (with expenditures totaling $36,676,176) which included 47 total subrecipient sites required to have on-site reviews performed. During our testing of seven high risk subrecipient sites selected for testing (related to seven subrecipients with expenditures totaling $15,207,297), we noted ISBE was unable to provide documentation evidencing on-site reviews were performed for five of the subrecipient sites samples. We also noted documentation was not available to evidence the reviews of the other two subrecipient sites sampled were completed as ISBE could not locate documentation of the procedures performed, conclusions reached, or communication of the review results to the subrecipient sites. In addition, we noted ISBE’s internal controls over subrecipient on-site monitoring are not designed at an appropriate level of precision to ensure monitoring of subrecipients is completed, documented, and retained as required by ISBE policies and procedures. ISBE passed through approximately $59,630,722 to 78 subrecipients of the 21st Century program during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. According to 2 CFR200.332(b), a pass-through entity must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing supervisory procedures at an appropriate level of precision to ensure adequate monitoring is performed and documentation is maintained. Cause: In discussing these conditions with ISBE officials, they stated the inability to provide required documentation is attributable to staff turnover as those responsible for these monitoring activities have since left ISBE. Possible Asserted Effect: Failure to perform required monitoring procedures and maintain documentation may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and grant agreements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-045. (Finding Code 2024-025, 2023-045) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation:We recommend ISBE establish policies and procedures to ensure programmatic monitoring is performed and appropriately documented. Views of ISBE Officials: Management agrees with the finding and has developed processes and structures to correct it.

State Agency: Illinois State Board of Education (ISBE) Federal Agency: U.S. Department of Education (USDE) Program Name: Education and Stabilization Fund (ESF) ALN and Program Expenditures: 84.425 ($2,176,294,000) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-026: Untimely Review of Subrecipient Performance Reports Condition Found: ISBE did not review subrecipient performance reports in a timely manner according to its program monitoring policies and procedures for subrecipients of the Education and Stabilization Fund - Elementary and Secondary Education (ESF) program for fiscal year 2024. The ESF program operates to provide State educational agencies and local educational agencies with emergency relief funds to address the impact that COVID-19 has had, and continues to have, on elementary and secondary schools across the nation. To monitor the ESF program activities performed by Illinois elementary and secondary schools, ISBE requires a performance report to be prepared on a semi-annual basis. The semi-annual performance report includes information on the accomplishment of deliverables described in the grant, the status of performance measures, and the alignment of accomplishments with spending to date. ISBE’s monitoring policies and procedures require these reports to be reviewed within 14 days of receipt to ensure program activities and program results are consistent with program requirements. During our testing of ESF program performance reports submitted by 41 subrecipients with expenditures of $824,985,617 during the year ended June 30, 2024, we noted performance reports submitted by 19 subrecipients (with expenditures of $777,031,717) were not reviewed by program personnel within 14 days of receipt in accordance with ISBE’s policies. Delayed review of the reports ranged from 1 to 112 past the requirement. "See Table in the Audit Report" ISBE passed through approximately $2,126,841,390 to subrecipients of the ESF program during the year ended June 30, 2024. Criteria or Requirement: 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring program procedures and reviews are performed in a timely manner. Cause: In discussing these conditions with ISBE officials, they stated the delays in performing these reviews are attributable to the limited capacity of ISBE monitoring personnel as the responsibilities of existing program monitoring staff were not expanded to accommodate the additional programs. Possible Asserted Effect: Failure to timely review subrecipient semi-annual performance reports may result in untimely identification of subrecipients not properly administering federal program requirements in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-046. (Finding Code 2024-026, 2023-046). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ISBE ensure proper review procedures are performed in a timely manner in accordance with its program monitoring policies and procedures. Views of ISBE Officials: We agree with the finding. To ensure proper review procedures are performed in a timely manner in accordance with its program monitoring policies and procedures, the Fiscal department is sending weekly lists of submitted, past due and disapproved Grant Periodic Reports (GPRS) to each applicable department. Program analyzes the GPRS reports and prioritizes reviews based on submission dates. Title Grants Administration department has also trained additional team members to assist with the review process.

State Agency: Illinois State Board of Education (ISBE) Federal Agency: U.S. Department of Education (USDE) Program Name: Education and Stabilization Fund (ESF) ALN and Program Expenditures: 84.425 ($2,176,294,000) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-027: Failure to Report Subaward Information Required by Federally Funded Accountability and Transparency Act (FFATA) Condition Found: ISBE failed to report subaward information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Education Stabilization Fund (ESF) program. The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testwork over FFATA reporting, we noted ISBE was required to report information for 73 new subawards issued during the year ended June 30, 2024. In preparing documentation for our audit procedures, ISBE identified FFATA reporting was not completed for seven subawards. Additionally, we noted ISBE did not have adequate internal controls in place over FFATA reporting to ensure all subawards were reported as required. ISBE passed through approximately $2,126,841,390 to subrecipients of the ESF program during the year ended June 30, 2024. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, governmentwide website and follow OMB guidance to support FFATA implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to ensure all FFATA reports are accurately and timely prepared and submitted in accordance with federal regulations. Cause: In discussing these conditions with ISBE officials, they stated the omission of FFATA reporting was attributable to upload errors in the FFATA Subaward Reporting System (FSRS). ISBE officials also stated that ESF FFATA reporting presented an additional challenge and required additional review and reconciliation compared to the standard FFATA reports submitted for ordinary and customary grants since ESF grants lasted longer than its financial systems were accustomed to. ISBE acknowledged improper data reconciliation of new and old State fiscal year 2024 projects in its financial records. Possible Asserted Effect: Failure to report subaward information in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-027) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ISBE establish additional procedures and internal controls to ensure all new subawards and amendments subject to FFATA reporting requirements are properly reported in accordance with FFATA. Views of ISBE Officials: ISBE agrees with the finding. When a grant runs longer than its financial systems are accustomed to (two state fiscal years), management in the Department of Funding and Disbursements will maintain and present a list of grants previously approved and reported to FFATA to the principal consultant responsible for FFATA reporting, ensuring the principal consultant has the necessary tools to properly reconcile grants that have previously been reported and those that have not. Then, management will review the list of subrecipient projects prepared by the principal consultant for submission to ensure accuracy prior to the data being reported in SAM.gov, which has replaced FSRS.

State Agency: Illinois Student Assistance Commission (ISAC) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Child Care and Development Fund (CCDF) Cluster ALN and Program Expenditures: 93.575/93.596 ($747,612,292) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: None Finding 2024-028: Inaccurate Reporting of Federal Expenditures Condition Found: ISAC did not accurately report Federal expenditures, including amounts passed-through to subrecipients, under the CCDF Cluster. Federal expenditures, including amounts provided to subrecipients, reported to the Illinois Office of Comptroller (IOC) which were used to prepare the schedule of expenditure of federal awards (SEFA), did not agree to ISAC’s financial records provided for audit. Specifically, we noted the following differences between amounts provided for audit by ISAC and the amounts passed through to subrecipients of the CCDF Cluster program reported to the IOC for the SEFA for the year ended June 30, 2024: "See Table in the Audit Report" Finally, we noted ISAC’s controls over reporting federal expenditures, including amounts passed-through to subrecipients, were not designed at a sufficient level of precision to ensure complete and accurate reporting in a timely manner. Criteria or Requirement: According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statements which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. Among other things required by 2 CFR 200.510(b), the SEFA must include the total amount provided to subrecipients from each Federal program.Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures, including amounts passed-through to subrecipients, are accurately reported on the SEFA and to other State agencies, where applicable. Cause: In discussing these conditions with ISAC management, they stated they presented these beneficiary payments as amounts passed through to subrecipients in accordance with guidance provided by parties responsible for the State’s financial reporting process. Possible Asserted Effect: Failure to accurately report federal expenditures impedes the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal funding. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-028) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ISAC establish procedures to accurately report federal expenditures (including subrecipient expenditures) used to prepare the SEFA to the IOC. Views of ISAC Officials: ISAC accepts the finding. During the year ended June 30, 2024, payments totaling $79,103,694 were made to educational institutions for the direct benefit of eligible beneficiaries, as reflected in ISAC’s internal accounting records for the same fiscal year. ISAC believes federal expenditures were appropriately made to beneficiaries who were determined to have qualified under the program and that the amount of the total expenditures was correct. The classification of these amounts on the SEFA for the year ended June 30, 2024, was done using the same methodology applied in the prior fiscal year based on reporting guidance received for that fiscal year. ISAC maintained the established reporting framework, in preparing the SEFA for the fiscal year ended June 30, 2024. ISAC agrees that the amounts should not have been reported as payments to subrecipients on the SEFA for the fiscal year ended June 30, 2024. ISAC continues to maintain adequate internal controls designed to ensure federal expenditures are accurately recorded in its accounting records and are properly presented in accordance with the applicable guidance within 2 CFR 200.

State Agency: Illinois Community College Board (ICCB) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Child Care and Development Fund (CCDF) Cluster ALN and Program Expenditures: 93.575/93.596 ($747,612,292) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-029: Failure to Report Subaward Information Required by FFATA Condition Found: ICCB failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the CCDF Cluster (CCDF). The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, six subaward amendments (totaling $4,487,676) we noted FFATA reporting was not completed for any of the subawards sampled. Upon additional review, we noted ICCB did not complete FFATA reporting for any of its CCDF subawards during the year ended June 30, 2024. We also noted ICCB did not establish adequate control procedures to ensure FFATA reports were properly completed for all subawards as required by federal regulations. ICCB’s subrecipient expenditures under the CCDF Cluster for the year ended June 30, 2024 were $19,843,035. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, government-wide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures designed to ensure FFATA reporting is completed in accordance with federal requirements. Cause: In discussing these conditions with ICCB officials, they noted FFATA reporting responsibilities were not clearly assigned within the agency during the fiscal year. As a result, subaward amendments were executed without corresponding FFATA reporting submissions in the designated reporting system. Possible Asserted Effect: Failure to identify awards subject to FFATA and to report subawards in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-029) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICCB establish procedures to identify awards subject to FFATA reporting requirements and establish internal controls to report required subaward information. Views of ICCB Officials: ICCB concurs with the finding.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($2,329,354,603) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $2,335,092 Compliance Requirement: Eligibility Finding 2024-030: Unemployment Benefit Payments to Ineligible Claimants Condition Found: IDES failed to follow established policies when making eligibility determinations for claimants of the Unemployment Insurance (UI) program. The UI program administered by IDES provides benefits to eligible individuals that are unemployed and able and available to work. IDES utilizes the Illinois Benefits Information System (IBIS) to perform and document claimant eligibility determinations, to process claims for unemployment insurance benefits, and to assist IDES in complying with the requirements of the Illinois UI Act, rules, policies, and procedures applicable to unemployment benefits. UI program eligibility requirements include, among other criteria, the following: • The individual is unemployed through no fault of their own • The individual must register with IDES employment service system IllinoisJobLink.com • The individual has been paid $1,600 or more in wages during a recent 12-month period • The individual has earned at least $400 outside of the base period quarter in which his/her earnings were the highest • The individual must be actively seeking employment and be available to work • The individual must not refuse an offer of suitable work To be eligible to receive UI benefits, a claimant completes an application either online, in-person, or over the phone. Claimant applications are processed by the IBIS system which includes a number of edit checks which must be passed in order for a claimant to be eligible to receive UI benefits. However, because of the volume of claims and suspension of certain requirements during the pandemic public health emergency, we noted IDES had disabled certain edit checks in IBIS to allow claims to process and failed to re-establish the edit checks with the conclusion of the public health emergency provisions. As a result, certain ineligible claimants were identified during our assessment of eligibility. Specifically, we noted the following exceptions: • 135 claimants were inappropriately determined to be eligible for UI benefits when the individuals should have been flagged as ineligible as the claimants were terminated from previous employment with cause, which is a disqualifying requirement. UI benefits paid to this group of claimants were $821,715. • 73 claimants were inappropriately determined to be eligible for UI benefits when the individuals should have been flagged as ineligible as the claimants voluntarily left work without cause, which is a disqualifying requirement. UI benefits paid to this group of claimants were $259,485. • 248 claimants were inappropriately determined to be eligible for UI benefits when the individuals should have been flagged as ineligible as the claimants were offered suitable work, but refused employment, which is a disqualifying requirement. UI benefits paid to this group of claimants were $1,253,892. Additionally, we noted adequate internal controls have not been established to ensure necessary changes resulting from the conclusion of pandemic related provisions are made to UI eligibility procedures in a timely manner. Benefits paid to UI claimants totaled $2,149,469,000 during the year ended June 30, 2024. Criteria or Requirement: According to the State of Illinois Unemployment Insurance Law Handbook, an individual who is discharged for misconduct with his work is ineligible for benefits for the week in which he was discharged for misconduct and thereafter until the individual has become re-employed and has had earnings equal to or in excess of their weekly benefit amount in each of four calendar weeks. Further, an individual will be ineligible for benefits if the individual has failed, without good cause, to accept suitable work when offered by the Department of Employment Security or an employing unit (i.e. business). In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure eligibility determinations are made in accordance with the UI Act. Cause: In discussing these conditions with IDES officials, they stated these conditions occurred as the result of competing priorities with limited resources. Possible Asserted Effect: Failure to follow established policies to determine beneficiary eligibility may result in noncompliance with program regulations and payments to ineligible recipients. Repeat Finding: A similar finding was reported in the prior year as finding number 2023-038. (Finding Code 2024-030, 2023-038) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDES review its current procedures and consider any changes necessary to ensure eligibility determinations are made in accordance with internal policy and federal regulations. Views of IDES Officials: IDES accepts the recommendation and has reviewed and updated procedures and training to improve controls over eligibility determinations relative to this finding.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($2,329,354,603) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-031: Inadequate Process for Preparing ETA 9130 Financial Reports Condition Found: IDES does not have an adequate process in place to ensure that the ETA 9130 financial reports prepared for the Unemployment Insurance (UI) program are complete and accurate. On a quarterly basis, IDES is required to report program and administrative expenditure information for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects, on the ETA 9130, Financial Status Report, UI Programs. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. During our test work of 60 ETA 9130 reports covering the September 2023 and March 2024 quarters, we noted certain grant awards had inaccurate amounts reported for key line items for the September 30, 2023, and March 31, 2024 reporting quarters. Specifically, we noted IDES inaccurately reported the following line items: "See Table in the Audit Report" We also noted IDES does not perform analytical or other procedures over previously reported information or expectations relative to current program activities. Additionally, supervisory review procedures are not designed to operate at a level of precision to identify errors of this nature. Criteria or Requirement: According to OMB Number 1205-0461, IDES is responsible for submitting a quarterly ETA 9130 report at the completion of each quarter. Each quarter should correspond to the following calendar quarter dates: March 31, June 30, September 30, and December 31. Additionally, the primary contact person, the designated authorized official in the recipient’s organization, is responsible for certifying the accuracy of the data reported to the USDOL. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal control should include procedures to ensure the completeness and accuracy of information reported in required financial reports. Cause: In discussing these conditions with IDES officials, they stated the incorrect amounts submitted for the September 30, 2023 and March 31, 2024 quarterly reports were due to data entry errors. Possible Asserted Effect: Failure to prepare accurate ETA 9130 reports may inhibit the USDOL from effectively monitoring the UI program. Repeat Finding: A similar finding was reported in prior year audit as finding 2023-040. (Finding Code 2024-031, 2023-040, 2022-026) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDES review its procedures for preparing ETA 9130 financial reports required for the UI program and implement analytical and any other procedures considered necessary to ensure the reports are complete and accurate prior to submission to the USDOL. Views of IDES Officials: IDES accepts the audit finding and will work to ensure the ETA 9130 financial reports are complete and accurate by prioritizing the hiring of additional staff, reviewing procedures, looking for ways to strengthen internal controls and continuing conversation with DoIT about improving and/or modernizing reporting tools.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($2,329,654,603) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-032: Inadequate Process for Preparing ETA 2208A Special Report Condition Found: IDES does not have an adequate process in place to ensure the ETA 2208A special reports prepared for the Unemployment Insurance (UI) program are complete and accurate. On a quarterly basis, IDES is required to report information on staff years worked and paid by program category on the ETA 2208A – Quarterly UI Above-Base (ETA 2208A) report. The information required to be reported includes UI program staff year usage (Section A), regular contingency entitlement certification (Section B), trade above-base entitlement certification (Section C), and additional benefits above-base entitlement certification (Section D). Key line items required for testing include items one through seven in Section A. IDES has implemented procedures whereby IDES program staff prepare the quarterly reports and a supervisor reviews and approves the report prior to submission to the USDOL. During our testwork of two quarterly ETA 2208A reports, we noted IDES was unable to provide evidence a supervisor reviewed and approved the December 31, 2023 and the March 31, 2024 reports prior to submission to the USDOL. As a result, we were unable to determine if a supervisory review was performed and whether the duties of preparing and reviewing the report were appropriately segregated. Criteria or Requirement: 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal control should include procedures to ensure supervisory reviews of required special reports are completed and documented prior to submission to the USDOL. Cause: In discussing these conditions with IDES officials, they stated the lack of evidence of review and errors were due to IDES personnel not properly documenting approval of the special reports prior to submission to the USDOL. This issue was exacerbated by staff turnover and hiring delays. Possible Asserted Effect: Failure to follow established reporting controls may result in inaccurate reports which prevents the USDOL from effectively monitoring the UI program. Repeat Finding: A similar finding was reported in prior year audit as finding number 2023-041. (Finding Code 2024-032, 2023-041, 2022-028, 2021-032) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDES ensure supervisory reviews of special reports prior to submission to the USDOL are documented in accordance with its established policies and procedures. Views of IDES Officials: IDES accepts the finding. It has been reviewed and corrected.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($2,329,354,603) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: None Finding 2024-033: Inaccurate Reporting of Federal Expenditures Condition Found: IDES did not accurately report Federal expenditures under the Unemployment Insurance (UI) program. Federal expenditures reported to the Illinois Office of Comptroller (IOC) which were used to prepare the schedule of expenditure of federal awards (SEFA) did not agree to IDES’s financial records provided for audit. Specifically, we noted the following difference between amounts provided for audit by IDES and the SEFA amounts reported to the IOC for the Unemployment Insurance program for the year ended June 30, 2024: "See Table in the Audit Report" Finally, we noted IDES’s controls over reporting federal expenditures were not designed at a sufficient level of precision to ensure complete and accurate reporting in a timely manner. Criteria or Requirement: According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statements which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures are accurately reported on the SEFA. Cause: In discussing these conditions with IDES officials, they stated the cause of the difference was the result of a large audit adjustment related to return of debit cards from a third party bank who sopped serving the program in December 2021. Possible Asserted Effect: Failure to accurately report federal expenditures inhibits the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal funding. Repeat Finding: A similar finding was reported in prior year audit as finding number 2023-042. (Finding Code 2024-033, 2023-042) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDES establish procedures to accurately report federal expenditure used to prepare the SEFA to the IOC. Views of IDES Officials: The Agency accepts the recommendation and will adjust for returned debit cards in accordance with the final resolution determined in consultation with the Comptroller and financial statement auditors for State fiscal year 2024 if this situation should arise again.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Low-Income Home Energy Assistance (LIHEAP) ALN and Program Expenditures: 93.568 ($205,171,791) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Cash Management Finding 2024-034: Failure to Re-certify to the Accuracy of the Clearance Pattern Condition Found: DCEO did not properly review or re-certify the accuracy of the clearance pattern specified in the Treasury-State Agreement related to cash draws for the Low-Income Home Energy Assistance Program (LIHEAP). Annually, the State of Illinois negotiates the Treasury-State Agreement (TSA) with the U.S. Department of the Treasury (the Treasury) which details the funding techniques used for the draw down of federal funds. Certain approved finding techniques utilized by the State require the use of a clearance pattern that identifies the average number of days disbursements (warrants) take to clear the State Treasurer’s account. The established clearance pattern is then used to determine the date the State should request federal funds from the U.S. Treasury in order to minimize the time elapsing between the receipt of federal funds and the State Treasurer’s clearance of funds. The clearance pattern must be recertified at least every five years. During our testwork over cash management requirements, we noted the clearance pattern included in the TSA in place for the year ended June 30, 2024 had not been recertified since 2016 (more than 5 years since previous recertification). Additionally, we noted internal controls have not been established to ensure clearance patterns are calculated and recertified in accordance with Treasury regulations. Criteria or Requirement: 31 CFR 205.20 requires a State to ensure that a clearance pattern accurately represents the flow of Federal funds under the Federal assistance programs to which it is applied, and that a clearance pattern reflects seasonal or other periodic variations in clearance activity. A State shall also ensure that a clearance pattern is auditable. 31 CFR 205.22 states an authorized State official shall recertify that a clearance pattern corresponds to a program’s clearance activity and shall recertify the accuracy of the clearance pattern at least every five years. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to ensure clearance patterns are recertified in accordance with federal regulations. Cause: In discussing these conditions with DCEO officials, they stated they did not have procedures in place to re-certify the clearance pattern every 5 years as required due to unfamiliarity with the requirements. Possible Asserted Effect: Failure to evaluate and recertify a program’s clearance pattern violates the requirement of 31 CFR 205.9 and could result in the inaccurate recalculation of DCEO’s interest obligation to the Treasury. Repeat Finding: A similar finding was reported in the prior year audit and finding number 2023-027. (Finding Code 2024-034, 2023-027) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCEO establish procedures and controls to ensure clearance patterns are recertified within required timeframes. Views of DCEO Officials: DCEO agrees with this finding.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Low-Income Home Energy Assistance (LIHEAP) ALN and Program Expenditures: 93.568 ($205,171,791) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Cash Management Finding 2024-035: Failure to Perform Cash Draws in Accordance with the Treasury State Agreement Condition Found: DCEO did not perform its cash draws in accordance with the funding technique prescribed in the Treasury State Agreement (TSA). On an annual basis, the State of Illinois negotiates the TSA with the U.S. Department of the Treasury (the Treasury), which details, among other things, the funding techniques to be used for requesting federal funds. The TSA funding technique prescribed for the Low Income Home Energy Assistance Program (LIHEAP) program is interest neutral and requires DCEO to request funds from the awarding federal agency so that the funds are deposited by ACH on the dollar weighted average day of clearance for disbursements. According to the 2024 TSA, the average day of clearance for program costs is three days. As such, under this funding technique, DCEO should request federal funds two days after issuing warrants (payments) for program expenditures. During our testwork over 15 cash draws (totaling $67,855,621) for program (subrecipient) expenditures of the LIHEAP program during the year ended June 30, 2024, we noted the expenditures supporting the cash draws were not disbursed in accordance with the timeframe required by the prescribed funding technique. During our testing of 40 subrecipient payments (totaling $9,991,994), we noted federal funds were requested 1 to 5 days earlier than permitted by the funding technique (totaling $1,859,216). Additionally, we noted internal controls have not been established to ensure cash draws are calculated and recertified in accordance with Treasury regulations and the funding technique prescribed by the TSA. Criteria or Requirement: According to 31 CFR part 205.6(a), a TSA documents the accepted funding techniques and methods for calculating interest agreed upon by the U.S. Treasury and the State for each Federal program governed by subpart A of the Treasury regulations. Section 6.3.2 of the 2024 Treasury State Agreement (effective July 1, 2023 to June 30, 2024) states that the Low-Income Home Energy Assistance program is required to use the Average Clearance funding technique. Section 6.2.1 of the 2024 Treasury State Agreement describes the Average Clearance funding technique as being interest neutral and requiring the State to request funds such that they are deposited by ACH on the dollar-weighted average day of clearance for the disbursement. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure that Federal cash draws are performed in accordance with the TSA. Cause: In discussing these conditions with DCEO officials, DCEO did not have the correct funding technique listed within the Treasury-State Agreement for the Low-Income Home Energy Assistance Program. Possible Asserted Effect: Failure to draw funds in accordance with the TSA results in noncompliance with U.S. Treasury regulations. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-028. (Finding Code 2024-035, 2023-028) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCEO implement procedures to ensure cash draws are performed in accordance with the TSA or work with the US Treasury to amend the TSA to reflect DCEO cash draw request practices. Views of DCEO Officials: DCEO agrees with this finding.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Labor (USDOL) U.S. Department of Health and Human Services (USDHHS) Program Name: WIOA Cluster, Low-Income Home Energy Assistance (LIHEAP) ALN and Program Expenditures: 17.258/17.259/17.278 ($142,310,788), 93.568 ($205,171,791) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-036: Failure to Maintain Updated Procedures to File Subaward Information Required by FFATA Condition Found: DCEO failed to maintain updated procedures which resulted in filing inaccurate Federal Funding Accountability and Transparency Act (FFATA) reports. The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During State fiscal year 2024, DCEO did not have updated procedures in place to identify and report the following key data elements, for each of the programs: "See Table in the Audit Report" Additionally, we noted DCEO did not have adequate internal controls in place over FFATA reporting to ensure all subawards were reported as required. DCEO passed through approximately $198,786,849 and $124,406,438 to subrecipients of the LIHEAP and WIOA programs, respectively, during the year ended June 30, 2024. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to ensure all FFATA reports are accurately and timely prepared and submitted in accordance with federal regulations. Cause: In discussing these conditions with DCEO officials, they stated the department’s procedures did not reflect a requirement to re-file a FFATA report after a sub-award agreement had its dollar amount modified. In addition, because the department’s procedures presumed that the obligation date of a subaward was interchangeable with the award date for a subaward, FFATA reports were filed based on when a sub-award was obligated. Possible Asserted Effect: Failure to maintain updated reporting procedures in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-029. (Finding Code 2024-036, 2023-029) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCEO update procedures and controls to identify awards and amendments subject to FFATA reporting requirements and report required subaward information in accordance with FFATA. Views of DCEO Officials: DCEO agrees with the finding and recommendations.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Low-Income Home Energy Assistance (LIHEAP) ALN and Program Expenditures: 93.568 ($205,171,791) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-037: Inaccurate Special Report Condition Found: DCEO did not prepare accurate special reports for the Low-Income Home Energy Assistance Program (LIHEAP). DCEO is required to prepare Quarterly Performance and Management Reports for LIHEAP. During our testwork over two Quarterly Performance and Management Reports submitted during the fiscal year ended June 30, 2024, we noted for the quarterly report for the period ending June 30, 2024, the amount of funds obligated was reported as $110,510,629. The actual amount of funds obligated was $109,882,656, resulting in an overstatement of $627,973. Additionally, we noted DCEO has not established appropriate internal controls to ensure its quarterly reports submitted to USDHHS are accurate in accordance with federal requirements. We also noted supervisory review procedures have not been designed to operate at a level of precision to identify errors of the size and nature noted above. Criteria or Requirement:According to the Administration for Children and Families Action Transmittal LIHEAP-AT-2024-02, the Quarterly Performance and Management Report is conducted in accordance with the LIHEAP statute (Title XXVI of P.L. 97-35). The information received from the report provides data to the Administration for Children and Families and Congress in its oversight of recipients’ performance in administering the LIHEAP program. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include controls to ensure amounts reported in the Quarterly Performance and Management Report are accurate. Cause: In discussing these conditions with DCEO officials, they stated the incorrect amounts submitted for the June 30, 2024 quarterly report was due to a data entry error not detected by supervisory review procedures Possible Asserted Effect: Failure to accurately prepare the quarterly performance and management reports inhibits the completion of the audit and may prevent USDHHS from obtaining accurate program data for monitoring the LIHEAP program. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-031. (Finding Code 2024-037, 2023-031) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCEO review the process and procedures in place to prepare special reports required for the LIHEAP program and implement procedures necessary to ensure the reports submitted to USDHHS are accurate. Views of DCEO Officials: DCEO agrees with the finding and recommendation. Due to the timing of field work of the 2023 audit, the quarterly report identified in this finding was submitted prior to the identification of the prior year finding.

State Agency: Illinois Department of Transportation (IDOT) Federal Agency: U.S. Department of Transportation (USDOT) Program Name: Airport Improvement Program, COVID-19 Airports Programs, and Infrastructure Investment and Jobs Act Programs (AIP) ALN and Program Expenditures: 20.106 ($86,526,057) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Special Tests and Provisions – Wage Rate Requirements Finding 2024-038: Failure to Follow Established Control Procedures for Obtaining Certified Payrolls for the Airport Improvement Program, COVID-19 Airports Programs, and Infrastructure Investment and Jobs Act Programs (AIP) Condition Found: IDOT did not document approval of certified payrolls in accordance with its established internal control procedures for the Airport Improvement Program, COVID-19 Airports Programs, and Infrastructure Investment and Jobs Act Programs (AIP). Non-federal entities are required to comply with the requirements of the Davis-Bacon Act and the Department of Labor regulations applicable to contracts governing federally financed and assisted construction. These regulations require, in part, that all laborers and mechanics employed by contractors or subcontractors who work on construction contracts in excess of $2,000 financed by Federal assistance funds must be paid prevailing wage rates established for the locality of the project. Each subcontractor subject to the Wage Rate Requirement (formally known as the Davis-Bacon Act) must submit payrolls on a weekly basis and include a signed certification that they have complied with the prevailing wage rates. The resident engineer on the construction site is required to keep a log of contractors and monitor payroll submission. These logs are reviewed by the resident engineer, which indicates that the certified payrolls for that period have been received and meet IDOT’s program requirements. During our testwork of 51 AIP contractor payments for construction projects managed by subrecipients (totaling $18,632,822), we noted that the certified payrolls for 3 AIP contractor payments on construction projects managed by subrecipients (totaling $440,232) did not contain documentation of approval by an IDOT resident engineer. Payments made to subrecipients for construction contracts under the Airport Improvement Program were $38,125,279 during the year ended June 30, 2024. Total payments made to subrecipients under the Airport Improvement Program were $86,237,740 during the year ended June 30, 2024. Criteria or Requirement: 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures in place to ensure certified payrolls are reviewed with proper documentation of resident engineer approval. Cause: In discussing these conditions with IDOT officials, IDOT stated continued staffing turnover, staffing shortages, and shifts in responsibility for oversight between relevant sections/bureaus as such contributed to this finding. Possible Asserted Effect: Failure to approve certified payrolls in line with IDOT’s established control procedures could result in contractors not paying the prevailing wage rate to employees. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code: 2024-038) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOT review its current process and consider any changes necessary to ensure weekly payroll certifications are reviewed and approved in accordance with federal requirements and IDOT’s procedures. Views of IDOT Officials: IDOT agrees with the finding and recommendation. IDOT would like to note that even though the full program title includes “COVID-19 Airport Programs”, this specific issue does not relate to any of the COVID-19 funding sources. COVID-19 funding was not largely utilized by airports for capital projects and the issue noted in this finding relates to capital projects.

State Agency: Illinois Department of Transportation (IDOT) Federal Agency: U.S. Department of Transportation Program Name: Airport Improvement Program, COVID-19 Airports Programs, and Infrastructure Investment and Jobs Act Programs (AIP) ALN and Program Expenditures: 20.106 ($86,526,057) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-039: Failure to Report Subaward Information Required by FFATA Condition Found: IDOT failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Airport Improvement Program, COVID-19 Airports Programs, and Infrastructure Investment and Jobs Act Programs (AIP). The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers IDOT passed through approximately $86,237,740 to subrecipients of the AIP during the year ended June 30, 2024. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Regulation (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include complying with FFATA. Cause: In discussing these conditions with IDOT officials, IDOT stated missing FFATA reporting was due to staffing transition combined with a lack of appropriate staffing resources. Possible Asserted Effect: Failure to identify awards subject to FFATA and to report subaward in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-043. (Finding Code 2024-039, 2023-043, 2022-029, 2021-036). Recommendation: We recommend IDOT establish procedures to identify awards subject to FFATA reporting requirements and report required subaward information in accordance with FFATA. Views of IDOT Officials: IDOT agrees with this finding.

State Agency: Illinois Department of Transportation (IDOT) Federal Agency: U.S. Department of Transportation Program Name: Airport Improvement Program, COVID-19 Airports Programs, and Infrastructure Investment and Jobs Act Programs (AIP) ALN and Program Expenditures: 20.106 ($86,526,057) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-040: Inaccurate Information Included in the Financial Reports Condition Found: IDOT did not prepare accurate federal financial status reports for the Airport Improvement Program, COVID-19 Airports Programs, and Infrastructure Investment and Jobs Act Programs (AIP). IDOT is required to prepare a federal financial status report (SF-425) submitted annually for each open grant, due 90 days after the end of each Federal Aviation Administration’s (FAA) fiscal year, by sponsors to monitor outlays and program income on a cash or accrual basis. In addition, this report must be submitted as a final financial report during grant closeout. Further, IDOT is required to submit an Outlay Report and Request for Reimbursement for Construction Program (SF-271) for each construction project, due 90 days after the end of the FAA’s fiscal year, by sponsors to summarize requests for reimbursements. This report must also be submitted as a final financial report during closeout. During our testwork over the annual SF-425 and related SF-271 reports submitted for the federal fiscal year ended September 30, 2023, we noted the following errors: "See Table in the Audit Report" We further noted the supervisory review procedures performed for this report were not at an appropriate level of precision to identify the errors identified in our testing. Additionally, IDOT does not perform analytical procedures to identify potential errors or unusual fluctuations in reported amounts. Criteria or Requirement: According to the SF-425 report Box 13 for certification, recipients of AIP grants must submit true, complete, and accurate information on the SF-425 reports. Further, according to the SF-271 report Box 12 for certification, recipients of AIP grants must certify that the billed costs or disbursements reported are in accordance with the terms of the project and that the reimbursement represents the Federal share due which has not been previously requested and that all work is in accordance with the terms of the award. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure information reported in required financial reports is accurate. Cause: In discussing these conditions with IDOT officials, IDOT stated the preparation of the reports is a manual process and the difference was due to human error. Possible Asserted Effect: Failure to accurately prepare financial reports prevents USDOT from effectively monitoring the Airport Improvement Program. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-044. (Finding Code 2024-040, 2023-044) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOT review the process and procedures in place to prepare financial status reports required for the Airport Improvement Program and implement the additional procedures necessary to ensure the reports are complete, accurate, and agree or reconcile to its financial records. Views of IDOT Officials: IDOT agrees with this finding.

State Agency: Illinois Department of Transportation (IDOT) Federal Agency: U.S. Department of Transportation Program Name: Highway Planning and Construction (HPC) Program ALN and Program Expenditures: 20.205 ($2,192,857,212) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-041: Failure to Communicate Award Information to Subrecipients Condition Found: IDOT did not follow its established policies and procedures for monitoring subrecipients of the Highway Planning and Construction program. During our testwork of the award communications for our sample of subrecipients, we selected the contracts under which funds were disbursed during fiscal year 2024 to review for compliance with federal award communication requirements. During our review of the award communication files for a sample of 30 awards (related to subrecipient expenditures of $46,016,588), we noted the following information was not communicated in the subrecipient award agreement for three subrecipients sampled (with payments totaling $742,559): • Federal Award Identification Number (FAIN) • Assistance Listing Number (ALN) • Subaward Period of Performance Start and End Date • Subrecipient’s Unique Entity Identifier Amounts passed through to subrecipients under the Highway Planning and Construction program totaled $94,970,638 during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(a), a pass-through entity is required to identify Federal awards made to the subrecipient by informing each subrecipient of required information. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include controls to ensure required information is properly communicated. Cause: In discussing these conditions with IDOT officials, they stated there are two separate causes for this finding. For two of the agreements, the FAIN and ALN were overlooked when drafting the agreement. In these instances, it was employee oversight. For the final agreement noted, elements were missing from the template at that time, and IDOT was unaware of any requirements to have the CFDA# (ALN), DUNS number (UEI), or single audit included in the agreement as it was executed in 2002. Possible Asserted Effect: Failure to communicate required award information may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-041) Recommendation: We recommend IDOT implement additional procedures to ensure award information communicated to subrecipients is reviewed for completeness and accuracy. Views of IDOT Officials: IDOT agrees with the finding.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-042: Failure to Adequately Monitor Subrecipients Condition Found: ICJIA did not follow its established program monitoring policies and procedures for subrecipients of the Crime Victim Assistance (CVA) program during fiscal year 2024. ICJIA selects subrecipients of the CVA program to perform programmatic monitoring procedures using a risk-based approach. Among other things, ICJIA has identified subrecipients receiving CVA funding under shorter term programs (12 months or less in duration) as higher risk and requires an on-site review to be performed once during the period of performance. Additionally, longer term programs (12 to 36 months in duration) require an on-site review in the first twelve months of the period of performance and a second on-site review during the remaining period of performance. In scheduling the timing of its on-site reviews, ICJIA considers whether there are any additional subrecipient specific risk factors that warrant an earlier review time. Based upon ICJIA’s monitoring criteria, we noted ICJIA should have conducted site visits for 51 subrecipients (with expenditures totaling $26,561,276) from longer term programs during the year ended June 30, 2024. During our review of the subrecipient site visits conducted during State fiscal year 2024, we noted 14 of the 51 subrecipients from longer term programs (with expenditures of $4,215,392 during the year ended June 30, 2024) were not subjected to site visits. Additionally, we noted three of the 51 reviews required to be performed during the year ended June 30, 2024 were not performed within the required time period. Specifically, we noted reviews for three subrecipients (with expenditures of $659,442) were performed 19 to 21 days late. ICJIA passed through $50,412,108 to subrecipients of the CVA program during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. ICJIA’s Site Visits policy requires Grant Specialists to conduct two site visits within thirty-six months of the start of a grant with the first site visit taking place within the first twelve months, unless the grantee’s Program Risk Assessment requires that a site visit be completed within a shorter time period. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring on-site program monitoring procedures are performed in a timely manner. Cause: In discussing these conditions with ICJIA officials, they stated due to staffing shortages within the federal and state grants unit, all of the required visits were not completed. Possible Asserted Effect: Failure to adequately perform on-site monitoring reviews of subrecipients may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-033. (Finding Code 2024-042, 2023-033) Recommendation: We recommend ICJIA ensure programmatic on-site reviews are performed and documented for subrecipients in accordance with established policies and procedures. Views of ICJIA Officials: ICJIA acknowledges that these gaps in documentation and consistency contributed to the finding and has taken corrective actions to strengthen monitoring procedures, enhance documentation standards, and ensure timely follow-up with subrecipients.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-043: Inadequate Review of Subrecipient Single Audit Reports Condition Found: ICJIA did not adequately review single audit reports received from its subrecipients for the Crime Victim Assistance Program (CVA) program on a timely basis. The State of Illinois established the Grant Accountability and Transparency Unit (GATU) to implement the provisions of the State’s Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal and State programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning, to the applicable state agency, any findings attributable to amounts passed through to the subrecipient(s) by the State. As a State agency, ICJIA is responsible for reviewing the reports assigned to them by GATU and determining whether Federal funds reported in the consolidated year-end financial report (CYEFR) reconcile to ICJIA records. Additionally, as the cognizant State agency, ICJIA is responsible for issuing management decisions on findings reported and applying sanctions to subrecipients who do not comply with reporting requirements (i.e. stop pay process). During our testing of a sample of single audit desk review files for 14 subrecipients (with expenditures of $37,884,972 in the fiscal year), we noted the following: • For five subrecipients (with expenditures totaling $19,501,158), ICJIA did not issue a management decision letter in a timely manner. The delays in issuing management decision letters ranged from 61 to 128 days beyond the required timeframe. • For 11 subrecipients (with expenditures totaling $24,680,412), ICJIA did not reconcile the CYEFR to ICJIA’s records as required. As of the date we communicated our findings to ICJIA (January 27, 2026), ICJIA had still not reconciled the CYEFR to ICJIA’s records for 10 subrecipients (with expenditures totaling $24,097,663). • For one subrecipient (with expenditures of $295,572), the subrecipient single audit reporting package was not submitted within the required timeframe, and ICJIA did not follow up with the subrecipient or invoke the stop pay process. ICJIA has not established controls over subrecipient single audit reviews at an adequate level of precision to ensure single audit reporting requirements, including obtaining and reviewing single audit reporting packages, issuing management decision letters, reconciling CYEFRs to agency records, and invoking stop payment actions, are performed within required timeframes. ICJIA passed through $50,412,108 to subrecipients of the CVA program during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statues, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. Additionally, 2 CFR 200.332(e)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure Single Audit reports are reviewed in a timely manner and management decisions are issued within required timeframes. Cause: In discussing these conditions with ICJIA officials, they stated this GATA responsibility has not been performed as consistently as other responsibilities due to competing priorities and staff shortages. Possible Asserted Effect: Failure to complete and document reviews of subrecipient single audit reports in a timely manner may result in federal funds being expended for unallowable purposes and subrecipients not administering the federal programs in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-034. (Finding Code 2024-043, 2023-034) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA establish procedures to ensure subrecipient single audit report reviews are completed and documented in a timely manner. Additionally, ICJIA should implement procedures to ensure timely reconciliation of funds, issuance of management decision letters, and initiation of the stop pay process. Views of ICJIA Officials: ICJIA agrees with the finding and the cause. Staffing continues to be a priority for resolving the single audit review process.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-044: Inadequate Fiscal Monitoring of Subrecipients Condition Found: ICJIA did not follow its established policies and procedures for monitoring subrecipients of the Crime Victim Assistance (CVA) program. ICJIA selects subrecipients of the CVA program over which to perform fiscal monitoring procedures using a risk-based approach. Specifically, a risk assessment is performed annually over the subrecipient, which includes calculating a risk score based upon criteria established by ICJIA. ICJIA’s risk assessment criteria include the total award amount, the subgrantee’s experience with ICJIA grant awards, results of financial monitoring, the percentage of grant expended to date, the quality of financial submissions, the timeliness of financial submissions, and the payment type. Based upon the risk score, each subrecipient is designated as needing high, moderate, or low oversight. The oversight category assigned determines the frequency and type of financial monitoring (i.e. desk review or fiscal audit). During our audit procedures, we noted three CVA subrecipients (with expenditures of $582,277) were designated for high oversight and did not have a fiscal audit performed over their CVA program grants. Agency personnel indicated additional risk assessment criteria were considered to reduce the number of high oversight subrecipients; however, these additional criteria are not documented in the fiscal monitoring policy or risk score documentation. ICJIA passed through approximately $50,412,108 to subrecipients of the CVA program during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity must evaluate each subrecipient's risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. 2 CFR 200.332(e)(3) requires pass-through entities to issue management decisions for applicable audit findings pertaining to the federal awards provided to the subrecipient and 2 CFR 200.332(e)(4) requires pass through entities to resolve audit findings through corrective action plans (CAP). In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing and performing monitoring procedures in accordance with Uniform Guidance and program requirements. Cause: In discussing these conditions with ICJIA officials, they stated ICJIA utilizes both a formal, documented policy to determine a risk score for over 600 active grantees and a more subjective, unwritten assessment to determine which higher and medium risk grantees actually will be scheduled to receive active fiscal monitoring procedures. The subjective analysis is used by ICJIA to adjust the potential volume of monitoring effort to the anticipated number of resources available in a given period. Due to the scarcity of resources, the agency prioritized reviews for subrecipients of other ICJIA programs. Possible Asserted Effect: Failure to fully document required risk assessments and to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-035. (Finding Code 2024-044, 2023-035) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA review their fiscal subrecipient monitoring procedures and implement additional procedures as necessary to ensure proper monitoring procedures are performed and documentation of monitoring activities are adequately maintained. Views of ICJIA Officials: ICJIA agrees with the findings as we have additional risk assessment criteria that are established but not documented.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-045: Inadequate Controls Over the Communication of Subrecipient Monitoring Results Condition Found: ICJIA did not consistently document supervisory reviews of the communication of on-site monitoring review results of its subrecipients for the Crime Victim Assistance (CVA) program in accordance with ICJIA’s control procedures. ICJIA internal control procedures require supervisory review and approval of program site visit reports prior to providing the results to subrecipients. During our testing of eight on-site reviews (for subrecipients with expenditures of $3,609,155), we noted the results of seven on-site reviews (for subrecipients with expenditures of $3,167,249) were communicated to the subrecipients prior to supervisory review and approval. ICJIA passed through approximately $50,412,108 to subrecipients of the Crime Victim Assistance (CVA) program during the year ended June 30, 2024. Criteria or Requirement: 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring supervisory reviews of on-site monitoring results and communications are performed. Cause: In discussing these conditions with ICJIA officials, they stated the exceptions noted are due to inadequate policies and procedures. Possible Asserted Effect: Failure to properly review and approve monitoring reports may result in inaccurate monitoring information and results being communicated to subrecipients. Repeat Finding: A similar finding was reported in the prior year audit as number 2023-036. (Finding Code 2024-045, 2023-036, 2022-024) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA review its current process for ensuring on-site monitoring results and communications are properly reviewed and approved before they are sent to subrecipients. Views of ICJIA Officials: ICJIA agrees with the finding and generally agrees with the identified cause. The issue stemmed from weaknesses in internal review and documentation processes, which limited the effectiveness of oversight during the reporting period. ICJIA has since implemented corrective actions to address these control gaps and prevent recurrence.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-046: Inadequate Controls over the Review of Subaward Information Required to be Reported for FFATA Condition Found: ICJIA did not perform supervisory reviews over subaward information required to be reported by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Crime Victim Assistance (CVA) program. The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing of 11 subawards (to subrecipients with expenditures totaling $30,433,708), we noted ICJIA could not provide evidence supervisory review procedures were performed to ensure the subaward information required to be reported by FFATA was complete and accurate. ICJIA passed through $50,412,108 to subrecipients of the CVA program during the year ended June 30, 2024. Criteria or Requirement: In accordance with 2 CFR 200.303, non-Federal entities are required to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include implementing procedures to review subaward information prior to submission to ensure all FFATA reports are accurately and timely prepared and submitted in accordance with federal regulations. Cause: In discussing these conditions with ICJIA officials, they stated ICJIA had not implemented formal supervisory review procedures. Possible Asserted Effect: Failure to perform supervisory reviews of subaward information required to be reported by FFATA could result in inaccurate reporting and noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-037. (Finding Code 2024-046, 2023-037, 2022-022, 2021-028) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA establish supervisory review procedures of subaward information required to be reported by FFATA. Views of ICJIA Officials: ICJIA agrees to the finding. During State fiscal year 2024, ICJIA was under FFATA policy from October 26, 2022.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-047: Failure to Accurately Prepare Financial Reports for the Crime Victim Assistance Program Condition Found: ICJIA did not prepare accurate federal financial status reports for the Crime Victim Assistance (CVA) program. ICJIA was required to prepare quarterly federal financial status reports (SF-425) for each open grant of the CVA program. During our testing over the quarterly SF-425 reports submitted during state fiscal year 2024, we noted the following error in the Victim of Crime Act (VOCA) 18 grant (#2018-V2-GX-0070) SF-425 report for the quarter ended September 30, 2023."See Table in the Audit Report" We further noted the supervisory review procedures performed for this report were not designed to operate at an appropriate level of precision to ensure financial reports are accurately prepared. Additionally, ICJIA does not perform analytical procedures to identify potential errors or unusual fluctuations in reported amounts. Criteria or Requirement: According to the USDOJ Grants Financial Guide 2024 section 3.15, the SF-425 must show the actual funds that have been spent (expenditures) and any bills that will be paid (unliquidated obligations incurred) at the recipient/subrecipient level for each award. Additionally, recipients are required to report on a quarterly basis the cumulative information on expenditures on line 10e, 10f, 10j, 10m, and 10n of the SF-425. According to the SF-425, Federal Financial Report box 13 for certification, non-Federal recipients of Federal grant awards must submit true, complete, and accurate information on the SF-425 reports. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure information reported in required financial reports is accurate. Cause: In discussing these conditions with ICJIA officials, they stated grants impacted by the COVID-19 pandemic were subject to various alterations to the established match requirements and procedures, which led to some confusion amongst program staff responsible for preparing financial reports. Possible Asserted Effect: Failure to accurately prepare financial reports prevents USDOJ from effectively monitoring the CVA program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-047) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA review the process and procedures in place to prepare financial status reports required for the CVA program and implement the additional procedures necessary to ensure the reports are complete, accurate, and agree or reconcile to its financial records. Views of ICJIA Officials: ICJIA agrees to the finding and the cause cited.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Cash Management Finding 2024-048: Inadequate Review of Cash Draw Calculations Condition Found: ICJIA did not adequately document their review of cash draw calculations for the Crime Victim Assistance program. During testing performed over 10 cash draws (totaling $18,381,243), we noted ICJIA could not provide evidence of supervisory review of the calculations supporting the cash draw request prior to submission for reimbursement. Upon further review, there were an additional 37 cash draws (totaling $29,408,246) where ICJIA could not provide evidence of supervisory review of the calculations supporting the cash draws. Criteria or Requirement: 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure supervisory reviews of cash draw calculations are properly documented. Cause: In discussing these conditions with ICJIA officials, they stated that a change to the formatting of the required Form C-64 in July 2023 removed the requirement for the agency to provide signature approval of each draw. ICJIA stopped documenting their review of cash draw calculations because of this update. Possible Asserted Effect: Failure to adequately perform and document supervisory reviews of cash draw calculations prior to request submission for reimbursement may result in the submission of inaccurate cash draw requests for reimbursement, which could result in the reimbursement of unallowable expenditures. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-048) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA review their process to ensure supervisory reviews of cash draw calculations are properly documented. Views of ICJIA Officials: ICJIA agrees to the finding and the cause cited.

State Agency: Illinois Department on Aging (IDOA) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Aging Cluster ALN and Program Expenditures: 93.044/93.045/93.053 ($68,210,944) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-049: Inadequate Review of Subrecipient Single Audit Reports Condition Found: IDOA did not adequately document review of single audit reports received from its subrecipients for the Aging Cluster program on a timely basis. The State of Illinois established the Grant Accountability and Transparency Unit (GATU) to implement the provisions of the State’s Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal and State programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning to the applicable state agency any findings attributable to amounts passed through to the subrecipient(s) by the State. IDOA staff are responsible for reviewing the reports assigned to them by GATU and determining whether: (1) federal funds reported in the schedule of expenditures of federal awards reconcile to IDOA records; (2) issuing management decisions on findings reported within required timeframes; and (3) applying sanctions to subrecipients who do not comply with reporting requirements (i.e. stop pay process). During our testing of a sample of single audit desk review files for seven subrecipients (with expenditures of $40,522,841 in the fiscal year), we noted the following: • For five subrecipients (with expenditures totaling $23,626,549), IDOA did not issue a management decision letter. • For one subrecipient (with expenditures totaling $2,117,589), IDOA did not issue a management decision letter over the subrecipient’s single audit that was received during state fiscal year 2024. In addition, the subrecipient did not file a single audit for the prior year with the Federal Audit Clearinghouse. While IDOA received a copy of the unfiled single audit report, a review was not performed and funding was not suspended in accordance with the State’s established policies. IDOA has not established controls over subrecipient single audit reviews at an adequate level of precision to ensure single audit reporting requirements, including obtaining and reviewing single audit reporting packages, issuing management decision letters, and invoking stop payment actions are performed within required timeframes. IDOA passed through $66,724,826 to subrecipients of the Aging Cluster program during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statues, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. Additionally, 2 CFR 200.332(d)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on federal award audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure Single Audit reports are reviewed in a timely manner and management decisions are issued within required timeframes. Cause: In discussing these conditions with IDOA officials, they stated competing priorities and limited resources have impacted the Department’s ability to comply with this requirement. Possible Asserted Effect: Failure to complete and document reviews of subrecipient single audit reports in a timely manner may result in federal funds being expended for unallowable purposes and subrecipients not administering the federal programs in accordance with laws, regulations, and the grant agreement. Additionally, failure to issue management decision letters within six months of acceptance of the single audit report by the FAC results in noncompliance with federal regulations. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-049) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOA establish procedures to ensure (1) subrecipient single audit report reviewed within established deadlines, (2) management decision letters are issued for all findings affecting its federal programs in accordance with the Uniform Guidance, and (3) follow up procedures are performed to ensure subrecipients have taken timely and appropriate corrective action. Views of IDOA Officials: The Department agrees with this finding. Although the Department shows that all the Area Agency on Aging single audits were received in the audit report review management system (ARRMS), there is one pending approval by the Audit Clearinghouse. The Department did not get the audits reconciled during state fiscal year 2024. The Department did not issue any management decision letters for those audits.

State Agency: Illinois Department on Aging (IDOA) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Aging Cluster ALN and Program Expenditures: 93.044/93.045/93.053 ($68,210,944) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-050: Failure to Accurately Prepare Financial Reports for the Aging Cluster Condition Found: IDOA did not prepare accurate federal financial status reports for the Aging Cluster (Aging) program. IDOA is required to prepare semi-annual federal financial status reports (SF-425) for each open grant of the Aging program. During our testing of seven SF-425 reports submitted during state fiscal year 2024, we noted the following errors in the Older Americans Act Title III FFY21 grant (#2101ILOACM) SF-425 report for the semi-annual period ended September 30, 2023: "See Table in the Audit Report" We further noted the supervisory review procedures performed for this report were not designed to operate at an appropriate level of precision to ensure financial reports are accurately prepared. Additionally, IDOA does not perform analytical procedures to identify potential errors or unusual fluctuations in reported amounts. Criteria or Requirement: According to 2 CFR 200.328, Aging Cluster program grantees are required to submit SF-425 and Administration on Aging (AoA) Title III supplemental forms on a semi-annual basis. Reports are due within 30 days for the periods ending March 31 and September 30 and are based on the accrual basis. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure information reported in required financial reports is accurate. Cause: In discussing these conditions with IDOA officials, they stated IDOA’s records were not updated for an error identified during the preparation and supervisory review of the report. Possible Asserted Effect: Failure to accurately prepare financial reports prevents the USDHHS from effectively monitoring the Aging program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-050) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOA review the process and procedures in place to prepare financial status reports required for the Aging program and implement the additional procedures necessary to ensure the reports are complete, accurate, and agree or reconcile to its financial records. Views of IDOA Officials: The Department agrees with this finding. The SF-425 reports are prepared by Department staff, reviewed by an outside contractor, entered into the payment management system, submitted and reviewed again before being certified. Although the adjustment has now been made and staff have been reminded to promptly enter and save adjustments or corrections in the working files at the time of the auditors’ review the spreadsheet was incorrect.

State Agency: Illinois Department on Aging (IDOA) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Aging Cluster ALN and Program Expenditures: 93.044/93.045/93.053 ($68,210,944) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-051: Failure to Report Subaward Information Required by FFATA Condition Found: IDOA failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Aging Cluster program. The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that IDOA did not prepare or submit FFATA reports as required by federal regulations for any subawards made for the Aging Cluster program for the period July 1, 2023 through June 30, 2024. Additionally, we noted IDOA did not establish adequate internal controls over FFATA reporting to ensure all subawards were reported as required. 2024. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include complying with FFATA. Cause: In discussing these conditions with IDOA officials, they stated with the departure of experienced staff, delay in hiring the new staff and the system change where the FFATA information is to be entered this requirement was overlooked and missed getting completed. Possible Asserted Effect: Failure to identify and report subawards subject to FFATA results in noncompliance with federal regulations. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-051) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOA establish procedures to identify awards subject to FFATA reporting requirements and report required subaward information in accordance with FFATA. Views of IDOA Officials: The Department agrees with this finding.

State Agency: Illinois Governor’s Office of Management and Budget (GOMB) Federal Agency: U.S. Department of Agriculture (USDA), U.S. Department of Justice (DOJ), U.S. Department of Labor (DOL), U.S. Department of Transportation (DOT), U.S. Department of the Treasury (TREAS), U.S. Department of Education (ED), U.S. Department of Health and Human Services (USDHHS) Program Name: Special Supplemental Nutrition Program for Women, Infants and Children (WIC), Child and Adult Care Food Program (CACFP), Crime Victims Assistance Program, WIOA Cluster, Highway Planning and Construction, Emergency Rental Assistance Program, Homeowner Assistance Fund Program, Coronavirus State and Local Fiscal Recovery Funds, Title I Grants to Local Educational Agencies, Twenty-First Century Community Learning Centers, Supporting Effective Instruction State Grants, Education Stabilization Fund (ESF), Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Temporary Assistance for Needy Families (TANF), Child Support Enforcement, Low-Income Home Energy Assistance Program, Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures 10.557 ($168,740,425), 10.558 ($156,353,139), 16.575 ($78,196,419), 17.258/17.259/17.278 ($141,177,677), 20.205 ($1,932,300,419), 21.023 ($179,355,381), 21.026 ($177,107,928), 21.027 ($2,804,581,453), 84.010A ($704,235,726), 84.287 ($77,436,583),84.367A ($76,537,613), 84.425 ($2,227,152,891), 93.323 ($174,636,052), 93.558 ($578,867,422), 93.563 ($131,300,355), 93.568 ($288,503,657), 93.575/93.596 ($783,907,069), 93.667 ($57,147,970), 93.959 ($101,011,200) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Finding 2023-002: Inadequate Monitoring of Subrecipient Single Audit Reviews Compliance Requirement: Subrecipient Monitoring Condition Found: The State of Illinois did not establish adequate controls to monitor the completion and documentation of the review single audit reports for its subrecipients of the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), Child and Adult Care Food Program (CACFP), Crime Victims Assistance Program (CVA), WIOA Cluster (WIOA), Highway and Planning Construction (Highway), Emergency Rental Assistance Program (ERAP), Homeowner Assistance Fund Program (HAF), Coronavirus State and Local Fiscal Recovery Funds (SLFRF), Twenty-First Century Community Learning Centers (Twenty-First), Title I Grants to Local Education Agencies (Title I), Supporting Effective Instruction State Grants (SEISG), Education Stabilization Funds (ESF), Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Temporary Assistance for Needy Families Cluster (TANF), Child Support Enforcement (CSE), Low-Income Home Energy Assistance Program (LIHEAP), Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS). The State of Illinois established the Grant Accountability Transparency Unit (GATU) to implement the provisions of GATA on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning, to the applicable state agency, any findings attributable to amounts passed through to the subrecipient(s) by the State and working with program personnel to issue management decisions on findings. The State utilizes a contractor to perform the centralized functions of obtaining the single audit report, verifying the report meets the requirements, and assigning findings to the applicable State agency. During our testing of subrecipient single audit desk review files for our 2023 major programs, we noted instances where single audit desk reviews were still in process and had not been finalized within GATA ARRMS as of the date of our testing (October 7, 2024). One subrecipient in our sample for the WIC program had incomplete single audit reviews for fiscal years 2019 through 2022, despite the fact the State had obtained the single audit report from the Federal Audit Clearinghouse for each of these fiscal years. Upon further review of data contained within GATA ARRMS, we identified 669 single audit reviews were identified as incomplete in GATA ARRMS for grantees who: (1) reported expenditures under fiscal year 2023 major programs, (2) had an audit report with a FAC acceptance date between January 2, 2022 and January 3, 2023 (requiring the report to be reviewed during fiscal year 2023) and (3) were not sanctioned (placed on the Illinois Stop Payment List) by the State for noncompliance with reporting requirements. These 669 reviews were in varying stages of completion with the majority (608 audits) pending documentation supporting the issuance of a final completion letter by the cognizant agency. The remaining 61 audits (9.1%) were pending receipt of documentation, pending a review, or had another error requiring follow-up. These 669 audits included 323 audits (48.3%) with one or more findings potentially requiring a management decision to be issued. We noted the cognizant agencies for the 669 incomplete single audit reviews in GATA ARRMS were as follows: "See Table in the Audit Report". The 669 incomplete single audit reviews in GATA ARRMS pertained to subrecipients of the following major programs: "See Table in the Audit Report". While in many instances there was evidence the State agencies had completed the necessary procedures outside of GATA ARRMS, the purpose of GATA ARRMS is to reduce the duplication of effort across State agencies and to provide a single submission point for the State’s subrecipients. The lack of monitoring controls around this centralized process may result in noncompliance with subrecipient single audit desk review requirements. The State’s subrecipient expenditures under the federal programs for the year ended June 30, 2023 were as follows: "See Table in the Audit Report". Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure the federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. Further, 2 CFR 200.332(d)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on audit findings within six months of acceptance of the audit report by the Federal Audit Clearinghouse (FAC) and ensure that the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include implementing procedures to monitor whether single audit reports are reviewed, management decision letters are issued, and single audit desk review files are closed out in GATA ARRMS in a timely manner. Cause: In discussing these conditions with GOMB officials, management stated that the incompleteness of the State’s audit reviews in GATA ARRMS was due to oversight. Possible Asserted Effect: Failure to complete and document reviews of subrecipient single audit reports in GATA ARRMS in a timely manner may result in noncompliance with the State’s obligation as a pass-through entity to appropriately monitor its subrecipients. Repeat Finding: A similar finding was not reported in the prior year audit (Finding Code 2023-002). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend GOMB establish procedures to monitor the completion and documentation of single audit report reviews in GATA ARRMS to ensure the State complies with its obligation as a pass-through entity. Views of GOMB Officials: GOMB agrees with the finding.

State Agency: Illinois Governor’s Office of Management and Budget (GOMB) Federal Agency: U.S. Department of the Treasury (TREAS) Program Name: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN and Program Expenditures 21.027 ($2,804,581,453) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2023-003: Failure to Accurately Prepare Performance Reports for the COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Program Condition Found: GOMB did not prepare accurate federal project and expenditure reports (Paperwork Reduction Act (PRA) 1505-0271) for the COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program. The State was required to prepare quarterly federal project and expenditure reports (PRA 1505-0271) for the CSLFRF program. To assist the State agencies, GOMB prepared these reports. According to the U.S. Treasury’s SLFRF Compliance and Reporting Guidance, expenditures may be reported on a cash or accrual basis, as long as the methodology is disclosed and consistently applied. During our testing of two quarterly PRA 1505-0271 reports submitted during State fiscal year ended June 30, 2023, we noted that GOMB did not consistently apply cash or accrual basis for reporting and noted the following errors on the cash basis: "See Table in the Audit Report". Supervisory review procedures of the PRA 1505-0271 reports have not been designed to operate at an appropriate level of precision to ensure the financial reports are accurately prepared. Criteria or Requirement: 2 CFR 200.328 requires grantees to submit PRA 1505-0271 reports with the frequency required by the terms and conditions of the federal award. The State and Local Fiscal Recovery Funds: Project and Expenditure Report User Guide requires grantees to submit quarterly reports with current financial information, including current period and cumulative obligations and expenditures. In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure financial information reported in required financial reports is complete and accurate prior to submission. Cause: In discussing these conditions with GOMB officials, management stated the reporting errors were a result of inaccurate information submitted to GOMB by other State agencies which were not detected. Possible Asserted Effect: Failure to prepare complete and accurate financial reports prevents the U.S. Treasury from effectively monitoring the CSLFRF program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-003) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend GOMB implement more precise review procedures to ensure the reports submitted to the U.S. Treasury are complete, accurate, and agree or reconcile to its financial records. Views of GOMB Officials: GOMB agrees with the recommendation. GOMB will continue to work with the State agencies to produce accurate financial reporting for the CSLFRF program.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of the Treasury (TREAS) Program Name: COVID-19 – Homeowner Assistance Fund Program ALN and Program Expenditures: 21.026 ($177,107,928) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2023-004: Failure to Establish Subrecipient Monitoring Procedures Condition Found: IDHS did not perform a risk assessment or subrecipient monitoring procedures for the subrecipient of the COVID-19 – Homeowner Assistance Fund (HAF) program for the year ended June 30, 2023. The State designated IDHS as the State agency responsible for monitoring of the HAF program’s subrecipient, the Illinois Housing Development Authority (IHDA), a discretely presented component unit of the State. As a pass-through entity, IDHS was responsible for: • Identifying the award and applicable requirements, • Evaluating IHDA’s risk of noncompliance for purposes of determining the appropriate monitoring procedures related to the subaward, • Monitoring the activities of IHDA as necessary to ensure the subaward is used for authorized purposes, IHDA complies with the terms and conditions of the subaward, and IHDA achieves performance goals, and • Issuing a management decision for audit findings pertaining to the federal award provided to IHDA, if applicable. During our testing, we noted IDHS did not perform any subrecipient monitoring procedures over IHDA with respect to the HAF program during the year ended June 30, 2023. Amounts passed through to IHDA for the HAF program totaled $177,107,928 for the year ended June 30, 2023. Criteria or Requirement: According to 2 CFR 200.332(b), a pass-through entity must evaluate each subrecipient's risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. According to 2 CFR 200.332(d), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. 2 CFR 200.332(d)(3) requires pass-through entities to issue management decisions for applicable audit findings pertaining to the federal awards provided to the subrecipient and 2 CFR 200.332(d)(4) requires pass through entities to resolve audit findings through corrective action plans (CAP). In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing and performing monitoring procedures in accordance with Uniform Guidance and program requirements. Cause: In discussing these conditions with IDHS officials, management stated that IDHS lacked dedicated resources needed when the HAF program was assigned to IDHS to collaborate with the Illinois Housing Development Authority. Possible Asserted Effect: Failure to perform required risk assessments and to adequately monitor subrecipients may result in the subrecipient not properly administering the federal programs in accordance with laws, regulations, and the grant agreements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2022-004. (Finding Code 2023-004, 2022-004) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS implement subrecipient monitoring procedures in accordance with federal regulations. Views of IDHS Officials: The Department accepts the recommendation. The Department agrees with the finding and recognizes the importance of programmatic reporting. The Department has procedures in place to complete programmatic and financial monitoring for the HAF program.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of the Treasury (TREAS) Program Name: COVID-19 – Homeowner Assistance Fund Program ALN and Program Expenditures: 21.026 ($177,107,928) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2023-005: Failure to Accurately Prepare Financial Reports for the COVID-19 – Homeowner Assistance Fund Program Condition Found: IDHS did not prepare accurate federal financial reports (Paperwork Reduction Act (PRA) 1505-0269) for the COVID-19 – Homeowner Assistance Fund (HAF) program. IDHS was required to prepare quarterly federal financial reports (PRA 1505-0269) for the HAF program. During our testing of two quarterly PRA 1505-0269 reports submitted during State fiscal year ended June 30, 2023, we noted the following errors: "See Table in the Audit Report". Supervisory review procedures of the PRA 1505-0269 reports have not been designed to operate at an appropriate level of precision to ensure the financial reports are accurately prepared. Criteria or Requirement: 2 CFR 200.328 requires grantees to submit PRA 1505-0269 reports with the frequency required by the terms and conditions of the federal award. The Homeowner Assistance Fund: Quarterly Report User Guide requires grantees to submit quarterly reports with current financial information, including administrative expenses. In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure financial information reported in required financial reports is complete and accurate prior to submission. Cause: In discussing these conditions with IDHS officials, management stated that during the reporting period sampled, the 3rd quarter report was the first group of program data reported. Due to limited availability of staff at that time, the Department was still working to identify appropriate staff to complete the reporting. Possible Asserted Effect: Failure to prepare complete and accurate financial reports prevents U.S. Treasury from effectively monitoring the HAF program. Repeat Finding: A similar finding was not reported in prior years. (Finding Code 2023-005) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS implement more precise review procedures to ensure the reports submitted to U.S. Treasury are complete, accurate, and agree or reconcile to its financial records. Views of IDHS Officials: The Department accepts the recommendation. The Department recognizes the need for accurate data submissions and now has standard templates for subrecipients to complete to ensure accurate program reporting is achieved.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Social Services Block Grant ALN and Program Expenditures: 93.667 ($57,147,970) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2023-006: Inadequate Procedures to Determine Accuracy of the Post-Expenditure Report Condition Found: IDHS failed to provide supporting documentation for the post-expenditure report including a key line item, the number of eligible individuals who received services paid for in part or in whole with federal funds under the Social Services Block Grant (Title XX) program. During our testing of the 2022 post-expenditure report, we noted the total individuals served was reported as 163,445. This line item represents services provided by various departments and third parties. In reviewing the summary schedule used to support these line items, we noted supporting documentation was not available to identify the individuals served for certain line items or did not match the individuals reported on the summary schedule. As a result, testing a sample of individuals to verify the individual was eligible for the service received could not be performed. We noted the following exceptions in our testing of the 2022 post-expenditure report: "See Table in the Audit Report". Internal controls have not been established to ensure required supporting documentation is maintained. Criteria or Requirement: 42 USC 1397e requires states to submit to the federal administering agency an annual post-expenditure report. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include retaining support for the post-expenditure report and a formalized methodology to ensure the reporting is consistent and accurate. Cause: In discussing these conditions with IDHS officials, management stated uniform procedures were still being implemented to track client listings and retain documentation supporting the annual report. Management also noted staff shortages contributing to the lack of tracking client information. Possible Asserted Effect: Failure to completely and accurately report SSBG individuals served could result in incomplete and/or inaccurate data being submitted to the federal administering agency. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-006) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures to maintain documentation supporting the post-expenditure report. IDHS should also establish supervisory review procedures to ensure the report is complete, accurate, and properly supported. Views of IDHS Officials: The Department accepts the recommendation. The Department will work to establish procedures to maintain complete, accurate, and adequate documentation supporting the post-expenditure report.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Agriculture (USDA), U.S. Department of Health and Human Services (USDHHS) Program Name: SNAP Cluster, Temporary Assistance for Needy Families, Children’s Health Insurance Program, Medicaid Cluster ALN and Program Expenditures: 10.551/10.561 ($5,991,938,129), 93.558 ($578,867,422), 93.767 ($497,921,432), 93.775/93.777/93.778 ($20,820,349,431) Award Numbers: Various – See table of award numbers Federal Award Year: Various – See table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Eligibility, Special Tests and Provisions – Child Support Non-Cooperation, Special Tests and Provisions – Penalty for Refusal to Work, Special Tests and Provisions – ADP System for SNAP Finding 2023-007: Missing Documentation in Beneficiary Files Condition Found: IDHS could not locate case file documentation supporting certain eligibility and special test requirements for beneficiaries of the Temporary Assistance for Needy Families (TANF) program. During our test work, we selected eligibility files to review for compliance with eligibility requirements and for the allowability of the related benefits provided. We also selected 40 Child Support Non-Cooperation (Non-Cooperation) and 40 Penalty for Refusal to Work (Refusal to Work) beneficiaries to review for compliance with the respective special test and provision requirements. We noted the following exceptions: • In 3 of 50 TANF cases (with payments sampled of $1,129), IDHS could not locate the Responsibility Service Plan (RSP) completed and signed by the beneficiary covering the payment date. Total TANF cash assistance paid to these beneficiaries during the year ended June 30, 2023 totaled $16,766. • In 5 of 40 TANF Non-Cooperation special test cases, IDHS could not provide evidence that notice for good cause non-cooperation was obtained, or subsequent timely action on the case was taken once the case was determined non-cooperating. TANF cash assistance paid to these beneficiaries during the year ended June 30, 2023 totaled $22,096. • In 7 of 40 TANF Refusal to Work special test cases, IDHS could not provide evidence that a RSP was obtained and signed by the beneficiary. TANF cash assistance paid to these beneficiaries during the year ended June 30, 2023 totaled $30,309. Details of the beneficiary payments selected in our samples for TANF programs are as follows: "See Table in the Audit Report". We also noted IDHS does not have adequate resources to perform and document eligibility determinations. Additionally, IDHS has not established appropriate monitoring procedures to ensure eligibility determinations are properly documented in accordance with program requirements. Because the State uses a single application and eligibility determination process for the Supplemental Nutrition Assistance Program Cluster (SNAP), TANF, Medicaid Cluster, and State Children’s Health Insurance Program (CHIP) programs, certain of the TANF compliance exceptions and the inadequate internal control matters discussed above also impact the SNAP Cluster, Medicaid Cluster, and CHIP programs. "See Table in the Audit Report". Criteria or Requirement: According to 42 USC 602(a)(1)(B)(iii) (the State Plan for TANF), IDHS is required to determine client eligibility in accordance with eligibility requirements defined in the approved State Plans. The TANF State Plan amended December 2022, Section L Personal Responsibility, requires all adults and minor parents applying for or receiving assistance be required to sign a RSP and follow through with its provisions. The TANF State Plan also required an application to be completed to apply for assistance. For non-cooperation, if an individual is not cooperating with the state establishing paternity or enforcing a support order with respect to a child of the individual, the State much apply a sanction or deny assistance. (45 CFR sections 264.30). For refusal to work, the State must reduce or terminate the assistance payable to the family if an individual in a family receiving assistance refuses to work, subject to any good cause or other exemptions established by the State (42 USC 609(a)(14); 45 CFR sections 261.14, 261.16, and 261.54). In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include maintaining adequate controls over beneficiary case files to ensure all required documentation is received and appropriate sanctions applied. Cause: In discussing these conditions with IDHS officials, IDHS management stated the exceptions noted were due to staff vacancies which led to lack of oversight to secure or upload supporting documentation adequately and to follow up on notices of non-cooperation or good cause for refusal to work. Possible Asserted Effect: Failure to maintain RSPs, applications, or other eligibility documentation may result in inadequate documentation of a recipient’s eligibility and in federal funds being paid to ineligible beneficiaries. Inability to demonstrate if a sanction has been appropriately applied also may result in federal funds being awarded to an ineligible beneficiary. Repeat Finding: A similar finding was reported in prior year audit as finding number 2022-005. (Finding Code 2023-007, 2022-005, 2021-011, 2020-010, 2019-005, 2018-004, 2017-004, 2016-004, 2015-004, 2014-004, 2013-004, 12-04, 11-04, 10-06, 09-06, 08-08, 07-19, 06-16, 05-30, 04-18, 03-20, 02-26, 01-15) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its current process for collecting and maintaining SNAP/TANF eligibility support and documentation to support the appropriate TANF application of sanctions. Views of IDHS Officials: IDHS accepts the recommendation. Additional oversight and instruction will be provided to ensure supporting documentation for all eligibility items is properly retained in the record. In addition, IDHS will explore options to automate processes where possible.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 93.959 ($101,011,200) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $11,528,128 Compliance Requirement: Matching, Level of Effort, Earmarking Finding 2023-008: Failure to Meet the SAPT MOE Requirement Condition Found: IDHS did not maintain the required aggregate State expenditures for the maintenance of effort (MOE) requirements for the Block Grants for Prevention and Treatment of Substance Abuse (SAPT) program. As a condition of receiving federal funding under the SAPT program, USDHHS requires the State to maintain the level of State and locally funded expenditures for substance abuse prevention and treatment activities at an amount that is at least equal to the average level of these same amounts for the prior two years. During the current fiscal year, we noted IDHS did not maintain the necessary aggregate expenditures to meet the SAPT MOE requirement. The table below illustrates the shortfall: "See Table in the Audit Report". In addition, IDHS has not established internal control procedures to monitor whether maintenance of effort requirements are met. Criteria or Requirement: According to 45 CFR 96.30(a), the fiscal control and accounting procedures of the State must be sufficient to permit tracing funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of the statute authorizing the block grant. Further, 45 CFR 96.134(a) states with respect to the principal agency of a State for carrying out authorized activities, the agency shall for each fiscal year maintain aggregate State expenditures by the principal agency for authorized activities at a level that is not less than the average level of such expenditures maintained by the State for the two-year period preceding the fiscal year for which the State is applying for the grant. In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing procedures to ensure MOE requirements are achieved with allowable expenditures. Cause: In discussing these conditions with IDHS officials, management stated that the review of MOE to date was not occurring on a regular basis until reporting to the federal entity was complete. Possible Asserted Effect: Failure to maintain required State expenditure levels for MOE results in noncompliance with program requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2022-006. (Finding Code 2023-008, 2022-006, 2021-012, 2020-012, 2019-009, 2018-007, 2017-008, 2016-008, 2015-009, 2014-010) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its process for identifying expenditures to achieve the SAPT MOE and implement controls to appropriately monitor whether the MOE requirement has been met. Views of IDHS Officials: The Department accepts the recommendation. IDHS has reviewed its process for identifying expenditures to achieve the SAPT MOE and implemented controls to appropriately monitor whether the MOE requirement has been met.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families, Child Care and Development Fund (CCDF) Cluster, Block Grants for Prevention and Treatment of Substance Abuse, Social Services Block Grant, ALN and Program Expenditures: 93.558 ($578,867,422), 93.575/93.596 ($783,907,069), 93.959 ($101,011,200), 93.667 ($57,147,970) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2023-009: Failure to Report Subaward Information Required by FFATA Condition Found: IDHS failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Temporary Assistance for Needy Families (TANF), Child Care and Development Fund (CCDF) Cluster, Block Grants for Prevention and Treatment of Substance Abuse (SAPT), and Social Services Block Grant (SSBG) programs. FFATA requires the State to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name, 2. Subawardee DUNS number, 3. Amount of subaward, 4. Subaward obligation or action date, 5.Date of report submission, 6. Subaward number, 7. Subaward project description, 8. Subawardee names and compensation of highly compensated officers. During our testing, we noted that IDHS did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. During our testwork of 96 subawards and 23 amendments, we noted the following exceptions: "See Table in the Audit Report". IDHS’s subrecipient expenditures under the federal programs for the year ended June 30, 2023 were as follows: "See Table in the Audit Report". Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include complying with FFATA. Cause: In discussing these conditions with IDHS officials, management stated the exceptions noted were due to inaccuracies in the manual entry of subawards, and not all awards were identified through the existing information process flow. Possible Asserted Effect: Failure to identify awards subject to FFATA and to report subawards in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2022-007. (Finding Code 2023-009, 2022-007, 2021-014, 2021-015) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures to identify awards subject to FFATA reporting requirements and report required subaward information in accordance with the FFATA. Views of IDHS Officials: The Department accepts the recommendation. IDHS has established procedures to identify awards subject to the FFATA reporting requirements and to report required subaward information in accordance with the FFATA. The Department will assess the need for additional resources and the process for inputting grant award information into the grant making system will continue to be communicated to responsible staff to ensure compliance.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families, Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 93.558 ($578,867,422), 93.575/93.596 ($783,907,069), 93.667 ($57,147,970), 93.959 ($101,011,200) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2023-010: Failure to Follow Established Program Subrecipient Monitoring Procedures Condition Found: IDHS did not follow its established program monitoring policies and procedures for subrecipients of the Temporary Assistance for Needy Families (TANF), Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. IDHS has implemented procedures whereby program staff perform periodic program on-site and desk reviews of IDHS subrecipient compliance with regulations applicable to the federal programs administered by IDHS. Generally, these reviews are formally documented and include the issuance of a report of the review results to the subrecipient summarizing the procedures performed, results of the procedures, and any findings or observations for improvement noted. IDHS’s policies require the subrecipient to respond to each finding by providing a written corrective action plan. Additionally, IDHS program staff perform reviews of expenditure reports submitted by subrecipients. IDHS subrecipient monitoring procedures are subject to the review and approval of a supervisor. During our test work over program on-site review procedures performed for 95 subrecipients of the TANF, CCDF, SSBG, and SAPT programs, we noted IDHS did not follow its established program monitoring procedures as follows: We tested the program on-site review procedures performed by IDHS during the year ended June 30, 2023 for a sample of subrecipients of the TANF, CCDF, SSBG, and SAPT programs comprised of the following: "See Table in the Audit Report". We noted the following exceptions in our testing of program on-site reviews performed during the year ended June 30, 2023: • IDHS did not perform on-site monitoring reviews of subrecipients in fiscal year 2023 in accordance with IDHS’ planned monitoring schedule and/or could not provide support for the review. Specifically, we noted the following exceptions: "See Table in the Audit Report". • IDHS did not provide timely notification (within 60 days) of the results of the programmatic on-site reviews. We noted the following exceptions: "See Table in the Audit Report". • IDHS did not complete their quality review on a timely basis (within 60 days). We noted the following exceptions: "See Table in the Audit Report". • IDHS did not receive a corrective action plan from the subrecipient after findings were identified during the review. We noted the following exceptions: "See Table in the Audit Report". • For the SSBG program, IDHS personnel were unable to provide support for managment review of the program review tool for 16 of 41 subrecipients sampled."See Table in the Audit Report". The SAPT program also requires subrecipients to submit periodic reports to allow IDHS to monitor certain programmatic performance metrics. These reports are reviewed quarterly by IDHS program personnel. Any subrecipients who meet less than 80% of the performance metrics reported are also required to submit a corrective action plan to IDHS. During our testing, we noted IDHS was unable to provide documentation evidencing monitoring of the quarterly program reports as follows: "See Table in the Audit Report". Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. According to 2 CFR 200.332(b), a pass-through entity must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring on-site program procedures and expenditure reviews are performed in a timely manner and adequate documentation is maintained. Cause: In discussing these conditions with IDHS officials, management stated that the program monitoring deficiencies noted are due to misplaced or misfiled documentation, untimely monitoring, inadequate staffing, and lack of consistent application in each program division. Possible Asserted Effect: Failure to adequately perform and document program on-site monitoring reviews of subrecipients and notify subrecipients of findings in a timely manner may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Failure to properly review subrecipient expenditures may result in inaccurate payments or unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2022-008. (Finding Code 2023-010, 2022-008, 2021-017, 2020-015, 2019-013, 2018-012, 2017-013, 2016-012, 2015-011, 2014-008, 2013-009, 12-07, 11-09) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS ensure programmatic on-site and expenditure report reviews are performed and documented for subrecipients in accordance with established policies and procedures. In addition, we recommend IDHS review its process for reporting and following up on program findings relative to subrecipient on-site reviews to ensure timely corrective action and quality control is taken. Views of IDHS Officials: The Department accepts the recommendation. The Department will review and update programmatic monitoring guidance and ensure changes are communicated, as appropriate. Additionally, the Department will work to hire additional staff to improve the tracking and performance of compliance reviews.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Child Care and Development Fund (CCDF) Cluster ALN and Program Expenditures: 93.575/93.596 ($783,907,069) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $95,700 Compliance Requirement: Eligibility and Special Tests and Provisions – Child Care Provider Eligibility for American Rescue Plan Act Stabilization Funds Finding 2023-011: Failure to Obtain Required Certifications for Child Care Providers Receiving American Rescue Plan Act Stabilization Funds Condition Found: IDHS did not obtain the required certifications at the time of application for certain providers of the Child Care and Development Fund (CCDF) Cluster receiving American Rescue Plan (ARP) Act stabilization funds. Child care providers must provide the following certifications to receive ARP Act stabilization funding under the CCDF Cluster: 1. The provider will, when open and providing services, implement policies in line with guidance and orders from corresponding state, territorial, tribal, and local authorities and, to the greatest extent possible, implement policies in line with guidance from the CDC, 2.For each employee, the provider must pay at least the same amount in weekly wages and maintain the same benefits for the durations of the stabilization funding, 3. The provider will provide relief from copayments and tuition payments for the families enrolled in the provider’s program, to the extent possible, and prioritize such relief for families struggling to make either type of payment. During our test work over 20 child care providers receiving ARP Act stabilization funds (totaling $244,746,902), we noted IDHS could not provide the required certifications for ARP Act stabilization funds for 6 providers who are noted as “license-exempt” providers. Child Care ARP Act Stabilization funds passed through to 86 unique license-exempt providers totaled $95,700 during the year ended June 30, 2023. IDHS passed through a total of $245,070,522 of Child Care ARP Act stabilization funds during the year ended June 30, 2023. Criteria or Requirement: ARP Act Section 2202(d)(2)(D) requires the State to make available on its website an application for qualified child care providers that includes the certifications above. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include ensuring child care providers who receive ARP Act stabilization funds meet the eligibility criteria and provide all required certifications at the time of application. Cause: In discussing these conditions with IDHS officials, management stated the reason certifications/attestations were not collected for these providers was because they are License-Exempt Home Child Care providers who receive scheduled health and safety monitoring and procedures were not established to obtain certifications from child care providers receiving ARP Act stabilization funds. Possible Asserted Effect: Failure to obtain required certifications for child care providers receiving ARP Act stabilization funds may result in inadequate documentation of a provider’s eligibility under ARP Act and in federal funds being awarded to ineligible providers. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2022-009. (Finding Code 2023-011, 2022-009) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures for verifying provider eligibility under ARP Act Stabilization funds, including ensuring all child care providers complete required certifications. Views of IDHS Officials: The Department accepts the recommendation. The Department does not anticipate the receipt of any further federal relief funds. The Department will ensure that staff are properly trained to identify and implement new grant funding requirements and ensure childcare providers complete required certifications if similar funding is received by the Department in future periods.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Agriculture (USDA), U.S. Department of Education (USDE), U.S. Department of Health and Human Services (USDHHS), U.S. Social Security Administration (USSSA) Program Name: Supplemental Nutrition Assistance Program Cluster, Special Supplemental Nutrition Program for Women, Infants, and Children, Rehabilitation Services – Vocational Rehabilitation, Temporary Assistance for Needy Families, Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse, Disability Insurance/SSI Cluster ALN and Program Expenditures: 10.551/10.561 ($5,991,938,129), 10.557 ($168,740,425), 84.126 ($127,053,406), 93.558 ($578,867,422), 93.575/93.596 ($783,907,069), 93.667 ($57,147,970), 93.959 ($101,011,200), 96.001/96.006 ($72,937,910) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: None Finding 2023-012: Inaccurate Reporting of Federal Expenditures Condition Found: IDHS did not accurately report Federal expenditures, including amounts provided to subrecipients, under the Supplemental Nutrition Assistance (SNAP) Cluster, Supplemental Nutrition for Women, Infants, and Children (WIC) programs, Vocational Rehabilitation (VR), Temporary Assistance for Needy Families (TANF), Child Care and Development Funds (CCC) Cluster, Social Services Block Grants (SSBG), Block Grants for Prevention and Treatment of Substance Abuse (SAPT), and Disability Insurance/SSI (SSDI) Cluster programs. Federal expenditures, including amounts provided to subrecipients, reported to the Illinois Office of Comptroller (IOC) which were used to prepare the schedule of expenditure of federal awards (SEFA), did not agree to IDHS’ financial records provided for audit. Specifically, we noted the following differences between amounts provided for audit by IDHS and the SEFA amounts reported to the IOC for each program for the year ended June 30, 2023: "See Table in the Audit Report". Additionally, the following differences were identified relative to amounts provided to subrecipients for the following major programs: "See Table in the Audit Report". We also noted the cash basis expenditures provided by IDHS for our audit procedures included accrued (not paid) expenditures. Further, we noted amounts passed through to other State agencies from IDHS provided by IDHS for our audit procedures included accrued (not paid) expendituresr. We also noted these same amounts were reported to the IOC and were used to prepare the SEFA. Specifically, we noted expenditures in the following amounts which were not paid in fiscal year ended June 30, 2023 and were erroneously reported as cash basis expenditures for the year ended June 30, 2023: "See Table in the Audit Report". Finally, we noted IDHS’ controls over reporting federal expenditures were not designed at a sufficient level of precision to ensure complete and accurate reporting in a timely manner. Criteria or Requirement: According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statements which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. Among other things required by 2 CFR 200.510(b), the SEFA must include the total amount provided to subrecipients from each Federal program. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures are accurately reported on the SEFA and to other State agencies, where applicable. Cause: In discussing these conditions with IDHS officials, management stated that differences in the amounts of federal expenditures and amounts passed through to subrecipients were due to differences in reporting methods fort he SEFA and IDHS’ records. The expenditures in the IDHS’ records come from the agency financial accounting system, SAP. The expenditures in the SEFA come from the annual GAAP reports must reconcile to the Illinois Office of the Comptroller accounting system (SAMS). Possible Asserted Effect: Failure to accurately report federal expenditures prohibits the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal funding. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2022-010. (Finding Code 2023-012, 2022-010) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures to accurately report federal expenditures (including subrecipient expenditures) used to prepare the SEFA to the IOC. Views of IDHS Officials: The Department accepts the recommendation. The Department has created a spreadsheet with all federal expenditure data grouped by ALN, and a tab with only the major program expenditure data comparing it to the IDHS Records/Bucket amount. Any discrepancies between the reporting methodologies are identified and researched.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 93.959 ($101,011,200) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $92,642 Compliance Requirement: Allowable Costs/Cost Principles and Period of Performance Finding 2023-013: Unallowable Costs Charged to the SAPT Program Condition Found: IDHS charged subrecipient expenditures to the Block Grants for Prevention and Treatment of Substance Abuse (SAPT) program which were incurred after the period of performance ended. During our testing of 41 expenditures (totaling $2,778,358) charged to the federal fiscal year 2021 SAPT block grant during the year ended June 30, 2023, we noted 4 expenditures for payments to subrecipients (totaling $88,666) for which the underlying expenditures submitted to IDHS for reimbursement pertained to expenditures incurred by the subrecipient after September 30, 2022. The period of performance for the federal fiscal year 2021 SAPT block grant is from October 1, 2020 to September 30, 2022. Accordingly, these expenditures were incurred after the grant’s period of performance and are not allowable costs. In response to the errors identified by our audit procedures, IDHS performed a review of subrecipient expenditures charged to the federal fiscal year 2021 SAPT grant award and determined there were 6 additional expenditures (totaling $3,976) for which the underlying expenditures submitted by the subrecipient pertained to expenditures incurred by the subrecipient after September 30, 2022. The review procedures initially performed to authorize the subrecipient expenditures were not performed at a level of precision to determine if the underlying expenditures were incurred within the period of performance. Criteria or Requirement: 42 USC 300x-62 requires any amounts awarded to the state for a fiscal year to be obligated and expended by the end of the fiscal year following the fiscal year for which the amounts were awarded. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should be designed to ensure that block grant amounts awarded are obligated and expended within the period of performance. Cause: In discussing these conditions with IDHS officials, management stated that the current billing system is not configured to differentiate payments submitted by month but rather all charges that are submitted by the cut off are lumped together and paid in one payment. Possible Asserted Effect: Failure to ensure payments to subrecipients are only for expenditures incurred during the period of performance results in noncompliance and unallowable costs. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-013) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS implement procedures to properly review detail expenditures at the appropriate level of precision to ensure expenditures are within the period of performance of the federal award. Views of IDHS Officials: The Department accepts the recommendation. The Department has implemented procedures to monitor billing data for dates that occur outside of the performance period of the grant and separate payments are made when needed.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families, Child Care and Development Fund (CCDF) Cluster ALN and Program Expenditures: 93.558 ($578,867,422). 93.575/93.596 ($783,907,069) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: $878 (TANF Federal), $2,540 (TANF Maintenance of Effort) $1,691 (CCDF Federal), $231 (CCDF Maintenance of Effort) Compliance Requirement: Allowable Costs/Cost Principles and Matching, Level of Effort, and Earmarking Finding 2023-014: Unallowable Costs Charged to the TANF and CCDF Cluster Programs Condition Found: IDHS could not provide documentation to support payments made on behalf of beneficiaries of the Temporary Assistance for Needy Families (TANF) and Child Care and Development Fund (CCDF) Cluster programs. The State of Illinois operates the Child Care Assistance Program (CCAP) which provides eligible families child care services at an approved, licensed providers. Payments are made by IDHS directly to the child care provider on behalf of an eligible family. Providers submit billings to IDHS detailing the name of the recipient of the services and the number of days for which services were received. IDHS performs monitoring reviews of childcare providers on a rotational basis. During these monitoring reviews, IDHS reviews provider records to ensure services billed are adequately documented. During our testing of CCAP beneficiary payments claimed under the TANF program (40 payments totaling $8,463 in federal claim and $22,307 in MOE claim) and CCDF (40 payments totaling $184,226 in federal claim and $2,385 in MOE claim), we noted 3 TANF payments and 3 CCDF payments for which IDHS could not provide documentation supporting the services provided to eligible beneficiaries which are unallowable costs. These unallowable expenditures were reported and claimed to federal programs as follows: "See Table in the Audit Report". Additionally, we noted IDHS has not performed a monitoring review in 2023 or either of the previous two fiscal years to ensure billing information provided by the child care providers is accurate for any of the 58 unique providers sampled. As a result, IDHS does not have adequate controls in place to ensure information provided by providers is accurate and the related child care payments made were appropriate. Criteria or Requirement: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable under federal awards, costs must meet certain general criteria. Those criteria require, among other things, that each expenditure must be necessary, reasonable, and supported by adequate documentation. Additionally, 45 CFR section 98.67 requires lead agencies to expend and account for CCDF funds in accordance with their own laws and procedures, and for fiscal control and accounting procedures to be sufficient to permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of those laws and procedures. IDHS CCAP Policy Memo 07.10.01 requires the agency to perform monitoring reviews over all Child Care Resource and Referrals (CCR&R), site administered, and non-contracted child care providers who participate in the IDHS Child Care Assistance Program. These reviews are conducted to ensure that services billed to the Department are adequately documented and contractual obligations are fulfilled. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should be designed to ensure that supporting documentation for CCAP payments is obtained and maintained. Additionally, effective internal controls should be designed to ensure that billing information provided by providers is complete and accurate. Cause: In discussing these conditions with IDHS officials, management stated that IDHS does not require submission of billing certificates to IDHS or its contracted agencies to receive payment. Additionally, the CCAP payments cited were entered by the provider via the IDHS Telephone Billing System and IDHS does not have a procedure to review billing certificates entered through this system. Possible Asserted Effect: Failure to maintain documentation that supports payments to TANF and CCDF beneficiaries of the Child Care Assistance Program and adequately monitor these beneficiaries results in noncompliance and unallowable costs. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-014) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review the process and procedures in place for collecting and maintaining documentation to support amounts paid to beneficiaries of the Child Care Assistance Program. Further, we recommend IDHS ensure monitoring reviews are performed for CCAP beneficiaries under the CCDF and TANF programs in accordance with established policies and procedures. Views of IDHS Officials:The Department accepts the recommendation. The Department will work to review and update the process and procedures for collecting, reviewing, and maintaining documentation supporting amounts paid to beneficiaries of ACCAP and TANF Programs. Additionally, the Department will assess the need to develop and implement tools to ensure that monitoring reviews are performed in accordance with established policies and procedures.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Agriculture (USDA), U.S. Department of Health and Human Services (USDHHS), Program Name: Special Supplemental Nutrition Program for Women, Infants and Children, Temporary Assistance for Needy Families, Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 10.557 ($168,740,425), 93.558 ($578,867,422), 93.575/93.596 ($783,907,069), 93.667 ($57,147,970), 93.959 ($101,011,200) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2023-015: Inadequate Review of Subrecipient Single Audit Reports Condition Found: IDHS did not adequately review single audit reports received from its subrecipients for the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), Temporary Assistance for Needy Families (TANF), Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs on a timely basis. The State of Illinois established the Grant Accountability Transparency Unit (GATU) to implement the provisions of the State's Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning, to the applicable state agency, any findings attributable to amounts passed through to the subrecipient(s) by the State and working with program personnel to issue management decisions on findings. Subrecipients who are required to report their single audits to GATU must submit their audit report within 9 months of their fiscal year end. Subrecipients who fail to provide the required reporting package within that timeframe will be suspended unless a deadline waiver or extension is granted. IDHS staff are responsible for reviewing the reports assigned to them by GATU and determining whether: (1) federal funds reported in the schedule of expenditures of federal awards (SEFA) reconcile to IDHS records and (2) issuing management decisions on findings reported within required time frames. During our testing of a sample of single audit desk review files for 83 subrecipients of the WIC, TANF, CCDF, SSBG, and SAPT programs we noted the single audit desk reviews are still in process and have not been finalized within the GATA Audit Report Review Management System (ARRMS) as of the date of our test work for two subrecipients of the WIC and SSBG programs. Additionally, we noted one subrecipient of the WIC and SSBG programs, one subrecipient of the SSBG and SAPT programs, and five subrecipients of the SAPT program with June 30, 2022 fiscal year-ends that did not submit their reporting package to ARRMS within 9 months of their fiscal year end in accordance with GATU policies. GATU’s files did not contain evidence that waivers were granted, or sanctions were imposed on these subrecipients. Further, we noted IDHS has not established controls over subrecipient single audit report reviews at an adequate level of precision to ensure single audit reports are received and reviewed timely. IDHS’ subrecipient expenditures under the federal programs for the year ended June 30, 2023 were as follows: "See Table and Audit Reports". Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure the federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. Further, 2 CFR 200.332(e)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on audit findings within six months of acceptance of the audit report by the FAC and ensure that the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include implementing procedures and hiring adequate resources to ensure single audit reports are reviewed in a timely manner and management decision letters are issued with required timeframes. Cause: In discussing these conditions with IDHS officials, management stated that since the COVID-19 pandemic, IDHS has attempted to maintain communications with non-compliant grantees that have had ongoing issues with accounting staff shortages and scheduling of their required audits. These issues have led to grantees not meeting required timelines for the submissions of their annually-required audits. Additionally, in some instances, IDHS has had issues identifying grantees in the statewide audit review portal, resulting in delays of processing audit reviews and due dates. Possible Asserted Effect: Failure to complete and document reviews of subrecipient single audit reports in a timely manner may result in federal funds being expended for unallowable purposes and subrecipients not administering the federal programs in accordance with laws, regulations, and the grant agreements. Additionally, failure to issue management decisions within six months of acceptance of the single audit report by the FAC results in noncompliance with federal regulations. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-015). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures to ensure: (1) subrecipient single audit reports are obtained and reviewed within established deadlines, (2) management decisions are issued for all findings affecting its federal programs in accordance with the Uniform Guidance, and (3) follow up procedures are performed to ensure subrecipients have taken timely and appropriate corrective action. Views of IDHS Officials: The Department accepts the recommendation. The Department will review existing policies and procedures and make revisions where possible to strengthen controls over the timeliness of receipt and review of subrecipient single audit reports, issuance of management decisions, and follow up procedures performed to ensure subrecipients have taken timely and appropriate corrective action for findings.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families ALN and Program Expenditures: 93.558 ($578,867,422) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $33,257 Compliance Requirement: Eligibility Finding 2023-016: Improper TANF Beneficiary Payments Condition Found: IDHS made improper payments to beneficiaries of the Temporary Assistance for Needy Families (TANF) program. During our testwork of 50 TANF program beneficiary payments (with total payments sampled of $19,844), we noted four beneficiaries (with payments of $1,747) received payments that were improperly calculated using amounts inconsistent with information contained in the beneficiary’s case file. As a result of the calculation errors, the monthly payments for these beneficiaries were understated in total by $218. Total payments made to these beneficiaries under the TANF program were $18,594 for the year ended June 30, 2023. In addition, IDHS identified a system error in June 2025 impacting beneficiaries whose benefit payments were calculated using diverted income. Diverted income occurs in dependent eligible only TANF cases where an ineligible working adult in the household has income which is allocated to the eligible members of the household to determine the overall TANF program benefit payment. The State’s benefit system was erroneously excluding the ineligible working adult in the benefit calculation potentially resulting in an overpayment of TANF benefits on cases with diverted income. IDHS identified benefit payments paid during the year ended June 30, 2023 totaling $7,181,916 were calculated using diverted income for 2,572 beneficiaries. The system calculation error related to these benefit payments resulted in total TANF overpayments of $33,257 during the year ended June 30, 2023. The payment errors identified above had not been corrected by IDHS or refunded to USDHHS (if required) as of the date we communicated our findings to IDHS (August 27, 2025). We further noted IDHS did not establish control procedures at an adequate level of precision to ensure TANF program benefits were accurately calculated based on the beneficiary’s case file supporting documentation. Payments made to beneficiaries of the TANF cash assistance program totaled $36,637,652 during the year ended June 30, 2023. Criteria or Requirement: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable under federal awards, costs must meet certain general criteria. Those criteria require, among other things, that each expenditure must be necessary, reasonable, and supported by adequate documentation. In accordance with the OMB Compliance Supplement, dated May 2023, IDHS is required to determine eligibility in accordance with eligibility requirements defined in the approved State Plan. The current State Plan requires payments to be made to eligible beneficiaries in accordance with payment levels established within the State Plan. Further, the State Plan requires an excluded or ineligible individual’s income to be considered in the calculation of the payment level of the TANF unit. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing internal control at an appropriate level of precision to identify benefit payment errors in a timely manner. Cause: In discussing these conditions with IDHS officials, management stated the exceptions noted were due to an oversight to secure or upload supporting documentation adequately and case actions not being thoroughly reviewed. Possible Asserted Effect: Failure to properly calculate benefit payments may result in unallowable costs being charged to the TANF program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-016) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its current process for calculating beneficiary payments and consider changes necessary to ensure payments are properly calculated and paid. Views of IDHS Officials: The Department accepts the recommendation and will work to review and modify the process of calculating beneficiary payments to ensure payments are properly calculated and paid.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families, Child Care and Development Fund ( Cluster ALN and Program Expenditures: 93.558 ($578,867,422), 93.575/93.596 ($789,383,109) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Allowable Costs/Cost Principles Finding 2023-017: Inadequate Process for Monitoring Interagency Program Expenditures Condition Found: IDHS does not have an adequate process for monitoring interagency expenditures claimed under or used to meet maintenance of effort (MOE) requirements of the Temporary Assistance for Needy Families (TANF) and Child Care and Development Fund (CCDF) Cluster programs. Federal and State expenditures under the TANF and CCDF Cluster programs are comprised of programs operated by various State agencies. As the State agency responsible for administering these programs, IDHS has executed interagency agreements with each of the State agencies expending federal and/or State program funds. The interagency agreements require periodic reporting of a summary of the agency’s “allowable” expenditures to IDHS for preparation of the financial reports required for each program. As the State agencies expending program funds do not determine under which program IDHS reports their expenditures, IDHS is responsible for establishing procedures to ensure the expenditures reported by the expending State agencies meet the specific requirements applicable to the federal program. During the year ended June 30, 2023, IDHS reported expenditures from other agencies that were claimed for reimbursement or used to meet MOE requirements as follows: "See Table in the Audit Report". IDHS’ procedures to monitor other State agencies expending program funds reported by IDHS include the following: • Interagency agreements were reviewed and updated (where necessary) to ensure all State programs claimed under or used to meet MOE requirements of the TANF and CCDF Cluster programs were subject to an interagency agreement. • Program questionnaires were developed and distributed to each of the State agencies to assist in documenting the nature of the expenditures provided to IDHS and the internal controls established to ensure compliance with the applicable federal regulations. • Quarterly certification reports were collected from each of the State agencies to support amounts reported in the federal reports required for each federal program. • Expenditure details were obtained from each of the State agencies and were reconciled to the quarterly certifications. However, during our test work over the documentation of the monitoring procedures discussed above, we noted the following deficiencies: • Program questionnaires describing internal control procedures for the CCDF program were not obtained by IDHS from the Illinois Student Assistance Commission, Illinois Board of Higher Education, and Illinois Community College Board. Additionally, the program questionnaire describing internal control procedures for the TANF program was not updated for the period under audit by the Department of Children and Family Services. • Quarterly certification reports were not prepared during the period for the CCDF program by the Illinois Student Assistance Commission, Illinois Board of Higher Education, and Illinois Community College Board. • IDHS did not perform a detailed review of costs claimed from expenditures reported by any of the other State agencies to ensure they met the specific program requirements. The other State agencies do not necessarily know which federal program or maintenance of effort requirement the costs they are providing to IDHS will be claimed or used and are not able to assess whether the costs are allowable. Further, IDHS did not assess whether the expenditures reported by other State agencies were paid during state fiscal year 2023 to ensure the amounts reported to the Illinois Office of the Comptroller (IOC) and used to prepare the schedule of expenditures of federal awards (SEFA) were cash basis expenditures. Criteria or Requirement: 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures in place to ensure expenditures reported by the expending state agencies meet the applicable federal requirements. Cause: In discussing these conditions with IDHS officials, management stated that the current monitoring process was not adequate to ensure interagency expenditures and MOE of federal monies from other State agencies met applicable program regulations as they relate to TANF and CCDF. Possible Asserted Effect: Failure to properly monitor interagency expenditures may result in claiming of expenditures that are inconsistent with the objectives of the federal program and federal funds being expended for unallowable purposes. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-017) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its current process for identifying and reporting interagency expenditures and implement monitoring procedures to ensure that federal and state expenditures expended by other State agencies meet the applicable program regulations. Views of IDHS Officials: The Department accepts the recommendation. The Department will communicate the process for reporting and appropriate use of federal funds, including interagency expenditures, to program fiscal liaisons. Additionally, the Department will request quarterly certifications and program questionnaires for other State agencies receiving funds from federal awards.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of the Treasury (Treasury) Program Names: COVID-19 – Emergency Rental Assistance (ERA), COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) ALN and Program Expenditures: 21.023 ($179,355,381), 21.027 ($2,804,581,453) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2023-018: Inadequate Monitoring of Subrecipients of the CSLFRF and ERA Programs Condition Found: IDHS did not obtain and review periodic performance reports for subrecipients of the Emergency Rental Assistance (ERA) and COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) programs during the year ended June 30, 2023. Each state agency is responsible for monitoring of their subrecipients of ERA and CSLFRF funding. As a pass-through entity, IDHS was responsible for: • Identifying the awards and applicable requirements, • Evaluating each subrecipient’s risks of noncompliance for purposes of determining the appropriate monitoring procedures related to the subaward, • Monitoring the activities of each subrecipient as necessary to ensure the subaward is used for authorized purposes, the subrecipients comply with the terms and conditions of the subawards, and the subrecipients achieve performance goals, and • Issuing a management decision for audit findings pertaining to the federal award provided to each subrecipient, if applicable. For the ERA and CSLFRF programs, IDHS requires subrecipients to provide periodic performance reports (PPR) which contain performance measures and accomplishments allowing IDHS to monitor program results. During our testing of 1 grantee for ERA and 40 grantees for CSLFRF, IDHS could not provide evidence periodic performance reports were obtained or reviewed by IDHS for any of the subrecipients tested. Amounts passed through by DHS to subrecipients totaled $15,325,849 for ERA and $127,605,292 for CSLFRF for the year ended June 30, 2023. Criteria or Requirement: According to 2 CFR 200.332(b), a pass-through entity must evaluate each subrecipient's risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. According to 2 CFR 200.332(d), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. 2 CFR 200.332(d)(3) requires pass-through entities to issue management decisions for applicable audit findings pertaining to the federal awards provided to the subrecipient and 2 CFR 200.332(d)(4) requires pass through entities to resolve audit findings through corrective action plans (CAP). In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include performing monitoring procedures in accordance with Uniform Guidance and program requirements. Cause: In discussing these conditions with IDHS officials, management stated the Department was unable to produce all requested PPRs due to staff turnover and the lack of a central repository for PPRs. Possible Asserted Effect: Failure to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-018) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS perform subrecipient monitoring procedures in accordance with federal regulations. Views of IDHS Officials: The Department accepts the recommendation. The Department recognizes the importance of performance monitoring and is taking steps to better preserve and organize performance monitoring reports for future requests.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Medicaid Cluster CFDA # and Program Expenditures: 93.775/93.777/93.778 ($20,820,349,431) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2023-019: Failure to Report Drug Rebates on the Medicaid CMS-64 Report in a Timely Manner Condition Found: DHFS did not accurately report certain Medicaid Cluster program drug rebates on quarterly federal financial (CMS-64) reports. DHFS is the State Medicaid agency and is responsible for calculating drug rebates, billing pharmaceutical companies for drug rebates, and reporting drug rebates on the quarterly CMS-64 reports. In October 2024, DHFS identified significant inaccuracies in the drug rebates billed to and paid by pharmaceutical companies which were reported on quarterly CMS-64 reports submitted to USDDHS. Specifically, DHFS determined the data used to calculate drug rebates beginning in the quarter ended September 30, 2019 through June 30, 2024 erroneously included Medicare Part D drug data which did not pertain to beneficiaries of the Medicaid Cluster program. The data error resulted in drug rebates billed to and paid by pharmaceutical companies reported on the quarterly CMS-64 reports being overstated. Consequently, Medicaid Cluster expenditures were understated on both the quarterly CMS-64 reports and on the State’s Schedule of Expenditures of Federal Awards (SEFA) for fiscal year 2023. DHFS management estimated the federal portion of the drug rebate error to be $815,984,264, of which $228,534,245 pertained to amounts reported in fiscal year 2023. The estimated impact of the drug rebate error on CMS-64 reports filed in or related to quarters within fiscal year 2023 are as follows: "See Table in the Audit Report". The State revised the Medicaid Cluster expenditures reported on the 2023 SEFA to increase the reported expenditures by the estimated drug rebate error related to the year ended June 30, 2023. A final revised SEFA was provided in July 2025. We also noted adequate internal controls have not been established to ensure the data used to calculate drug rebates reported on the quarterly CMS-64 reports are complete and accurate. Specifically, the supervisory reviews and analytical procedures performed over the quarterly CMS-64 reports were not designed at an appropriate level of precision to detect the drug rebates errors. Criteria or Requirement: 42 CFR 430.30(c) requires States to submit Form CMS-64 (Quarterly Medicaid Statement of Expenditures for the Medical Assistance Program) to the central office not later than 30 days after the end of each quarter. This report is the State’s accounting of actual recorded expenditures. According to the Center for Medicaid and CHIP Services Information Bulletin dated July 24, 2014, CMS requires drug rebates to be reported in the quarter in which the State incurs the expenditure. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure information used in calculating drug rebates is complete and accurate and required financial reports are accurately prepared. Cause: In discussing these conditions with DHFS officials, they noted DHFS began receiving the impacted managed care encounter data files in 2019. IT programming to allow for the identification and exclusion of Medicare Part D drug claims from rebate invoices was not included. As a result, Medicare Part D drug claims that were not eligible for rebates were included in invoices DHFS sent to pharmaceutical manufactures. Possible Asserted Effect: Failure to accurately report drug rebate amounts and program expenditures on the CMS-64 inhibits USDHHS’ ability to monitor the Medicaid Cluster program. Additionally, failure to accurately report federal expenditures in a timely manner prohibits the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal funding. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-019) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS evaluate its process for calculating drug rebates reported on the CMS-64 and implement the necessary procedures to ensure amounts reported in the quarterly CMS-64 reports are complete and accurate. Views of DHFS Officials: DHFS accepts the recommendation. DHFS identified & implemented the programming necessary to omit the Medicare Part D drugs in August 2024. DHFS continues to monitor quarterly variances within the drug rebates included in CMS-64.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program , Medicaid Cluster ALN and Program Expenditures: 93.767 ($497,921,432), 93.775/93.777/93.778 ($20,820,349,431) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Special Tests and Provisions -Managed Care Financial Audit Finding 2023-020: Failure to Perform Periodic Audits of Encounter Data Condition Found: DHFS did not perform periodic audits of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each Managed Care Organization (MCO) for the Children’s Health Insurance Program (CHIP) and Medicaid Cluster programs during the fiscal year. During our testing, we noted DHFS did not conduct or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each its MCOs with contracts starting on or after July 1, 2017, during fiscal year 2023 or in the past three years. Accordingly, no audit results were available to be posted on DHFS’ website. While we noted DHFS obtained annual financial statement audit reports from each of the MCOs, these audit reports had not been reviewed by DHFS personnel. Upon our review of 4 MCO financial statement audit reports, we noted the auditors issued an adverse opinion for each of the sampled MCOs. Accordingly, the MCO financial reports were not prepared in accordance with generally accepted accounting principles (GAAP) as required by program regulations. Additionally, we noted DHFS has not established internal control procedures to ensure the encounter data audits are performed and posted as required or to ensure financial reports are prepared in accordance with the program requirements. Criteria or Requirement: According to 42 CFR 438.602(e), the State must periodically, but no less frequently than once every 3 years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, Prepaid Inpatient Health Plan (PIHP) or Prepaid Ambulatory Health Plan (PAHP). 42 CFR 438.602(g)requires the State to post the results of any audits under 42 CFR 438.602(e) on its website. Additionally, 42 CFR 438.3(m) requires that the contract with MCOs must require submission of audited GAAP financial reports specific to the Medicaid contract on an annual basis. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to perform periodic audits of encounter and financial data submitted by, or on behalf of each of its MCOs. Cause: In discussing these conditions with DHFS officials, they stated that although the contracts with each MCO were amended to include independent periodic audits of encounter data, no audits had been completed as of the initial audit request. Possible Asserted Effect: Failure to perform review over periodic audits of encounter data and financial statement audits submitted by, or on behalf of each of its MCOs may result in inaccurate capitation rate setting for the respective MCOs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2022-013. (Finding Code 2023-020, 2022-013, 2021-009) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS implement procedures to perform periodic audits of encounter data submitted by, or on behalf of each of its MCOs. For financial audits, we recommend HFS perform reviews over the submitted reports to ensure that they comply with the stated requirements. Additionally, information should be made publicly available as required. Views of DHFS Officials: DHFS accepts the recommendation. DHFS, in coordination with its external quality review organization, worked with the MCOs to conduct a validation audit of the MCOs and posted the final report on the DHFS Report Center webpage on September 28, 2023. DHFS also issued a notice to the MCOs and required submission of GAAP/Financial Audits, per 438.3(m), no later than July 31, 2023. The reports submitted by each MCO have been shared with the DHFS’ financial team for review. DHFS has also created a policy document for the encounter and financial 3-year audit cycle.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program Cluster, Medicaid Cluster CFDA # and Program Expenditures: 93.767 ($497,921,432), 93.775/93.777/93.778 ($20,820,349,431) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Special Tests and Provisions – Provider Eligibility (Screening and Enrollment) Finding 2023-021: Inadequate Procedures to Determine Provider Eligibility Condition Found: DHFS did not adequately screen providers of the Children’s Health Insurance Program (CHIP) and Medicaid Cluster programs to ensure that Medicaid providers were not on the USDHHS Office of the Inspector General’s (OIG) List of Excluded Individuals/Entities (LEIE) at the time the voucher for the related services performed was paid. The Illinois Medicaid Program Advanced Cloud Technology (IMPACT) system is used by DHFS for the enrollment and screening of CHIP and Medicaid providers. On a monthly basis, IMPACT automatically checks providers enrolled within IMPACT to the LEIE to verify the provider is not on the LEIE. During our testing of 60 CHIP and 60 Medicaid beneficiary payments (totaling $5,040 and $106,920, respectively) to ensure the providers were not on the LEIE at the time the voucher for the related services performed was paid, we identified 9 CHIP payments (totaling $699) and 3 Medicaid payments (totaling $843) to providers for services where the providers were not checked against the LEIE to verify they were not on the LEIE for the month when the voucher was paid. Payments made to providers on behalf of beneficiaries of the CHIP and Medicaid Cluster programs totaled approximately $489,947,829 and $20,318,469,207, respectively, during the year ended June 30, 2023. Criteria or Requirement: 2 CFR 455.436(a) requires the State Medicaid agency to confirm the identify and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of a provider through routine checks of federal databases. Additionally, 42 CFR 455.436(b) requires the State Medicaid agency to check the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System, the LEIE, the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. 42 CFR 455.436(c) requires the State Medicaid agency to consult the appropriate databases to confirm identity upon enrollment and reenrollment and check the LEIE and EPLS no less frequently than monthly. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing adequate procedures to screen providers of the CHIP and Medicaid Cluster programs, specifically, to ensure the providers were not on the LEIE for the month when the voucher was paid. Cause: In discussing these conditions with DHFS officials, DHFS management identified this issue as a system defect with the monthly batch screenings not indicating which databases were checked during the screenings. Possible Asserted Effect: Failure to adequately screen CHIP and Medicaid Cluster program providers may result in federal funds being paid to providers that should have been denied, which are unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2022-015. (Finding Code 2023-021, 2021-006) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS address the IMPACT processing error for screening CHIP and Medicaid Cluster program providers, specifically, the process to check, on a monthly basis, that providers are not on the LEIE. Views of DHFS Officials: DHFS accepts the recommendation. DHFS management created job ticket, ILPRO-889, to address the monthly screening check box issue as part of the 1.6 release which was deployed in March of 2023. When the monthly screening occurs, the boxes will be checked based on the presence of corresponding licenses for the provider. In addition, DHFS receive a discipline file which will include information from the Excluded Parties Listing System, List of Excluded Individuals and Entities, Medicaid Sanctions List, other federal, and other states so all of these will be checked for all providers for each monthly batch screening.

State Agency Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program Cluster CFDA # and Program Expenditures: 93.767 ($497,921,432) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: $3,113,664 Compliance Requirement: Eligibility Finding 2023-022: Failure to Discontinue CHIP Benefits for Ineligible Individuals Condition Found: DHFS improperly continued providing benefits under the Children’s Health Insurance Program (CHIP) program to individuals who were over the age of 19 prior to the start of the Public Health Emergency (PHE) on March 13, 2020. The CHIP program provides benefits to children under the age of 19 at an enhanced federal participation (FFP) rate. CHIP benefits should be discontinued when a beneficiary turns 19; however, if they meet all other eligibility criteria, these beneficiaries are allowed to transition to benefits under the Medicaid Cluster program. During our testing of fiscal year 2022 payments (totaling $351,494) made on behalf of 60 CHIP beneficiaries, we identified three beneficiaries (with sampled medical payments of $3,246) who were over the age of 19 on or before March 13, 2020 (the beginning of the PHE). As this finding was finalized after the end of the year ended June 30, 2023, there was no time to implement a corrective action plan prior to the end of fiscal year 2023. As a result, we have assessed the same exceptions to have occurred during the year ended June 30, 2023. DHFS performed a review of medical payments made during the year ended June 30, 2023 and identified 1,010 CHIP beneficiaries who attained the age of 19 prior to the beginning of the PHE for whom medical payments totaling $3,113,664 were made during the year ended June 30, 2023. We also noted DHFS has not established adequate controls to identify and remove individuals over the age of 19 (who did not meet the eligibility requirements for the CHIP program) prior to the PHE to determine if they were eligible for the Medicaid Cluster program. Medical payments made on behalf of CHIP beneficiaries during the year ended June 30, 2023, totaled $489,947,829. Criteria or Requirement: In accordance with 42 CFR 435.10 and the OMB Compliance Supplement, dated May 2022, the State is required to determine client eligibility in accordance with eligibility requirements defined in the approved State Plans for the CHIP program. Specifically, 42 CFR 457.320(a) requires the State CHIP agency to provide benefits for groups of children up to, but not including the age 19 in addition to other eligibility criteria. State Plan Amendment IL-14-0009 includes general eligibility considerations which allows benefits to be provided for children up to the age of 19 which is consistent with 42 CFR 457.320(a). In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing and maintaining adequate controls over processes to perform and document beneficiary eligibility determinations. Cause: In discussing these conditions with DHFS officials, they stated DHFS had a backlog of redeterminations prior to the PHE, which included cases with 19-year-olds who had aged out. This was due to a lack of staff and the adaptation to a new Integrated Eligibility System. Possible Asserted Effect: Failure to properly perform eligibility determinations in accordance with State Plans may result in federal funds being awarded to ineligible beneficiaries, which are unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2022-016. (Finding Code 2023-022, 2022-016) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS review its current process for performing eligibility decisions and consider changes necessary to ensure all initial and redetermination decisions are performed in accordance with guidelines set forth by the State Plan and temporary guidance set forth by COVID-19 waivers and announcements. Views of DHFS Officials: DHFS accepts the recommendation. DHFS is reviewing eligibility determinations for effectiveness and will create a plan of action, including implementing the federally mandated unwinding plan and hiring and training additional staff.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Medicaid Cluster CFDA # and Program Expenditures: 93.775/93.777/93.778 ($20,820,349,431) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Special Tests and Provisions - Medicaid Recovery Audit Contractors Finding 2023-023: Failure to Perform Recovery Audits over Medicaid Underpayments and Overpayment Claims Condition Found: DHFS did not initiate any recovery audits over Medicaid claims during the year ended June 30, 2023. DHFS, the State of Illinois Medicaid Agency, is required to establish various policies and procedures to promote the integrity of the Medicaid Cluster program. One of these requirements is to establish programs with recovery audit contractors (RAC) to identify under and overpayments related to Medicaid claims. The Medicaid RAC is responsible for reviewing claims for errors and recouping overpayments under the state plan or waiver. During our audit procedures, we noted the DHFS Office of Inspector General (OIG)’s pre-existing contract with the RAC expired at the end of fiscal year 2022. OIG executed a new RAC contract effective August 12, 2022. Throughout fiscal year 2023, OIG and the RAC worked to established audit protocols and processes for the new contract. As a result, no audits were initiated during the year ended June 30, 2023. Criteria or Requirement: 42 CFR 455.502(b) requires the State enter into contracts, consistent with State law and in accordance with this section, with one or more eligible Medicaid Recovery Audit Contractor (RAC) to carry out the activities described in section 455.506. 42 CFR 455.506 (a) requires Medicaid RACs to review claims submitted by providers of items and services or other in individuals furnishing items and services for which payment has been made under section 1902(a) of the Social Security Act for under any waiver of the State Plan to identify underpayments and overpayments and recoup overpayments for the States. According to 42 CFR 506(d), States must make referrals of suspected fraud and/or abuse, as defined in 42 CFR 455.2, to the Medicaid Fraud Control Unit. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure Medicaid utilization controls, including the Medicaid RAC program, are implemented, and operating as required. Cause: In discussing these conditions with DHFS officials, they stated the contract with the RAC began as of August 12, 2022, and they were developing audit protocols and scenarios during the entire fiscal year. Once the protocols and scenarios were finalized, the RAC would begin performing for underpayments and overpayments of claims submitted by providers. Possible Asserted Effect: Failure to properly perform RAC audits over medical claims results in noncompliance with program regulations and may result in unallowable amounts being claimed to the Medicaid Cluster program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-023) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS finalize the audit protocols and scenarios with its Medicaid RAC vendor to permit the performance of recovery audits to promote the integrity of the Medicaid Cluster program. Views of DHFS Officials: DHFS accepts the recommendation. The auditors’ recommendation to perform Medicaid RAC audits has been implemented. Once DHFS OIG and the RAC vendor developed and implemented the audit system, audits began. DHFS OIG as the administrator of this program monitors its efficacy on an on-going basis and will make adjustments as necessary.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Medicaid Cluster ALN and Program Expenditures: 93.775/93.777/93.778 ($20,820,349,431) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2023-024: Failure to Report Expenditures on the Medicaid CMS-64 Report in a Timely Manner Condition Found: DHFS did not report certain Medicaid Cluster program expenditures on quarterly federal financial (CMS-64) reports in a timely manner. DHFS is the State Medicaid agency and is responsible for determining whether payments made to providers were for permissible services on behalf of eligible beneficiaries. The Illinois Department of Human Services (IDHS) is responsible for determining the eligibility of certain Medicaid Cluster beneficiaries and for administering certain Medicaid waiver programs, including certain Home and Community Based Services provided by the State. In January 2023, DHFS and IDHS discovered expenditures under the Home and Community Based Services waiver program operated by IDHS had not been claimed since January 1, 2021. As a result, DHFS reported expenditures totaling $508,822,205 paid by the State in prior periods on the CMS 64 reports submitted in the year ended June 30, 2023. Specifically, we noted the following expenditure amounts were reported by quarter: "See Table in the Audit Report". Additionally, we noted the supervisory review and analytical procedures performed over the quarterly CMS-64 reports were not designed at a sufficient level of precision to identify that these expenditures had not been provided by IDHS for reporting on the CMS-64 report. Criteria or Requirement: 42 CFR 430.30(c) requires States to submit Form CMS-64 (Quarterly Medicaid Statement of Expenditures for the Medical Assistance Program) to the central office not later than 30 days after the end of each quarter. This report is the State’s accounting of actual recorded expenditures. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure financial and other award information reported in required financial reports is accurate prior to submission. Cause: In discussing these conditions with DHFS officials, they stated insufficient review and comparison of data, by both DHFS and IDHS, resulted in expenditures not being claimed timely. Possible Asserted Effect: Failure to timely report expenditures on the CMS-64 inhibits USDHHS’ ability to monitor the Medicaid Cluster program. Additionally, failure to report federal expenditures in a timely manner prohibits the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal funding. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2022-014. (Finding Code 2023-024, 2022-014) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS evaluate its process for preparing and reviewing its financial reports and implement the procedures necessary to ensure quarterly CMS-64 reports are complete and accurate. Views of DHFS Officials: DHFS accepts the recommendation. DHFS and IDHS Department of Innovation and Technology (DoIT) staff have implemented weekly reports related to the Home and Community Based Services waiver payment submissions, which allows IDHS staff to review and timely identify any issues with the waiver submissions to the Department of Healthcare and Family Services. DHFS reviewed and revised its quarterly other agency Medicaid spending/federal revenue reporting. The report was redesigned to provide prior quarter/year comparisons to allow for more effective identification of problematic issues. The distribution list was updated to ensure appropriate staff receive these reports for review. DHFS staff follows-up with other agency recipients to ensure the quarterly reports are reviewed and responses are communicated to DHFS.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Medicaid Cluster CFDA # and Program Expenditures: 93.775/93.777/93.778 ($20,820,349,431) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Special Tests and Provisions - Utilization Control Finding 2023-025: Failure to Perform Reviews over Home and Community Based Waiver Services (HCBS) Condition Found: DHFS failed to conduct utilization reviews over HCBS services for five of the nine waivers contracted out to their vendor during fiscal year 2023. DHFS is required to follow the state plan’s methods and procedures to safeguard against unnecessary utilization of care and services. HCBS services are furnished to beneficiaries who would otherwise need inpatient care that is furnished in a hospital, nursing facility or other institutional setting which are reimbursable for Medicaid claims under the state plan. One of these requirements is to perform reviews over HCBS waiver services. There are nine total HCBS waivers and five of them are contracted out through a vendor. These five waivers are: Persons with Disabilities, People with HIV or AIDS, Persons with Brain Injury, Adults with Developmental Disabilities and Persons who are Elderly. During our audit procedures and based on inquiries with DHFS officials, the vendor contract came to an end on February 28, 2023, and a new contract had not been in place to cover the remainder of the fiscal year. As a result, we identified no reviews performed from March 1, 2023, through the end of the fiscal year. The agency continued to provide reviews and monitoring over the other four HCBS waivers: Residential Waiver for Children and Young Adults with Developmental Disabilities, the Support Waiver for Children and Young Adults with Developmental Disabilities, the Medically Fragile/Technology Dependent Children waiver, and the Supportive Living Facility waiver. The engagement team tested the PCG waiver reviews from July 1, 2022, through February 28, 2023, and did not identify any additional exceptions. The failure to perform reviews from March 1, 2023, through June 30, 2023 resulted in $853,119,907 in Medicaid claims that were not subject to contractor reviews during fiscal year 2023. Criteria or Requirement: 42 CFR 456 discusses the entire utilization control program to help ensure appropriate care is being provided for Medicaid services. Specifically, 42 CFR 456.22 and 456.23 requires the State Medicaid agency to have a sampling plan in place to perform reviews over the quality of Medicaid services. Additionally, 42 CFR 456.4 discusses the responsibilities of the state Medicaid agency to monitor these requirements even if they are outsourced to a third-party to perform these reviews. Cause: The contract with the third-party servicer expired as of February 28, 2023. The intention was to have the contract renewed to continue working on the HCBS waiver reviews, but there were issues renewing the contract. DHFS posted a request for quote in attempt to hire another contractor but did not receive any responses. As a result, there were no reviews performed after the expiration of the current contract. Possible Asserted Effect: Failure to properly review and monitor Medicaid services could result in inadequate services being provided and poor quality of care at the facilities. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-025) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS obtain a contractor for fiscal year 2024 or have a plan in place to perform reviews themselves if there are no contractors willing and able to perform these reviews. Views of DHFS Officials: DHFS accepts the recommendation. DHFS is working to procure a new vendor to complete the reviews.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Low Income Home Energy Assistance Program (LIHEAP) ALN and Program Expenditures: 93.568 ($288,503,657) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2023-026: Failure to Maintain Adequate Documentation for Reporting Condition Found: DCEO did not maintain adequate documentation to substantiate the amounts reported on the Low-Income Home Energy Assistance Program (LIHEAP) Performance Data Form. DCEO is required to prepare and submit the LIHEAP Performance Data Form to the Administration for Children and Families on an annual basis. The report includes LIHEAP data on the sources and uses of funds, average benefits provided by the program, and maximum income cutoffs for four-person households for each type of LIHEAP assistance. The report also provides LIHEAP data on energy burden targeting, the restoration of home energy service, and the prevention of loss of home energy service during the fiscal year. During our testing of the LIHEAP Performance Data Form for the federal fiscal year ended September 30, 2022 (filed in State fiscal year 2023), DCEO was unable to provide documentation to support the amounts reported within the LIHEAP Performance Data Form. We also noted DCEO has not established appropriate internal controls to ensure required data reports submitted to USDHHS are properly supported in accordance with federal requirements. Criteria or Requirement: According to the Administration for Children and Families Action Transmittal LIHEAP-AT-2023-02, the LIHEAP Performance Data Form is designed for State LIHEAP Grant Recipients to complete every federal fiscal year. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include controls to ensure supporting documentation for amounts reported in required performance reports is maintained. Cause: In discussing these conditions with DCEO officials, they stated that although it is the normal practice for the Office of Community Assistance (OCA) to maintain complete and thorough documentation for all reports submitted to federal funding sources, for this particular report, the spreadsheet supporting the amounts submitted in the LIHEAP Grantee Survey was inadvertently saved over by another version of the spreadsheet that did not contain the accurate supporting documentation. Possible Asserted Effect: Failure to maintain supporting documentation for the performance reports prohibits the completion of the audit and may prevent the USDHHS from obtaining accurate program data for monitoring the LIHEAP program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding code 2023-026) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCEO implement procedures to ensure supporting documentation is maintained for performance reports. Views of DCEO Officials: DCEO agrees with the finding and recommendation.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Low Income Home Energy Assistance Program (LIHEAP) ALN and Program Expenditures: 93.568 ($288,503,657) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Cash Management Finding 2023-027: Failure to Re-certify to the Accuracy of the Clearance Pattern Condition Found: DCEO did not properly review or re-certify the accuracy of the clearance pattern specified in the Treasury-State Agreement related to cash draws for the Low Income Home Energy Assistance Program (LIHEAP). Annually, the State of Illinois negotiates the Treasury-State Agreement (TSA) with the U.S. Department of the Treasury (the Treasury) which details the funding techniques used for the draw down of federal funds. Certain approved finding techniques utilized by the State require the use of a clearance pattern that identifies the average number of days disbursements (warrants) take to clear the State Treasurer’s account. The established clearance pattern is then used to determine the date the State should request federal funds from the U.S. Treasury in order to minimize the time elapsing between the receipt of federal funds and the State Treasurer’s clearance of funds. The clearance pattern must be recertified at least every five years. During our testwork over cash management requirements, we noted the clearance pattern included in the TSA in place for the year ended June 30, 2023 had not been recertified since 2016 (more than 5 years since previous recertification). Additionally, we noted internal controls have not been established to ensure clearance patterns are calculated and recertified in accordance with Treasury regulations. Criteria or Requirement: 31 CFR 205.20 requires a State shall ensure that a clearance pattern accurately represents the flow of Federal funds under the Federal assistance programs to which it is applied, and that a clearance pattern reflects seasonal or other periodic variations in clearance activity. A State shall also ensure that a clearance pattern is auditable. 31 CFR 205.22 states an authorized State official shall recertify that a clearance pattern corresponds to a program’s clearance activity and shall recertify the accuracy of the clearance pattern at least every five years. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to ensure clearance patterns are recertified in accordance with federal regulations. Cause: In discussing these conditions with agency officials, DCEO stated they did not have procedures in place to re-certify the clearance pattern every 5 years as required due to unfamiliarity with the requirements. Possible Asserted Effect: Failure to evaluate and recertify a program’s clearance pattern violates the requirement of 31 CFR 205.9 and could result in the inaccurate recalculation of DCEO’s interest obligation to the Treasury. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-027) Recommendation: We recommend DCEO establish procedures and controls to ensure clearance patterns are recertified within required timeframes. Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Views of DCEO Officials: DCEO agrees with this finding and recommendation.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Low Income Home Energy Assistance Program (LIHEAP) ALN and Program Expenditures: 93.568 ($288,503,657) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Cash Management Finding 2023-028: Failure to Perform Cash Draws in Accordance with the Treasury-State Agreement Condition Found: DCEO did not perform its cash draws in accordance with the funding technique prescribed in the Treasury-State Agreement (TSA). On an annual basis, the State of Illinois negotiates the TSA with the U.S. Department of the Treasury (the Treasury), which details, among other things, the funding techniques to be used for requesting federal funds. The TSA funding technique prescribed for the Low Income Home Energy Assistance Program (LIHEAP) program is interest neutral and requires DCEO to request funds from the awarding federal agency so that the funds are deposited by ACH on the dollar weighted average day of clearance for disbursements. According to the 2023 TSA the average day of clearance for program costs is three days. As such, under this funding technique, DCEO should request federal funds two days after issuing warrants (payments) for program expenditures. During our testwork over 12 cash draws (totaling $72,635,351) for program (subrecipient) expenditures of the LIHEAP program during the year ended June 30, 2023, we noted the expenditures supporting the cash draws were not disbursed in accordance with the timeframe required by the prescribed funding technique. During our testing of 25 subrecipient payments (totaling $32,294,005) we noted federal funds were requested 1 to 13 days earlier than permitted by the funding technique. Criteria or Requirement: According to 31 CFR part Subpart A 205.6(a), a TSA documents the accepted funding techniques and methods for calculating interest agreed upon by the U.S. Treasury and the State for each Federal program governed by subpart A of the Treasury regulations. Section 6.3.2 of the 2023 Treasury State Agreement (effective July 1, 2022 to June 30, 2023) states that the Low-Income Home Energy Assistance program is required to use the Average Clearance funding technique. Section 6.2.1 of the 2023 Treasury State Agreement describes the Average Clearance funding technique as being interest neutral and requiring the State to request funds such that they are deposited by ACH on the dollar-weighted average day of clearance for the disbursement. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure that Federal cash draws are performed in accordance with the TSA. Cause: In discussing these conditions with Agency Officials, DCEO did not have the correct funding technique listed within the Treasury-State Agreement for the Low-Income Home Energy Assistance Program. Possible Asserted Effect: Failure to draw funds in accordance with the TSA results in noncompliance with U.S. Treasury regulations. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-028) Recommendation: We recommend DCEO implement procedures to ensure cash draws are performed in accordance with the TSA or work with the US Treasury to amend the TSA to reflect DCEO cash draw request practices. Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Views of DCEO Officials: DCEO agrees with this finding and recommendation.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Health and Human Services (USDHHS), U.S. Department of Labor (USDOL) Program Name: Low Income Home Energy Assistance Program (LIHEAP), Workforce Innovation and Opportunity Act (WIOA) ALN and Program Expenditures: 93.568 ($288,503,657), 17.258/17.259/17.278 ($141,177,677) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2023-029: Failure to Maintain Updated Procedures to File Subaward Information Required by FFATA Condition Found: DCEO failed to maintain updated procedures which resulted in filing inaccurate Federal Funding Accountability and Transparency Act (FFATA) reports. FFATA requires the State to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name,2. Subawardee DUNS number, 3. Amount of subaward, 4. Subaward obligation or action date, 5. Date of report submission, 6. Subaward number, 7. Subaward project description, 8. Subawardee names and compensation of highly compensated officers. During State fiscal year 2023, DCEO did not have updated procedures in place to identify and report the following key data elements, for each of the programs: "See Table in the Audit Report" DCEO passed through approximately $282,019,216 and $129,891,431 to subrecipients of the LIHEAP and WIOA programs, respectively, during the year ended June 30, 2023. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to ensure all FFATA reports are accurately and timely prepared and submitted in accordance with federal regulations. Cause: In discussing these conditions with DCEO officials, DCEO's procedures did not reflect a requirement to re-file a FFATA report after a sub-award agreement had its dollar amount modified. In addition, the department’s procedures presumed that the obligation date of a subaward was interchangeable with the award date for a subaward, FFATA reports were filed based on when a sub-award was obligated. Possible Asserted Effect: Failure to maintain updated reporting procedures in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-029) Recommendation: We recommend DCEO update procedures and controls to identify awards and amendments subject to FFATA reporting requirements and report required subaward information in accordance with FFATA. Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Views of DCEO Officials: DCEO agrees with this finding and recommendation.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Low Income Home Energy Assistance Program (LIHEAP) ALN and Program Expenditures: 93.568 ($288,503,657) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2023-030: Failure to Communicate Award Information to Subrecipients Condition Found: DCEO did not follow its established policies and procedures for monitoring subrecipients of the Low-Income Home Energy Assistance Program (LIHEAP). During our testwork of the award communications for our sample of subrecipients, we selected the contracts under which funds were disbursed during fiscal year 2023 to review for compliance with federal award communication requirements. During our review of the award communication files for a sample of 35 awards, we noted the Federal Award Identification Number (FAIN) was not communicated in the subrecipient award agreement for two of the subrecipients (with payments totaling $1,192,330). Upon further review by the agency, an additional 36 awards (with payments totaling $2,727,317) did not communicate the FAIN in the subrecipient award agreement. Amounts passed through to subrecipients under the LIHEAP program totaled $282,019,216 during the year ended June 30, 2023. Criteria or Requirement: According to 2 CFR 200.332(a), a pass-through entity is required to identify Federal awards made to the subrecipient by informing each subrecipient of the federal award identification number. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include controls to ensure required information is properly communicated. Cause: In discussing these conditions with DCEO officials, they stated that the FAIN for award 2102ILLIEA was incorrectly labeled as 2101ILLIEA on the issued Grant Agreements for the 36 subrecipients under the 21-224 LIHEAP Grant Series due to an entry error during set up in the DCEO eGrants system for this grant series. The fourth digit of the standard naming convention for HHS award shifted with this award from 1 to 2, as the 2020 award was 2001ILLIEA. To initiate grants, the award number is entered into a single field in the eGrants system and automatically generated on any grant agreement created in this series. While this was missed with the establishment of the 21-224 award series, it was corrected with the 21-221 series. Possible Asserted Effect: Failure to communicate required award information may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-030) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCEO implement additional procedures to ensure award information communicated to subrecipients is reviewed for completeness and accuracy. Views of DCEO Officials: DCEO agrees with the finding and recommendation.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Low Income Home Energy Assistance Program (LIHEAP) ALN and Program Expenditures: 93.568 ($288,503,657) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2023-031: Inaccurate Special Report Condition Found: DCEO did not maintain supporting documentation for key line items or prepare accurate special reports for the Low-Income Home Energy Assistance Program (LIHEAP). DCEO is required to prepare Quarterly Performance and Management Reports for LIHEAP. During our testwork over two Quarterly Performance and Management Reports submitted during the fiscal year ended June 30, 2023, we noted the following: • For the quarterly report for the period ending March 31, 2023, the amount of funds obligated was reported as $84,608,801. The actual amount of funds obligated was $85,119,500, resulting in an understatement of $510,699. • For the quarterly report for the period ending June 30, 2023, the amount of funds obligated was reported as $197,366,164. DCEO personnel responsible for preparing the report were unable to provide support for the amount reported. Additionally, we noted DCEO has not established appropriate internal controls to ensure its quarterly reports submitted to USDHHS are properly supported in accordance with federal requirements. We also noted supervisory review procedures have not been designed to operate at a level of precision to identify errors of the size and nature noted above. Criteria or Requirement: According to the Administration for Children and Families Action Transmittal LIHEAP-AT-2023-03, the Quarterly Performance and Management Report is conducted in accordance with the LIHEAP statute (Title XXVI of P.L. 97-35). The information received from the report provides data to the Administration for Children and Families and Congress in its oversight of recipients’ performance in administering the LIEAP program. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include controls to ensure amounts reported in the Quarterly Performance and Management Report are accurate and properly supported. Cause: In discussing these conditions with DCEO officials, they stated the incorrect amounts submitted for the 03/31/23 and 06/30/23 quarterly reports were due to data entry errors. Possible Asserted Effect: Failure to maintain supporting documentation for and to accurately prepare the quarterly performance and management reports prohibits the completion of the audit and may prevent USDHHS from obtaining accurate program data for monitoring the LIHEAP program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-031) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCEO implement procedures to ensure supporting documentation is maintained for the quarterly performance and management report. We also recommend DCEO review the process and procedures in place to prepare special reports required for the LIHEAP program and implement procedures necessary to ensure the reports submitted to USDHHS are accurate. Views of DCEO Officials: DCEO agrees with the finding and recommendation.

State Agency: Illinois Department of Public Health (IDPH) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: COVID-19 – Immunization Cooperative Agreements (ICA), COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) ALN and Program Expenditures: 93.268 ($120,464,844), 93.323 ($174,226,387) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2023-032: Failure to Report Subaward Information Required by FFATA Condition Found: IDPH failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Immunization Cooperative Agreements (ICA) and Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) programs.FFATA requires the State to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subaward Name 2. Subaward DUNS number 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted IDPH did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations until June 2023. As a result, FFATA reports were not prepared or submitted for any subawards of the ICA and ELC programs for the period July 1, 2022, through May 31, 2023. Additionally, we noted that IDPH did not establish control procedures to submit FFATA reports for subawards as required by federal regulations for the period June 1, 2023 through June 30, 2023. During our testwork of 35 subawards, we noted the following exceptions: "See Table in the Audit Report". IDPH’s subrecipient expenditures under the federal programs for the year ended June 30, 2023 were as follows: "See Table in the Audit Report". Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include complying with FFATA. Cause: In discussing these conditions with IDPH officials, management stated there was a lack of compliance among grant managers in completing the required FFATA reporting. IDPH’s Office of Performance Management (OPM) identified this issue and developed a Standard Operating Procedure (SOP) for FFATA reporting to address the gap and improve the process. The SOP was developed and tested from May through June 2023 and officially implemented in July 2023. The new process involved downloading all award information from the grant management system, EGrAMS, and having OPM conduct a monthly batch upload of the data. When the policy was implemented, IDPH ensured that all awards from FY 2020 onward were reported, and that going forward, all subawards would be submitted within the required timeframe. Additionally, it was discovered that the obligation/action date on the reports was being automatically generated based on the date the signed Uniform Grant Agreement (UGA) was uploaded into EGrAMS, instead of the actual date the agreement was signed. To correct this, OPM worked with EGrAMS to add a field where grant managers would manually enter the date the award was signed when uploading the UGA. Possible Asserted Effect: Failure to identify award subject to FFATA and to report subawards in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2022-020. (Finding Code 2023-032, 2022-020, 2021-021) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDPH establish procedures to identify awards subject to FFATA reporting requirements and report required subaward information in accordance with FFATA. Views of IDPH Officials: We agree with the recommendations of the auditor.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($78,196,419) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2023-033: Failure to Adequately Monitor Subrecipients Condition Found: ICJIA did not follow its established program monitoring policies and procedures for subrecipients of the Crime Victim Assistance (CVA) program for fiscal year 2023. ICJIA selects subrecipients of the CVA program to perform programmatic monitoring procedures using a risk-based approach. Among other things, ICJIA has identified subrecipients receiving CVA funding under shorter term programs (12 months or less in duration) as higher risk and requires an on-site review to be performed once during the period of performance. Additionally, longer term programs (12 to 36 months in duration) require an on-site review in the first twelve months of the period of performance and a second on-site review during the remaining period of performance. In scheduling the timing of its on-site reviews, ICJIA considers whether there are any additional subrecipient specific risk factors that warrant an earlier review time. Based upon ICJIA’s monitoring criteria, we noted ICJIA should have conducted site visits with 9 subrecipients (with expenditures of $1,542,221) from shorter term programs and 35 subrecipients (with expenditures of $41,777,962) from longer term programs during the year ended June 30, 2023. During our review of the subrecipient site visits conducted during State fiscal year 2023, we noted none of the 9 subrecipients from shorter term programs were subjected to site visits and 19 of the 35 subrecipients from longer term programs (with expenditures of $9,561,899 during the year ended June 30, 2023) were not subjected to site visits. ICJIA passed through approximately $75,301,704 to subrecipients of the CVA program during the year ended June 30, 2023. Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. ICJIA’s Site Visits policy requires Grant Specialists to conduct two site visits within thirty-six months of the start of a grant with the first site visit taking place within the first twelve months, unless the grantee’s Program Risk Assessment requires that a site visit be completed within a shorter time period. One-time, twelve-month (or less) grants will also have a site visit conducted during their period of performance. In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include ensuring on-site program monitoring procedures are performed in a timely manner. Cause: In discussing these conditions with ICJIA officials, they stated due to staffing shortages within the federal and state grants unit, all of the required visits were not completed. Possible Asserted Effect: Failure to adequately perform on-site monitoring reviews of subrecipients may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-033) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA ensure programmatic on-site reviews are performed and documented for subrecipients in accordance with established policies and procedures. Views of ICJIA Officials: We agree with the recommendation.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($78,196,419) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2023-034: Inadequate Review of Subrecipient Single Audit Reports Condition Found: ICJIA did not adequately review single audit reports received from its subrecipients for the Crime Victim Assistance Program (CVA) program on a timely basis. The State of Illinois established the Grant Accountability and Transparency Unit (GATU) to implement the provisions of the State’s Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal and State programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning, to the applicable state agency, any findings attributable to amounts passed through to the subrecipient(s) by the State. As a State agency, ICJIA is responsible for reviewing the reports assigned to them by GATU and determining whether Federal funds reported in the consolidated year-end financial report (CYEFR) reconcile to ICJIA records. Additionally, as the cognizant State agency, ICJIA is responsible for issuing management decisions on findings reported and applying sanctions to subrecipients who do not comply with reporting requirements (i.e. stop pay process). During our testing of a sample of single audit desk review files for 16 subrecipients (with expenditures of $52,565,919 in the fiscal year), we noted the following: • For one subrecipient (with expenditures of $471,739), ICJIA did not issue a Management Decision Letter (MDL) in a timely manner. The delay in issuing this management decision letter was 67 days beyond the required timeframe. • For six subrecipients (with expenditures of $28,012,353), ICJIA did not review the single audit reports and did not issue a MDL as required. • For 10 subrecipients (with expenditures of $27,690,600), ICJIA did not reconcile the CYEFR to ICJIA’s records as required. • For two subrecipients (with expenditures of $1,155,919), ICJIA did not receive the single audit reporting package within required timeframes or follow up with the subrecipient. Additionally, ICJIA did not invoke the stop pay process. ICJIA has not established controls over subrecipient single audit reviews at an adequate level of precision to ensure single audit reporting requirements, including obtaining and reviewing single audit reporting packages, issuing management decision letters, reconciling CYEFRs to agency records, and invoking stop payment actions are performed within required timeframes. ICJIA passed through approximately $75,301,704 to subrecipients of the CVA program during the year ended June 30, 2023. Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statues, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. Additionally, 2 CFR 200.332(d)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to established and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure Single Audit reports are reviewed in a timely manner and management decisions are issued within required timeframes. Cause: In discussing these conditions with ICJIA officials, they stated this GATA responsibility has not been performed as consistently as other responsibilities due to competing priorities and staff shortages. Possible Asserted Effect: Failure to complete and document reviews of subrecipient single audit reports in a timely manner may result in federal funds being expended for unallowable purposes and subrecipients not administering the federal programs in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-034) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA establish procedures to ensure subrecipient single audit report reviews are completed and documented in a timely manner. Additionally, ICJIA should implement procedures to ensure timely reconciliation of funds, issuance of management decisions letters, and initiation of the stop pay process. Views of ICJIA Officials: ICJIA agrees with the recommendation. ICJIA does not have staff dedicated to this function. We are actively in the hiring process for a person who will be dedicated to this work. We believe once this person is hired, the Authority will be able to meet the GATA requirements.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($78,196,419) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2023-035: Inadequate Fiscal Monitoring of Subrecipients Condition Found: ICJIA did not follow its established policies and procedures for monitoring subrecipients of the Crime Victim Assistance (CVA) program. ICJIA selects subrecipients of the CVA program to perform fiscal monitoring procedures using a risk-based approach. Specifically, a risk assessment is performed annually over the subrecipient which includes calculating a risk score based upon criteria established by ICJIA. ICJIA’s risk assessment criteria include the total award amount, the subgrantee’s experience with ICJIA grant awards, results of financial monitoring, the percent of grant expended to date, the quality of financial submissions, the timeliness of financial submissions, and the payment type. Based upon the risk score, each subrecipient is designated as needing high, moderate, or low oversight. The oversight category assigned determines the frequency and type of financial monitoring (i.e. desk review or fiscal audit). During our audit procedures, we noted 21 sub-grantees who received CVA program funds were designated for high oversight for which the monitoring policy generally requires a fiscal audit. Of the 21 high oversight designated subrecipients, only two subrecipients had a fiscal audit performed over their CVA program grants. Agency personnel indicated additional risk assessment criteria were considered to reduce the number of high oversight subrecipients; however, these additional criteria are not documented in the fiscal monitoring policy or risk score documentation. ICJIA passed through approximately $75,301,704 to subrecipients of the CVA program during the year ended June 30, 2023. Criteria or Requirement: According to 2 CFR 200.332(b), a pass-through entity must evaluate each subrecipient's risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. According to 2 CFR 200.332(d), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. 2 CFR 200.332(d)(3) requires pass-through entities to issue management decisions for applicable audit findings pertaining to the federal awards provided to the subrecipient and 2 CFR 200.332(d)(4) requires pass through entities to resolve audit findings through corrective action plans (CAP). In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing and performing monitoring procedures in accordance with Uniform Guidance and program requirements. Cause: In discussing these conditions with ICJIA Officials, they stated ICJIA utilizes both a formal, documented policy to determine a risk score for over 600 active grantees and a more subjective, unwritten assessment to determine which higher and medium risk grantees actually will be scheduled to receive one of our active fiscal monitoring procedures. The subjective analysis is used by ICJIA to adjust the potential volume of monitoring effort to the anticipated number of resources available in a given period. Possible Asserted Effect: Failure to fully document required risk assessments and to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding code 2023-035) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA review their fiscal subrecipient monitoring procedures and implement additional procedures as necessary to ensure proper monitoring procedures are performed and documentation of monitoring activities are adequately maintained. Views of ICJIA Officials: ICJIA agrees with the findings as we have additional risk assessment criteria that are established but not documented.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($78,196,419) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2023-036: Inadequate Controls over the Communication of Subrecipient Monitoring Results Condition Found: ICJIA did not consistently document supervisory reviews of the communication of on-site monitoring review results in accordance with ICJIA’s control procedures. ICJIA internal control procedures require a supervisory review and approval of program site visit reports prior to providing the results to subrecipients. During our testing of 7 on-site reviews, we noted ICJIA could not provide evidence of supervisory review of the site visit reports or communications of on-site monitoring results to subrecipients had been performed prior to the communication to the subrecipient for 5 on-site reviews tested in accordance with ICJIA’s policies. ICJIA passed through approximately $75,301,704 to subrecipients of the Crime Victim Assistance (CVA) program during the year ended June 30, 2023. Criteria or Requirement: 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include ensuring supervisory reviews of on-site monitoring results and communications are performed. Cause: In discussing these conditions with ICJIA officials, they stated the exceptions noted are due to not following the policy and procedure. Possible Asserted Effect: Failure to properly review and approve monitoring reports may result in inaccurate monitoring information and results being communicated to subrecipients. Repeat Finding: A similar finding was reported in the prior year audit as number 2022-024. (Finding Code 2023-036, 2022-024) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA review its current process for ensuring on-site monitoring results and communications are properly reviewed and approved before they are sent to the subrecipients. Views of ICJIA Officials: ICJIA accepts the recommendation. In the upcoming months, ICJIA will update its current policy and procedures to add additional controls to ensure on-site monitoring results are reviewed and approved prior to being communicated to subrecipients.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($78,196,419) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2023-037: Failure to Report Subaward Information Required by FFATA Condition Found: ICJIA failed to report subaward information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Crime Victim Assistance (CVA) program. FFATA requires the State to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee DUNS number 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During State fiscal year 2023, ICJIA did not have adequate controls in place to ensure the accuracy of the information reported and identify and report subaward amendment information required by FFATA. During our testwork of 16 subawards, we noted the following exceptions: • One subaward had an amendment that was not reported within the required timeframe. The delay in reporting the amendment was 83 days after the required timeframe. • For two subawards, the subaward obligation date was inaccurately reported. • For one subaward, the amount of the award was inaccurately reported as $606,556 instead of $635,489. ICJIA passed through approximately $75,301,704 to subrecipients of the CVA program during the year ended June 30, 2023. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to ensure all FFATA reports are accurately and timely prepared and submitted in accordance with federal regulations. Cause: In discussing these conditions with ICJIA officials, they stated ICJIA lacks a reliable automated data source that provides timely and accurate information for the timely and accurate completion of the FFATA reporting. Possible Asserted Effect: Failure to report subaward information in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2022-022. (Finding Code 2023-037, 2022-022, 2021-028) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA establish procedures and controls to identify awards and amendments subject to FFATA reporting requirements and to ensure the accuracy of the required subaward information in accordance with FFATA. Views of ICJIA Officials: ICJIA accepts the recommendation. ICJIA lacks a reliable automated process that provides timely and accurate information for timely and accurate completion of the FFATA reporting.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($1,931,585,889) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Eligibility Finding 2023-038: Failure to Follow Unemployment Insurance Eligibility Determination Policies Condition Found: IDES failed to follow established policies when making eligibility determinations for claimants of the Unemployment Insurance (UI) program. The UI program administered by IDES provides benefits to eligible individuals that are unemployed and able and available to work. IDES utilizes the Illinois Benefits Information System (IBIS) to perform and document claimant eligibility determinations, to process claims for unemployment insurance benefits, and to assist IDES in complying with the requirements of the Illinois UI Act, rules, policies, and procedures applicable to unemployment benefits. UI program eligibility requirements include, among other criteria, the following: • The individual is unemployed through no fault of their own • The individual must register with IDES employment service system IllinoisJobLink.com • The individual has been paid $1,600 or more in wages during a recent 12-month period • The individual has earned at least $400 outside of the base period quarter in which his/her earnings were the highest • The individual must be actively seeking employment and be available to work • The individual must not refuse an offer of suitable work To be eligible to receive UI benefits, a claimant completes an application either online, in-person, or over the phone. Claimant applications are processed by the IBIS system which includes a number of edit checks which must be passed in order for a claimant to be eligible to receive UI benefits. However, because of the volume of claims and suspension of certain requirements during the pandemic public health emergency, we noted IDES had disabled certain edit checks in IBIS to allow claims to process and failed to re-establish the edit checks with the conclusion of the public health emergency provisions. As a result, certain ineligible claimants were identified in our testing. Specifically, during our testing of 65 claimants who received $70,701 of UI benefits in 2023, we noted the following exceptions: • One claimant was inappropriately determined to be eligible for UI benefits when the individual should have been flagged as ineligible as the claimant was terminated from previous employment with cause, which is a disqualifying requirement. UI benefits paid to this claimant were $2,975. Further, IDES determined that there were an additional 562 instances of ineligible claimants who had a similar disqualifying factor (i.e. terminated with cause), but still received improper UI benefits. The UI benefits paid to these 562 claimants was $1,989,610. • One claimant was inappropriately determined to be eligible for UI benefits when the individual should have been flagged as ineligible as the claimant was offered suitable work, but refused employment, which is a disqualifying requirement. UI benefits paid to this claimant were $1,156. Further, IDES determined there were an additional 580 additional instances of ineligible claimants who had a similar disqualifying factor (i.e. refused offers to work), but still received UI benefits. The UI benefits paid to these 580 claimants was $3,143,332. Additionally, we noted adequate internal controls have not been established to ensure necessary changes resulting from the conclusion of pandemic related provisions are made to UI eligibility procedures in a timely manner.Benefits paid to UI claimants totaled $1,739,854,000 during the year ended June 30, 2023. Criteria or Requirement: According to the State of Illinois Unemployment Insurance Law Handbook, an individual who is discharged for misconduct with his work is ineligible for benefits for the week in which he was discharged for misconduct and thereafter until the individual has become re-employed and has had earnings equal to or in excess of their weekly benefit amount in each of four calendar weeks. Further, an individual will be ineligible for benefits if the individual has failed, without good cause, to accept suitable work when offered by the Department of Employment Security or an employing unit (i.e. business). In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure eligibility determinations are made in accordance with the UI Act. Cause: In discussing these conditions with IDES officials, they indicated these conditions occurred as a result of competing priorities with limited resources. Possible Asserted Effect: Failure to follow established policies to determine beneficiary eligibility may result in noncompliance with program regulations and payments to ineligible recipients. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-038) Recommendation: We recommend IDES review its current procedures and consider any changes necessary to ensure eligibility determinations are made in accordance with internal policy and federal regulations. Views of IDES Officials: The Agency accepts the recommendation and will work to ensure eligibility determinations are made in accordance with internal policy and federal regulations.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($1,931,585,889) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Special Tests and Provisions - UI Benefit Payments Finding 2023-039: Failure to Complete UI BAM Case File Reviews Within Required Timeframes Condition Found: IDES did not complete the Benefit Accuracy Measurement (BAM) case file reviews in accordance with United States Department of Labor (USDOL) requirements for the Unemployment Insurance (UI) program. The Payments Integrity Information Act (PIIA) of 2019 codified the requirement for valid statistical estimates of improper payments. State Workforce Agencies (SWAs) are required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is USDOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims. The BAM program estimates error rates, that is, numbers of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. To accomplish this, IDES’ BAM unit is required to select a weekly sample of payments and denied claims (known as a batch) from weeks specified by the USDOL, on which to complete prompt, and in-depth investigations to determine if the administration of the Unemployment Compensation program is consistent with state and federal law (20 CFR section 602.21(d)). USDOL has promulgated investigational requirements and instructions in ET Handbook No. 395 pursuant to 20 CFR section 602.30(a).The handbook states that for paid cases, a minimum (1) 70% of cases must be complete within 60 days of the last day of the week from which the batch was selected (2) 95% of cases must be completed within 90 days of the last day of the week from which the batch was selected and (3) 98% of cases for the calendar year must be completed within 120 days of the last date of the calendar year. In addition, a minimum of 480 cases must be complete during the calendar year. During our testwork of paid claims, we noted IDES did not achieve either of the required percentage of case reviews within the required timeframes. Specifically, for batch range 20227-202326, IDES failed to meet the 60-day time lapse standard of 70% complete as only 60.41% of case reviews were complete. Additionally, IDES failed to meet the 90-day time lapse standard of 95% complete as only 81.22% of case reviews were complete. We also noted that IDES did not notify USDOL of the failed case completion percentage requirements nor receive a waiver of the requirements from the USDOL. Further, we noted IDES has not established adequate controls to ensure BAM case file review procedures are completed within timeframes established by the USDOL. Criteria or Requirement: According to 20 CFR 602.11(d), SWAs are required to operate and maintain a quality control system. In addition, 20 CFR 602.11(a) requires States to provide such methods of administration as will reasonably ensure prompt and full payment of unemployment benefits to eligible claimants, and collection and handling of income for the State unemployment fund, with greatest accuracy feasible. In addition, according to ET Handbook No. 395, 5th Edition, IDES is required to submit BAM case file data to the USDOL when case files are complete. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal control should include ensuring adequate resources are available to meet required completion timeframes. Cause: In discussing these conditions with IDES officials, they stated that there was a redistribution staff and staff reductions that contributed to the exceptions. Possible Asserted Effect: Failure to complete BAM case file reviews in accordance with USDOL requirements results in results in noncompliance with program regulations and prevents the USDOL from effectively monitoring the State of Illinois UI program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-039) Recommendation: We recommend IDES review its procedures for completing BAM case file reviews to ensure they are completed in accordance with program regulations. Effective internal controls should include establishing and maintaining adequate resources to ensure the BAM case file reviews are completed in accordance with the required timeframes established by USDOL. Views of IDES Officials: The Agency accepts the recommendation, and the BAM department has instituted a program to help with the timeliness of case completion.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures:17.225 ($1,931,585,889) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2023-040: Inadequate Process for Preparing ETA 9130 Financial Reports Condition Found: IDES does not have an adequate process in place to ensure that the ETA 9130 financial reports prepared for the Unemployment Insurance (UI) program are complete and accurate.On a quarterly basis, IDES is required to report program and administrative expenditure information for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects, on the ETA 9130, Financial Status Report, UI Programs. Financial data is required to be reported cumulative from grant inception through the end of each reporting period. During our test work of 60 ETA 9130 reports covering the December 2022 and March 2023 quarters, we noted certain grant awards had inaccurate amounts reported for key line items for the December 31, 2022, and March 31, 2023 reporting quarters. Specifically we noted IDES inaccurately reported the following line items: "See Table in the Audit Report". IDES reported corrections to all the errors identified above in the subsequent quarterly report submissions to USDOL. We also noted IDES does not perform analytical or other procedures over previously reported information or expectations relative to current program activities. Additionally, supervisory review procedures are not designed to operate at a level of precision to identify errors of this nature. Criteria or Requirement: According to OMB Number 1205-0461, IDES is responsible for submitting a quarterly ETA 9130 report at the completion of each quarter. Each quarter should correspond to the following calendar quarter dates: March 31, June 30, September 30, and December 31. Additionally, the primary contact person, the designated authorized official in the recipient’s organization, is responsible for certifying the accuracy of the data reported to the USDOL. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal control should include procedures to ensure the completeness and accuracy of information reported in required financial reports. Cause: In discussing these conditions with IDES officials, they indicated these conditions occurred as a result of competing priorities with limited resources. Possible Asserted Effect: Failure to prepare accurate ETA 9130 reports may inhibit the USDOL from effectively monitoring the UI program. Repeat Finding: A similar finding was reported in prior year audit as finding number 2022-026. (Finding Code 2023-040, 2022-026) Recommendation: We recommend IDES review its procedures for preparing ETA 9130 financial reports required for the UI program and implement analytical and any other procedures considered necessary to ensure the reports are complete and accurate prior to submission to the USDOL. Views of IDES Officials: IDES accepts the audit finding and will work to ensure the ETA 9130 financial reports are complete and accurate by prioritizing the hiring of additional staff, reviewing procedures, looking for ways to strengthen internal controls and continuing conversation with DoIT about improving and/or modernizing reporting tools.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($1,931,585,889) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2023-041: Inadequate Process for Preparing ETA 2208A Special Report Condition Found: IDES does not have an adequate process in place to ensure the ETA 2208A special reports prepared for the Unemployment Insurance (UI) program are complete and accurate. On a quarterly basis, IDES is required to report information on staff years worked and paid by program category on the ETA 2208A – Quarterly UI Above-Base (ETA 2208A) report. The information required to be reported includes UI program staff year usage (Section A), regular contingency entitlement certification (Section B), trade above-base entitlement certification (Section C), and additional benefits above-base entitlement certification (Section D). Key line items required for testing include items one through seven in Section A. IDES has implemented procedures whereby IDES program staff prepare the quarterly reports and a supervisor reviews and approves the report prior to submission to the United States Department of Labor. During our testwork of two quarterly ETA 2208A reports, we noted the December 31, 2022, report included inaccurate amounts reported for key line items in Section A. Specifically: "See Table in the Audit Report" As of January 24, 2024, IDES had not revised the report with the USDOL. Additionally, IDES was unable to produce adequate evidence of review and approval of the December 31, 2022, report by a supervisor. Criteria or Requirement: According to ET Handbook No.336, 18th edition, IDES is required to submit complete and accurate quarterly UI above-base reports (known as ETA 2208A reports) by the first day of the second month after the quarter of reference. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal control should include procedures to ensure the completeness and accuracy of information reported in required special reports and following established policy for program staff to prepare and a supervisor to review the special reports prior to submission to the USDOL. Cause: In discussing these conditions with IDES officials, they stated the lack of evidence of review and errors were due to IDES personnel not properly documenting approval of the special reports prior to submission to the USDOL. This issue was exacerbated by staff turnover and hiring delays. Possible Asserted Effect: Failure to follow established reporting controls may result in inaccurate reports which prevents the USDOL from effectively monitoring the UI program. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2022-028. (Finding Code 2023-041, 2022-028, 2021-032) Recommendation: We recommend IDES review its procedures for preparing special reports required for the UI program and implement analytical and any other procedures considered necessary to ensure the reports are accurate prior to submission to the USDOL. Additionally, we recommend IDES ensures the preparation and review of special reports prior to submission to the USDOL is documented in accordance with established policies and procedures. Views of IDES Officials: The Agency accepts the recommendation. Between March and July 2024, IDES hired a budget director and two full-time budget staff, enabling implementation of checks and balances to review reports before they are submitted. IDES has also assessed its procedures for compiling the reports to verify that procedures are appropriate to produce accurate and timely reports.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($1,931,585,889) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: None Finding 2023-042: Inaccurate Reporting of Federal Expenditures Condition Found: IDES did not accurately report Federal expenditures under the Unemployment Insurance (UI) program. Federal expenditures reported to the Illinois Office of Comptroller (IOC) which were used to prepare the schedule of expenditure of federal awards (SEFA) did not agree to IDES’ financial records provided for audit. Specifically, we noted the following differences between amounts provided for audit by IDES and the SEFA amounts reported to the IOC for the Unemployment Insurance program for the year ended June 30, 2023: "See Table in the Audit Report". Finally, we noted IDES’ controls over reporting federal expenditures were not designed at a sufficient level of precision to ensure timely, complete, and accurate SEFA reporting. Criteria or Requirement: According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statements which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. Among other things required by 2 CFR 200.510(b), the SEFA must include the total amount provided to subrecipients from each Federal program. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures are accurately reported on the SEFA. Cause: In discussing the error with IDES officials, they stated during the Financial Audit, it was determined IDES needed two adjustments to their financial statements. These adjustments affected the SEFA expenditures. The first adjustment concerning the financial statements was caused by the bank's calculation of the nightly sweep for the collateralization of our funds at INB. The bank's instructions for the nightly sweep calculation did not match the bank's actual sweep and the difference appeared like NSF returns. The second adjustment concerning the financial statement was caused by the under reporting of the Combined Wage Claims. In addition, IDES included State spending within Federal expenditures on the SEFA in error, causing an overstatement of Federal expenditures. This resulted from following pre-pandemic procedures and reports that did not contemplate the State spending of administrative funds on Federal programs. Possible Asserted Effect: Failure to accurately report federal expenditures prohibits the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal funding. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-042) Recommendation: We recommend IDES establish procedures to accurately report federal expenditures used to prepare the SEFA to the IOC. Views of IDES Officials: The Agency accepts the recommendation. The Agency is updating the way it prepares the Trust Fund GAAP package to avoid these types of adjustments and/or audit findings in the future.

State Agency: Illinois Department of Transportation (IDOT) Federal Agency: U.S. Department of Transportation Program Name: COVID-19 – Airport Improvement Program ALN and Program Expenditures: 20.106 ($96,207,991) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2023-043: Failure to Report Subaward Information Required by FFATA Condition Found: IDOT failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Airport Improvement Program. FFATA requires the State to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee DUNS number 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers IDOT passed through approximately $95,884,759 to subrecipients of the Airport Improvement Program during the year ended June 30, 2023. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Regulation (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include complying with FFATA. Cause: In discussing these conditions with IDOT officials, IDOT stated missing FFATA reporting was due to staffing transition combined with a lack of appropriate staffing resources. Possible Asserted Effect: Failure to identify awards subject to FFATA and to report subaward in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2022-029. (Finding Code 2023-043, 2022-029, 2021-036) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOT establish procedures to identify awards subject to FFATA reporting requirements and report required subaward information in accordance with FFATA. Views of IDOT Officials: IDOT agrees with the finding and recommendation. Within the last reporting period, the Contracts Section was without adequate staff.

State Agency: Illinois Department of Transportation (IDOT) Federal Agency: U.S. Department of Transportation Program Name: COVID-19 – Airport Improvement Program ALN and Program Expenditures: 20.106 ($96,207,991) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2023-044: Inaccurate Information Included in the Financial Reports Condition Found: IDOT did not prepare accurate federal financial status reports for the Airport Improvement Program (AIP). IDOT is required to prepare a federal financial status report (SF-425) submitted annually for each open grant, due 90 days after the end of each Federal Aviation Administration’s (FAA) fiscal year, by sponsors to monitor outlays and program income on a cash or accrual basis. In addition, this report must be submitted as a final financial report during grant closeout. Further, IDOT is required to submit an Outlay Report and Request for Reimbursement for Construction Program (SF-271) for each construction project, due 90 days after the end of the FAA’s fiscal year, by sponsors to summarize requests for reimbursements. This report must also be submitted as a final financial report during closeout. During our testwork over the annual SF-425 and related SF-271 reports submitted for the federal fiscal year September 30, 2022, we noted the following errors: "See Table in the Audit Report". We further noted the supervisory review procedures performed for this report were not at an appropriate level of precision to identify the errors identified in our testing. Additionally, IDOT does not perform analytical procedures to identify potential errors or unusual fluctuations in reported amounts. Criteria or Requirement: According to the SF-425 report Box 13 for certification, recipients of AIP grants must submit true, complete, and accurate information on the SF-425 reports. Further, according to the SF-271 report Box 12 for certification, recipients of AIP grants must certify that the billed costs or disbursements reported are in accordance with the terms of the project and that the reimbursement represents the Federal share due which has not been previously requested and that all work is in accordance with the terms of the award. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure information reported in required financial reports is accurate Cause: In discussing these conditions with IDOT officials, IDOT stated the preparation of the reports is a manual process and the difference was due to human error. Possible Asserted Effect: Failure to accurately prepare financial reports prevents USDOT from effectively monitoring the Airport Improvement Program Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-044) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOT review the process and procedures in place to prepare financial status reports required for the Airport Improvement Program and implement the additional procedures necessary to ensure the reports are complete, accurate, and agree or reconcile to its financial records. Views of IDOT Officials: IDOT agrees with the finding and recommendation. This Annual Report occurred at a time when the State of Illinois was shut down for COVID, in addition the Contracts Section was without adequate staffing. The Bureau Chief attempted to complete the annual report on her own as her and the Grant Administrator were attempting to meet all federal requirements for the Section.

State Agency: Illinois State Board of Education (ISBE) Federal Agency: U.S. Department of Education Program Name: Twenty-First Century Community Learning Centers (21st Century) ALN and Program Expenditures: 84.287 ($77,436,583) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2023-045: Inadequate Monitoring of 21st Century Subrecipients Condition Found: ISBE did not adequately monitor and document program monitoring procedures performed over subrecipients of the Twenty-First Century Community Learning Centers (21st Century) program. The 21st Century program operates to provide State educational agencies and local educational agencies with funding specific to rural and inner-city public schools. To monitor the 21st Century program activities performed by Illinois elementary and secondary schools, ISBE has established Tier I, Tier II, and Tier III monitoring activities which are applied to each subrecipient depending upon the annual risk score determined by ISBE. ISBE’s 21st Century program subrecipient monitoring manual outlines the risk assessment procedures to determine the tier of monitoring required, the methods used for tier determination, and documentation required for each tier of monitoring. Tier I subrecipient monitoring procedures apply to all subrecipients, with no consideration of the risk assessment score they have received, and consist of a twice-a-year call in which ISBE personnel discuss enrollment and registration statistics, progression towards goals specific to the district, and budgetary changes. A notification email is sent twice a year, alerting the subrecipient that a call is required to be scheduled. Once the call is scheduled, a call form detailing the responses to the discussion points is completed by ISBE personnel during the call to document the call was conducted and any matters for follow up. Tier II applies to the subrecipients who receive a moderate risk assessment score. These procedures consist of a desk review over program compliance, goal attainability specific to the subrecipient, and quality programming. Similar to Tier I, a notification email is initially sent, alerting the subrecipient that a desktop review is going to occur. During the review, a standardized checklist is completed, outlining the documentation provided by the subrecipient to address each portion of review. ISBE documents the completion of its desk review procedures with a letter to the subrecipient communicating any noncompliance and requesting corrective action, if applicable. Any required corrective action plans are reviewed and formally accepted by ISBE in a letter to the subrecipient. Tier III applies to subrecipients who receive a high risk assessment score and consists of an on-site review including interviews with the project director and site coordinators, and observations of the academics and academic enrichment taking place at each site. ISBE personnel complete monitoring checklists to document the completion of its on-site procedures and a summary checklist is completed after the on-site visit to summarize all areas of noncompliance. A letter is sent to the subrecipient communicating the completion of the on-site review and any noncompliance identified, and requesting corrective action, if applicable. Any required corrective action plans are reviewed and formally accepted by ISBE in a letter to the subrecipient. During the year ended June 30, 2023, ISBE passed through 21st Century program funding (totaling $75,983,860) to 139 subrecipients. During our testing of 21st Century program monitoring, we noted ISBE did not follow its subrecipient monitoring procedures during the year ended June 30, 2023. In several instances, documentation supporting monitoring procedures or conclusions was not retained or prepared. In other instances, monitoring documentation was missing required checklists, reports, corrective action plans, or evidence of supervisory review procedures. The following is a summary of the exceptions identified in our testing: "See Table in the Audit Report". We also noted that ISBE’s controls for monitoring are not designed at an appropriate level of precision to ensure monitoring of subrecipients is completed as required. Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. According to 2 CFR section 200.332(b), a pass-through entity must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing supervisory procedures at an appropriate level of precision to ensure adequate monitoring is performed and documentation is maintained. Cause: In discussing these conditions with ISBE officials, they stated the inability to provide required documentation is attributable to staff turnover as those responsible for these monitoring activities have since left ISBE. Possible Asserted Effect: Failure to perform required monitoring procedures and maintain documentation may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and grant agreements. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-045) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ISBE establish policies and procedures to ensure programmatic monitoring is performed and appropriately documented. Views of ISBE Officials: Management agrees with the finding and has begun to develop processes and structures to correct it.

State Agency: Illinois State Board of Education (ISBE) Federal Agency: U.S. Department of Education Program Name: Education and Stabilization Fund – Elementary and Secondary Education (ESF) ALN and Program Expenditures: 84.425 ($2,227,152,891) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2023-046: Untimely Review of Subrecipient Performance Reports Condition Found: ISBE did not review subrecipient performance reports in a timely manner according to its program monitoring policies and procedures for subrecipients of the Education and Stabilization Fund - Elementary and Secondary Education (ESF) program for fiscal year 2023. The ESF program operates to provide State educational agencies and local educational agencies with emergency relief funds to address the impact that COVID-19 has had, and continues to have, on elementary and secondary schools across the nation. To monitor the ESF program activities performed by Illinois elementary and secondary schools, ISBE requires a performance report to be prepared on a semi-annual basis. The semi-annual performance report includes information on the accomplishment of deliverables described in the grant, the status of performance measures, and the alignment of accomplishments with spending to date. ISBE’s monitoring policies and procedures require these reports to be reviewed within 14 days of receipt to ensure program activities and program results are consistent with program requirements. During our testing of ESF program performance reports submitted by 41 subrecipients (with expenditures of $838,616,073 during the year ended June 30, 2023), we noted performance reports submitted by 24 subrecipients (with expenditures of $129,209,951) were not reviewed by program personnel within 14 days of receipt in accordance with ISBE’s policies. Delayed review of the reports ranged from 4 to 113 past the requirement. "See Table in the Audit Report". ISBE passed through approximately $2,166,525,604 to subrecipients of the ESF program during the year ended June 30, 2023. Criteria or Requirement: According to 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring program procedures and reviews are performed in a timely manner. Cause: In discussing these conditions with ISBE officials, they stated the delays in performing these reviews are attributable to the limited capacity of ISBE monitoring personnel as the responsibilities of existing program monitoring staff were expanded to accommodate the additional programs. Possible Asserted Effect: Failure to timely review subrecipient semi-annual performance reports may result in untimely identification of subrecipients not properly administering federal program requirements in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2023-046) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ISBE ensure proper review procedures are performed in a timely manner in accordance with its program monitoring policies and procedures. Views of ISBE Officials: We agree with the finding. To ensure proper review procedures are performed in a timely manner in accordance with its program monitoring policies and procedures, the agency is sending weekly lists of submitted, past due and disapproved Grant Periodic Reports (GPRS) to each applicable department. The Title Grant Administration Department analyzes the ARP -LEA American Rescue Plan (ESSER III 4998-E3 GPRS) reports and prioritizes reviews based on submission dates. The Title Grant Administration Department also has trained team members to assist with the review process.

State Agency: Illinois Student Assistance Commission (ISAC) Federal Agency: U.S. Department of Education (USDE) Program Name: Federal Family Education Loans – Guaranty Agencies ALN and Program Expenditures: 84.032G ($2,171,012,437) Federal Award Numbers: None Federal Award Year: July 1, 2021 to June 30, 2022 Questioned Costs: None Compliance Requirement: Reporting Special Tests and Provisions - All Finding 2022-002: Inability to Implement Dear Colleague Letter Type of Finding: Disclaimer of opinion and material weaknessCondition Found: ISAC was unable to implement all required elements of the Dear Colleague Letter GEN-21-03 for loans serviced under the Federal Family Education Loans – Guaranty Agencies (FFEL) program due to system limitations. On May 12, 2021, USDE issued Dear Colleague Letter (DCL) GEN-21-03, with an update on May 24, 2021 titled “Expansion of Collections Pause to Defaulted FFEL Program Loans Managed by Guaranty Agencies.” The purpose of DCL GEN-21-03 was to help borrowers burdened by debt during the COVID- 19 emergency. DCL GEN-21-03 had a significant impact on guaranty agency operations, including the following: • Interest was required to be retroactively reduced to zero percent back to March 13, 2020 through May 1, 2022. • Guaranty agencies were not allowed to charge and retain collection cost for loan rehabilitation, and for those rehabilitations which occurred during the period, the guarantor was required to make adjustments on the account before it was transferred to the new holder for interest and collection cost charged. • Guaranty agencies were allowed to charge 2.8% collection cost to borrowers for consolidation loans, which represented a change from 18.5%, and any previous charges were required to be refunded to the Direct Loan consolidating servicer to adjust the borrower accounts. • Guaranty agencies were required to make adjustments to interest and involuntary payments to loans which defaulted on/after March 13, 2020; these loans were required to be transferred to USDE under Special Mandatory Assignment. • Guaranty agencies may transfer funds from the Federal Fund to the Operating Fund without prior permission from USDE to reimburse themselves for lost revenue and to make refunds to borrowers. Guaranty agencies who received additional funds from USDE were required to report that activity on their Annual Report.As a direct result of the requirements established upon issuance of the DCL GEN-21-03, on July 29, 2021, ISAC notified USDE of its request to terminate its operations as a guaranty agency of the FFEL program. On September 22, 2021, USDE approved ISAC’s request for termination as a guaranty agency of FFEL, and also informed ISAC of its decision to designate an unrelated third party to act as the guarantor for the State of Illinois. Effective May 1, 2022, the FFEL loan portfolio was transitioned to the third party loan servicer. Although the loan portfolio was transitioned to a third party to act as guaranty agency, ISAC was responsible to service the outstanding FFEL loan portfolio and maintain compliance with USDE requirements through the May 1, 2022 transition date. Through discussions with ISAC officials, given the limitations of its legacy guaranty system, ISAC was unable to set interest rates for outstanding loans to 0% as required by the DCL. Further, given the loan portfolio was transferred to the third party servicer on May 1, 2022, we were unable to test ISAC’s compliance with requirements that are direct and material to the FFEL program. The outstanding FFEL loan balance at July 1, 2021 for which ISAC was required to service and maintain compliance during the State fiscal year ended June 30, 2022 was $2,035,226,000. Criteria or Requirement: Dear Colleague Letter GEN-21-03 imposes certain requirements that Guaranty Agencies were to implement into their operations, including actions on borrower communications, interest rates, involuntary collections, voluntary payments, collection attempts, loan rehabilitation and eligibility reinstatement, credit reporting, default aversion and default claims, National Student Loan Data System (NSLDS) reporting, mandatory assignment, consolidations, order of transactions, reimbursement of lost revenue, and waivers. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure all elements of the Dear Colleague Letter GEN-21-03 are implemented. Cause: In discussing these conditions with ISAC officials, they stated certain requirements of the DCL were not implemented due to limitations with its legacy guaranty system. Possible Asserted Effect: ISAC’s inability to implement all the requirements of the Dear Colleague Letter GEN-21-03 prior to the transition date results in noncompliance with USDE requirements. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2022-002) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: With the transition of the loan portfolio to a third party guaranty agency, we recommend ISAC work with USDE to finalize closeout of the FFEL program. Views of ISAC Officials: ISAC converted its FFEL loan population to a new guarantor. As part of the conversion, all remedies required by the DCL were identified and completed either prior to the loans being transferred or once they were uploaded by the new guarantor. ISAC and the successor guarantor scrubbed the data and the successor guarantor ensured that on May 1, 2022 all balances were correct. The US Department of Education was involved in all the bi-weekly meetings with ISAC and the successor guarantor and upon conversion agreed that all steps were correctly handled. The final federal reporting was completed and all reconciliations accepted by the US Department of Education as of May 11, 2023. ISAC received the approval to transfer close the federal fund back and transfer the balance to the US Treasury to officially exit the FFEL program. No further action was required.

State Agency: Illinois Department of Revenue (IDOR) Federal Agency: U.S. Department of Treasury (Treasury) Program Name: COVID-19 – Homeowner Assistance Fund ALN and Program Expenditures: 21.026 ($209,795,189) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: None Compliance Requirement: Cash Management Finding 2022-003: Failure to Monitor Subrecipient Cash Draws Type of Finding: Adverse opinion and material weaknessCondition Found: IDOR passed through most of the advance drawn funds to its subrecipient while reporting no activity had occurred for the COVID–19 – Homeowner Assistance Fund (HAF) program in the special report prepared during fiscal year 2022. The State designated IDOR as the State agency responsible for fiscal activities of the COVID-19 – HAF program. IDOR passed funding through to the Illinois Housing Development Authority (IHDA) (a component unit of the State) who works directly with program beneficiaries (eligible homeowners or subrecipients). During our audit procedures, we noted the State received $211,309,688 of COVID-19 – HAF program funding from the U.S. Treasury in January 2022. At the time of the January 2022 cash receipt, we noted IDOR had passed through $32,886,765 to IHDA. During our review of subrecipient payments (totaling $209,795,189) made to IHDA during the year ended June 30, 2022, we noted IHDA had only reported expenditures of $6,901,019 during the year ended June 30, 2022. Accordingly, IDOR had provided HAF program advances totaling $202,894,170 during the year ended June 30, 2022. IDOR did not have procedures in place to monitor whether IHDA had incurred or would be incurring program expenditures to minimize federal cash on hand. Additionally, the State prepared and submitted a one-time special report (Interim Report 1505-0269) that covered the reporting period beginning on the date of the COVID-19 – HAF program award (May 3, 2021) through January 31, 2022. The key line items in the special report included the following: • Number of unique Homeowners that received HAF assistance and subset(s) that are classified as Socially Disadvantaged and 100 percent Area Median Income (AMI) or less • Homeowners that received HAF assistance disaggregated by Program Design Element • Amount of assistance provided to Homeowners disaggregated by Program Design Element During our testing of the COVID-19 – HAF program special report, we noted the State did not report activity data for any of the key line items. Total subrecipient expenditures for the HAF program administered by the State were $209,795,189 during the year end June 30, 2022.Criteria or Requirement: Pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the federal award to the recipient (2 CFR section 200.305(b)(1)). In addition, 2 CFR 200.303 requires non-federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing procedures to minimize the time elapsing between the transfer of funds to subrecipients and the subrecipient’s actual cash outlay for program costs. Cause: The State’s relationship with IHDA is a multi-agency initiative. IDOR’s role has historically been statutorily limited to funding agent. This role does not include expenditure monitoring or reporting responsibilities. There was confusion in fiscal year 2022 regarding which state agency would perform these tasks for the COVID grant money awarded to IHDA. Possible Asserted Effect: Failure to monitor whether subrecipients minimize the time between the receipt of federal funds and expenditure for program purposes may result in advance funding in excess of immediate cash needs. Additionally, failure to properly report program activities in required special reports inhibits the U.S. Treasury from properly monitoring program activities and progress. Repeat Finding: A similar finding was not reported in a prior year audit. (Finding Code No. 2022-003) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOR implement procedures to monitor subrecipients to ensure funds are requested only for expenditures which have been incurred or will be incurred within a reasonable time period to minimize federal cash on hand. Additionally, the State should implement procedures to ensure the COVID-19 – HAF program special report completely and accurately describes required program activities. Views of IDOR Officials: The IHDA Act was updated to allow IDOR to disburse COVID money. However, the language for the tasks to be performed by the funding agent was left unchanged. This ambiguity along with the reporting IHDA does to other agencies contributed to confusion regarding which agency was responsible for the grant expenditure monitoring and reporting. IDOR pursued legislative clarification. This resulted in the decision to transition the funding agent role to DHS.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of the Treasury (Treasury) Program Name: COVID-19 – Homeowner Assistance Fund ALN and Program Expenditures: 21.026 ($209,795,189) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Subrecipient Monitoring Finding 2022-004: Failure to Establish Subrecipient Monitoring Procedures Type of Finding: Adverse opinion and material weaknessCondition Found: IDHS did not perform a risk assessment or subrecipient monitoring procedures for the subrecipient of the COVID-19 – Homeowner Assistance Fund (HAF) program for the year ended June 30, 2022. The State designated IDHS as the State agency responsible for monitoring of the HAF program subrecipient, Illinois Housing Development Authority (IHDA), a discretely presented component unit of the State. As a pass-through entity, IDHS was responsible for: • Identifying the award and applicable requirements, • Evaluating IHDA’s risk of noncompliance for purposes of determining the appropriate monitoring procedures related to the subaward, • Monitoring the activities of IHDA as necessary to ensure the subaward is used for authorized purposes, IHDA complies with the terms and conditions of the subaward, and IHDA achieves performance goals, and • Issuing a management decision for audit findings pertaining to the federal award provided to IHDA, if applicable. During our testing, we noted IDHS did not perform any subrecipient monitoring procedures over IHDA with respect to the HAF program during the year ended June 30, 2022. Amounts passed through to IHDA totaled $209,795,189 for the year ended June 30, 2022. Criteria or Requirement: According to 2 CFR 200.332(b), a pass-through entity must evaluate each subrecipient's risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. According to 2 CFR 200.332(d), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. 2 CFR 200.332(d)(3) requires pass-through entities to issue management decisions for applicableaudit findings pertaining to the federal awards provided to the subrecipient and 2 CFR 200.332(d)(4) requires pass through entities to resolve audit findings through corrective action plans (CAP). In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing and performing monitoring procedures in accordance with Uniform Guidance and program requirements. Cause: In discussing these conditions with IDHS officials, management stated this program is administered in collaboration with the Illinois Department of Revenue, the Illinois Emergency Management Agency (IEMA), the Governor’s Office of Management and Budget, and the Illinois Housing Development Authority (a component unit of the State). Delays encountered in launching the program resulted in a delay in executing interagency agreements to establish roles and responsibilities for the program. Possible Asserted Effect: Failure to perform required risk assessments and to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2022-004) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS implement subrecipient monitoring procedures in accordance with federal regulations. Views of IDHS Officials: IDHS accepts the recommendation. IDHS has subrecipient monitoring procedures and has kicked off subrecipient monitoring with IHDA on the Homeowners Assistance Fund program.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S Department of Agriculture (USDA) U.S. Department of Health and Human Services (USDHHS) Program Name: SNAP Cluster Temporary Assistance for Needy Families ALN and Program Expenditures: 10.551/10.561 ($5,801,570,781) 93.558 ($606,030,110) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Eligibility, Special Tests and Provisions – Child Support Non- Cooperation, Special Tests and Provisions – Penalty for Refusal to Work, and Special Tests and Provisions – ADP System for SNAP Finding 2022-005: Missing Documentation in Beneficiary Files Type of Finding: Material noncompliance and material weakness Condition Found: IDHS could not locate case file documentation supporting eligibility determinations and special test requirements for beneficiaries of the SNAP Cluster and/or Temporary Assistance for Needy Families (TANF) program. Details of the beneficiary payments selected in our samples for the SNAP and TANF programs are as follows: During our test work, we selected eligibility files to review for compliance with eligibility requirements of the related benefits provided. Specifically, in 1 of 50 TANF/SNAP cases (with a payment sampled of $239), IDHS did not obtain the beneficiary’s assignment of rights to the State. TANF cash assistance paid to this beneficiary during the year ended June 30, 2022 was $2,656. During our test work, we also selected Child Support Non-Cooperation (Non-Cooperation) files to review for compliance with the respective special tests and provisions. We noted in 6 of 40 TANF Non- Cooperation special test cases, IDHS could not provide evidence that notice for good cause non-cooperation was obtained, or subsequent timely action on the case was taken once the case was determined noncooperating. TANF cash assistance paid to these beneficiaries during the year ended June 30, 2022 totaled $40,670. During our test work, we also selected Penalty for Refusal to Work (Refusal to Work) files to review for compliance with the respective special tests and provisions. We noted in 9 of 40 TANF Refusal to Work cases, IDHS could not provide evidence that a responsibility service plan (RSP) was obtained and signed by the beneficiary. Further we noted that the control to ensure the RSPs are collected (i.e. completeness) in accordance with policy is not effectively designed. TANF cash assistance paid to these beneficiaries during the year ended June 30, 2022 totaled $33,881. Criteria or Requirement: According to 42 USC 602(a)(1)(B)(iii) (the State Plan for TANF/SNAP), IDHS is required to determine client eligibility in accordance with eligibility requirements defined in the approved State Plans. The TANF State Plan amended April 1, 2020, Section L Personal Responsibility, requires all adults and minor parents applying for or receiving assistance with be required to sign a Responsibility and Services Plan (RSP) and follow through with its provisions. TANF/SNAP State Plan also required an application to be completed to apply for assistance. For non-cooperation, if an individual is not cooperating with the state establishing paternity or enforcing a support order with respect to a child of the individual, the state much apply a sanction or deny assistance (45 CFR sections 264.30). For refusal to work, the State must reduce or terminate the assistance payable to the family if an individual in a family receiving assistance refuses to work, subject to any good cause or other exemptions established by the State (42 USC 609(a)(14); 45 CFR sections 261.14, 261.16, and 261.54). In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include maintaining adequate controls over beneficiary eligibility case files to ensure all required documentation is received and appropriate sanctions applied. Cause: In discussing these conditions with IDHS officials, management stated that the exceptions noted were due to oversight to secure or upload supporting documentation adequately and to follow up on notices of noncooperation or good cause for refusal to work. Possible Asserted Effect: Failure to maintain RSPs, applications, or other eligibility documentation may result in inadequate documentation of a recipient’s eligibility and in federal funds being awarded to ineligible beneficiaries. Payments beyond the eligibility period can result in unallowable costs. Inability to demonstrate if a sanction has been appropriately applied also may result in federal funds being awarded to an ineligible beneficiary. Repeat Finding: A similar finding was reported in prior year audit as finding number 2021-011. (Finding Code 2022-005, 2021-011, 2020-010, 2019-005, 2018-004, 2017-004, 2016-004, 2015-004, 2014-004, 2013-004, 12-04, 11-04, 10-06, 09-06, 08-08, 07-19, 06-16, 05-30, 04-18, 03-20, 02-26, 01-15) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its current process for collecting and maintaining TANF/SNAP eligibility support and documentation to support the appropriate TANF application of sanctions. Views of IDHS Officials: IDHS accepts the recommendation. IDHS will work to ensure support for all eligibility items are properly retained in the record.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 93.959 ($81,408,580) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Matching, Level of Effort, Earmarking Finding 2022-006: Failure to Provide Adequate Documentation for the SAPT MOE Requirement Type of Finding: Material noncompliance and material weakness Condition Found: IDHS was unable to provide adequate documentation to substantiate the maintenance of effort (MOE) requirements were met for the Block Grants for Prevention and Treatment of Substance Abuse (SAPT) program for award year 2020 that closed during State fiscal year 2022. As a condition of receiving federal funding under the SAPT program, USDHHS requires the State to maintain the level of State and locally funded expenditures for substance abuse prevention and treatment activities at an amount that is at least equal to the average level of these same amounts for the prior two years. During the current fiscal year, we noted IDHS was required to maintain aggregate State expenditures for State fiscal year June 30, 2020 (SFY20) of $128,854,228. IDHS reported actual aggregate State expenditures for State fiscal year June 30, 2020 of $159,761,708. However, included in the total MOE reported expenditures were $94,207,294 of managed care organization (MCO) billings in SFY20. The MCO billings represented MCO encounter data amounts, and IDHS could not provide evidence or reconcile MCO encounter data to actual State paid expenditures. Accordingly, these expenditures are not allowable for purposes of meeting the maintenance of effort requirement. IDHS appears to be approximately $63 million short of the $129 million MOE requirement. Criteria or Requirement: According to 45 CFR 96.30(a), the fiscal control and accounting procedures of the State must be sufficient to permit tracing funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of the statute authorizing the block grant. Further, 45 CFR 96.134(a) states with respect to the principal agency of a State for carrying out authorized activities, the agency shall for each fiscal year maintain aggregate State expenditures by the principal agency for authorized activities at a level that is not less than the average level of such expenditures maintained by the State for the two-year period preceding the fiscal year for which the State is applying for the grant. In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing procedures to ensure MOE requirements are achieved with allowable expenditures.Cause: In discussing these conditions with IDHS officials, management stated IDHS believed its methodology was compliant and was awaiting a decision from USDHHS on this matter. Possible Asserted Effect: Failure to maintain required State expenditure levels for MOE and maintain adequate supporting documentation to support expenditures used to meet the MOE requirements results in noncompliance with program requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2021-012. (Finding Code 2022- 006, 2021-012, 2020-012, 2019-009, 2018-007, 2017-008, 2016-008, 2015-009, 2014-010) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its process for identifying allowable expenditures to achieve the SAPT MOE, including receiving input from the Substance Abuse and Mental Health Services Administration (SAMHSA) regarding the applicability of MCO encounter data expenditures. Views of IDHS Officials: IDHS accepts the recommendation. IDHS received confirmation on November 8, 2023, that they may not continue to use Encounter Data to meet the MOE requirement unless they can demonstrate that they can trace the use of those funds to the level of expenditure and ensure the use of those funds do not violate the restrictions and prohibitions of the statute authorizing the block grant. IDHS will seek SAMHSA approval of an alternate MOE methodology that does not include encounter data. IDHS will confirm the process for amending previous MOE numbers reported and submit any required waivers to SAMHSA.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families Cluster CCDF Cluster Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 93.558 ($585,590,187) 93.575/93.596 ($910,712,554) 93.959 ($81,408,580) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Reporting Finding 2022-007: Failure to Report Subaward Information Required by FFATA Type of Finding: Material noncompliance and material weakness Condition Found: IDHS failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Temporary Assistance for Needy Families (TANF), CCDF Cluster (Child Care), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. FFATA requires the State to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee DUNS number 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that IDHS did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. During our testwork of 59 subawards and 78 amendments, we noted the following exceptions: IDHS’ subrecipient expenditures under the federal programs for the year ended June 30, 2022 were approximately as follows: Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a publicfacing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include complying with FFATA. Cause: In discussing these conditions with IDHS officials, management stated the exceptions noted are due to inaccuracies in the manual entry of subawards, and not all awards were being identified through the existing information process flow. The Division of Substance Use, Prevention, and Recovery (SUPR) stated that there was not adequate staff for reporting and a misunderstanding of how often reporting was required. Possible Asserted Effect: Failure to identify awards subject to FFATA and to report subawards in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding numbers 2021-014 and 2021-015. (Finding Code 2022-007, 2021-014, 2021-015) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures to identify awards subject to FFATA reporting requirements and report required subaward information in accordance with the FFATA. Views of IDHS Officials: IDHS accepts the recommendation. IDHS is continuing to establish automated procedures to identify all awards that are subject to FFATA reporting requirements and to report required subaward information in accordance with the FFATA.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families Cluster CCDF Cluster Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 93.558 ($585,590,187) 93.575/93.596 ($910,712,554) 93.959 ($81,408,580) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Subrecipient Monitoring Finding 2022-008: Failure to Follow Established Program Subrecipient Monitoring Procedures Type of Finding: Material noncompliance and material weakness Condition Found: IDHS did not follow its established program monitoring policies and procedures for subrecipients of the Temporary Assistance for Needy Families (TANF) Cluster, CCDF Cluster (Child Care), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. IDHS has implemented procedures whereby program staff perform periodic program on-site and desk reviews of IDHS subrecipient compliance with regulations applicable to the federal programs administered by IDHS. Generally, these reviews are formally documented and include the issuance of a report of the review results to the subrecipient summarizing the procedures performed, results of the procedures, and any findings or observations for improvement noted. IDHS’s policies require the subrecipient to respond to each finding by providing a written corrective action plan. Additionally, IDHS program staff perform reviews of expenditure reports submitted by subrecipients. IDHS subrecipient monitoring procedures are subject to the review and approval of a supervisor. During our test work over program on-site review procedures performed for 59 subrecipients of the TANF Cluster, CCDF Cluster, and SAPT programs, we noted IDHS did not follow its established program monitoring procedures as follows: IDHS did not provide timely notification (within 60 days) of the results of the programmatic onsite reviews. We noted the following exceptions: IDHS did not complete their quality review on a timely basis (within 60 days). We noted the following exceptions: Additionally, for 1 of 28 SAPT subrecipient expenditures sampled, IDHS could not provide supporting documentation that reconciled to the sampled amount. IDHS’s subrecipient expenditures under the federal programs for the year ended June 30, 2022 were approximately as follows: Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. According to 2 CFR 200.332(b), a pass-through entity must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring on-site program procedures and expenditure reviews are performed in a timely manner and adequate documentation is maintained. Cause: In discussing these conditions with IDHS officials, management stated that the program monitoring deficiencies noted are due to misplaced or misfiled documentation, untimely monitoring, inadequate staffing, and lack of consistent application in each program division. Possible Asserted Effect: Failure to adequately perform and document program on-site monitoring reviews of subrecipients and notify subrecipients of findings in a timely manner may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Failure to properly review subrecipient expenditures may result in inaccurate payments or unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2021-017. (Finding Code 2022- 008, 2021-017, 2020-015, 2019-013, 2018-012, 2017-013, 2016-012, 2015-011, 2014-008, 2013-009, 12- 07, 11-09) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS ensure programmatic on-site and expenditure report reviews are performed and documented for subrecipients in accordance with established policies and procedures. In addition, we recommend IDHS review its process for reporting and following up on program findings relative to subrecipient on-site reviews to ensure timely corrective action and quality control is taken. Views of IDHS Officials: IDHS accepts the recommendation. IDHS will seek to ensure programmatic monitoring reviews are performed and accurately documented for subrecipients in accordance with established policies and procedures.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: CCDF Cluster ALN and Program Expenditures: 93.575/93.596 ($941,280,574) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: $7,699,780 Compliance Requirement: Special Tests and Provisions – Child Care Provider Eligibility for American Rescue Plan Act Stabilization Funds Finding 2022-009: Failure to Obtain Required Certifications for Child Care Providers Receiving American Rescue Plan Act Stabilization Funds Type of Finding: Material noncompliance and material weakness Condition Found: IDHS did not obtain the required certifications at the time of application for certain providers of the CCDF (Child Care) Cluster receiving American Rescue Plan (ARP) Act stabilization funds. Child care providers must provide the following certifications to receive ARP Act stabilization funding under the Child Care Cluster: 1. The provider will, when open and providing services, implement policies in line with guidance and orders from corresponding state, territorial, tribal, and local authorities and, to the greatest extent possible, implement policies in line with guidance from the Centers for Disease Control (CDC). 2. For each employee, the provider must pay at least the same amount in weekly wages and maintain the same benefits for the duration of stabilization funding. 3. The provider will provide relief from copayments and tuition payments for families enrolled in the provider’s program, to the extent possible, and prioritize such relief for families struggling to make either type of payment. During our test work over 40 child care providers receiving ARP Act stabilization funds (totaling $545,843,265), we noted IDHS could not provide the required certifications for ARP Act stabilization funds for 39 providers who are noted as ‘license-exempt’ providers by IDHS. Upon further review, we noted IDHS did not obtain certifications for any ‘license-exempt’ providers. Child Care ARP Act Stabilization funds passed through to license-exempt providers totaled $7,699,780 during the year ended June 30, 2022. IDHS passed through a total of $553,500,145 of Child Care ARP Act stabilization funds for the year ended June 30, 2022. Criteria or Requirement: ARP Act Section 2202(d)(2)(D) requires the State to make available on its website an application for qualified child care providers that includes the certifications above. Additionally, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring child care providers who receive ARP Act stabilization funds meet the eligibility criteria and provide all required certifications at the time of application. Cause: In discussing these conditions with IDHS officials, management stated the reason certifications /attestations were not collected for these providers was because they are License-Exempt Family Child Care providers who receive scheduled health and safety monitoring and procedures were not established to obtain certifications from child care providers receiving ARP Act stabilization funds. Possible Asserted Effect: Failure to obtain required certifications for child care providers receiving ARP Act stabilization funds may result in inadequate documentation of a provider’s eligibility under ARP Act and in federal funds being awarded to ineligible providers. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2022-009) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures for verifying provider eligibility under ARP Act Stabilization funds, including ensuring all child care providers provide the required certifications. Views of IDHS Officials: IDHS accepts the recommendation. IDHS will establish procedures for verifying provider eligibility under ARP Act Stabilization funds, including ensuring all Child Care providers provide the required certifications.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S Department of Agriculture (USDA) U.S. Department of Health and Human Services (USDHHS) Program Name: Supplemental Nutrition Assistance Program Cluster Coronavirus State and Local Fiscal Recovery Funds Temporary Assistance for Needy Families Cluster CCDF Cluster Medicaid Cluster Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 10.551/10.561 ($5,801,570,781) 21.027 ($4,895,262,395) 93.558 ($606,030,110) 93.575/93.596 ($941,280,574) 93.775/93.777/93.778 ($18,817,832,850) 93.959 ($81,408,580) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: Cannot be determined Compliance Requirement: None Finding 2022-010: Inaccurate Reporting of Federal Expenditures Type of Finding: Noncompliance and material weakness Condition Found: IDHS did not accurately report Federal expenditures, including amounts provided to subrecipients, under the Supplemental Nutrition Assistance (SNAP) Cluster, Coronavirus State and Local Fiscal Recovery Funds (SLFRF), Temporary Assistance for Needy Families (TANF) Cluster, Child Care Development Funds (CCC) Cluster, Medicaid Cluster, and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. Federal expenditures, including amounts provided to subrecipients, reported to the Illinois Office of Comptroller (IOC) which were used to prepare the schedule of expenditure of federal awards (SEFA) did not agree to IDHS’ financial records provided for audit. Specifically, we noted the following differences between amounts provided for audit by IDHS and the SEFA amounts reported to the IOC for each program for the year ended June 30, 2022: Additionally, the following differences were identified relative to amounts provided to subrecipients for the following major programs: Additionally, we noted the cash basis expenditures provided by IDHS for our audit procedures included accrued (not paid) expenditures. We also noted these same amounts were reported to the IOC and were used to prepare the SEFA. Specifically, we noted expenditures that were not paid as of June 30, 2022, were erroneously reported as cash basis expenditures for the year ended June 30, 2022: Additionally, we noted in January 2023 IDHS discovered expenditures under its Home and Community Based Services (HCBS) waiver program had not been reported to the Illinois Department of Healthcare and Family Services (DHFS) for claiming under the Medicaid Cluster program since January 1, 2021. As a result, DHFS did not report expenditures totaling $508,822,206 paid by the State during the year ended June 30, 2022 on quarterly financial reports submitted to USDHHS. On July 31, 2023 the State provided a revised SEFA for the year ended June 30, 2022 which included a correction to add the previously unreported $508,822,206 of Medicaid Cluster HCBS expenditures. The addition of these expenditures delayed the completion of the State’s 2022 single audit. Finally, we noted IDHS’ controls over reporting federal expenditures were not designed at a sufficient level of precision to ensure complete and accurate reporting in a timely manner. Criteria or Requirement: According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statements which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. Among other things required by 2 CFR 200.510(b), the SEFA must include the total amount provided to subrecipients from each Federal program. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures are accurately reported on the SEFA and to other State agencies, where applicable. Cause: In discussing these conditions with IDHS officials, management stated that differences in the amounts of federal expenditures and amounts passed through to subrecipients were due to the Department’s conversion to a new financial accounting system, which included creation of new database queries and reports derived from the new financial system data sources that were used for financial reporting. Possible Asserted Effect: Failure to accurately report federal expenditures prohibits the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal funding. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2022-010) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures to accurately report federal expenditures (including subrecipient expenditures) used to prepare the SEFA to the IOC. Views of IDHS Officials: IDHS accepts the recommendation. IDHS will establish procedures to accurately report federal expenditures (including subrecipient expenditures) used to prepare the SEFA to the IOC as required.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 93.959 ($81,408,580) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2022-011: Inaccurate Financial Report for the SAPT program Type of Finding: Noncompliance and material weakness Condition Found: IDHS did not prepare an accurate financial report for the Block Grants for Prevention and Treatment of Substance Abuse (SAPT) program. IDHS is required to prepare a federal financial report (SF-425) for the SAPT program on an annual basis. During our testwork over the SF-425 report for the federal fiscal year ending September 30, 2021, we noted IDHS inaccurately reported the following items: Additionally, in considering the reporting process for the SF-425 report, we noted IDHS does not perform analytical or other procedures during the report preparation process to ensure amounts reported are reasonable in relation to previously reported information or expectations relative to current program activities. Criteria or Requirement: According to 45 CFR 96.30(a), the State’s fiscal control and accounting procedures must be sufficient to permit preparation of reports required by the statute authorizing the block grant. In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure expenditures are accurately reported in the federal financial report. Cause: In discussing these conditions with IDHS officials, management stated that the inaccurate financial reporting for the SAPT Block Grant (Substance Abuse and Treatment) was due to refunds being recorded in the wrong grant fiscal year. Possible Asserted Effect: Failure to accurately prepare financial reports prevents the USDHHS from effectively monitoring the SAPT program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2022-011) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review the process and procedures in place to prepare financial reports required for the SAPT program and implement procedures necessary to ensure the reports are accurate. Views of IDHS Officials: IDHS accepts the recommendation. The process and procedures to prepare financial reports required for the SAPT program will be reviewed. Necessary steps will be added to ensure that the financial reports are accurate and that refunds received from SAPT providers have been applied to the correct grant fiscal year/grant.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Treasury Department (TREAS) Program Name: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN and Program Expenditures: 21.027 ($4,895,262,395) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Subrecipient Monitoring Finding 2022-012: Failure to Notify Subrecipients of Federal Funding Type of Finding: Noncompliance and material weakness Condition Found: IDHS did not communicate required federal program information to subrecipients at the time of disbursement for the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) program. During our testing of 43 SLFRF subrecipient payments, we noted IDHS did not communicate the Assistance Listing Number (ALN) at the time of disbursement for 15 of the subrecipients tested. Amounts passed through to subrecipients by IDHS under the SLFRF program totaled $60,364,704 during the year ended June 30, 2022. Amounts passed through to subrecipients by the State under the SLFRF program totaled $336,176,469 during the year ended June 30, 2022. Criteria or Requirement: Per 2 CFR 200.332(a)(1)(xii), all pass-through entities must identify the dollar amount made available under each Federal award and the ALN at the time of disbursement. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include controls to ensure ALN notifications are made at the time of subrecipient disbursement. Cause: In discussing these conditions with IDHS officials, management stated some staff were not aware of the requirement to notify subrecipients of ALNs at the time of disbursement. Possible Asserted Effect: Failure to communicate ALNs at the time of disbursement can hamper the subrecipient’s ability to correctly prepare their schedule of expenditures of federal awards. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2022-012) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS add to their warrant description the ALN for each disbursement made to subrecipients. Views of IDHS Officials: IDHS accepts the recommendation. IDHS will work to ensure that the description of the Assistance Listing Numbers (ALN) is properly communicated to subrecipients at the time of disbursement.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program Medicaid Cluster ALN and Program Expenditures: 93.767 ($544,509,368) 93.775/93.777/93.778 ($18,817,832,850) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Managed Care Financial Audit Finding 2022-013: Failure to Perform Periodic Audits of Encounter Data Type of Finding: Material noncompliance and material weakness Condition Found: DHFS did not perform periodic audits of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each Managed Care Organization (MCO) for the Children’s Health Insurance Program (CHIP) and Medicaid Cluster programs. During our testing, we noted DHFS did not conduct or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each its MCOs with contracts starting on or after July 1, 2017, during fiscal year 2022 or in the past three years. Accordingly, no audit results were available to be posted on DHFS’ website. Additionally, we noted DHFS has not established internal control procedures to ensure the encounter data audits are performed and posted as required. Criteria or Requirement: Per 42 CFR 438.602(e), the State must periodically, but no less frequently than once every 3 years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, Prepaid Inpatient Health Plan (PIHP) or Prepaid Ambulatory Health Plan (PAHP). Additionally, per 42 CFR 438.602(g), the State must post on its website the results of any audits under 42 CFR 438.602(e). Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to perform periodic audits of encounter and financial data submitted by, or on behalf of each of its MCOs. Cause: In discussing these conditions with DHFS officials, they stated that although the contracts with each MCO were amended to include independent periodic audits of encounter data, no audits have been completed to-date. Possible Asserted Effect: Failure to perform periodic audits of encounter data submitted by, or on behalf of each of its MCOs may result in inaccurate capitation rate setting for the respective MCOs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2021-009. (Finding Code 2022- 013, 2021-009) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS implement procedures to perform periodic audits of encounter and financial data submitted by, or on behalf of each of its MCOs. Additionally, information should be made publicly available as required. Views of DHFS Officials: The Department accepts the recommendation. The Department has a robust encounter utilization management (EUM) process that is managed by our consulting actuary, Milliman. The Department has also contracted with its external quality review organization (EQRO) to audit the MCOs encounter data. The EQRO completed and submitted the draft EDV report to the Department on June 15, 2023. The report is currently pending review and approval by the Department. The Department will proceed with posting the final report as required once it has been reviewed and approved by all internal reviewing entities. The Department is working toward having the final, approved report posted on the Program web page no later than August 31, 2023.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Medicaid Cluster ALN and Program Expenditures: 93.775/93.777/93.778 ($18,817,832,850) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2022-014: Failure to Report Expenditures on the Medicaid CMS-64 Report in a Timely Manner Type of Finding: Material noncompliance and material weakness Condition Found: DHFS did not report certain Medicaid Cluster program expenditures on quarterly federal financial (CMS- 64) reports in a timely manner. DHFS is the State Medicaid agency and is responsible for determining whether payments made to providers were for permissible services on behalf of eligible beneficiaries. The Illinois Department of Human Services (IDHS) is responsible for determining the eligibility of certain Medicaid Cluster beneficiaries and for administering certain Medicaid waiver programs, including certain Home and Community Based Services provided by the State. In January 2023, DHFS and IDHS discovered expenditures under the Home and Community Based Services waiver program operated by IDHS had not been claimed since January 1, 2021. As a result, DHFS had not reported expenditures totaling $508,822,205 paid by the State during the year ended June 30, 2022 on any of the quarterly reports filed for this period. Specifically, we noted the following expenditure amounts were not reported timely: On July 31, 2023, the State provided a revised Schedule of Expenditures of Federal Awards (SEFA) for the year ended June 30, 2022 which included a correction to add the previously unreported $508,822,205 of Medicaid Cluster Home and Community Based Services expenditures. The addition of these expenditures delayed the completion of the State’s single audit. Additionally, we noted the supervisory review and analytical procedures performed over the quarterly CMS-64 reports were not designed at a sufficient level of precision to identify that these expenditures had not been provided by IDHS for reporting on the CMS-64 report. Criteria or Requirement: 42 CFR 430.30(c) requires States to submit Form CMS-64 (Quarterly Medicaid Statement of Expenditures for the Medical Assistance Program) to the central office not later than 30 days after the end of each quarter. This report is the State’s accounting of actual recorded expenditures. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure financial and other award information reported in required financial reports is accurate prior to submission. Cause: In discussing these conditions with DHFS officials, programming errors related to a system change at IDHS resulted in incomplete Home and Community Based Services expenditure information being transferred to DHFS for claiming. Possible Asserted Effect: Failure to timely report expenditures on the CMS-64 inhibits USDHHS’ ability to monitor the Medicaid Cluster program. Additionally, failure to report federal expenditures in a timely manner prohibits the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal funding. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2022-014) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS evaluate its process for preparing and reviewing its financial reports and implement the procedures necessary to ensure quarterly CMS-64 reports are complete and accurate. Views of DHFS Officials: DHFS accepts the recommendation. As noted by the auditors, management of the Developmentally Disabled (DD) waiver program is shared between IDHS and DHFS. IDHS administers the DD waiver program and pays provider billings. DHFS, as the federally designated single state Medicaid agency, is tasked with claiming federal reimbursement. While DHFS acknowledges current internal controls did not result in timely identification of the DD waiver automated file transfer issue, DHFS did utilize two existing DD waiver tracking reports (acceptance/rejection report and federal revenue summary report) produced by DHFS and shared with IDHS for purposes of verifying DD waiver billing information received by DHFS and the resulting amount of federal revenue claimed. This longstanding inter-agency reporting process has historically served as an effective internal control but given the DD waiver issue, the entire system of internal controls will be revisited.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program Medicaid Cluster ALN and Program Expenditures: 93.767 ($544,509,368) 93.775/93.777/93.778 ($18,316,425,586) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Provider Eligibility (Screening and Enrollment) Finding 2022-015: Inadequate Procedures to Determine Provider Eligibility Type of Finding: Noncompliance and material weakness Condition Found: DHFS did not adequately screen providers of the Children’s Health Insurance Program (CHIP) and Medicaid Cluster programs to ensure that Medicaid providers were not on the USDHHS Office of the Inspector General’s (OIG) List of Excluded Individuals/Entities (LEIE) at the time the voucher for the related services performed was paid. The Illinois Medicaid Program Advanced Cloud Technology (IMPACT) system is used by DHFS for the enrollment and screening of CHIP and Medicaid providers. On a monthly basis, IMPACT automatically checks providers enrolled within IMPACT to the LEIE to verify the provider is not on the LEIE. During our testing of 60 CHIP and 120 Medicaid beneficiary payments (totaling $351,494 and $327,392, respectively) to ensure the providers were not on the LEIE at the time the voucher for the related services performed was paid, we identified 11 CHIP payments (totaling $23,071) and 20 Medicaid payments (totaling $40,430) to providers for services where the providers were not checked against the LEIE to verify they were not on the LEIE for the month when the voucher was paid. Payments made to providers on behalf of beneficiaries of the CHIP and Medicaid Cluster programs totaled approximately $528,680,095 and $17,630,174,846, respectively, during the year ended June 30, 2022. Criteria or Requirement: 2 CFR 455.436(a) requires the State Medicaid agency to confirm the identify and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of a provider through routine checks of federal databases. Additionally, 42 CFR 455.436(b) requires the State Medicaid agency to check the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System, the LEIE, the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. 42 CFR 455.436(c) requires the State Medicaid agency to consult the appropriate databases to confirm identity upon enrollment and reenrollment and check the LEIE and EPLS no less frequently than monthly. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing adequate procedures to screen providers of the CHIP and Medicaid Cluster programs, specifically, to ensure the providers were not on the LEIE for the month when the voucher was paid. Cause: In discussing these conditions with DHFS officials, they stated the providers were not checked against the LEIE on a monthly basis due to a processing error within the IMPACT system. Possible Asserted Effect: Failure to adequately screen CHIP and Medicaid Cluster program providers may result in federal funds being paid to providers that should have been denied, which are unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2021-006. (Finding Code 2022- 015, 2021-006) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS address the IMPACT processing error for screening CHIP and Medicaid Cluster program providers, specifically, the process to check, on a monthly basis, that providers are not on the LEIE. Views of DHFS Officials: DHFS accepts the recommendation. The system defect that caused this screening error was corrected on March 23, 2023. There haven’t been any screening issues since the correction was made.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program Cluster ALN and Program Expenditures: 93.767 ($544,509,368) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: $3,218,270 Compliance Requirement: Eligibility Finding 2022-016: Failure to Discontinue CHIP Benefits for Ineligible Individuals Type of Finding: Material noncompliance and material weakness Condition Found: DHFS improperly continued providing benefits under the Children’s Health Insurance Program (CHIP) program to individuals who were over the age of 19 prior to the start of the Public Health Emergency (PHE) on March 13, 2020. The CHIP program provides benefits to children under the age of 19 at an enhanced federal participation (FFP) rate. CHIP benefits should be discontinued when a beneficiary turns 19; however, if they meet all other eligibility criteria, these beneficiaries are allowed to transition to benefits under the Medicaid Cluster program. During our testing of payments (totaling $351,494) made on behalf of 60 CHIP beneficiaries, we identified three beneficiaries(with sampled medical payments of $3,246) who were over the age of 19 on or before March 13, 2020 (the beginning of the PHE). The total medical payments made on behalf of these three beneficiaries during the year ended June 30, 2022, were $264,418. DHFS performed a review of medical payments made during the year ended June 30, 2022 and identified a total of 1,330 CHIP beneficiaries who attained the age of 19 prior to the beginning of the PHE for whom medical payments totaling $3,218,270 were made during the year ended June 30, 2022. We also noted DHFS has not established adequate controls to identify and remove individuals over the age of 19 (who did not meet the eligibility requirements for the CHIP program) prior to the PHE to determine if they were eligible for the Medicaid Cluster program. Medical payments made on behalf of CHIP beneficiaries during the year ended June 30, 2022, totaled $528,680,095. Criteria or Requirement: In accordance with 42 CFR 435.10 and the OMB Compliance Supplement, dated May 2022, the State is required to determine client eligibility in accordance with eligibility requirements defined in the approved State Plans for the CHIP program. Specifically, 42 CFR 457.320(a) requires the State CHIP agency to provide benefits for groups of children up to, but not including the age 19 in addition to other eligibility criteria. State Plan Amendment IL-14-0009 includes general eligibility considerations which allows benefits to be provided for children up to the age of 19 which is consistent with 42 CFR 457.320(a). In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing and maintaining adequate controls over processes to perform and document beneficiary eligibility determinations. Cause: In discussing these conditions with DHFS officials, they stated the benefits were provided due to untimely processing of redeterminations prior to the COVID-19 pandemic. After the pandemic, DHFS officials believed they had to continue providing benefits to these individuals under the CHIP program. Possible Asserted Effect: Failure to properly perform eligibility determinations in accordance with State Plans may result in federal funds being awarded to ineligible beneficiaries, which are unallowable costs. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2022-016) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS review its current process for performing eligibility decisions and consider changes necessary to ensure all initial and redetermination decisions are performed in accordance with guidelines set forth by the State Plan and temporary guidance set forth by COVID-19 waivers and announcements. Views of DHFS Officials: DHFS accepts the recommendation. In accordance with Federal CMS’ directive, DHFS resumed normal operations regarding eligibility and redeterminations as of April 1, 2023. States can now terminate individuals no longer eligible; Federal CMS has given states up to 14 months to return to normal eligibility operations.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Medicaid Cluster ALN and Program Expenditures: 93.775/93.777/93.778 ($18,817,832,850) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Earmarking – 1915(c) Waivers Finding 2022-017: Inadequate Segregation of Duties over Medicaid Earmarking Requirement Type of Finding: Material weakness Condition Found: DHFS does not have an adequate segregation of duties in place relative to the compilation and review of the Center for Medicare and Medicaid Services (CMS) 372 report used to report earmarking requirements applicable to Home and Community Based Services (HCBS) provided under section 1915(c) waivers. The CMS 372 report details program information and data applicable to the HCBS waivers operated under the Medicaid Cluster program. This report is used by USDHHS to monitor the State’s compliance with HCBS waiver requirements. During our review of the process for preparing and submitting the CMS 372 report, we noted the same individual is responsible for the compilation, review, approval, and submission of the report. A supervisory review of the report and related earmarking requirement is not performed by anyone other than the preparer. Criteria or Requirement: 2 CFR 200.303 requires non-Federal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls f should include a supervisory review of all reports prepared and filed with a federal agency. Cause: In discussing these conditions with DHFS officials, they stated there was not an individual appointed as Deputy Administrator to review the CMS 372 reports prior to their submission. Possible Asserted Effect: An inadequate segregation of duties may result in inaccurate reporting which may prevent USDHHS from properly monitoring and evaluating the HCBS waiver earmarking requirements. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2022-017) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: DHFS should implement procedures to require an independent review of the CMS 372 report and supporting schedules from a person knowledgeable of the earmarking requirement prior to the submission of the report. Views of DHFS Officials: DHFS accepts the recommendation. A Deputy Administrator has been appointed and reviews all CMS 372 reports prior to their submission.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Medicaid Cluster ALN and Program Expenditures: 93.775/93.777/93.778 ($18,817,832,850) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Medicaid National Correct Coding Initiative Finding 2022-018: Failure to Download and Implement Medicaid NCCI Edit Files Type of Finding: Noncompliance and material weakness Condition Found: DHFS did not download quarterly Medicaid National Correct Coding Initiative (NCCI) edit files from the Medicaid Integrity Institute and implement the edit files in their Medicaid Management Information System (MMIS) for the Medicaid Cluster program. State Medicaid agencies are required to apply NCCI edits to Medicaid fee-for-service claims. These NCCI edits are intended to improve the accuracy of Medicaid payments and reduce improper Medicaid payments. DHFS currently manages and operates the MMIS system to support claims processing for the Illinois Medicaid Enterprise. During our testing, we noted DHFS has added edits to MMIS to address the six Medicaid NCCI methodologies for fee for service claims; however, MMIS does not have the capability to download Medicaid NCCI edit files from the Medicaid Integrity Institute. As a result, DHFS was unable to download the quarterly Medicaid NCCI edit files for States during fiscal year 2022. Criteria or Requirement: Section 6507 of the Affordable Care Act (ACA) requires States to use compatible NCCI methodologies in paying applicable Medicaid claims. The Center for Medicaid and CHIP Services (CMCS) requires that the Medicaid Enterprise Systems (MES), formerly known as the MMIS, in each State completely and correctly implement and use in paying applicable Medicaid claims the Medicaid NCCI methodologies. Specifically, according to the NCCI Medicaid Technical Guidance Manual Section 2, States are required to implement, and use in paying all applicable Medicaid claims, the new quarterly Medicaid NCCI edit files for States on the first day of every calendar quarter corresponding to the effective date of the files. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures required by the Medicaid NCCI to download and implement edit files in DHFS’s MMIS. Cause: In discussing these conditions with DHFS officials, they stated the current MMIS system does not have the functionality built in to incorporate the NCCI edit files and enforce the rules. Possible Asserted Effect: Failure to download and implement quarterly edit files from the Medicaid Integrity Institute can result in coding errors and improper payments for procedures and services. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2021-008. (Finding Code 2022- 018, 2021-008, 2020-009). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: DHFS should make the necessary process changes to ensure quarterly Medicaid NCCI edit files from the Medicaid Integrity Institute can be downloaded as required by the Affordable Care Act. Views of DHFS Officials: DHFS accepts the recommendation. While DHFS has implemented several custom edits to enforce the NCCI rules and refers to the NCCI code on code rules for proper editing along with the enforcement of medically unlikely edits, the functionality is not programmed against the quarterly files.

State Agency: Illinois Department of Children and Family Services (DCFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Adoption Assistance ALN and Program Expenditures: 93.659 ($95,153,644) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Eligibility Finding 2022-019: Inadequate Procedures to Reasonably Ensure Children are in the Continued Care of Their Adoptive Parent Type of Finding: Noncompliance and material weakness Condition Found: DCFS does not have adequate procedures to reasonably ensure adoptive children for which adoption assistance subsidies are paid are in the continued care of their adoptive parent(s). The Adoption Assistance program provides funds to states to support the payment of subsidies and nonrecurring expenses on behalf of eligible children with special needs. A child’s eligibility for the program is determined initially at the time of adoption proceedings. However, it is the State’s responsibility to establish a process to ensure that children on behalf of whom the State is making subsidy payments are in the continued care of their adoptive parent(s). Prior to fiscal year 2019, the State sent a recertification form to the adoptive parent(s) of a child on behalf of whom the parent is receiving adoption subsidy payments on an annual basis. The form contained a series of questions concerning the parents’ legal and financial responsibility for the child. The adoptive parent(s) were required to answer the questions and then sign and return the form to DCFS to demonstrate their continued legal and financial responsibility for the adopted child. Effective January 29, 2018, the State amended DCFS’s policy guide to eliminate the requirement for the adoptive parent to complete the recertification form. DCFS has not implemented new procedures or controls since the elimination of the requirement to address the continued care eligibility requirement. While adoptive parents are told they should inform DCFS of any change in the child’s care, DCFS does not have a process or control to validate that all children remain in the care of their adoptive parents. Adoption subsidies paid during the year ended June 30, 2022 totaled $71,769,651. Criteria or Requirement: According to 42 USC 673(a)(4), payments are discontinued when the state determines that the adoptive parents are no longer legally responsible for the support of the child. Parents must keep the state agency informed of circumstances that would make the child ineligible for adoption assistance payments or eligible for assistance payments in a different amount. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing procedures to monitor and validate whether an adoptive child is in the continued care of their adoptive parent. Cause: In discussing these conditions with DCFS officials, they stated DCFS officials misinterpreted the federal guidelines as well as the prior auditor recommendation when eliminating the completion of the recertification form, which led to an incomplete solution to the control issues identified. Possible Asserted Effect: Failure to establish adequate procedures to identify and validate changes in the care of adoptive children could result payments for ineligible beneficiaries which are unallowable costs. Repeat Finding: A similar finding was reported in prior year audit as finding number 2021-002. (Finding Code 2022-019, 2021-002, 2020-003, 2019-029, 2018-031) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCFS implement a process and controls to ensure payments made to adoptive parents are only on behalf of eligible children in the continued care of their adoptive parents. View of DCFS Officials: DCFS agrees with the auditors’ recommendation. DCFS is currently working with USDHHS’ Childrens’ Bureau (CB) on a Program Improvement Plan (PIP) related to Adoption Assistance subsidy payments. The PIP requires significant changes to Policy that are still being vetted by CB and DCFS management, which will have a significant impact on how this program is carried out. As soon as the Policy changes are completed, DCFS will finalize procedures consistent with Policy, the Social Security Act and Title IV-E. These procedures will include controls to ensure payments made are appropriate per the subsidy agreements with the adoptive parents and federal requirements.

State Agency: Illinois Department of Public Health (IDPH) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) ALN and Program Expenditures: 93.323 ($248,405,971) Award Numbers: Various – see table of award numbers. Federal Award Year: Various – see table of award numbers. Questioned Costs: None Compliance Requirement: Reporting Finding 2022-020: Failure to Report Subaward Information Required by FFATA Type of Finding: Material noncompliance and material weakness Condition Found: IDPH failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. FFATA requires the State to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. During our testing, we noted that IDPH did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. As a result, FFATA reports were not prepared or submitted for any subawards of the ELC program for the period July 1, 2021, through June 30, 2022. Of the information required to be reported, the following key data elements are required to be audited: 1. Subaward Name 2. Subaward DUNS number 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers Amounts passed through to subrecipients under the ELC program totaled $133,533,458 during the year ended June 30, 2022. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a publicfacing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include complying with FFATA. Cause: In discussing these conditions with IDPH officials, IDPH stated that a new procedure was developed by the previous CFO but required staffing to fully implement. Possible Asserted Effect: Failure to identify award subject to FFATA and to report subawards in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2021-021. (Finding Code 2022- 020, 2021-021) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDPH establish procedures to identify awards subject to FFATA reporting requirements and report required subaward information in accordance with FFATA. Views of IDPH Officials: We agree with the recommendations of the auditor.

State Agency: Illinois Department of Public Health (IDPH) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) ALN and Program Expenditures: 93.323 ($248,405,971) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Subrecipient Monitoring Finding 2022-021: Failure to Notify Subrecipients of Federal Funding Type of Finding: Noncompliance and material weakness Condition Found: IDPH did not communicate required federal program information to subrecipients at the time of disbursement for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. During our testing of 46 ELC subrecipient payments (totaling $18,040,567), we noted IDPH did not communicate the Assistance Listing Number (ALN) at the time of disbursement for 7 of the subrecipient payments tested (totaling $2,284,855). Further, we noted IDPH did not have effective controls to ensure the ALN number was communicated at the time of payment. Amounts passed through to subrecipients under the ELC program totaled $133,533,458 during the year ended June 30, 2022. Criteria or Requirement: Per 2 CFR 200.332(a)(1)(xii), all pass-through entities must identify the dollar amount made available under each Federal award and the ALN at the time of disbursement. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include controls to ensure ALN notifications are made at the time of subrecipient disbursement. Cause: In discussing these conditions with IDPH officials, IDPH stated that once the deficiency was brought to their attention in November of 2021, the corrective action was implemented, but the payments noted above were before the deficiency was identified. Possible Asserted Effect: Failure to communicate ALNs at the time of disbursement may inhibit the subrecipient’s ability to correctly prepare their schedule of expenditures of federal awards. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2021-022. (Finding Code 2022- 021, 2021-022) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDPH add the ALN to the warrant description for each subrecipient disbursement made. We also recommend IDPH implement additional control procedures necessary to ensure subrecipients are provided information in accordance with Uniform Guidance requirements. Views of IDPH Officials: We agree with the auditor’s recommendation and have implemented the recommendations during the audit period under review.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($86,803,479) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2022-022: Failure to Report Subaward Information Required by FFATA Type of Finding: Material noncompliance and material weakness Condition Found: ICJIA failed to report subaward amendment information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Crime Victim Assistance (CVA) program. FFATA requires the State to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee DUNS number 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During State fiscal year 2022, ICJIA did not have adequate controls in place to identify and report subaward amendment information required by FFATA. For 16 FFATA reports tested, six had amendments that were required to be reported. ICJIA did not report the correct amounts for two amendments tested. ICJIA was unable to identify the number of contract amendments made during the year ended June 30, 2022. ICJIA passed through approximately $83,376,000 to subrecipients of the CVA program during the year ended June 30, 2022. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public facing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Regulation (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to ensure all FFATA reports are accurately prepared and submitted in accordance with federal regulations. Cause: In discussing these conditions with ICJIA officials, they stated they did not have a policy in place to report amendment to subawards until October 2022. Possible Asserted Effect: Failure to report subaward amendments in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2021-028. (Finding Code 2022- 022, 2021-028) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA establish procedures and controls to identify awards and amendments subject to FFATA reporting requirements and report required subaward information in accordance with FFATA. Views of ICJIA Officials: ICJIA accepts the recommendation. Prior to receipt of this finding, in calendar year 2022, ICJIA developed a new internal procedure that assisted agency personnel in identifying awards and amendments subject to FFATA reporting requirements and report required subaward information in accordance with FFATA.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($86,803,479) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2022-023: Inaccurate Performance Report Type of Finding: Noncompliance and material weaknessCondition Found: ICJIA did not prepare an accurate performance report for the Crime Victim Assistance program. ICJIA is required to prepare an annual Victims of Crime Act (VOCA) performance report for the Crime Victim Assistance program. During our testwork over the VOCA report for the federal fiscal year ended September 30, 2021, we noted the following errors: Additionally, in considering the reporting process for the VOCA performance report, we noted ICJIA did not perform analytical or other procedures during the report preparation process to ensure amounts reported were reasonable in relation to previously reported information or expectations relative to current program activities. Criteria or Requirement: The Clarification for Victim Assistance Grantee PMT Reporting guidance from the Office for Victims of Crime (OVC) in April 2020 communicates that "States should enter the amount of each federal award that is allocated for administrative and training purposes on the Administration: Federal Award List page. Administrative and training allocations should be updated at least annually, before the annual report is submitted via Grant Management System (GMS).” In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure amounts are accurately reported in the VOCA performance report. Cause: In discussing these conditions with ICJIA officials, they stated the administrative expenditures for each award are tracked in their grants management system, however, none were reported in the annual performance report. Possible Asserted Effect: Failure to accurately prepare the annual performance report prevents the USDOJ from effectively monitoring the Crime Victim Assistance Program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2022-023) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA accurately report data and information in its VOCA performance report. Additionally, we recommend ICJIA review the process and procedures in place to prepare the annual VOCA performance report required for the Crime Victim Assistance program and implement procedures necessary to ensure the report is accurate. Views of ICJIA Officials: ICJIA accepts the recommendation. ICJIA will review its processes and procedures for the preparation of the annual VOCA performance report and will update the processes and procedures to ensure accurate reporting.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($86,803,479) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2022-024: Inadequate Controls over the Communication of Subrecipient Monitoring Results Type of Finding: Significant deficiency Condition Found: ICJIA did not consistently document supervisory reviews of the communication of on-site monitoring review results in accordance with ICJIA’s control procedures. ICJIA internal control procedures require a supervisory review and approval of program site visit reports prior to providing the results to subrecipients. During our testing of 7 on-site reviews, we noted ICJIA could not provide evidence a supervisory review of the site visit reports or communications of on-site monitoring results to subrecipients had been performed for 3 on-site reviews tested in accordance with ICJIA’s policies. ICJIA passed through approximately $83,376,000 to subrecipients of the CVA program during the year ended June 30, 2022. Criteria or Requirement: 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include ensuring supervisory reviews of on-site monitoring results and communications are performed. Cause: In discussing these conditions with ICJIA officials, they stated there was a timing issue between the report approvals and sending of the follow up letters due to oversight. Possible Asserted Effect: Failure to properly review and approve monitoring reports may result inaccurate monitoring information and results being communicated to subrecipients. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2022-024) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA review its current process for ensuring on-site monitoring results and communications are properly reviewed and approved before they are sent to the subrecipients. Views of ICJIA Officials: ICJIA accepts the recommendation. The ICJIA Site Visit Policy requires approval of the site visit report by the program supervisor prior to submission of a follow-up letter to subrecipients. ICJIA will review the Site Visit Policy to ensure the language describing the timing of submissions is clear and will train staff on the current policy, or any updates identified as part of the agency’s review.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($2,236,535,243 for non-COVID ) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – UI Program Integrity – Overpayments Finding 2022-025: Failure to Implement UI Program Integrity and Overpayment Reduction Requirements Type of Finding: Material noncompliance and material weakness Condition Found: IDES did not implement Federal requirements to improve program integrity and reduce overpayments. The State is required to establish written procedures for: (1) identifying overpayments, (2) classifying overpayments into categories based on the reason the overpayment occurred (i.e. employer error, nonresponse from employers, beneficiary fraud, etc.), and (3) establishing appropriate methods for following up on each category of overpayment. In establishing these procedures, the State is required to enter into three agreements prior to commencing recoveries. The first agreement permits the State to offset State unemployment insurance (UI) from Federal UI overpayments (Cross Program Offset and Recovery Agreement). The second agreement permits the State to recover overpayments from benefits being administered by another State (Interstate Reciprocal Overpayment Recovery Agreement). The third agreement permits the State to utilize the Treasury Offset Program to recover overpayments that remain uncollected one year after the debt was determined to be due. Additionally, the State is (1) required to impose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted in overpayments, and (2) prohibited from providing relief from charges to an employer’s UI account when overpayments are the result of the employer’s failure to respond timely or adequately to a request for information. During our testwork, we noted that while IDES has developed the written procedures relative to overpayments and has entered into the required agreements described in the previous paragraph, the written procedures did not address the requirement to impose a monetary penalty on fraud overpayments. Additionally, we noted the policies do not address the prohibition of providing employers relief resulting from an employer failing to provide timely or adequate information. Criteria or Requirement: 42 U.S.C. 503(a)(11)(A) requires states to impose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted in overpayment. In addition, 26 U.S.C. 3303(f)(1)(A) prohibits states from providing relief from charges to an employer’s UI account when overpayments are the result of the employer’s failure to respond timely or adequately to a request for information. 26 U.S.C. 3304(a)(4)(D) and 42 U.S.C. 503(g)(1) require states to recover overpayments through offset against unemployment compensation (UC) payments. In addition, 42 U.S.C. 503(m) requires states to utilize the Treasury Offset Program for overpayments that remain uncollected one year after the debt was determined to be due. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure program integrity and overpayment reduction requirements are implemented. Cause: In discussing these conditions with IDES officials, they stated although the 15% fraud penalty was implemented and is supported by Illinois statute, the fraud penalty was not incorporated into existing overpayment procedures due to oversight. Also, IDES had identified a process to implement the prohibition on non-charging due to employer fault which was delayed by the historic unemployment claim surges due to the pandemic. Possible Asserted Effect: Failure to implement federal requirements could result in noncompliance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was reported in the prior year audit as number 2021-033. (Finding Code 2022-025, 2021- 033, 2020-024, 2019-063, 2018-052, 2017-053, 2016-061, 2015-056) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDES develop and implement written procedures to improve UI program integrity and reduce overpayments that incorporate the required monetary penalty on fraud overpayments and prohibit providing relief to employers who fail to provide timely and adequate responses to information requests. Views of IDES Officials: The Department accepts this recommendation.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($2,236,535,243 for non-COVID) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Reporting Finding 2022-026: Inadequate Process for Preparing ETA 9130 Financial Reports Type of Finding: Noncompliance and material weakness Condition Found: IDES does not have an adequate process in place to ensure the ETA 9130 financial reports are prepared for the Unemployment Insurance (UI) program are complete and accurate. On a quarterly basis, IDES is required to report program and administrative expenditure information for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects, on the ETA 9130, Financial Status Report, UI Programs. Financial data is required to be reported cumulative from grant inception through the end of each reporting period. During our test work of 40 ETA 9130 reports covering the December 2021 and June 2022 quarters, we noted certain grant awards had inaccurate amounts reported for key line items for the December 31, 2021 reporting quarter. Specifically, we noted IDES inaccurately reported the following line items: IDES reported corrections to the errors identified for recipient account numbers 21021, 21022, and 21095 in the subsequent quarterly report submissions to USDOL. As of the date of our testing, (May 30, 2023), IDES has not submitted revised reports for the errors identified for recipient grant numbers 21020 and 45321. We also noted IDES does not perform analytical or other procedures over previously reported information or expectations relative to current program activities. Additionally, supervisory review procedures are not designed to operate at a level of precision to identify errors of this nature. Criteria or Requirement: According to OMB Number 1205-0461, IDES is responsible for submitting a quarter ETA 9130 report at the completion of each quarter. Each quarter should correspond to the following calendar quarter and dates: March 31, June 30, September 30, and December 31. Additionally, the primary contact person, the designated authorized official in the recipient’s organization, is responsible for certifying the accuracy of the data reported to USDOL. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal control should include procedures to ensure the completeness and accuracy of information reported in required financial reports. Cause: In discussing with IDES officials, they indicated these conditions occurred as a result of increased workloads due to the COVID-19 programs and numerous audits that occurred over the same time period. Possible Asserted Effect: Failure to prepare accurate ETA 9130 reports may inhibit the USDOL from effectively monitoring the UI program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2022-026) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDES review its procedures for preparing ETA 9130 financial reports required for the UI program and implement analytical and any other procedures considered necessary to ensure the reports are complete and accurate prior to submission to the USDOL. Views of IDES Officials: IDES accepts the audit finding and will work to ensure the ETA 9130 financial reports are complete and accurate.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: COVID-19 – Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($444,319,389 for PUA) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Eligibility Finding 2022-027: Inadequate Controls over Determining Eligibility for the Pandemic Unemployment Assistance Program Type of Finding: Material weakness Condition Found: IDES did not establish adequate internal controls over its third-party service organization who administered the Unemployment Framework for Automated Claim & Tax Services (uFACTS) system used to determine eligibility for claimants under the Pandemic Unemployment Assistance (PUA) program. The PUA program was established by the Coronavirus Aid, Relief, and Economic Security Act (CARES) enacted on March 27, 2020. The main provisions of the PUA program include providing up to 39 weeks of benefits to qualifying individuals who were otherwise able to work and available for work within the meaning of applicable state law, except that they were unemployed, partially unemployed, or unable or unavailable to work due to COVID-19 related reasons, as defined in the CARES Act. Benefit payments under PUA were retroactive, for weeks of unemployment, partial unemployment, or inability to work due to COVID-19 reasons starting on or after January 27, 2020 and through December 26, 2020. The Continued Assistance Act, enacted on December 27, 2020, provided an additional 11 weeks of benefits to qualifying individuals (increasing the duration from 39 to 50 weeks). Further, the American Rescue Plan Act (ARP), enacted on March 11, 2021, provided an additional 29 weeks of benefits to qualifying individuals, increasing the duration from 50 to 79 weeks. IDES hired a third-party service organization to administer the uFACTS system. Specifically, the following was noted with regard to general information technology controls (GITC): Segregation of Duties (SOD) – Controls were not in place to restrict access to migrate program or configuration changes into the production environment for the PUA system. For application changes, we were unable to determine that SOD was enforced on the application level and no supporting evidence was available to demonstrate SOD. Given the segregation of duties issues identified above, no further testing of the GITC environment was performed and uFACTS was not able to be relied on for control or compliance testing of PUA transactions.Criteria or Requirement: 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure adequate monitoring controls over the PUA program are implemented, including oversight controls over its third-party service organization including user access provisioning, segregation of duties, and change management over uFACTS. Cause: In discussing these conditions with IDES officials, they stated the reason for the uFACTS inadequate system design was a result of the expedited timeframe of the PUA program implementation in order to provide beneficiary payments to claimants as quickly as possible during the pandemic. Possible Asserted Effect: Failure to establish adequate processes and internal controls may result in noncompliance with program regulations and payments to ineligible recipients. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2021-031. (Finding Code 2022- 027, 2021-031, 2020-023) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDES review its current procedures and consider any changes necessary to ensure adequate monitoring internal controls are established and implemented relating to the PUA program, including oversight controls over its third-party service organization to address adequate segregation of duties over uFACTS. Views of IDES Officials: The Department accepts the recommendation.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($2,236,535,243 for non-COVID) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2022-028: Failure to Follow Established Controls for ETA 2208A Special Report Type of Finding: Significant deficiency Condition Found: IDES did not follow its established policies and procedures for the preparation and review of the ETA 2208A special reports prepared for the Unemployment Insurance (UI) program. On a quarterly basis, IDES is required to report information on staff years worked and paid by program category on the ETA 2208A – Quarterly UI Above-Base (ETA 2208A) report. The information required to be reported includes UI program staff year usage (Section A), regular contingency entitlement certification (Section B), trade above-base entitlement certification (Section C), and additional benefits above-base entitlement certification (Section D). Key line items required for testing include items one through seven in Section A. IDES has implemented procedures whereby IDES program staff prepare the quarterly reports and a supervisor reviews and approves the reports prior to submission to the USDOL. During our testwork of two quarterly ETA 2208A reports, we noted IDES was unable to produce adequate evidence of review and approval of the December 31, 2021 report by a supervisor. Criteria or Requirement: According to ET Handbook No. 336, 18th edition, IDES is required to submit quarterly UI above-base reports (known as ETA 2208A reports) by the first day of the second month after the quarter of reference. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls include following established policy for program staff to prepare and a supervisor to review the special reports prior to submission to the USDOL. Cause: In discussing these conditions with IDES officials, they stated the lack of evidence of review was due to IDES personnel not properly documenting approval of the special reports prior to submission to the USDOL. IDES officials stated this issue was exacerbated by staff turnover. Possible Asserted Effect: Failure to follow established reporting controls may result in inaccurate reports which prevents the USDOL from effectively monitoring the UI program. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2021-032. (Finding Code 2022- 028, 2021-032) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDES ensure the preparation and review of special reports prior to submission to the USDOL is documented in accordance with its established policies and procedures. Views of IDES Officials: IDES accepts this audit finding and will implement an internal process to include supervisory review.

State Agency: Illinois Department of Transportation (IDOT) Federal Agency: U.S. Department of Transportation (USDOT) Program Name: COVID-19 – Airport Improvement Program ALN and Program Expenditures: 20.106 ($96,389,802) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2022-029: Failure to Report Subaward Information Required by FFATA Type of Finding: Material noncompliance and material weakness Condition Found: IDOT failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Airport Improvement Program. FFATA requires the State to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. During our testing, we noted that IDOT did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. As a result, FFATA reports were not prepared or submitted for any subawards of the Airport Improvement Program for the period July 1, 2021 through May 1, 2022 and the following information was not submitted: 1. Subawardee Name 2. Subawardee DUNS number 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers IDOT passed through approximately $95,044,000 to subrecipients of the COVID-19 – Airport Improvement Program during the year ended June 30, 2022. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a publicfacing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Regulation (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include complying with FFATA. Cause: In discussing these conditions with IDOT officials, IDOT stated missing FFATA reporting was due to staffing transition combined with a lack of appropriate staffing resources. Possible Asserted Effect: Failure to identify awards subject to FFATA and to report subaward in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as number 2021-036. (Finding Code 2022-029, 2021- 036) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOT establish procedures to identify awards subject to FFATA reporting requirements and report required subaward information in accordance with FFATA. Views of IDOT Officials: IDOT agrees with the finding and recommendation.

State Agency: Illinois Department on Aging (IDOA) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Aging Cluster ALN and Program Expenditures: 93.044/93.045/93.053 ($59,868,648) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2022-030: Failure to Report Subaward Information Required by FFATA Type of Finding: Material noncompliance and material weakness Condition Found: IDOA failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Aging Cluster program. FFATA requires the State to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. During our testing, we noted that IDOA did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. As a result, FFATA reports were not prepared or submitted for any subawards of the Aging Cluster program for the period July 1, 2021, through June 30, 2022. Of the information required to be reported, the following key data elements are required to be audited: 1. Subaward Name 2. Subaward DUNS number 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers Amounts passed through to subrecipients under the Aging Cluster program totaled $58,510,661 during the year ended June 30, 2022. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a publicfacing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include complying with FFATA. Cause: In discussing these conditions with IDOA officials, they stated that the FFATA reports had been started within the 30-day requirement, but unfortunately were not completed due to the federal awards being receive in pieces over a 12 to 16 month timeframe. Possible Asserted Effect: Failure to identify awards subject to FFATA and to report subawards in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2022-030) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOA establish procedures to identify awards subject to FFATA reporting requirements and report required subaward information in accordance with FFATA. Views of IDOA Officials: Aging concurs with this finding and will adjust our procedures to complete the full FFATA report based on estimates until the full award is received.

State Agency: Illinois Department on Aging (IDOA) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Aging Cluster ALN and Program Expenditures: 93.044/93.045/93.053 ($59,868,648) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2022-031: Inadequate Review of Subrecipient Single Audit Reports Type of Finding: Material noncompliance and material weakness Condition Found: IDOA did not adequately document review over single audit reports received from its subrecipients for the Aging Cluster program on a timely basis. The State of Illinois established the Grant Accountability Transparency Unit (GATU) to implement the provisions of the State's Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submitted their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning, to the applicable state agency, any findings attributable to amounts passed through to the subrecipient(s) by the State. IDOA staff are responsible for reviewing the reports assigned to them by GATU and determining whether: (1) federal funds reported in the schedule of expenditures of federal awards (SEFA) reconcile to IDOA records and (2) issuing management decisions on findings reported within required time frames. During our testing of a sample of single audit desk review files for four subrecipients (with expenditures of $36,828,349 in the fiscal year), we noted IDOA did not document the reconciliation of the subrecipient SEFAs to IDOA records within the GATA Audit Report Review Management System (ARRMS) and did not issue management decision letters to each subrecipient as of the date of our testing (June 2023). IDOA's subrecipient expenditures under the Aging Cluster program for the year ended June 30, 2022 were $58,503,162. Criteria or Requirement According to 2 CFR 200.332(d), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. Additionally, 2 CFR 200.332(d)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure Single Audit reports are reviewed in a timely manner and management decisions are issued within required timeframes. Cause: In discussing these conditions with IDOA officials, they stated the area agency on aging (AAA) audit reviews are completed, however resolution of the reconciliation items and management decisions letters were not completed timely due to a lack of staffing. Possible Asserted Effect: Failure to complete and document reviews of subrecipient single audit reports in a timely manner may result in federal funds being expended for unallowable purposes and subrecipients not administering the federal programs in accordance with laws, regulations and the grant agreement. Repeat Finding: A similar finding was reported in the 2019 Single Audit as finding number 2019-039. (Finding Code 2022- 031) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOA establish procedures to ensure subrecipient single audit report reviews are completed and documented in a timely manner. Additionally, IDOA should ensure procedures will permit issuance of management decisions within required timeframes. Views of IDOA Officials: Aging has posted and scheduled interviews for the vacant position that will oversee this process.

State Agency: Illinois Department on Aging (IDOA) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Aging Cluster ALN and Program Expenditures: 93.044/93.045/93.053 ($59,868,648) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Reporting Finding 2022-032: Failure to Accurately Prepare Financial Reports for the Aging Cluster Type of Finding: Noncompliance and material weakness Condition Found: IDOA did not prepare accurate federal financial status reports (SF-425) for the Aging Cluster program. IDOA is required to prepare semiannual federal financial status reports (SF-425) for each active federal grant in the Aging Cluster. During our testing of five SF-425 report(s) submitted during the State fiscal year ended June 30, 2022, we noted the following errors: In addition, the 3/31/2022 report for award 2101ILSCC6 did not contain the recipient share field or required supplemental schedule. As the amounts were not tracked at the time, the actual amount and difference is indeterminable. Supervisory review procedures for the SF-425 reports were not documented and have not been designed to operate at an appropriate level of precision to ensure the financial reports are accurately prepared. Criteria or Requirement: Aging Cluster grants require grantees to submit SF-425 and Administration on Aging (AoA) Title III supplemental forms on a semi-annual basis. Reports are due within 30 days for the periods ending March 31 and September 30 and are based on the accrual basis. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure financial and other award information reported in required financial reports is accurate prior to submission. Cause: ln discussing these conditions with IDOA officials, when the semi-annual SF-425 was prepared in the payment management system for the Title III ARPA, the system does not contain the supplemental form and therefore the supplemental form was accidently overlooked. Our ACL Fiscal contact let us know that the supplemental form was missing, and we prepared it, submitted it, and will continue to do so until the grant closes. The SF-425s for 2201ILOANS and 2201ILOACM had underdraw’s reported on them which was noted in box 12. Possible Asserted Effect: Failure to establish adequate controls may result in inaccurate financial reports which prevents the USDHHS from effectively monitoring the Aging Cluster. In addition, noncompliance could occur with regards to required matching specified in the grant awards. Repeat Finding: A similar finding was not reported in prior years. (Finding Code 2022-032) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOA maintain documentation of the report reviews demonstrating reports are complete, accurate, and agree or reconcile to financial records. We also recommend the review of the matching information be enhanced to a greater precision level to address data input errors and be retained to substantiate completion. Views of IDOA Officials: The Department agrees with the finding. However, the Department does have procedures for review of the SF-425 as follows: the SF-425s are prepared internally by Department on Aging, reviewed by a CPA firm, and submitted by the Agency through the payment management system. The SF- 425 supplemental form has been completed although after the audit was complete.

State Agency: Illinois Department of Corrections (DOC) Federal Agency: U.S. Treasury Department (TREAS) Program Name: COVID-19 – Coronavirus Relief Fund COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN and Program Expenditures: 21.019 ($190,168,889) 21.027 ($4,895,262,395) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $219,695 Compliance Requirement: Allowable Costs/Cost Principles and Period of Performance Finding 2022-033: Unallowable Costs Charged to the Coronavirus Relief Fund Program Type of Finding: Material noncompliance and material weakness (CRF) Material weakness (SLFRF) Condition Found: DOC charged subrecipient expenditures to the Coronavirus Relief Fund (CRF) program which were incurred prior to the period of performance. The CRF program was enacted by Congress to provide direct payments to state, territorial, tribal, and certain eligible local governments to cover: (1) necessary expenditures incurred due to the public health emergency with respect to COVID-19; (2) costs that were not accounted for in the governments approved budget as of March 27, 2020; and (3) costs that were incurred during the period from March 1, 2020 through December 31, 2021. During our testing of 19 expenditures (totaling $3,869,083) charged to the CRF program during the year ended June 30, 2022, we noted two expenditures for payments to subrecipients (totaling $219,695) for which the underlying expenditures submitted to the DOC for reimbursement pertained to expenditures incurred by the subrecipient prior to March 1, 2020. As these expenditures were incurred prior to the beginning of the period of performance for the CRF program, they are not allowable costs. Additionally, we noted seven CRF expenditures (totaling $2,007,224) from the 19 tested that were not paid by the State until after June 30, 2022, but were included in the 2022 Schedule of Expenditures of Federal Awards (SEFA). As the State prepares its SEFA using the cash basis of accounting, these expenditures were erroneously reported on the 2022 SEFA. Further, in review of the expenditures claimed under the CRF program by DOC, we noted 69 expenditures (totaling $18,080,783) that were not paid by the State until after June 30, 2022. The State’s 2022 SEFA was not corrected for this error. Further, we noted DOC has not established supervisory review controls over expenditures for the CRF and SLFRF programs at an adequate level of precision to ensure: (1) expenditures reimbursed to subrecipients are within the period of performance or (2) expenditures reported on the SEFA are reported in accordance with the cash basis of accounting. DOC expenditures for the CRF program and SLFRF program totaled $128,426,203 and $304,791,247, respectively, during the year ended June 30, 2022. Criteria or Requirement: The Federal Register Volume 86, Number 10 (dated January 15, 2021) states “the CARES Act provides that payments from the Fund may only be used to cover costs that: 1. are necessary expenditures incurred due to the public health emergency with respect to the Coronavirus Disease 2019 (COVID-19); 2. were not accounted for in the budget most recently approved as of March 27, 2020 (the date of enactment of the CARES Act) for the State or government; and 3. were incurred during the period that begins on March 1, 2020 and ends on December 31, 2021.” According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statements which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure: (1) expenditures are reimbursed by the State are within the period of performance and (2) are reported on the SEFA in accordance with cash basis of accounting. Cause: In discussing these conditions with DOC officials, they stated that when the expenses were selected for reimbursement, the posting date of the transaction was inadvertently reviewed and used. All posting dates fell on or before June 30, 2022. As noted in the finding, the actual warrant date should have been reviewed and used for cash basis. Possible Asserted Effect: Failure to ensure payments to subrecipients are only for expenditures incurred during the period of performance results in noncompliance and unallowable costs. Additionally, failure to report expenditures in accordance with the cash basis of accounting inhibits the auditors ability to properly determine major programs in accordance with the Uniform Guidance. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2022-033) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DOC implement procedures to properly review detail expenditures at the appropriate level of precision to ensure federal expenditures: (1) are within the period of performance and (2) are reported on the State’s SEFA in accordance with the cash basis of accounting. Views of DOC Officials: DOC agrees with the recommendation. DOC will ensure appropriate reviews are completed prior to submission of information related to expenditures of Federal Awards.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Treasury Department (TREAS) Program Name: COVID-19 – Coronavirus Relief Fund ALN and Program Expenditures: 21.019 ($190,168,889) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2022-034: Inadequate Review of Subrecipient Single Audit Reports Type of Finding: Significant deficiency Condition Found: DCEO did not adequately review single audit reports received from its subrecipients for the Coronavirus Relief Fund (CRF) program on a timely basis. The State of Illinois established the Grant Accountability Transparency Unit (GATU) to implement the provisions of the State's Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning, to the applicable state agency, any findings attributable to amounts passed through to the subrecipient(s) by the State. DCEO staff are responsible for reviewing the reports assigned to them by GATU and determining whether: (1) federal funds reported in the schedule of expenditures of federal awards (SEFA) reconcile to DCEO records and (2) issuing management decisions on findings reported within required time frames. During our testing of a sample of single audit desk review files for one subrecipient (with expenditures of $10,180 in the fiscal year) out of 60 tested (with expenditures of $8,356,958), we noted DCEO did not issue management decision letters to the subrecipient within the required time frame. The delay in issuing this management decision was 5 days beyond the required timeframe. Further, we noted DCEO has not established controls over subrecipient single audit reviews at an adequate level of precision to ensure management decision letters are issued within required timeframes. DCEO's subrecipient expenditures under the CRF program for the year ended June 30, 2022 were $18,502,818. Amounts passed through to subrecipients by the State under the CRF program totaled $24,432,342. Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. Additionally, 2 CFR 200.332(d)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure Single Audit reports are reviewed in a timely manner and management decisions are issued within required timeframes. Cause: In discussing these conditions with DCEO officials, they stated the 5 day delay (which includes two weekend days and a holiday) in issuing the management decision letter was caused by human error. Possible Asserted Effect: Failure to complete and document reviews of subrecipient single audit reports in a timely manner may result in federal funds being expended for unallowable purposes and subrecipients not administering the federal programs in accordance with laws, regulations and the grant agreement. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2022-034) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCEO establish procedures to ensure subrecipient single audit report reviews are completed and documented in a timely manner. Additionally, DCEO should ensure procedures will permit issuance of management decisions within required timeframes. Views of DCEO Officials: DCEO agrees with the auditor’s recommendation. DCEO has a system and procedures in place to assist with the compliance of 2 CFR 200.332(d)(3) and 2 CFR 200.521. Unfortunately, due to human error, the automatic reminder for ensuring issuance of the MDL was missed. At the time, the position responsible for issuing MDLs was vacant and the unit supervisor was completing those responsibilities in addition to her other duties. The position responsible for issuing MDLs has since been filled (June 2023) and DCEO does not expect this issue to repeat as now there is a primary person responsible and a backup person (the supervisor).

State Agency: Illinois Department of Children and Family Services (DCFS)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Adoption AssistanceALN and Program Expenditures: 93.659 ($88,216,000)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: NoneCompliance Requirement: Cash ManagementFinding 2021-001: Inadequate Process for Reconciling Cash BalancesType of Finding: Material WeaknessCondition Found: DCFS does not have an adequate process to reconcile its cash balances to the records of the Illinois Officeof Comptroller (IOC) and to perform an independent review of the cash reconciliations.DCFS is the state agency responsible for expending program funds and requesting federal cashreimbursement for expenditures under the Adoption Assistance program. The IOC is the official recordkeeper of the State and is responsible for paying vouchers processed by DCFS and other state agencies.DCFS is required to reconcile its records to the IOC records monthly and resolve any reconciling items ona timely basis.During our test work over the monthly cash reconciliation process, we noted supervisory reviews of themonthly reconciliations were not performed. Thus, one individual acted as both the preparer and reviewerof the reconciliations.Criteria or Requirement:2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrols designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include procedures to ensure that cash reconciliations areproperly performed and reviewed monthly during the year.Cause:In discussing these conditions with DCFS officials, they stated DCFS continued to struggle with timelyfilling key vacancies in their General Accounting division.Possible Asserted Effect:Failure to appropriately segregate duties between preparation and review may result in inaccurate financialreporting and drawing federal funds more than expenditures incurred. Repeat Finding:A similar finding was reported in the prior year audit as finding number 2020-001. (Finding Code 2021-001, 2020-001, 2019-033, 2018-036, 2017-034, 2016-034, 2015-030, 2014-027)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend DCFS implement procedures to ensure appropriate segregation of duties in the monthlycash reconciliations process.Views of DCFS Officials:DCFS agrees with this recommendation. DCFS has made improvements since the FY20 audit andperformed the reconciliations timely. A key position was filled late in FY21, so DCFS will be able toseparate the preparation and review of the reconciliation going forward.

State Agency: Illinois Department of Children and Family Services (DCFS)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Adoption AssistanceALN and Program Expenditures: 93.659 ($88,216,000)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: NoneCompliance Requirement: EligibilityFinding 2021-002: Inadequate Procedures to Reasonably Ensure Children are in the ContinuedCare of Their Adoptive ParentType of Finding: Significant DeficiencyCondition Found: DCFS does not have adequate procedures to reasonably ensure adoptive children for which adoptionassistance subsidies are paid are in the continued care of their adoptive parent(s).The Adoption Assistance program provides funds to states to support the payment of subsidies and nonrecurringexpenses on behalf of eligible children with special needs. A child?s eligibility for the program isdetermined initially at the time of adoption proceedings. However, it is the State?s responsibility to establisha process to ensure that children on behalf of whom the State is making subsidy payments are in thecontinued care of their adoptive parent(s).According to 42 USC 673(a)(4), payments are discontinued when the state determines that the adoptiveparents are no longer legally responsible for the support of the child. Parents must keep the state agencyinformed of circumstances that would make the child ineligible for adoption assistance payments or eligiblefor assistance payments in a different amount. To meet this requirement, prior to fiscal year 2019, the Statesent a recertification form to the adoptive parent(s) of a child on behalf of whom the parent is receivingadoption subsidy payments on an annual basis. The form contains a series of questions concerning theparents? legal and financial responsibility for the child. The adoptive parent(s) were required to answer thequestions and then sign and return the form to DCFS to demonstrate their continued legal and financialresponsibility for the adopted child. Effective January 29, 2018, the State amended DCFS?s policy guide toeliminate the requirement for the adoptive parent to complete the recertification form. There has not beena control implemented since the elimination of the requirement to address continued care. Adoptive parentsare told they should inform DCFS of any change in the child?s care but DCFS does not have a process orcontrol to validate that all children remain in the care of their adoptive parents.Criteria or Requirement:2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrols designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include establishing procedures to monitor whether theadoptive child is in the continued care of the adoptive parent. Cause:In discussing these conditions with DCFS officials, they stated that DCFS officials misinterpreted thefederal guidelines as well as the prior auditor recommendation when eliminating the completion of therecertification form, which led to an incomplete solution to the control issues identified.Possible Asserted Effect:Failure to establish adequate procedures to identify changes in care of adoptive children could result inunallowable costs.Repeat Finding:A similar finding was reported in prior year audit as finding number 2020-003. (Finding Code 2021-002,2020-003, 2019-029, 2018-031)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend DCFS implement a process and controls to ensure payments made to adoptive parents areonly on behalf of eligible children in the continued care of their adoptive parents.Views of DCFS Officials:DCFS agrees with the recommendation. DCFS is currently negotiating a Program Improvement Plan withUSDHHS? Children?s Bureau to correct the deficiencies noted in this finding. DCFS has amended itsrecertification form to clarify responsibilities and remedies of both the adoptive parent and DCFS. DCFSwill also review its current systems and processes including controls to discover or develop othermechanisms to ensure that children on behalf of whom the State is making subsidy payments are in thecontinued care of their adoptive parent(s). DCFS is also updating the current notification form that containsthe appeal process when terminating adoption subsidy payments to meet federal requirements.

State Agency: Illinois Department of Children and Family Services (DCFS)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Foster Care ? Title IV-EALN and Program Expenditures: 93.658 ($150,648,000)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: NoneCompliance Requirement: EligibilityFinding 2021-003: Inadequate Controls to Maintain Adequate Provider Licensing FilesType of Finding: Significant DeficiencyCondition Found: DCFS has not established adequate controls to ensure documentation of background checks is completedin a consistent manner.The objective of the Foster Care program administered by DCFS is to provide safe, appropriate, substitutecare for children in Illinois in need of temporary placement and care outside their homes. DCFS, as theState foster care licensing authority, is required to ensure foster family homes or child care service providersare fully licensed, which includes ensuring the required background checks have been performed and thesafety considerations with respect to child-care institution staff have been addressed. DCFS utilizes theAuthorization for Background Check for Foster Care & Adoption form 718-A (Form 718-A) and theAuthorization for Background Check for Child Care form 718-B (Form 718-B) to obtain employeeauthorization as well as control documentation for the completion of required background checks.During our test work of 50 Foster Care maintenance assistance payments (totaling $59,239), we reviewedthe associated provider licensing files for compliance with licensing requirements and for the allowabilityof related benefits paid. We noted for 4 foster family homes tested (with payments of $1,936) and for 2child care service providers tested (with payments of $972) that background check clearance dates werenoted as completed prior to the service date; however, documentation of the review control to ensurebackground checks were obtained prior to service was not consistent. Licensing representatives did notalways use the completion date as their final review date such that there was a gap in evidence of reviewdate and background check clearance date. The range of date differences was 1 to 49 days, indicating theevidence of sign-off was an initiation date versus a completion date.Foster care maintenance payments during year the ended June 30, 2021 totaled approximately$74,005,000.Criteria or Requirement:2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrols designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include procedures to ensure the foster care providerlicensing files are complete, including documentation that required criminal records checks and child abuseand neglect registry checks have been performed for all prospective foster parents, child-care institution applicants, employees, volunteers, or non-licensed service providers.Cause:In discussing these conditions with DCFS officials, they stated that inconsistencies amongst staff membersin carrying out the procedures for documenting foster home background check clearances caused the datevariances described above.Possible Asserted Effect:Failure to maintain complete provider licensing files for foster family homes and child-care institutions,including documentation that required criminal records checks and child abuse and neglect registry checkshave been performed for all prospective foster parents, child-care institution applicants, employees,volunteers, or non-licensed service providers, could result in payments being made to ineligible serviceproviders, which are unallowable costs.Repeat Finding:A similar finding was reported in prior year audit as finding number 2020-004. (Finding Code 2021-003,2020-004, 2019-028, 2018-029, 2017-025, 2016-028)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend DCFS evaluate its control procedures relative to provider background checks andimplement additional changes as considered necessary to ensure evidence of completion of the backgroundcheck (i.e. the completion date) is consistently documented and supported.Views of DCFS Officials:DCFS agrees with the auditor?s recommendation and has implemented changes as of July 2021 to addressthe auditor?s recommendation. Individual Licensing Summaries (ILS) will always reflect the most recentbackground check updates i.e. renewals, background hits, adoption, etc. Whereas, the 718A & 718B willonly show the initial clearances. DCFS Licensing will only record straight background check clearances onthe CFS 718-A and B (authorization forms) and will maintain consistency when recording dates from thevarious background check data sources used to document the background check clearances. Effective July2021, DCFS licensing have updated their practice by entering only the final clearances on the 718-A andB, using a clearance tracking sheet for all pending codes. Any historical data prior to July 2021 will notreflect this current practice.For Foster home license applications, the completion of the CFS 718-A should continue to be completed atthe initial and renewal period that reflect exact date of updates in background check clearances. For anyreason, if clearance occur outside the initial and renewal period, the updates will be made on theBC04/05/09 screens with the supporting documentation used to update the clearances be kept in thelicensing background unit file.

State Agency: Illinois Department of Healthcare and Family Services (DHFS)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Medicaid ClusterALN and Program Expenditures: 93.775/93.777/93.778 ($16,558,856,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: NoneCompliance Requirement: Special Tests and Provisions ? Utilization Control and Program IntegrityFinding 2021-004: Inadequate Monitoring of Quality Improvement Organization Contracted toPerform Reviews of Home and Community Based Service WaiversType of Finding: Significant DeficiencyCondition Found: DHFS did not adequately monitor its Quality Improvement Organization (QIO) responsible for reviewingHome and Community Based Services (HCBS) waivers operated by the State of Illinois.The Illinois Medicaid program, as administered by DHFS, currently has nine federally approved HCBSwaiver programs. The federal Centers for Medicare and Medicaid Services (CMS) holds DHFS, as theSingle State Medicaid agency, responsible for the oversight and monitoring of the nine federally approvedHCBS waiver programs operated by the State of Illinois. To ensure compliance with these federalrequirements, DHFS contracts with a QIO to independently perform reviews for five of the nine waiverprograms, including Persons with Disabilities, Persons with HIV or AIDS, Persons with Brain Injuries,Adults with Developmental Disabilities, and Persons who are Elderly.DHFS? procedures to effectively monitor the QIO consist of formal, regularly scheduled meetings with theQIO. However, during fiscal year 2021, DHFS did not conduct the formal weekly meetings with the QIO,instead only communicating ad hoc with the QIO throughout the year. Formal, regularly scheduledmeetings with the QIO resumed in September 2021.Criteria or Requirement:2 CFR 200.303 requires non-Federal entities receiving Federal awards establish and maintain internalcontrols designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include formal monitoring of the QIO to ensure the HCBSwaiver programs are operated in compliance with federal regulations.Cause:In discussing these conditions with DHFS officials, they stated formal weekly meetings were suspended infiscal year 2021 due to the COVID-19 pandemic. Possible Asserted Effect:Failure to adequately monitor the QIO may result in noncompliance within the HCBS waiver programsoperated by the State of Illinois.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-004)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend DHFS continue the weekly formal meetings with the QIO which were resumed September2021.Views of DHFS Officials:DHFS accepts the recommendation.

State Agency: Illinois Department of Healthcare and Family Services (DHFS)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Medicaid ClusterALN and Program Expenditures: 93.775/93.777/93.778 ($16,558,856,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: Special Tests and Provisions ? Utilization Control and Program IntegrityFinding 2021-005: Inadequate Procedures to Ensure Recovery Audits Conducted by the MedicaidRecovery Audit Contractor are ReceivedType of Finding: Significant Deficiency and Non-ComplianceCondition Found: DHFS does not have adequate procedures to ensure recovery audit files received from their MedicaidRecovery Audit Contractor (RAC) are complete.DHFS contracts with an independent Medicaid RAC to perform audits of Medicaid providers to identifyand correct improper Medicaid payments through the collection of overpayments made on claims forhealthcare services provided to Medicaid beneficiaries. DHFS receives the audit files from the MedicaidRAC and maintains the audit files in their database.During our testing, DHFS provided a listing of recovery audits performed by the Medicaid RAC duringfiscal year 2021. However, we noted the listing of recovery audits provided improperly excluded tworecovery audits performed by the Medicaid RAC during fiscal year 2021. As such, we were unable to verifythe completeness of the listing of recovery audits performed during fiscal year 2021.Criteria or Requirement:2 CFR 200.303 requires non-Federal entities receiving Federal awards establish and maintain internalcontrols designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include implementing procedures to ensure all recoveryaudit files received from the Medicaid RAC are complete and are maintained in the DHFS database.Cause:In discussing these conditions with DHFS officials, they stated not loading the two recovery audits to theDHFS database was an oversight.Possible Asserted Effect:Failure to maintain a complete listing of recovery audits performed by the Medicaid RAC may result innoncompliance with program regulations as the subsequent actions taken, such as collection ofoverpayments from Medicaid providers, are not pursued and/or properly supported by the DHFS database. Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-005)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend DHFS develop procedures to ensure recovery audit files received from the Medicaid RACare complete and are maintained in the DHFS database.Views of DHFS Officials:DHFS accepts the recommendation. The Department of Healthcare and Family Services ? Office ofInspector General (OIG) requires our Recovery Audit Contractor (RAC), to send OIG an audit file whenRAC begins an audit. RAC submits this file to OIG via a secure file transfer protocol (FTP). Since May2019 the OIG bureau responsible for uploading these files has experienced a staffing shortage. Either as theresult of RAC not transferring these audit files or OIG staff failing to download the files from the FTP priorto their expiration, the files were not uploaded to OIG?s audit database. Prior to OIG?s collection on asustained RAC audit, there are several other exchanges of information between RAC and OIG beyond theinitial file transfer, which allow for OIG to become aware of an audit that may have been missed at RAC?sinitiation. OIG would not be able to commence a collection without first gathering the informationregarding the missing audit file.

State Agency: Illinois Department of Healthcare and Family Services (DHFS)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Children?s Health Insurance ProgramMedicaid ClusterALN and Program Expenditures: 93.767 ($489,725,000)93.775/93.777/93.778 ($16,558,856,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: Special Tests and Provisions ? Provider Eligibility (Screening andEnrollment)Finding 2021-006: Inadequate Procedures to Determine Provider EligibilityType of Finding: Material Weakness and Non-ComplianceCondition Found: DHFS did not adequately screen providers of the Children?s Health Insurance Program (CHIP) andMedicaid Cluster programs to ensure the providers were not on the USDHHS Office of the InspectorGeneral?s (OIG) List of Excluded Individuals/Entities (LEIE) at the time the voucher for the related servicesperformed was paid.The Illinois Medicaid Program Advanced Cloud Technology (IMPACT) system is used by DHFS for theenrollment and screening of CHIP and Medicaid providers. On a monthly basis, IMPACT automaticallychecks providers enrolled within IMPACT to the LEIE to verify the provider is not on the LEIE. Duringour testing of 80 CHIP and 100 Medicaid beneficiary payments (totaling $59,344 and $5,853,501,respectively) to ensure the providers were not on the LEIE at the time the voucher for the related servicesperformed was paid, we identified 2 CHIP payments (totaling $24,201) and 10 Medicaid payments (totaling$1,115) to providers for services where the providers were not checked against the LEIE to verify they werenot on the LEIE for the month when the voucher was paid.Payments made to providers on behalf of beneficiaries of the CHIP and Medicaid Cluster programs totaledapproximately $479,020,000 and $16,272,000,000, respectively, during the year ended June 30, 2021.Criteria or Requirement:42 CFR 455.436(a) requires the State Medicaid agency to confirm the identify and determine the exclusionstatus of providers and any person with an ownership or control interest or who is an agent or managingemployee of a provider through routine checks of federal databases. Additionally, 42 CFR 455.436(b)requires the State Medicaid agency to check the Social Security Administration's Death Master File, theNational Plan and Provider Enumeration System, the LEIE, the Excluded Parties List System (EPLS), andany such other databases as the Secretary may prescribe. 42 CFR 455.436(c) requires the State Medicaidagency to consult the appropriate databases to confirm identity upon enrollment and reenrollment and checkthe LEIE and EPLS no less frequently than monthly.Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards establish and maintaininternal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing adequate procedures toscreen providers of the CHIP and Medicaid Cluster programs, specifically, to ensure the providers were noton the LEIE for the month when the voucher was paid.Cause:In discussing these conditions with DHFS officials, they stated the providers were not checked against theLEIE on a monthly basis due to a processing error within the IMPACT system.Possible Asserted Effect:Failure to adequately screen CHIP and Medicaid Cluster program providers may result in federal fundsbeing paid to providers that should have been denied, which are unallowable costs.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-006)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend DHFS address the IMPACT processing error for screening CHIP and Medicaid Clusterprogram providers, specifically, the process to check, on a monthly basis, that providers are not on theLEIE.Views of DHFS Officials:DHFS accepts the recommendation. Provider Enrollment is working with the vendor to determineadditional resources for screening reviews. Changes are projected to be completed and implemented withthe 1.3 IMPACT System Release going into production June 2022.

State Agency: Illinois Department of Healthcare and Family Services (DHFS)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Children?s Health Insurance ProgramMedicaid ClusterALN and Program Expenditures: 93.767 ($489,725,000)93.775/93.777/93.778 ($16,558,856,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: NoneCompliance Requirement: Special Tests and Provisions ? Provider Eligibility (Screening andEnrollment) and Special Tests and Provisions ? Health and SafetyStandards for MedicaidFinding 2021-007: Inadequate Support for Automated Controls related to Provider EligibilityType of Finding: Material WeaknessCondition Found: DHFS changed third-party providers who administered the Illinois Medicaid Program Advanced CloudTechnology (IMPACT) system in September 2021. Information from the former third-party provider wasnot available to adequately audit the general information technology controls (GITC) over IMPACT.The IMPACT system was used by DHFS for the enrollment and screening of Children?s Health InsuranceProgram (CHIP) and Medicaid providers. Administrative access and password management evidence wasavailable. No exceptions were noted. However, due to the change in third-party providers, other areas ofGITC, including new user provisioning, timely removal of terminated users, and change managementauthorization, testing and approval prior to implementation, were not able to be audited for the year endedJune 30, 2021. Further, DHFS relied on IMPACT for application-level controls such as interfaces andvalidation of eligible providers. Without reliance on the GITC environment, the application-level controlscould not be relied on to validate the eligibility of providers including health and safety for Medicaidproviders.Payments made to providers on behalf of beneficiaries of the CHIP and Medicaid Cluster programs totaledapproximately $479,020,000 and $16,272,000,000, respectively, during the year ended June 30, 2021.Criteria or Requirement:2 CFR 200.303 requires non-Federal entities receiving Federal awards establish and maintain internalcontrols designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include GITC and application-level controls that can beverified through appropriate documentation. Cause:In discussing these conditions with DHFS officials, a business decision was made to change third-partyproviders and to not maintain the legacy system due to cost.Possible Asserted Effect:Failure to demonstrate adequate internal controls may result in noncompliance with program regulations.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-007)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend DHFS ensure the new third-party provider has adequate support for the GITC environmentfor future audits.Views of DHFS Officials:DHFS accepts the recommendation. Although the physical hardware was not available to be verified, logswere provided to demonstrate that all data tables had been migrated to the new hardware with only minorerrors that were expected. The application data was unchanged. New users established during the auditperiod were the same users in the new database with the same begin and end dates. Timely removal ofterminated users inside the Impact system was provided. DHFS followed the change control process formaking all changes. Proper testing was completed as part of the migration.

State Agency: Illinois Department of Healthcare and Family Services (DHFS)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Medicaid ClusterALN and Program Expenditures: 93.775/93.777/93.778 ($16,558,856,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: Special Tests and Provisions ? Medicaid National Correct Coding InitiativeFinding 2021-008: Failure to Download and Implement Medicaid NCCI Edit FilesType of Finding: Significant Deficiency and Non-ComplianceCondition Found: DHFS did not download quarterly Medicaid National Correct Coding Initiative (NCCI) edit files from theMedicaid Integrity Institute and implement the edit files in their Medicaid Management Information System(MMIS) for the Medicaid Cluster program.DHFS currently manages and operates the MMIS system to support claims processing for the IllinoisMedicaid Enterprise. During our testwork, we noted DHFS?s MMIS does not have the capability todownload Medicaid NCCI edit files from the Medicaid Integrity Institute. DHFS has added edits to MMISto address the six Medicaid NCCI methodologies for fee for service claims. DHFS is expected to transitionusing the Illinois Medicaid Program Advanced Cloud Technology (IMPACT) system for Medicaid claimsprocessing, which will provide DHFS the capability to download Medicaid NCCI edit files from theMedicaid Integrity Institute.Criteria or Requirement:Section 6507 of the Affordable Care Act (ACA) requires States to use compatible NCCI methodologies inpaying applicable Medicaid claims. The Center for Medicaid and CHIP Services (CMCS) requires that theMedicaid Enterprise Systems (MES), formerly known as the MMIS, in each State completely and correctlyimplement and use in paying applicable Medicaid claims the Medicaid NCCI methodologies. Specifically,according to the NCCI Medicaid Technical Guidance Manual Section 2, States are required to implement,and use in paying all applicable Medicaid claims, the new quarterly Medicaid NCCI edit files for States onthe first day of every calendar quarter corresponding to the effective date of the files.Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards establish and maintaininternal controls designed to reasonably ensure compliance with Federal laws, regulations, and programcompliance requirements. Effective internal controls should include implementing procedures required bythe Medicaid NCCI to download and implement edit files in DHFS?s MMIS.Cause:In discussing these conditions with DHFS officials, they stated the current MMIS system does not have thefunctionality built in to incorporate the NCCI edit files and enforce the rules. Possible Asserted Effect:Failure to download and implement quarterly edit files from the Medicaid Integrity Institute can result incoding errors and improper payments for procedures and services.Repeat Finding:A similar finding was reported in the prior year audit as finding number 2020-009. (Finding Code 2021-008, 2020-009)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:As noted above, DHFS is expected to transition to the IMPACT system for Medicaid claims processing;therefore, DHFS should implement policies and procedures to ensure the IMPACT system has thecapability to download Medicaid NCCI edit files from the Medicaid Integrity Institute.Views of DHFS Officials:DHFS accepts the recommendation. While DHFS has implemented several custom edits to enforce theNCCI rules and refers to the NCCI code on code rules for proper editing along with the enforcement ofmedically unlikely edits, the functionality is not programmed against the quarterly files. DHFS is in theprocess of implementing the new IMPACT system which has all functionality built in to take the quarterlyfiles from RISSNET and upload them into the MMIS and use them for editing.

State Agency: Illinois Department of Healthcare and Family Services (DHFS)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Children?s Health Insurance ProgramMedicaid ClusterALN and Program Expenditures: 93.767 ($489,725,000)93.775/93.777/93.778 ($16,558,856,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: Special Tests and Provisions ? Managed Care Financial AuditFinding 2021-009: Failure to Obtain Annual Audited Financial Reports and Perform PeriodicAudits of Encounter DataType of Finding: Material Weakness and Material Non-ComplianceCondition Found: DHFS did not obtain the annual audited financial reports required for each Managed Care Organization(MCO) specific to each MCO?s Medicaid contract for the Children?s Health Insurance Program (CHIP)and Medicaid Cluster programs. Additionally, DHFS did not perform periodic audits of the accuracy,truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCOfor the CHIP and Medicaid Cluster programs.During our test work, we noted DHFS did not obtain the annual audited financial reports conducted inaccordance with generally accepted accounting principles and generally accepted auditing standardsrequired for each of its MCOs specific to each MCO?s Medicaid contract. Additionally, we noted DHFSdid not conduct or contract for an independent audit of the accuracy, truthfulness, and completeness of theencounter and financial data submitted by, or on behalf of, each of its MCOs with contracts starting on orafter July 1, 2017 during fiscal year 2021 or in the past three years. As a result of not performing periodicaudits, no audit results were available to be posted on DHFS? website.Criteria or Requirement:Per 42 CFR 438.3(m) and 42 CFR 457.1201(k), the Medicaid contract must require MCOs, PrepaidInpatient Health Plans (PIHP), and Prepaid Ambulatory Health Plans (PAHP) to submit audited financialreports specific to the Medicaid contract on an annual basis. The audit must be conducted in accordancewith generally accepted accounting principles and generally accepted auditing standards. Per 42 CFR438.602(e), the State must periodically, but no less frequently than once every 3 years, conduct, or contractfor the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounterand financial data submitted by, or on behalf of, each MCO, PIHP, or PAHP. Additionally, per 42 CFR438.602(g), the State must post on its website the results of any audits under 42 CFR 438.602(e).Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish andmaintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, andprogram compliance requirements. Effective internal controls should include implementing procedures to obtain annual audited financial reports specific to each of its MCO?s Medicaid contracts and performperiodic audits of encounter and financial data submitted by, or on behalf of each of its MCOs.Cause:In discussing these conditions with DHFS officials, they stated that their current process does not includeobtaining annual audited financial reports specific to each of its MCO?s Medicaid contracts because theyrelied on the Department of Insurance who oversees financial viability of all licensed health plans (MCOs)statewide; therefore, the task was not assigned nor executed. On the second topic, although the contractswith each MCO were amended to include independent periodic audits of encounter data, no audits havebeen completed to date.Possible Asserted Effect:Failure to obtain annual audited financial reports specific to each of its MCO?s Medicaid contracts andperform periodic audits of encounter data submitted by, or on behalf of, each of its MCOs may result ininaccurate capitation rate setting for the respective MCOs.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-009)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend DHFS implement procedures to obtain annual audited financial reports specific to each ofits MCO?s Medicaid contracts and perform periodic audits of encounter and financial data submitted by, oron behalf of each of its MCOs.Views of DHFS Officials:DHFS accepts the recommendation. DHFS has a robust encounter utilization management (EUM) processthat is managed by our consulting actuary. DHFS has also included the ability to conduct an independentaudit of the MCOs encounter data in our contract with our external quality review organization (EQRO)but have not completed an audit to date. DHFS will work to conduct an independent audit of the accuracy,truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO,and post the results of these audits on our website pursuant to Federal regulation, at a minimum of onceevery three years. DHFS will add a provision to each of its MCO Medicaid contracts to require annualaudited financial reports conducted in accordance with generally accepted accounting principles startingwith calendar year 2022.

State Agency: Illinois Department of Human Services (IDHS)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Children?s Health Insurance ProgramMedicaid ClusterALN and Program Expenditures: 93.767 ($5,428,000)93.775/93.777/93.778 ($368,641,000)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: EligibilityFinding 2021-010: Failure to Perform Eligibility Decisions within Prescribed TimeframesType of Finding: Significant Deficiency and Non-ComplianceCondition Found: IDHS did not perform eligibility decisions for individuals receiving benefits under the Children?s HealthInsurance Program (CHIP) and Medicaid Cluster programs in accordance with timeframes required by therespective State Plans.Each of the State Plans for the CHIP and Medicaid Cluster programs require the State to perform eligibilityredeterminations on an annual basis. For the Medicaid Cluster, the determination may not exceed 90 daysfor disability basis and 45 days for all other reasons. The determination for CHIP may not exceed 45 days.During our test work over eligibility, we noted the State was late (overdue) in performing initial andredetermination eligibility decisions for individuals receiving benefits under the CHIP and MedicaidCluster programs.Evidence was not provided to document redeterminations were performed within required time frames for1 Medicaid Cluster cases with payments of $93. Additionally, there were 8 Medicaid Cluster cases notmeeting the initial determination time frames with payments sampled of $1,863,617 and 5 CHIP cases didnot meet initial determination time frames with payments sampled of $4,037.Details of the beneficiary payments selected in our samples for the CHIP and Medicaid Cluster programsare as follows. The Medicaid Cluster amounts include both IDHS and DHFS as beneficiary eligibility isprimarily the responsibility of IDHS while the beneficiary expenses are recorded in both agenciesdepending on the type of claim.See Schedule of Findings and Questioned Costs for chart/table.Criteria or Requirement:Per 42 CFR 435.916 (Medicaid) and 42 CFR 457.343 (CHIP), IDHS is required to determine clienteligibility in accordance with eligibility requirements defined in the approved State Plans. The current StatePlans require redeterminations of eligibility for all recipients on an annual basis. States are also directedunder 42 CFR 435.912, to determine Medicaid eligibility promptly and without undue delay. Forindividuals applying for Medicaid based on disability, the determination may not exceed 90 days. For allother applicants, the determination may not exceed 45 days. For CHIP, states are directed, at 42 CFR457.340(d), to determine eligibility promptly and without undue delay. The determination of eligibility maynot exceed 45 days.In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintaininternal controls designed to reasonably ensure compliance with Federal laws, regulations, and programcompliance requirements. Effective internal controls should include establishing procedures to ensureeligibility decisions are performed in accordance with program requirements.Cause:IDHS management stated factors contributing to untimely determination processing include the complexityof the work involved, manual processes that are a required component of case processing, and need foradditional resources to perform and document initial eligibility or redeterminations within the requiredtimeframes.Possible Asserted Effect:Failure to properly perform eligibility decisions in accordance with the State Plans may result in federalfunds being awarded to ineligible beneficiaries, which are unallowable costs.Repeat Finding:A similar finding was reported in the prior year audit as finding number 2020-011. (Finding Code 2021-010, 2020-011, 2019-006, 2018-005, 2017-005, 2016-005, 2015-005, 2014-002, 2013-002, 12-02, 11-02,10-03, 09-03, 08-03, 07-10, 06-03, 05-18, 04-15, 03-17)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDHS review its current process for performing eligibility decisions and consider changesnecessary to ensure all initial and redetermination decisions are performed within the timeframes prescribedwithin the State Plans for each affected program.Views of IDHS Officials:IDHS accepts the recommendation and continues to improve its process for performing eligibilitydeterminations. The exceptions noted represented case requests received prior to the current fiscal year.IDHS will work to ensure all requests for benefits are approved in a timely manner.

State Agency: Illinois Department of Human Services (IDHS)Federal Agency: U.S. Department of Agriculture (USDA)U.S. Department of Health and Human Services (USDHHS)Program Name: SNAP ClusterTemporary Assistance for Needy FamiliesALN and Program Expenditures: 10.551/10.561 ($5,094,429,000)93.558 ($524,774,000)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: Cannot be determined, known questioned costs for TANF is $1,124Compliance Requirement: Eligibility, Special Tests and Provisions ? Child Support Non-Cooperation,Special Tests and Provisions ? Income Eligibility and Verification Systemfor TANFSpecial Tests and Provisions ? ADP System for SNAPFinding 2021-011: Missing Documentation in Beneficiary FilesType of Finding: Material Weakness and Material Non-ComplianceCondition Found: IDHS could not locate case file documentation supporting eligibility determinations and special testrequirements for beneficiaries of the SNAP Cluster and/or the Temporary Assistance for Needy Families(TANF) program.Details of the beneficiary payments selected in our samples for the SNAP/TANF program are as follows: See Schedule of Findings and Questioned Costs for chart/table. During our test work, we selected eligibility files to review for compliance with eligibility requirements ofthe related benefits provided. We noted the following exceptions:? In 1 of 50 TANF cases (with payments sampled of $655), IDHS could not locate the ResponsibilityService Plan (RSP) completed and signed by the beneficiary covering the payment date. TANF cashassistance paid to these beneficiaries during the year ended June 30, 2021 totaled $7,183. Further wenoted that the control to ensure the RSPs are collected (i.e. completeness) in accordance with policy isnot effectively designed. For 13 of 50 TANF cases (with payments sampled of $5,158), IDHS could not provide support atredetermination that the applicant was not on probation, convicted of a felony, or other members of thefamily were not convicted of a drug related felony. TANF cash assistance paid to these beneficiariesduring the year ended June 30, 2021 totaled $56,106.? For 1 of 50 TANF/SNAP cases (with payments sampled of $644), IDHS could not provide theapplication. TANF cash assistance paid to these beneficiaries during the year ended June 30, 2021totaled $1,932.? For 1 of 50 TANF cases (with payments sampled of $767), IDHS could not provide support forpayments being made past 60 months of benefits. TANF cash assistance paid to these beneficiariesduring the year ended June 30, 2021 totaled $7,631.? For 1 of 50 TANF/SNAP cases (with payments sampled of $168), IDHS could not provide support forthe unearned income amount. TANF cash assistance paid to these beneficiaries during the year endedJune 30, 2021 totaled $1,843.? For 1 of 50 TANF cases, there was an overpayment of $1,124 when the case did not close on time andone additional month was paid. TANF cash assistance paid to these beneficiaries during the year endedJune 30, 2021 totaled $7,892.During our test work, we also selected Child Support Non-Cooperation (Non-Cooperation) files to reviewfor compliance with the respective special tests and provisions. We noted the following exceptions:? In 14 of 40 TANF Non-Cooperation special test cases, IDHS could not provide evidence that thebeneficiary was sanctioned after the beneficiary?s failure to cooperate. TANF cash assistance paid tothese beneficiaries during the year ended June 30, 2021 totaled $57,145.? In addition, in 1 of 40 TANF Non-Cooperation special test cases, IDHS did not take timely action onthe case. Payments received during the year ended June 30, 2021 were $3,831.? Also, the application of a sanction, or documentation of why the sanction is not applicable, is notconsistently applied.Criteria or Requirement:Per 42 USC 602(a)(1)(B)(iii) (the State Plan for TANF/SNAP), IDHS is required to determine clienteligibility in accordance with eligibility requirements defined in the approved State Plans. The TANF StatePlan amended April 1, 2020, Section L Personal Responsibility, requires all adults and minor parentsapplying for or receiving assistance be required to sign a Responsibility and Services Plan (RSP) and followthrough with its provisions. TANF/SNAP State Plan also required an application to be completed to applyfor assistance.A state may not provide TANF assistance to any individual who is fleeing to avoid prosecution, or custodyor confinement after conviction, for a felony or attempt to commit a felony or who is violating a conditionof probation or parole imposed under federal or state law (42 USC 608(a)(9)(A)). Further, any family thatincludes an adult or minor child head of household or a spouse of the head of household who has receivedassistance under any state program funded by federal TANF funds for 60 months (whether or notconsecutive) is ineligible for additional federally funded TANF assistance. (45 CFR sections 264.1(a), (b),and (c)). For non-cooperation, if an individual is not cooperating with the state establishing paternity or enforcing asupport order with respect to a child of the individual, the state nust apply a sanction or deny assistance (45CFR 264.30).Through the Income Eligibility and Verification System (IEVS), the state is required to request and obtaininformation for unearned income from the Internal Revenue Service (IRS) (45 CFR 205.55(a)(4)) .In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintaininternal controls designed to reasonably ensure compliance with Federal laws, regulations, and programcompliance requirements. Effective internal controls should include maintaining adequate controls overbeneficiary eligibility case files to ensure all required documentation is received and appropriate sanctionsapplied.Cause:IDHS management stated the exceptions noted were due to oversight to secure or upload supportingdocumentation adequately and to follow up on notices of non-cooperation.Possible Asserted Effect:Failure to maintain RSPs, applications, evidence of felony requirements, and support for unearned incomemay result in inadequate documentation of a recipient?s eligibility and in federal funds being awarded toineligible beneficiaries. Payments beyond the eligibility period can result in unallowable costs. Inability todemonstrate if a sanction has been appropriately applied also may result in federal funds being awarded toan ineligible beneficiary.Repeat Finding:A similar finding was reported in prior year audit as finding number 2020-010. (Finding Code 2021-011,2020-010, 2019-005, 2018-004, 2017-004, 2016-004, 2015-004, 2014-004, 2013-004, 12-04, 11-04, 10-06,09-06, 08-08, 07-19, 06-16, 05-30, 04-18, 03-20, 02-26, 01-15)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDHS review its current process for collecting and maintaining TANF/SNAP eligibilitysupport and documentation to support the appropriate TANF application of sanctions.Views of IDHS Officials:IDHS accepts the recommendation and will work to review and improve the processes by which eligibilitysupport and sanctions are documented and maintained.

State Agency: Illinois Department of Human Services (IDHS)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Block Grants for Prevention and Treatment of Substance AbuseALN and Program Expenditures: 93.959 ($62,270,000)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: Matching, Level of Effort, EarmarkingFinding 2021-012: Failure to Provide Adequate Documentation for the SAPT MOE RequirementType of Finding: Material Weakness and Material Non-ComplianceCondition Found: IDHS was unable to provide adequate documentation to substantiate the maintenance of effort (MOE)requirements were met for the Block Grants for Prevention and Treatment of Substance Abuse (SAPT)program for award year 2019 that closed during State fiscal year 2021.As a condition of receiving federal funding under the SAPT program, USDHHS requires the State tomaintain the level of State and locally funded expenditures for substance abuse prevention and treatmentactivities at an amount that is at least equal to the average level of these same amounts for the prior twoyears.During the current fiscal year, we noted IDHS was required to maintain aggregate State expenditures forState fiscal year June 30, 2019 (SFY19) of $101,071,199. IDHS reported actual aggregate Stateexpenditures for State fiscal year June 30, 2019 of $130,252,827. However, included in the total MOEreported expenditures were $63,104,919 of managed care organization (MCO) billings in SFY19. TheMCO billings represented MCO encounter data amounts, and IDHS could not provide evidence or reconcileMCO encounter data to actual State paid expenditures. Accordingly, these expenditures are not allowablefor purposes of meeting the maintenance of effort requirement. IDHS appears to be approximately$33 million short of the required $101 million MOE requirement.In addition, when testing the allowability of the SAPT state expenses, IDHS was unable to provide supportfor 6 of 15 sample items selected. The samples were selected from the detail of the $130 million describedabove and the 6 sample items were unable to be agreed to the amount paid. No sampling was performedfor the MCO billings described above as there was no payment support.Criteria or Requirement:According to 45 CFR 96.30(a), the fiscal control and accounting procedures of the State must be sufficientto permit the tracing of funds to a level of expenditure adequate to establish that such funds have not beenused in violation of the restrictions and prohibitions of the statute authorizing the block grant. Further, 45CFR 96.134(a) states with respect to the principal agency of a State for carrying out authorized activities,the agency shall for each fiscal year maintain aggregate State expenditures by the principal agency for authorized activities at a level that is not less than the average level of such expenditures maintained by theState for the two-year period preceding the fiscal year for which the State is applying for the grant.In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintaininternal controls designed to reasonably ensure compliance with Federal laws, regulations, and programcompliance requirements. Effective internal controls should include establishing procedures to ensure MOErequirements are achieved with allowable expenditures.Cause:In discussing these conditions with IDHS officials, management stated IDHS is awaiting confirmation fromthe Substance Abuse and Mental Health Services Administration (SAMHSA) and the Center for SubstanceAbuse Treatment (CSAT) of approval of the protocol for supporting the MOE requirement.Possible Asserted Effect:Failure to maintain required State expenditure levels for MOE and maintain adequate supportingdocumentation to support expenditures used to meet the MOE requirement results in noncompliance withprogram requirements.Repeat Finding:A similar finding was reported in the prior year audit as finding number 2020-012. (Finding Code 2021-012, 2020-012, 2019-009, 2018-007, 2017-008, 2016-008, 2015-009, 2014-010)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDHS review its process for identifying allowable expenditures to achieve the SAPT MOE,including receiving input from SAMHSA regarding the applicability of MCO encounter data expenditures.Views of IDHS Officials:IDHS accepts the recommendation. IDHS will continue to seek documentation from SAMHSA of theapproved MOE methodology to support the calculation for SFY2019-2021. IDHS will use the approvedMOE methodology prospectively and will continue making quarterly inquiries to SAMHSA as to theretroactive approval of the methodology for the timeframes of SFY2008-2013 and SFY 2016-2018.

State Agency: Illinois Department of Human Services (IDHS)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Block Grants for Prevention and Treatment of Substance AbuseALN and Program Expenditures: 93.959 ($62,270,000)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: $206,510Compliance Requirement: Matching, Level of Effort, EarmarkingFinding 2021-013: Failure to Meet Earmarking RequirementType of Finding: Material Weakness and Material Non-ComplianceCondition Found: IDHS did not meet the 5% administrative earmarking requirements of the Block Grants for Prevention andTreatment of Substance Abuse Program (SAPT) for the federal fiscal year 2019.During our testing of the SAPT administrative earmarking requirement for the federal fiscal year endedSeptember 30, 2019 (filed in State fiscal year 2021), we noted IDHS reported $3,392,615 as administrativeexpenditures as compared to 5% of program expenditures which was $3,186,105 thus overreportingadministrative expenditures by $206,510. For fiscal year 2019, the grant was not fully expended and theadministrative earmark not adjusted to 5% of expenditures incurred. The amount charged was 5% of thetotal grant award.IDHS has not established appropriate internal controls to ensure earmarking requirements are met inaccordance with federal requirements, specifically for grants that are not fully expended.Criteria or Requirement:According to 42 USC 300x-31 and 45 CFR 96.135 (b)(1), a state may not expend more than 5 percent ofthe grant to pay the costs of administering the grant.Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish andmaintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, andprogram compliance requirements. Effective internal controls should include implementing procedures toensure earmarking requirements are met.Cause:In discussing these conditions with IDHS officials, they stated turnover in program personnel did not allowfor adequate monitoring of the earmarking requirements.Possible Asserted Effect:Failure to meet earmarking requirements results in noncompliance with federal requirements. Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-013)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDHS implement procedures to ensure earmarking requirements are met by the State.Views of IDHS Officials:IDHS accepts the recommendation. IDHS will review federal guidelines and ensure SAPT earmarkingrequirements are met by the State.

State Agency: Illinois Department of Human Services (IDHS)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Block Grants for Prevention and Treatment of Substance AbuseALN and Program Expenditures: 93.959 ($62,270,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: ReportingFinding 2021-014: Failure to Report Subaward Information Required by FFATAType of Finding: Material Weakness and Material Non-ComplianceCondition Found: IDHS failed to report information required by the Federal Funding Accountability and Transparency Act(FFATA) for awards granted to subrecipients of the Block Grants for Prevention and Treatment ofSubstance Abuse program (SAPT).FFATA requires the State to report certain identifying information related to awards made to subrecipientsin amounts greater than or equal to $30,000. Of the information required to be reported, the following keydata elements are required to be audited:1. Subawardee Name2. Subawardee DUNS number3. Amount of subaward4. Subaward obligation or action date5. Date of report submission6. Subaward number7. Subaward project description8. Subawardee names and compensation of highly compensated officersPayments made to subrecipients for the SAPT program totaled approximately $57,107,000 during the yearended June 30, 2021.Criteria or Requirement:In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federalawards that equal or exceed the micro-purchase threshold and publish the required information on a publicfacing,OMB-designated, governmentwide website and follow OMB guidance to support Transparency Actimplementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontractreporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000.2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrol designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include complying with FFATA. Cause:In discussing these conditions with IDHS officials, Substance Use Prevention & Recovery (SUPR)personnel first became aware that FFATA reporting requirements for Substance Abuse and Mental HealthServices Administration (SAMHSA) non-discretionary programs had changed in August of 2020.Beginning in FY2020, SAMHSA re-classified the type of award from type 2 to type 1, making FFATAreporting a requirement. Due to the COVID-19 pandemic and the pending conversion of the IDHSaccounting system from CARS to ERP, SUPR was unable to comply with the new requirements.Possible Asserted Effect:Failure to identify awards subject to FFATA and to report subawards in accordance with FFATA results innoncompliance with federal requirements.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-014)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDHS establish procedures to identify awards subject to FFATA reporting requirementsand report required subaward information in accordance with FFATA.Views of IDHS Officials:IDHS accepts the recommendation. IDHS will establish procedures to identify awards subject to FFATAreporting requirements and report required subaward information in accordance with FFATA.

State Agency: Illinois Department of Human Services (IDHS)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Temporary Assistance for Needy FamiliesSocial Services Block GrantCOVID-19 ? CCDF ClusterALN and Program Expenditures: 93.558 ($524,774,000)93.667 ($56,163,000)93.575/93.596 ($368,181,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: ReportingFinding 2021-015: Failure to Report Subaward Information Required by FFATAType of Finding: Material Weakness and Material Non-ComplianceCondition Found: IDHS failed to report information required by the Federal Funding Accountability and Transparency Act(FFATA) for awards granted to subrecipients of the Temporary Assistance for Needy Families (TANF),Social Services Block Grant (Title XX), and CCDF Cluster (CCDF) programs.FFATA requires the State to report certain identifying information related to awards made to subrecipientsin amounts greater than or equal to $30,000. Of the information required to be reported, the following keydata elements are required to be audited:1. Subawardee Name2. Subawardee DUNS number3. Amount of subaward4. Subaward obligation or action date5. Date of report submission6. Subaward number7. Subaward project description8. Subawardee names and compensation of highly compensated officers. During our testwork of 63 subawards and 10 amendments, we noted the following exceptions: See Schedule of Findings and Questioned Costs for chart/table. IDHS?s subrecipient expenditures under the federal programs for the year ended June 30, 2021 wereapproximately as follows: See Schedule of Findings and Questioned Costs for chart/table. Criteria or Requirement:In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federalawards that equal or exceed the micro-purchase threshold and publish the required information on a publicfacing,OMB-designated, governmentwide website and follow OMB guidance to support Transparency Actimplementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontractreporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000.2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrol designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include complying with FFATA.Cause:In discussing these conditions with IDHS officials, they stated the exceptions noted are due to inaccuraciesin the manual entry of subawards, and not all awards being identified through the existing processes. Possible Asserted Effect:Failure to identify awards subject to FFATA and to report subawards in accordance with FFATA results innoncompliance with federal requirements.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-015)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDHS establish procedures to identify awards subject to FFATA reporting requirementsand report required subaward information in accordance with the FFATA.Views of IDHS Officials:IDHS accepts the recommendation. IDHS will establish procedures to identify awards subject to theFFATA reporting requirement and report required subaward information in accordance with the FFATA.

State Agency: Illinois Department of Human Services (IDHS)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Social Services Block GrantALN and Program Expenditures: 93.667 ($56,163,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: Eligibility and ReportingFinding 2021-016: Inadequate Procedures to Determine Accuracy of the Post-Expenditure ReportType of Finding: Material Weakness and Material Non-ComplianceCondition Found: IDHS failed to provide supporting documentation for the post-expenditure report including a key line item,the number of eligible individuals who received services paid for in part or in whole with federal fundsunder the Social Services Block Grant (Title XX) program.Per review of the 2020 post-expenditure report, total individuals served was noted at 419,008. Theindividual line items that represent different services supported with SSBG expenditures are tracked byvarious departments and third parties. For certain line items, support was not available, for others thesupport did not match the individuals reported, and for certain lines individuals reported includedindividuals not funded with SSBG. As a result, testing a sample of individuals to verify the individual waseligible for the service received could not be performed.Criteria or Requirement:42 USC 1397e requires states to submit to the federal administering agency an annual post-expenditurereport.2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrol designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include retaining support for the post-expenditure reportand a formalized methodology to ensure the reporting is consistent and accurate.Cause:In discussing these conditions with IDHS officials, they stated uniform procedures were not implementedto retain documentation supporting the annual report due to lack of policy and procedures.Possible Asserted Effect:Failure to completely and accurately report SSBG individuals served could result in incomplete data beingsubmitted to the federal administering agency. Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-016)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDHS establish a methodology for departments to gather data needed for the postexpenditurereport and a central repository for storing the supporting materials. IDHS should determine theappropriate person(s) to oversee the process and review the final report prior to submission to verify thereport is supported by appropriate documentation.Views of IDHS Officials:IDHS agrees that a methodology to gather data and store documentation utilized in the post-expendituresupport is needed. IDHS will work to create a process through which providers will submit supportingdocumentation with their quarterly reports.

State Agency: Illinois Department of Human Services (IDHS)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Temporary Assistance for Needy FamiliesCOVID-19 ? CCDF ClusterSocial Services Block GrantBlock Grants for Prevention and Treatment of Substance AbuseALN and Program Expenditures: 93.558 ($524,774,000)93.575/93.596 ($368,181,000)93.667 ($56,163,000)93.959 ($62,270,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: Subrecipient MonitoringFinding 2021-017: Failure to Follow Established Program Subrecipient Monitoring Procedures andto Notify Subrecipients of Federal FundingType of Finding: Material Weakness and Material Non-ComplianceCondition Found: IDHS did not follow its established program monitoring policies and procedures for subrecipients of theTemporary Assistance for Needy Families (TANF), CCDF Cluster (Child Care), Social Services BlockGrant (Title XX), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs.IDHS has implemented procedures whereby program staff perform periodic program on-site and deskreviews of IDHS subrecipient compliance with regulations applicable to the federal programs administeredby IDHS. Generally, these reviews are formally documented and include the issuance of a report of thereview results to the subrecipient summarizing the procedures performed, results of the procedures, andany findings or observations for improvement noted. IDHS?s policies require the subrecipient to respondto each finding by providing a written corrective action plan. Additionally, IDHS program staff performreviews of expenditure reports submitted by subrecipients. IDHS subrecipient monitoring procedures aresubject to the review and approval of a supervisor.During our test work over program on-site review procedures performed for 88 subrecipients of the TANF,CCDF Cluster, Title XX, and SAPT programs, we noted IDHS did not follow its established programmonitoring procedures as follows: During our test work performed, we noted that IDHS did not perform on-site monitoring reviewsof subrecipients in fiscal year 2021 in accordance with IDHS? planned monitoring schedule and/orcould not provide support for the review. Specifically, we noted the following exceptions: See Schedule of Findings and Questioned Costs for chart/table. IDHS did not provide timely notification (within 60 days) of the results of the programmatic onsitereviews. We noted the following exceptions: See Schedule of Findings and Questioned Costs for chart/table. IDHS did not complete their quality reviews on a timely basis (within 60 days). We noted thefollowing exceptions: See Schedule of Findings and Questioned Costs for chart/table. ? For the Title XX program, IDHS personnel were unable to provide support for management reviewof the program review tool for 2 of the 41 subrecipients sampled.? Additionally, for 13 of 40 Title XX and 31 of 31 CCDF Cluster subrecipient disbursementssampled, IDHS did not communicate the required ALNs to the subrecipients at time ofdisbursement. IDHS?s subrecipient expenditures under the federal programs for the year ended June 30, 2021 wereapproximately as follows: See Schedule of Findings and Questioned Costs for chart/table. Criteria or Requirement:According to 2 CFR 200.332(d), a pass-through entity is required to monitor the activities of subrecipientsas necessary to ensure that federal awards are used for authorized purposes in compliance with laws,regulations, and the provisions of contracts or grant agreements and that performance goals are achieved.According to 2 CFR 200.332(b), a pass-through entity must evaluate each subrecipient?s risk ofnoncompliance for purposes of determining the appropriate subrecipient monitoring related to thesubaward.Per 2 CFR 200.332(a)(1)(xii), all pass-through entities must identify the dollar amount made availableunder each Federal award and the ALN at the time of disbursement.In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintaininternal controls designed to reasonably ensure compliance with Federal laws, regulations, and programcompliance requirements. Effective internal controls should include ensuring on-site program proceduresand expenditure reviews are performed in a timely manner and adequate documentation is maintained.Further, controls should ensure ALN notifications are made at disbursement.Cause:In discussing these conditions with IDHS officials, they stated that the program monitoring deficienciesnoted are due to misplaced or misfiled documentation, untimely monitoring, inadequate staffing, and lackof consistent application in each program division. Furthermore, some staff were not aware of therequirement to notify subrecipients of ALNs at the time of disbursement.Possible Asserted Effect:Failure to adequately perform and document program on-site monitoring reviews of subrecipients andnotify subrecipients of findings in a timely manner may result in subrecipients not properly administeringthe Federal programs in accordance with laws, regulations, and the grant agreement. Failure tocommunicate ALNs at time of disbursement can hamper the subrecipient?s ability to correctly prepare theirschedule of expenditures of federal awards.Repeat Finding:A similar finding was reported in the prior year audit as finding number 2020-015. (Finding Code 2021-017, 2020-015, 2019-013, 2018-012, 2017-013, 2016-012, 2015-011, 2014-008, 2013-009, 12-07, 11-09). Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDHS ensure programmatic on-site reviews are performed and documented forsubrecipients in accordance with established policies and procedures. In addition, we recommend IDHSreview its process for reporting and following up on program findings relative to subrecipient on-sitereviews to ensure timely corrective action and quality control is taken. Further, we recommend IDHS addto their warrant description the ALN for each disbursement made to subrecipients.Views of IDHS Officials:IDHS accepts the recommendation and will work to have all programmatic monitoring report reviewscompleted in accordance with the established policies and procedures. This will include ensuring theprocess for reviewing and following up on program findings for subrecipients is performed timely. Inaddition, the communication of the ALN for each disbursement will be added to the warrant description forpayments made.

State Agency: Illinois Department of Revenue (IDOR)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: Temporary Assistance for Needy FamiliesALN and Program Expenditures: 93.558 ($105,396,000)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: NoneCompliance Requirement: Allowable Costs/Cost PrinciplesFinding 2021-018: Inadequate Process for Determining EITC ReversalsType of Finding: Significant Deficiency and Non-ComplianceCondition Found: IDOR is inappropriately reversing earned income tax credits (EITC) that are funded with the TemporaryAssistance for Needy Families (TANF) program.The State of Illinois, through the Department of Revenue (IDOR), has established an EITC program to providea tax refund to low-income families residing in Illinois. Certain amounts refunded to taxpayers under thisprogram are claimed by the Department of Human Services (DHS) under the Temporary Assistance for NeedyFamilies (TANF) program. To be considered for the EITC, the taxpayer must have a federal EITC. To beallowable for claiming under TANF, the state EITC is determined in accordance with the State?s earned incometax credit regulations and must be disbursed to the taxpayer through a refund. These eligible refunds are madethroughout the year as state tax returns are received and processed.Each fall, IDOR receives a US Department of the Treasury, Internal Revenue Service (IRS) file which includedfederal EITC data for the tax year. IDOR matches the IRS file against the state tax returns to validate the stateEITC was allowable. IDOR will change the method of finance from TANF to state funding if the data matchnotes there is no federal EITC, the filing status is different such as number of children, and/or the names on thefederal and state returns are different.During our test work, we selected 25 payments and 25 reversals to validate the state EITC allowability. For5 of 25 reversals, the IDOR data match noted the taxpayer names were different and created a reversal ofthe state EITC. Upon review of the returns, the names were the same and the amounts should not have beenreversed. IDOR determined that the data match was comparing primary name to primary name withoutconsideration of the secondary names on the returns. In essence, the names were the same but reversed inthe primary/secondary data fields between the state and federal returns. Amounts incorrectly moved fromTANF to state funding for the 5 items totaled $2,826.EITC payments under TANF were approximately $105,396,000 for the fiscal year ended June 30, 2021.Method of finance adjustments totaled approximately $7,026,000.Criteria or Requirement:Per the Illinois Income Tax Act (35 ILCS 5/212), a taxpayer is entitled to an 18% state EITC based on thefederal EITC amount. In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintaininternal controls designed to reasonably ensure compliance with Federal laws, regulations, and programcompliance requirements. Effective internal controls should include maintaining adequate controls toappropriately calculate EITC and related reversals.Cause:IDOR management stated the exceptions noted were due to inappropriate data matches being performedbetween the IRS file and the state tax return data. The parameters of the data match were not consideringall the correct data fields.Possible Asserted Effect:Inappropriate funding source is utilized for the EITC refunds.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-018)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDOR revise their data match routines to compare the appropriate data fields between theIRS file and the state tax return information.Views of IDOR Officials:IDOR agrees with the condition noted and are actively working to implement a remedy.

State Agency: Illinois Department of Public Health (IDPH)Federal Agency: U.S. Treasury Department (TREAS)Program Name: COVID-19 ? Coronavirus Relief FundALN and Program Expenditures: 21.019 ($282,250,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: NoneCompliance Requirement: Allowable Costs/Cost Principles and Period of PerformanceFinding 2021-019: Failure to Follow Established Invoice Approval ProceduresType of Finding: Significant DeficiencyCondition Found: IDPH did not follow its established policies and procedures for invoice approvals for the Coronavirus ReliefFund (CRF) program.IDPH has implemented procedures whereby IDPH program staff perform a review and approval of invoicessubmitted by vendors. During our testing of vendor payments, we noted for 2 of 65 invoices sampled forCRF, IDPH program staff did not properly review and approve the vendor invoice. Vendor expendituresunder the CRF program for the year ended June 30, 2021 were approximately as follows:See Schedule of Findings and Questioned Costs for chart/table.Criteria or Requirement:2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrol designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls include following established policy for program staff to reviewand document approval of vendor invoices prior to payment.Cause:In discussing these conditions with IDPH officials, IDPH stated that program approval deficiencies weredue to staff members not properly documenting approval of invoices prior to submitting them to the FiscalOffice.Possible Asserted Effect:Failure to properly review and approve vendor invoices may result in payments to unapproved vendors,inaccurate payments, or duplicate payments to vendors. Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-019)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDPH ensure vendor invoice reviews and approvals are performed and documented for allvendors in accordance with its established policies and procedures.Views of IDPH Officials:IDPH agrees with the finding and recommendation.

State Agency: Illinois Department of Public Health (IDPH)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: COVID-19 ? Epidemiology and Laboratory Capacity for Infectious Diseases(ELC)ALN and Program Expenditures: 93.323 ($185,424,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: ProcurementFinding 2021-020: Failure to Appropriately Obtain Procurement DocumentationType of Finding: Significant Deficiency and Non-ComplianceCondition Found: IDPH did not follow its established policies and procedures for procurement methods that can be used undera disaster proclamation for procurement for the Epidemiology and Laboratory Capacity for InfectiousDiseases (ELC) program.During our test work performed over procurement, we noted IDPH did not follow its established proceduresfor two procurement samples. For one sole source procurement contract tested which exceeded $250,000,IDPH did not obtain the $250,000 review packet to accompany the draft contract. In addition, for one ofsix samples which were bid, the $250,000 review packet was not obtained for one vendor. Further, IDPHdid not include suspension and debarment requirements in the contracts/agreements nor did IDPH verifythe vendors were not suspended or debarred.IDPH?s vendor expenditures under ELC for the year ended June 30, 2021 were approximately $96,739,000.Criteria or Requirement:2 CFR 200.317 requires states to follow the same policies and procedures it uses for procurements from itsnon-Federal funds. Per the IDPH Disaster Proclamation Procurement Guidance, if a contract value is$250,000 or greater, the contract is to be reviewed by IDPH?s legal staff. More specifically, IDPH legalstaff is to review the work plan and deliverables, and the budget is to be reviewed by IDPH fiscal staff. 2CFR 200.214 states a non-federal entity is subject to the non-procurement debarment and suspensionregulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. The regulations in 2 CFRPart 180 restrict awards, subawards, and contracts with certain parties that are debarred, suspended, orotherwise excluded from or ineligible for participation in Federal assistance programs or activities.Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish andmaintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, andprogram compliance requirements. Effective internal controls should include maintaining adequatedocument to demonstrate the execution of procurement procedures. Cause:IDPH personnel noted the lack of documentation to be a manual oversight due in part to the volume ofcontracting for the new federal programs during fiscal year 2021.Possible Asserted Effect:Failure to appropriately complete procurement procedures can result in the use of nonqualified vendorsresulting in unallowable costs.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-020)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDPH follow their established procurement policies.Views of IDPH Officials:IDPH agrees with the finding and recommendation. IDPH officials point to the extreme duress placed onthis agency during the time period associated with this finding. IDPH is the central agency in the State ofIllinois? response to the COVID-19 pandemic. During emergency situations, such as COVID-19, wherelives were at stake, every day IDPH delayed in issuing procurements was critical to saving lives. Sole sourceemergency declaration procurements were necessary to implement life-saving programs and receivedsignificant scrutiny from executive and legal staff prior to implementation. The subject sample of contractswere emergency procurements with established vendors of IDPH undertaken to provide COVID-19response services to the public.

State Agency: Illinois Department of Public Health (IDPH)Federal Agency: U.S. Department of Health and Human Services (USDHHS)Program Name: COVID-19 ? Epidemiology and Laboratory Capacity for Infectious Diseases(ELC)ALN and Program Expenditures: 93.323 ($185,424,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: NoneCompliance Requirement: ReportingFinding 2021-021: Failure to Report Subaward Information Required by FFATAType of Finding: Material Weakness and Material Non-ComplianceCondition Found: IDPH failed to report information required by the Federal Funding Accountability and Transparency Act(FFATA) for awards granted to subrecipients of the Epidemiology and Laboratory Capacity for InfectiousDiseases (ELC) program.FFATA requires the State to report certain identifying information related to awards made to subrecipientsin amounts greater than or equal to $30,000. Of the information required to be reported, the following keydata elements are required to be audited:1. Subawardee Name2. Subawardee DUNS number3. Amount of subaward4. Subaward obligation or action date5. Date of report submission6. Subaward number7. Subaward project description8. Subawardee names and compensation of highly compensated officersAmounts passed through to subrecipients under the ELC totaled approximately $76,123,000 during the yearended June 30, 2021Criteria or Requirement:In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federalawards that equal or exceed the micro-purchase threshold and publish the required information on a publicfacing,OMB-designated, governmentwide website and follow OMB guidance to support Transparency Actimplementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontractreporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrol designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include complying with FFATA.Cause:In discussing these conditions with IDPH officials, IDPH stated they were not aware that the FFATAreporting applied to ELC program.Possible Asserted Effect:Failure to identify awards subject to FFATA and to report subawards in accordance with FFATA results innoncompliance with federal requirements.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-021)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDPH establish procedures to identify awards subject to FFATA reporting requirementsand report required subaward information in accordance with FFATA.Views of IDPH Officials:IDPH agrees with the finding and recommendation.

State Agency: Illinois Department of Public Health (IDPH)Federal Agency: U.S. Treasury Department (TREAS)U.S. Department of Health and Human Services (USDHHS)Program Name: COVID-19 ? Coronavirus Relief FundCOVID-19 ? Epidemiology and Laboratory Capacity for Infectious Diseases(ELC)ALN and Program Expenditures: 21.019 ($282,250,000)93.323 ($185,424,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: Subrecipient MonitoringFinding 2021-022: Failure to Notify Subrecipients of Federal FundingType of Finding: Significant Deficiency and Non-ComplianceCondition Found: IDPH did not communicate required federal program information to subrecipients at the time ofdisbursement for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) andCoronavirus Relief Fund (CRF) programs.During our testing of 43 ELC and 30 CRF subrecipient payments, we noted IDPH did not communicate theAssistance Listing Number (ALN) at the time of disbursement to any of the subrecipients tested. Uponfurther review, IDPH did not provide any notification of ALNs at time of disbursement to any of itssubrecipients during fiscal year 2021.Amounts passed through to subrecipients under the ELC and CRF programs totaled approximately$76,123,000 and $118,951,000, respectively, during the year ended June 30, 2021.Criteria or Requirement:Per 2 CFR 200.332(a)(1)(xii), all pass-through entities must identify the dollar amount made availableunder each Federal award and the ALN at the time of disbursement.Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish andmaintain internal control designed to reasonably ensure compliance with Federal laws, regulations, andprogram compliance requirements. Effective internal controls should include implementing risk assessmentprocedures required by the Uniform Guidance and ensuring monitoring procedures are performed anddocumented in accordance with established policies and procedures.Cause:In discussing these conditions with IDPH officials, staff were not aware of the specific requirement to notifysubrecipients of ALNs at the time of disbursement. IDPH was communicating the state designated programname, mass vaccination or contract tracing. Possible Asserted Effect:Failure to communicate ALNs at the time of disbursement can hamper the subrecipients? ability to correctlyprepare their schedule of expenditures of federal awards.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-022)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDPH add to their warrant description the ALN for each disbursement made tosubrecipients.Views of IDPH Officials:While IDPH agrees with the finding and recommendation, IDPH officials point to the extreme duress placedon this agency during the time period associated with this finding. IDPH is the central agency in the Stateof Illinois? response to the COVID-19 pandemic. IDPH staff and systems were subjected to unprecedentedpressure during this period. While IDPH intends to follow all requirements even the most obscure, the sizeand volume of grants during the period combined with the exhaustive workload on staff contributed to thecausation of this finding.

State Agency: Illinois Department of Public Health (IDPH)Federal Agency: U.S. Treasury Department (TREAS)U.S. Department of Health and Human Services (USDHHS)Program Name: COVID-19 ? Coronavirus Relief FundCOVID-19 ? Epidemiology and Laboratory Capacity for Infectious Diseases(ELC)ALN and Program Expenditures: 21.019 ($282,250,000)93.323 ($185,424,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: NoneCompliance Requirement: Subrecipient MonitoringFinding 2021-023: Inadequate Single Audit Reports ProcessType of Finding: Significant Deficiency and Non-ComplianceCondition Found: The IDPH process for collecting single audit reports, issuing MDLs, and collecting corrective action plans(CAPs) only focuses on a subset of IDPH?s subrecipients and IDPH failed to ensure that managementdecision letters (MDLs) were issued and communicated to subrecipients of the Epidemiology andLaboratory Capacity for Infectious Diseases (ELC) and the Coronavirus Relief Fund (CRF) programs.The State of Illinois established the Grant Accountability Transparency Unit (GATU) to implement theprovisions of the State?s Grant Accountability and Transparency Act (GATA) on a centralized basis. GATUhas established standardized reporting requirements for subrecipients of the various Federal programsadministered by the State through its various departments. Subrecipients of the State are required to certifywhether they expended more than $750,000 in Federal awards during the fiscal year and submitted theirsingle audit reporting packages to the Federal Audit Clearinghouse (FAC), if required. IDPH staff areresponsible for ensuring single audit reports are received from subrecipients and reviewing the reports todetermine the need for issuing MDLs within required time frames and receiving corrective action plans.IDPH has a central process related to single audit reviews to ensure compliance with GATA and federalrequirements. This process includes extracting data from the GATA system on a weekly basis andreviewing it to ensure certain Federal requirements are met. For subrecipients where IDPH is assigned thestate cognizant agency role, IDPH monitors the submission of single audit packages to ensure thatsubrecipients are compliant with applicable timely submission requirements. IDPH sends follow up emailswhen the single audit package is past due. On a weekly basis, the single audit coordinator discussed theGATA dashboard report with various members of IDPH management with regard to subrecipients whomadditional follow-up and/or training could be beneficial. However, this process only includes IDPHsubrecipients for which GATA has designated IDPH as the state cognizant agent.Additionally, IDPH does not have a like process in place to ensure that management decision letters aretimely issued to the subrecipients nor that the CAPs are collected. During our review of single audits for 51 unique subrecipients of ELC and CRF, we noted that two had single audit reports containing major programfindings related to IDPH. IDPH drafted and posted to GATA management decision letters for these twosubrecipients within the time requirements to issue such letters. However, management failed to send theletter to the subrecipients. Further, IDPH responsibilities for issuing MDLs and CAPs are not consistentlydiscussed nor documented as occurring at the weekly management meetings.Amounts passed through to subrecipients under the ELC and CRF programs totaled approximately$76,123,000 and $118,951,000, respectively, during the year ended June 30, 2021.Criteria or Requirement:2 CFR 200.332(d)(3) requires pass-through entities to issue management decisions for applicable auditfindings pertaining to the Federal awards provided to the subrecipient, 2 CFR 200.332(f) requires theverification that every subrecipient is audited as required by Subpart F where applicable, and 2 CFR200.332(d)(4) requires pass through entities to resolve audit findings through corrective action plans.2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrol designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include procedures to ensure that single audit reports arecollected and reviewed in a timely manner, MDLs are issued and communicated to subrecipients within sixmonths after acceptance of the single audit report by the FAC, and CAPs are received for all subrecipientsof IDPH federal programs.Cause:In discussing these conditions with IDPH officials, IDPH stated they were not aware that the single auditcollection requirements and the issuance of MDLs was IDPH?s responsibility when IDPH was not the statecognizant agency. Also, IDPH was not aware they could issue an MDL directly to a subrecipient whenIDPH was not the state cognizant agency.Possible Asserted Effect:Failure to timely collect single audit reports, issue and communicate MDLs to the subrecipient, and collectCAPs could result in Federal funds being expended for unallowable purposes and subrecipients not properlyadministering the Federal programs in accordance with laws, regulations and the grant agreement.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-023)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDPH expand its single audit process to include the collection of single audit reports,issuance of MDL, and collection of CAPs for all IDPH subrecipients. Second, IDPH should issue MDLsdirectly to the subrecipients within the required federal 180 days. For effective internal controls, IDPH?sweekly management meetings should be expanded to include discussion and monitoring of IDPHcompliance procedures such as issuing MDL and CAPS to compliment the review of the subrecipients? responsibilities already discussed.Views of IDPH Officials:IDPH concurs with the finding and recommendation.

State Agency: Governor?s Office of Management and Budget (GOMB)Federal Agency: U.S. Treasury Department (TREAS)Program Name: COVID-19 ? Coronavirus Relief FundALN and Program Expenditures: 21.019 ($336,855,000)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: Subrecipient MonitoringFinding 2021-024: Failure to Establish Subrecipient Monitoring ProceduresType of Finding: Significant Deficiency and Non-ComplianceCondition Found: GOMB did not delegate the subrecipient monitoring requirement for the Illinois Housing DevelopmentAuthority (IHDA) to a state agency to execute.GOMB is responsible for overseeing the administration of the Coronavirus Relief Fund (CRF) for the Stateof Illinois. GOMB established guidance for the 34 state agencies that incurred costs related to the COVID-19 pandemic and response in fiscal year 2020 and was involved in the appropriations of the CRF fund forfiscal year 2021. IHDA was one of the agencies receiving appropriated CRF funding in fiscal year 2021 forrental assistance. IHDA is a discreetly presented component unit (DPCU) within the State of Illinois annualcomprehensive financial report (ACFR). As a DPCU, IHDA is considered a subrecipient of the State ofIllinois and obtains its own financial and single audit.As a pass-through entity, the State of Illinois was responsible for establishing a monitoring process to:? Identify the award and applicable requirements,? Evaluate IHDA?s risk of noncompliance for purposes of determining the appropriate subrecipientmonitoring related to the subaward,? Monitor the activities of IHDA as necessary to ensure that the subaward is used for authorizedpurposes, complies with the terms and conditions of the subaward, and achieves performance goals,and? Issue a management decision for audit findings pertaining to the federal award provided to theIHDA, if applicable.Amounts passed through totaled approximately $336,855,000, during the year ended June 30, 2021.Criteria or Requirement:2 CFR 200.332(a) requires a pass-through entity to clearly identify to the subrecipient data elements in thesubaward agreement. Per 2 CFR 200.332(b), a pass-through entity must evaluate each subrecipient?s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to thesubaward. According to 2 CFR 200.332(d), a pass-through entity is required to monitor the activities ofsubrecipients as necessary to ensure that federal awards are used for authorized purposes in compliancewith laws, regulations, and the provisions of contracts or grant agreements and that performance goals areachieved. 2 CFR 200.332(d)(3) requires pass-through entities to issue management decisions for applicableaudit findings pertaining to the federal awards provided to the subrecipient and 2 CFR 200.332(d)(4)requires pass through entities to resolve audit findings through corrective action plans (CAP).In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintaininternal controls designed to reasonably ensure compliance with Federal laws, regulations, and programcompliance requirements. Effective internal controls should include adequate subrecipient notification andmonitoring requirements.Cause:In discussing these conditions with GOMB officials, the ACFR treatment of IHDA as a DPCU was notconsidered during fiscal year 2021 such that subrecipient monitoring responsibilities were not delegated tothe appropriate agency.Possible Asserted Effect:Failure to adequately notify subrecipients of award elements and to perform monitoring reviews may resultin subrecipients not properly administering the federal programs in accordance with laws, regulations, andthe grant agreement.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-024)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We acknowledge the CRF funds have all been allocated and substantially spent as of June 30, 2021. Werecommend GOMB consider if there are any subrecipient relationships in the American Rescue Plan Actof 2021 (ARPA) appropriations that would require oversight by another state agency.Views of GOMB Officials:GOMB agrees with the recommendation. For fiscal year 2021, with the need to provide rental assistancefunds as quickly as possible, IHDA was identified as uniquely suitable to run such a program in the initialtimeframe allowed under CRF rules. While GOMB did not assign subrecipient monitoring duties to a Stateagency through a formal process, GOMB and other State agencies did work with IHDA on the developmentof their rental assistance program and to ensure proper reporting to U.S. Treasury of the expenditure of theCRF monies.The agency has taken steps to prevent similar findings related to remaining CARES Act funding and newfunding allocated to the State by the ARPA. GOMB facilitated agreements between IHDA and theDepartment of Human Services (DHS) for monitoring of the State?s allocations of funding from the federal Emergency Rental Assistance Program pursuant to the Consolidated Appropriations Act, 2021 and willwork to establish similar agreements with state agencies for money allocated to the State from the HousingAssistance Fund pursuant to the ARPA. GOMB is also in the process of working with State agencies andother DPCUs to establish similar relationships for additional funding appropriated from the State?sallocation of the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) pursuant to the ARPA.

State Agency: Governor?s Office of Management and Budget (GOMB)Federal Agency: U.S. Treasury Department (TREAS)Program Name: COVID-19 ? Coronavirus State and Local Fiscal Recovery FundALN and Program Expenditures: 21.027 ($116,379,000)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: NoneCompliance Requirement: Period of PerformanceFinding 2021-025: Inadequate Controls for Detail Review of ExpendituresType of Finding: Significant Deficiency and Non-ComplianceCondition Found: GOMB implemented a management review process regarding the allowable cost categories of expenses asdefined by Department of Treasury along with period of performance. A secondary control for a moredetailed review of the payment dates of the actual costs did not operate at the required precision level.GOMB is responsible for overseeing the administration of the Coronavirus State and Local Fiscal Recovery(SLFR) Fund for the State of Illinois with regard to the provision of government services to the extentCOVID-19 caused a reduction in revenues collected in the most recent full fiscal year. GOMB identifiedlost revenue, as defined, for the State of Illinois and qualifying government services expenses from theIllinois Department of Corrections (DOC) and Department of Juvenile Justice for the year ended June 30,2021. Specifically, payroll costs of state employees and the medical services provider of approximately$144 million were determined to have been paid during fiscal year 2021. During testwork, the $27 millionpaid to the medical services provider for payroll costs incurred were not paid until after June 30, 2021. TheSchedule of Expenditures of Federal Awards (SEFA) is on a cash basis, so these expenditures were movedfrom 2021 to the 2022 SEFA. All amounts were properly adjusted in the 2021 SEFA; therefore, there areno questioned costs.Criteria or RequirementSections 602 and 603 of the Social Security Act (the ?Act?), as added by section 9901 of the AmericanRescue Plan Act of 2021, Pub. L. No. 117-2 (Mar. 11, 2021) authorized the Coronavirus State FiscalRecovery Fund (CSFRF) and Coronavirus Local Fiscal Recovery Fund (CLFRF) respectively (referred tocollectively as the Coronavirus State and Local Fiscal Recovery Funds). The purpose of the SLFR fund isto provide direct payments to state, territorial, tribal, and certain eligible local governments to:1. Respond to the public health emergency, COVID-19 or its negative economic impacts, includingproviding assistance to households, small businesses, nonprofits, and impacted industries, such astourism, travel, and hospitality.2. Respond to workers performing essential work during the COVID-19 public health emergency byproviding premium pay to eligible workers of eligible employers that have eligible workers who are performing essential work, or by providing grants to eligible entities who perform essentialwork.3. Provide government services, to the extent COVID-19 caused a reduction in revenues collected inthe most recent full fiscal year of the State, Territory, Tribal government, Metropolitan city,County, or Non-entitlement units of local government.4. Make necessary investments in water, sewer, or broadband infrastructure.In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintaininternal controls designed to reasonably ensure compliance with Federal laws, regulations, and programcompliance requirements. Effective internal control should include procedures to ensure appropriate periodof performance.Cause:In discussing the condition found with GOMB officials, they stated the review of the medical servicesprovider payroll records detail focused on the pay periods, not the invoice payment dates, noting the payrollwas related to April, May, and June of 2021. GOMB did not make the adjustments in its accounting toaddress the cash-basis reporting requirement of the SEFA.Possible Asserted Effect:Failure to review expenditures at a detail level could result in unallowable costs or expenditures claimedoutside of the award?s period of performance.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-025)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend GOMB add an additional process to review the dates the amounts were paid to ensureproper cutoff.Views of GOMB Officials:GOMB agrees with the recommendation and is undertaking a review of its current process to determinehow to ensure detailed review of the payment dates incorporating voucher release date data from the IllinoisOffice of the Comptroller.

State Agency: Illinois Criminal Justice Information Authority (ICJIA)Federal Agency: U.S. Department of Justice (USDOJ)Program Name: Crime Victim AssistanceALN and Program Expenditures: 16.575 ($75,998,000)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: Subrecipient MonitoringFinding 2021-026: Failure to Execute Risk Assessment and Adequately Monitor SubrecipientsType of Finding: Material Weakness and Material Non-ComplianceCondition Found: ICJIA created a fiscal risk assessment policy but did not execute the risk assessment of subrecipients of theCrime Victim Assistance (CVA) program as required by the Uniform Guidance during fiscal year 2021.ICJIA does not have a formally documented program risk assessment. Practice is to review all subrecipientswithin a three-year cycle. Additionally, ICJIA did not perform programmatic and fiscal on-site visits inaccordance with its established monitoring procedures, did not have adequate controls around the reviewof single audit reports, and did not include identifying information with disbursements made tosubrecipients.The Uniform Guidance requires pass-through agencies to perform a risk assessment to establish appropriatemonitoring procedures based upon the risks inherent at each subrecipient. ICJIA is required to monitorsubrecipients to determine whether they establish and operate their fiscal system according to the conditionsof the award document and to ensure that funds are requested and expended according to the subrecipient?scash needs and eligible costs. ICJIA?s monitoring procedures for all subrecipients consisted of performingsingle audit report desk reviews, reviewing fiscal and data reports submitted by subrecipients, andperforming periodic program and fiscal site visits.ICJIA created a fiscal risk assessment policy during fiscal year 2020 and refined the policy in 2021 but didnot perform the risk assessments and document related conclusions for subrecipients as specified in thepolicy. Accordingly, we could not determine if the one fiscal on-site review conducted correlated with therisk criteria set forth in the policy.Further, ICJIA does not have a formally documented program risk assessment with sufficiently designedprocedures to address program and/or fiscal compliance. In reviewing the on-site program monitoringprocedures performed by ICJIA for seven subrecipients (with expenditures totaling $1,562,213), we notedthe following exceptions:? ICJIA?s program on-site monitoring reviews included completing a brief checklist to determinewhether certain program-specific compliance requirements (including activities allowed, matching,and maintenance of effort requirements) and select fiscal activities were being performed inaccordance with the grant award. The procedures performed appeared to primarily consist ofinquiries of personnel responsible for administering the program at the subrecipient location. ICJIA did not consistently document the supervisory review of the site visit reports or supervisoryreview of communications of on-site monitoring results to subrecipients in accordance withICJIA?s policies. Specifically, one of seven follow up letters was sent without evidence ofsupervisor review.Additionally, ICJIA did not adequately review single audit reports for subrecipients of the CVA program.The State of Illinois established the Grant Accountability Transparency Unit (GATU) to implement theprovisions of the State?s Grant Accountability and Transparency Act (GATA) on a centralized basis. GATUhas established standardized reporting requirements for subrecipients of the various Federal programsadministered by the State through its various departments. Subrecipients of the State are required to certifywhether they expended more than $750,000 in federal awards during the fiscal year and submitted theirsingle audit reporting packages to the Federal Audit Clearinghouse (if required).ICJIA staff are responsible for reviewing the reports of their subrecipients and issuing managementdecisions on findings reported within required time frames. During our testwork of a sample of single auditdesk review files for 18 CVA program subrecipients, we noted ICJIA did not have appropriate internalcontrols in place to ensure receipt of single audit reports or issuance of management decisions withinrequired time frames.Finally, all pass-through entities must identify the dollar amount made available under each Federal awardand the Assistance Listing Number (ALN) at the time of disbursement per 2 CFR 200.332(a)(1)(xii). ICJIAdid not provide notification of ALNs to 23 out of 34 subrecipients sampled when funds were disbursedduring fiscal year 2021.ICJIA passed through approximately $72,946,000 to subrecipients of the CVA program during the yearended June 30, 2021.Criteria or Requirement:28 CFR 94.106(a) requires the state administering agency (SAA) to develop and implement a monitoringplan in accordance with the requirements of this section and 2 CFR 200.332. The monitoring plan mustinclude a risk assessment plan. 2 CFR 200.332(b) states a pass-through entity must evaluate eachsubrecipient?s risk of noncompliance for purposes of determining the appropriate subrecipient monitoringrelated to the sub award. In addition, 2 CFR 200.332(d) states a pass-through entity must monitor theactivities of the subrecipient as necessary to ensure that the sub award is used for authorized purposes, incompliance with Federal statutes, regulations and the terms and conditions of the sub award, and that thesub award performance goals are achieved.Additionally, 2 CFR 200.332(d)(3) and 2 CFR 200.521 state that a pass-through entity is required to issuea management decision on audit findings within six months after receipt of the subrecipient?s audit reportand ensure that the subrecipient takes timely and appropriate corrective action on all audit findings.Further, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintaininternal control designed to reasonably ensure compliance with Federal laws, regulations, and programcompliance requirements. Effective internal controls should include implementing risk assessmentprocedures required by the Uniform Guidance and ensuring monitoring procedures are performed anddocumented in accordance with established policies and procedures. Cause:In discussing these conditions with ICJIA officials, they stated both a lack of adequate staff resourcescombined with the increase in new programs delayed the ability to adequately implement the fiscal riskassessment policy and conduct the respective onsite reviews. In addition, ICJIA officials indicated changesin personnel combined with competing priorities for the limited resources available led to a reduction in theaudits and review of work performed.Possible Asserted Effect:Failure to execute required risk assessments and adequately monitor subrecipients including review ofsingle audit reports may result in subrecipients not properly administering the federal programs inaccordance with laws, regulations, and the terms and conditions of the award. Not communicating ALNscan hamper the subrecipients? ability to correctly prepare their schedule of expenditures of federal awards.Repeat Finding:A similar finding was reported in the prior year audit as finding number 2020-018. (Finding Code 2021-026, 2020-018, 2019-056)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend ICJIA perform and document risk assessments of each subrecipient and ensure fiscal andprogram monitoring visits are performed in accordance with the results of such risk assessments. Inaddition, we recommend ICJIA establishes controls to ensure single audit reports are received timely anddesk reviews are completed and documented in a timely manner to substantiate whether MDLs should beissued by ICJIA within six months. Lastly, ICJIA should add to their warrant description the ALNassociated with each disbursement.Views of ICJIA Officials:ICJIA accepts this finding but notes that some of the conditions found were addressed as part of its responseto the SFY20 State Single Audit. For example, ICJIA now includes the ALN on federal fund disbursements,but only started after the SFY20 State Single Audit noted that ICJIA was not doing so in mid SFY21.ICJIA continues to develop and refine its risk assessments in order to ensure compliance with federal andstate requirements. ICJIA redid and implemented an actionable risk assessment pilot program in SFY22that is currently guiding the amount of audits completed; ICJIA has also supplemented audit activity withfinancial desk reviews in which ICJIA fiscal staff review financial documentation for a single reportingperiod for a select population of grants to make sure it backs up the amount reported in the financial report.

State Agency: Illinois Criminal Justice Information Authority (ICJIA)Federal Agency: U.S. Department of Justice (USDOJ)Program Name: Crime Victim AssistanceALN and Program Expenditures: 16.575 ($75,998,000)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: Reporting and Matching, Level of Effort, EarmarkingFinding 2021-027: Inadequate Controls over Reports and MatchingType of Finding: Material Weakness and Material Non-ComplianceCondition Found: ICJIA does not have adequate controls in place to ensure amounts reported on the federal financial statusreport (SF-425) and the annual Victims of Crime Act (VOCA) progress report are complete and accurate.With regard to matching, we noted the total recipient share of expenditures of approximately $15.1 millionreported on the final SF-425 submitted for the Federal fiscal year 2017 did not agree to supportingdocumentation. Specifically, during our review of seven subrecipient matching contributions totalingapproximately $13.1 million of the match, we noted two matching contributions did not agree to theunderlying expenditure reports submitted by subrecipients. As a result of these errors, the total recipientshare of expenditures was understated by approximately $17,000. The SF-425 control related to reviewingthe manually inputted matching information for accuracy did not function at the correct precision level. Inaddition, there was no evidence of review of the annual VOCA progress report. Criteria or Requirement:2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrols designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include procedures to ensure financial and other awardinformation reported in required financial reports is accurate prior to submission.28 CFR 94.118 required subrecipients to contribute not less than 20% of the total cost of each project unlessa waiver is applied.Cause:In discussing these conditions with ICJIA officials, they stated the current process for validating the fiscalexpenditure data for both the SF-425 and annual VOCA progress reports is not operating at a sufficientlevel to ensure complete and accurate submission of financial status reports due to a lack of available data,automation, and resources. In addition, ICJIA officials indicated documentation of supervisory reviews ofprepared reports was not retained due to the remote working environment. Possible Asserted Effect:Failure to establish adequate controls may result in inaccurate financial and/or progress reports whichprevents the USDOJ from effectively monitoring the Crime Victim Assistance Program. In addition, noncompliancecould occur with regard to required matching specified in the grant awards.Repeat Finding:A similar finding was reported in the prior year audit as finding number 2020-019. (Finding Code 2021-027, 2020-019, 2019-058)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend ICJIA maintain documentation of the report reviews demonstrating reports are complete,accurate, and agree or reconcile to financial records. We also recommend the review of the matchinginformation be enhanced to a greater precision level to address data input errors.Views of ICJIA Officials:ICJIA accepts this finding but notes that sufficient controls for SF-425 review were implemented as part ofits response to the SFY20 State Single Audit in late SFY21. ICJIA also accepts that the VOCA progressreport review was not documented in SFY21, but notes that an electronic review process implemented afterthe transition to remote work will demonstrate sufficient review moving forward.

State Agency: Illinois Criminal Justice Information Authority (ICJIA)Federal Agency: U.S. Department of Justice (USDOJ)Program Name: Crime Victim AssistanceALN and Program Expenditures: 16.575 ($75,998,000)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: NoneCompliance Requirement: ReportingFinding 2021-028: Failure to Report Subaward Information Required by FFATAType of Finding: Material Weakness and Material Non-ComplianceCondition Found: ICJIA failed to report subaward amendment information required by the Federal Funding Accountabilityand Transparency Act (FFATA) for awards granted to subrecipients of the Crime Victim Assistance (CVA)program.FFATA requires the State to report certain identifying information related to awards made to subrecipientsin amounts greater than or equal to $30,000. Of the information required to be reported, the following keydata elements are required to be audited:1. Subawardee Name2. Subawardee DUNS number3. Amount of subaward4. Subaward obligation or action date5. Date of report submission6. Subaward number7. Subaward project description8. Subawardee names and compensation of highly compensated officersFor 18 FFATA reports reviewed, four had amendments that were required to be reported. ICJIA did notreport any amendment information. ICJIA does not have adequate controls in place to ensure the subawardamendment information reported is complete and accurate for initial and amended subawards.ICJIA passed through approximately $72,946,000 to subrecipients of the CVA program during the yearended June 30, 2021.Criteria or Requirement:In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federalawards that equal or exceed the micro-purchase threshold and publish the required information on a publicfacing,OMB-designated, governmentwide website and follow OMB guidance to support Transparency Actimplementation. Consistent with the Federal Acquisition Regulation (FAR) threshold for subcontractreporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrol designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include complying with FFATA.Cause:In discussing these conditions with ICJIA officials, they stated they were not aware amendments wererequired to be reported under FFATA.Possible Asserted Effect:Failure to report subaward amendments in accordance with FFATA results in noncompliance with federalrequirements.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-028)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend ICJIA establish procedures and controls to identify awards and amendments subject toFFATA reporting requirements and report required subaward information in accordance with FFATA.Views of ICJIA Officials:ICJIA agrees with this finding. Staff were only aware that original designation amounts and performanceperiod parameters were required, not subsequent adjustments. Staff understood that once submissions weremade, they were locked by DOJ for their purposes, negating the need for updates. Staff could not findspecific directives in any FFATA reporting instructions involving these issues.

State Agency: Illinois Criminal Justice Information Authority (ICJIA)Federal Agency: U.S. Department of Justice (USDOJ)Program Name: Crime Victim AssistanceALN and Program Expenditures: 16.575 ($75,998,000)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: NoneCompliance Requirement: Matching, Level of Effort, EarmarkingFinding 2021-029: Failure to Maintain Adequate Documentation for Earmarking RequirementsType of Finding: Significant Deficiency and Non-ComplianceCondition Found:ICJIA did not maintain adequate documentation to substantiate the earmarking requirements of the CrimeVictim Assistance (CVA) Program were met during the federal fiscal year 2017.ICJIA is required to earmark a portion of its Crime Victim Assistance award to fund activities relative tovictims of crimes in three priority areas designated by USDOJ (10% for each priority area) and tounderserved victims (10%). The three priorities designated by USDOJ include child abuse, domestic andfamily violence, and sexual assault. Additionally, USDOJ has identified underserved victims to includevictims of federal crimes, survivors of homicide victims, or victims of assault, robbery, gang violence, hateand bias crimes, intoxicated drivers, bank robbery, economic exploitation and fraud, and elder abuse.During our testing of the Victims of Crime Act (VOCA) progress report for the federal fiscal year endedSeptember 30, 2017 (filed in State fiscal year 2021), we noted ICJIA reported the following amounts foreach of the earmarking requirements:See Schedule of Findings and Questioned Costs for chart/table.ICJIA has not established appropriate internal controls to ensure earmarking requirements are met inaccordance with federal requirements, specifically for the underserved victims? requirement.Criteria or Requirement:According to 28 CFR 94.104(a) through (c), the State Administering Agency shall allocate a minimum often percent of each year?s Victim of Crime Act grant to each of the three priority categories of victimsincluding sexual assault, spousal abuse, and child abuse, and previously underserved victims of violentcrime.Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish andmaintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures toensure earmarking requirements are met.Cause:In discussing these conditions with ICJIA officials, they stated a lack of staff resources combined withcompeting priorities for the limited resources did not allow for adequate monitoring of the earmarkingrequirements to ensure expenditures were incurred by the subrecipients.Possible Asserted Effect:Failure to meet earmarking requirements results in noncompliance with federal requirements.Repeat Finding:A similar finding was reported in a prior year audit as finding number 2019-055. (Finding Code 2021-029,2019-055)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend ICJIA implement procedures to ensure earmarking requirements are met by the State.Views of ICJIA Officials:ICJIA agrees with this finding. After extensive review of the priority funding amounts for Grant Number2017-VA-GX-0048, it has been determined that ICJIA was not compliant with the 10% threshold forunderserved populations.

State Agency: Illinois Department of Employment Security (IDES)Federal Agency: U.S. Department of Labor (USDOL)Program Name: COVID-19 ? Unemployment InsuranceALN and Program Expenditures: 17.225 ($3,643,128,000 for PUA)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: Eligibility for Unemployment Insurance? PUAFinding 2021-030: Inadequate Process over Determining Appropriate Benefit Amounts for thePandemic Unemployment Assistance ProgramType of Finding: Material Weakness and Material Non-ComplianceCondition Found: IDES inaccurately calculated the weekly benefit amount (WBA) for certain claimants of the PandemicUnemployment Assistance (PUA) program during the year ended June 30, 2021. In addition, IDES did notestablish adequate internal controls over its third-party service organization who administered theUnemployment Framework for Automated Claim & Tax Services (uFACTS) system used to determineeligibility for the PUA program.The PUA program was established by the Coronavirus Aid, Relief, and Economic Security Act (CARES)enacted on March 27, 2020. The main provisions of the PUA program include providing up to 39 weeks ofbenefits to qualifying individuals who were otherwise able to work and available for work within themeaning of applicable state law, except that they were unemployed, partially unemployed, or unable orunavailable to work due to COVID-19 related reasons, as defined in the CARES Act. Benefit paymentsunder PUA were retroactive, for weeks of unemployment, partial unemployment, or inability to work dueto COVID-19 reasons starting on or after January 27, 2020 and through December 26, 2020. The ContinuedAssistance Act, enacted on December 27, 2020, provided an additional 11 weeks of benefits to qualifyingindividuals (increasing the duration from 39 to 50 weeks). Further, the American Rescue Plan Act (ARP),enacted on March 11, 2021, provided an additional 29 weeks of benefits to qualifying individuals,increasing the duration from 50 to 79 weeks.Given the segregation of duties issues identified in finding 2021-031, uFACTS was not able to be relied onfor control testing of PUA transactions. IDES has automated controls within uFACTS to validate weeklyself-certifications for unemployment and monitoring of period of performance, including cutoff whenmaximum benefits have been issued. Therefore, controls over eligibility for PUA were not able to be tested.During our compliance testing of 70 claimants receiving PUA beneficiary payments, we noted that for thelast six months of the fiscal year (January 1, 2021 ? June 30, 2021), IDES used an outdated WBA pay charttable to calculate the WBA for PUA claimants, resulting in underpayments to some PUA claimants.Specifically, on January 1, 2021, IDES continued to use the calendar year 2020 WBA pay chart table, whenthe calendar year 2021 WBA pay chart table should have been used, which increased the WBA amountsfor those claimants receiving a WBA of $484 and above as of December 31, 2020. Two sampled items hada WBA of $484 on January 1, 2021 which should have been adjusted to $505. In addition, during our testing we identified 3 data entry errors in the PUA system which resulted in theincorrect WBA being calculated and paid to PUA claimants. The data entry errors were caused by the caseworker selecting an incorrect workflow which noted ?Claimant sent only proof of employment. Assignminimum PUA WBA.? Specifically, 3 claimants had monetary wages in the PUA system which wouldsuggest a higher WBA, ranging from $235 to $400 instead of the minimum $198 WBA that each claimantreceived. As a result of these errors, IDES performed an internal review and determined that a total of 181claimants had their WBA calculated incorrectly (and thus were underpaid) due to incorrect monetaryworkflow selections.Criteria or Requirement:Unemployment Insurance Program Letter (UIPL) No. 16-20, Change 4, issued on January 8, 2021, updatedthe definition of a PUA covered individual per Sec. 2102, Pandemic Unemployment Assistance (a)(3) asone who provides a self-certification that the individual is otherwise able to work and available for workwithin the meaning of applicable state law, except the individual is unemployed, partially unemployed, orunable or unavailable to work for a variety of COVID-19 related reasons such as diagnosed with COVID-19, self-quarantine, or place of employment is closed due to COVID-19. Additionally, individuals who arepaid on or after December 27, 2020, must submit proof of documentation substantiating employment, selfemployment,or the planned commencement of employment or self-employment and proof of identity.In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintaininternal controls designed to reasonably ensure compliance with Federal laws, regulations, and programcompliance requirements. Effective internal controls should include procedures to ensure adequatemonitoring controls over the PUA program are implemented, including oversight controls over its thirdpartyservice organization including user access provisioning, segregation of duties, and changemanagement over uFACTS. In addition, effective internal controls should include procedures to ensureaccurate weekly benefit amounts are calculated and paid to PUA claimants.Cause:In discussing these conditions with IDES officials, they stated the reason for incorrect workflow electionswas a result of data entry error by case workers, the use of an outdated WBA payment chart after January1, 2021 was an oversight to update the PUA system, and the uFACTS inadequate system design was a resultof the expedited timeframe of the PUA program implementation in order to provide beneficiary paymentsto claimants as quickly as possible during the pandemic.Possible Asserted Effect:Failure to establish adequate processes and internal controls may result in noncompliance with programregulations, payments to ineligible recipients, and under/over payments to eligible recipients.Repeat Finding:A similar finding was reported in the prior year audit as number 2020-022. (Finding Code 2021-030, 2020-022)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample. Recommendation:With the end of the PUA program in September 2021, we recommend IDES issue supplemental paymentsfor all the impacted individuals as a result of the incorrect workflow elections and use of the outdated WBApayment chart.Views of IDES Officials:The finding regarding uFACTS design has been discussed in the specific finding 2021-031 on that issue.The WBA maximum increase has been successfully programmed, tested and claimants have been paid asof January 14, 2022. The incorrect workflow choice issue was found to have affected slightly more than180 claimants, all of whom have been identified. Discussions are ongoing between IDES and the contractorto put a correction in place.

State Agency: Illinois Department of Employment Security (IDES)Federal Agency: U.S. Department of Labor (USDOL)Program Name: COVID-19 ? Unemployment InsuranceALN and Program Expenditures: 17.225 ($3,643,128,000 for PUA)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: NoneCompliance Requirement: EligibilityFinding 2021-031: Inadequate Controls over Determining Eligibility for the PandemicUnemployment Assistance ProgramType of Finding: Material WeaknessCondition Found:IDES did not establish adequate internal controls over its third-party service organization who administeredthe Unemployment Framework for Automated Claim & Tax Services (uFACTS) system used to determineeligibility for claimants under the Pandemic Unemployment Assistance (PUA) program.The PUA program was established by the Coronavirus Aid, Relief, and Economic Security Act (CARES)enacted on March 27, 2020. The main provisions of the PUA program include providing up to 39 weeks ofbenefits to qualifying individuals who were otherwise able to work and available for work within themeaning of applicable state law, except that they were unemployed, partially unemployed, or unable orunavailable to work due to COVID-19 related reasons, as defined in the CARES Act. Benefit paymentsunder PUA were retroactive, for weeks of unemployment, partial unemployment, or inability to work dueto COVID-19 reasons starting on or after January 27, 2020 and through December 26, 2020. The ContinuedAssistance Act, enacted on December 27, 2020, provided an additional 11 weeks of benefits to qualifyingindividuals (increasing the duration from 39 to 50 weeks). Further, the American Rescue Plan Act (ARP),enacted on March 11, 2021, provided an additional 29 weeks of benefits to qualifying individuals,increasing the duration from 50 to 79 weeks.IDES hired a third-party service organization to administer the uFACTS system. Specifically, the followingwas noted with regard to general information technology controls (GITC):Segregation of Duties (SOD) ? Controls were not in place to restrict access to migrate program orconfiguration changes into the production environment for the PUA system. For application changes, wewere unable to determine that SOD was enforced on the application level and no supporting evidence wasavailable to demonstrate segregation of duties.Given the segregation of duties issues identified above, no further testing of the GITC environment wasperformed and uFACTS was not able to be relied on for control or compliance testing of PUA transactions. Criteria or Requirement:2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrols designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include procedures to ensure adequate monitoring controlsover the PUA program are implemented, including oversight controls over its third-party serviceorganization including user access provisioning, segregation of duties, and change management overuFACTS.Cause:In discussing these conditions with IDES officials, they stated the reason for the uFACTS inadequatesystem design was a result of the expedited timeframe of the PUA program implementation in order toprovide beneficiary payments to claimants as quickly as possible during the pandemic.Possible Asserted Effect:Failure to establish adequate processes and internal controls may result in noncompliance with programregulations and payments to ineligible recipients.Repeat Finding:A similar finding was reported in the prior year audit as finding number 2020-023. (Finding Code 2021-031, 2020-023)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDES review its current procedures and consider any changes necessary to ensure adequatemonitoring internal controls are established and implemented relating to the PUA program, includingoversight controls over its third-party service organization to address adequate segregation of duties overuFACTS.Views of IDES Officials:IDES accepts the repeat audit finding and has completed a corrective action plan from the FY20 auditfinding. The plan includes developing appropriate business controls and requiring the third-party contractorto develop and document appropriate IT controls, along with proving segregation of duties with developersunable to migrate changes into production.Due to the timing of the FY20 audit process, these improvements were not in place for the duration of thecurrent audit year. In addition to the changes mentioned, a contract is in place for the third-party providerto have a SOC 1, type 2 covering the FY22 usage of the program.

State Agency: Illinois Department of Employment Security (IDES)Federal Agency: U.S. Department of Labor (USDOL)Program Name: Unemployment InsuranceALN and Program Expenditures: 17.225 ($5,859,656,000 for non-COVID)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: $54,696Compliance Requirement: ReportingFinding 2021-032: Inadequate Process for Preparing ETA 2208A Special ReportType of Finding: Significant Deficiency and Non-ComplianceCondition Found: IDES does not have an adequate process in place to ensure the ETA 2208A special reports prepared for theUnemployment Insurance (UI) program are complete and accurate.On a quarterly basis, IDES is required to report information on staff years worked and paid by programcategory on the ETA 2208A ? Quarterly UI Above-Base (ETA 2208A) report. The information required tobe reported includes UI program staff year usage (Section A), regular contingency entitlement certification(Section B), trade above-base entitlement certification (Section C), and additional benefits above-baseentitlement certification (Section D). Key line items required for testing include items one through sevenin Section A.During our testwork of two quarterly ETA 2208A reports, we noted the June 30, 2021 report includedinaccurate amounts reported for a key line item in Section A. Specifically, the amount reported in the ClaimsActivity program category (line item 1) for the 6/21 QTD PE column was reported as $470.47 when theamount that should have been reported was $472.47. As a result of this error, the net dollar entitlement wasoverstated by $54,696 as the reported amount was $14,026,213 when the amount should have been$12,971,517. As of September 29, 2021, IDES had not revised the report with the USDOL.Criteria or Requirement:According to ET Handbook No. 336, 18th edition, IDES is required to submit quarterly UI above-basereports (known as ETA 2208A reports) by the first day of the second month after the quarter of reference.In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintaininternal controls designed to reasonably ensure compliance with Federal laws, regulations, and programcompliance requirements. Effective internal controls should include procedures to ensure the completenessand accuracy of information reported in required special reports.Cause:In discussing these conditions with IDES officials, they stated the discrepancies are a result of a currentlymanual process to compile the reports with data from multiple systems. Possible Asserted Effect:Failure to establish adequate reporting controls may result in inaccurate reports which prevents the USDOLfrom effectively monitoring the UI program.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-032)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDES review its procedures for preparing special reports required for the UI program andimplement analytical and any other procedures considered necessary to ensure the reports are accurate priorto submission to the USDOL.Views of IDES Officials:IDES accepts this audit finding and will implement an audit procedure to address the accuracy of the report.

State Agency: Illinois Department of Employment Security (IDES)Federal Agency: U.S. Department of Labor (USDOL)Program Name: Unemployment InsuranceALN and Program Expenditures: 17.225 ($5,859,656,000 for non-COVID)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: Special Tests and Provisions ? UI Program Integrity ? OverpaymentsFinding 2021-033: Failure to Implement UI Program Integrity and Overpayment ReductionRequirementsType of Finding: Material Weakness and Material Non-ComplianceCondition Found: IDES did not implement Federal requirements to improve program integrity and reduce overpayments.The State is required to establish written procedures for: (1) identifying overpayments, (2) classifyingoverpayments into categories based on the reason the overpayment occurred (i.e. employer error, nonresponsefrom employers, beneficiary fraud, etc.), and (3) establishing appropriate methods for followingup on each category of overpayment. In establishing these procedures, the State is required to enter intothree agreements prior to commencing recoveries. The first agreement permits the State to offset Stateunemployment insurance (UI) from Federal UI overpayments (Cross Program Offset and RecoveryAgreement). The second agreement permits the State to recover overpayments from benefits beingadministered by another State (Interstate Reciprocal Overpayment Recovery Agreement). The thirdagreement permits the State to utilize the Treasury Offset Program to recover overpayments that remainuncollected one year after the debt was determined to be due. Additionally, the State is (1) required toimpose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted inoverpayments, and (2) prohibited from providing relief from charges to an employer?s UI account whenoverpayments are the result of the employer?s failure to respond timely or adequately to a request forinformation.During our test work, we noted that while IDES has developed the written procedures relative tooverpayments and has entered into the required agreements described in the previous paragraph, the writtenprocedures did not address the requirement to impose a monetary penalty on fraud overpayments.Additionally, we noted the policies do not address the prohibition of providing employers relief resultingfrom an employer failing to provide timely or adequate information.Criteria or Requirement:42 U.S.C. 503(a)(11)(A) requires states to impose a monetary penalty (not less than 15 percent) onclaimants whose fraudulent acts resulted in overpayment. In addition, 26 U.S.C. 3303(f)(1)(A) prohibitsstates from providing relief from charges to an employer?s UI account when overpayments are the result ofthe employer?s failure to respond timely or adequately to a request for information. 26 U.S.C. 3304(a)(4)(D) and 42 U.S.C. 503(g)(1) require states to recover overpayments through offsetagainst unemployment compensation (UC) payments. In addition, 42 U.S.C. 503(m) requires states toutilize the Treasury Offset Program for overpayments that remain uncollected one year after the debt wasdetermined to be due.In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintaininternal controls designed to reasonably ensure compliance with Federal laws, regulations, and programcompliance requirements. Effective internal controls should include procedures to ensure program integrityand overpayment reduction requirements are implemented.Cause:In discussing these conditions with IDES officials, they stated although the 15% fraud penalty wasimplemented and is supported by Illinois statute, the fraud penalty was not incorporated into existingoverpayment procedures due to oversight. Also, IDES had identified a process to implement the prohibitionon non-charging due to employer fault and was scheduled to roll it out beginning in fiscal year 2021, butthe roll-out was deferred by historic claim surges due to the pandemic.Possible Asserted Effect:Failure to implement federal requirements could result in noncompliance with laws, regulations, and thegrant agreement.Repeat Finding:A similar finding was reported in the prior year audit as number 2020-024. (Finding Code 2021-033, 2020-024, 2019-063, 2018-052, 2017-053, 2016-061, 2015-056)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDES develop and implement written procedures to improve UI program integrity andreduce overpayments that incorporate the required monetary penalty on fraud overpayments and prohibitproviding relief to employers who fail to provide timely and adequate responses to information requests.Views of IDES Officials:IDES accepts this finding. Written procedures regarding the 15% penalty have been incorporated intoestablished procedure(s) covering overpayments. In 2023, IDES will implement its identified process onthe prohibition of non-charging due to employer fault.

State Agency: Illinois Department of Employment Security (IDES)Federal Agency: U.S. Department of Labor (USDOL)Program Name: Unemployment InsuranceALN and Program Expenditures: 17.225 ($5,859,656,000 for non-COVID)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: NoneCompliance Requirement: Special Tests and Provisions ? UI Benefit PaymentsFinding 2021-034: Failure to Complete UI BAM Case File ReviewsType of Finding: Material Weakness and Material Non-ComplianceCondition Found: IDES did not complete the Benefit Accuracy Measurement (BAM) case file reviews in accordance withUSDOL requirements for the Unemployment Insurance (UI) program.The Payment Integrity Information Act (PIIA) of 2019 codified the requirement for valid statisticalestimates of improper payments. State Workforce Agencies (SWAs) are required by 20 CFR 602.11(d) tooperate and maintain a quality control system. The BAM program is USDOL?s quality control systemdesigned to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exemptedfrom such requirement (20 CFR 602.22). The program estimates error rates, that is, numbers of claimsimproperly paid or denied and dollar amounts of benefits improperly paid or denied, by projecting theresults from investigations of statistically sound random samples to the universe of all claims paid anddenied in a state. Specifically, the SWA?s BAM unit is required to draw a weekly sample of payments anddenied claims, complete prompt, and in-depth investigations to determine if the administration of theunemployment compensation (UC) program is consistent with state and federal law (20 CFR 602.21(d)).DOL has promulgated investigational requirements and instructions in its ET Handbook (the Handbook)No. 395, pursuant to 20 CFR 602.30(a). The Handbook states that for paid cases, a minimum of (1) 70% ofcases must be completed within 60 days of the week-ending date of the batch, (2) 95% of cases must becompleted within 90 days of the week-ending date of the batch, and (3) 98% of cases for the calendar yearmust be completed within 120 days of the ending date of the calendar year. In addition, a minimum of 480cases must be complete during the calendar year.During our test work of paid claims, we noted that IDES did not achieve the required percentage of casereviews within the required timeframes. Specifically, for batch range 202027 ? 202126, IDES failed to meetthe 60-day time lapse standard of 70 percent complete as only 48.43 percent of case reviews were complete.Additionally, IDES failed to meet the 90-day time lapse standard of 95 percent complete as only 58.66percent of case reviews were complete. Further, we noted that IDES did not notify USDOL of the failedcase completion percentage requirements nor receive a waiver of the requirements from USDOL. Lastly,IDES did not meet the 480 completed case requirement, as only 479 cases were completed during thecalendar year. Criteria or Requirement:According to 20 CFR 602.11(d), State Workforce Agencies (SWAs) are required to operate and maintaina quality control system. In addition, 20 CFR 602.11(a) requires States to provide such methods ofadministration as will reasonably ensure prompt and full payment of unemployment benefits to eligibleclaimants, and collection and handling of income for the State unemployment fund, with the greatestaccuracy feasible. In addition, according to ET Handbook No. 395, 5th Edition, IDES is required to submitBAM case file data to USDOL when case files are completed.Further, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintaininternal controls designed to reasonably ensure compliance with Federal laws, regulations, and programcompliance requirements. Effective internal control should include adequate review of the progression ofquarterly BAM testing.Cause:In discussing these conditions with IDES officials, they noted there are only two BAM investigators whoare responsible for most of the case reviews. Due to time constraints, leaves of absence, and competingpriorities, the investigators were not able to complete the reviews within the required timeframe.Possible Asserted Effect:Failure to complete BAM case file reviews timely prevents the USDOL from effectively monitoring theState of Illinois UI program and results in noncompliance with program regulations.Repeat Finding:A similar finding was reported in the prior year audit as number 2020-025. (Finding Code 2021-034, 2020-025)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDES review its procedures for completing BAM case file reviews to ensure they arecompleted in accordance with program regulations. Effective internal controls should include establishingand maintaining adequate controls to ensure the BAM case file reviews are completed in accordance withrequired timeframes established by USDOL.Views of IDES Officials:IDES accept this finding and has instituted plans to change how we ask for and receive the information.For some time, we have conducted the claimant interview by phone. This helps to limit rebuttals and allowsus to get accurate information that may be missing upon sending the questionnaire. Gathering informationfrom the employers has proved to be a challenge at times. We have changed our process to rely more onemails to employers to obtain the required forms. This has proven successful. IDES has created a way forthe investigators to show in real time how their case is developing. The use of share point was put in place,but its use was not being enforced. Enforcement began in late 2020. IDES accept this finding and has approved additional work hours for staff to complete cases as well asbegan the outreach process to onboard new staff to fill vacant positions in the BAM unit.

State Agency: Illinois Department of Employment Security (IDES)Federal Agency: U.S. Department of Homeland Security (HLS)Program Name: COVID-19 ? Presidential Declared Disaster Assistance to Individuals andHouseholds - Other NeedsALN and Program Expenditures: 97.050 ($1,261,433,000)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: NoneCompliance Requirement: Allowable Costs/Cost Principles, Eligibility, and Period of PerformanceFinding 2021-035: Inadequate Controls over Determining Eligibility for Lost Wages AssistancePaymentsType of Finding: Significant DeficiencyCondition Found: IDES did not establish adequate internal controls over its third-party service organization who administeredthe Unemployment Framework for Automated Claim & Tax Services (uFACTS) system used to determineeligibility for the Pandemic Unemployment Assistance (PUA) program. Eligibility for PUA alsodetermined eligibility for the Presidential Declared Disaster Assistance to Individuals and Households ?Other Needs Program known as Lost Wages Assistance (LWA).The LWA program was a supplemental Federal Emergency Management Agency (FEMA) programeffective from August 1, 2020 to September 5, 2020. Eligible recipients were those who received a weeklyPUA payment in excess of $100.Given the segregation of duties issues identified in finding 2021-031, uFACTS was not able to be relied onfor control testing of PUA transactions. IDES has automated controls within uFACTS to validate weeklyself-certifications for unemployment and monitoring of period of performance, including cutoff whenmaximum benefits have been issued. Therefore, controls over allowability, eligibility, and period ofperformance for LWA were not able to be tested. For compliance, 31 PUA participants were tested and nononcompliance was noted with regard to their eligibility to receive an additional LWA payment.Criteria or Requirement:2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrols designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include procedures to ensure adequate monitoring controlsover the PUA program are implemented, including oversight controls over its third-party serviceorganization including user access provisioning, segregation of duties, and change management overuFACTS. Cause:In discussing these conditions with IDES officials, they stated the reason for the uFACTS inadequatesystem design was a result of the expedited timeframe of the PUA program implementation in order toprovide beneficiary payments to claimants as quickly as possible during the pandemic.Possible Asserted Effect:Failure to establish adequate internal controls may result in noncompliance with program regulations andpayments to ineligible recipients.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-035)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:With the end of the LWA program in September 2020 and the PUA program in September 2021, werecommend IDES continue to work with FEMA to finalize the LWA program.Views of IDES Officials:The finding regarding uFACTS design has been discussed in the specific finding 2021-031 on that issue.

State Agency: Illinois Department of Transportation (IDOT)Federal Agency: U.S. Department of Transportation (USDOT)Program Name: COVID-19 ? Airport Improvement ProgramALN and Program Expenditures: 20.106 ($508,551,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: ReportingFinding 2021-036: Failure to Report Subaward Information Required by FFATAType of Finding: Material Weakness and Material Non-ComplianceCondition Found: IDOT failed to report information required by the Federal Funding Accountability and Transparency Act(FFATA) for awards granted to subrecipients of the Airport Improvement Program (AIP).FFATA requires the State to report certain identifying information related to awards made to subrecipientsin amounts greater than or equal to $30,000. Of the information required to be reported, the following keydata elements are required to be audited:1. Subawardee Name2. Subawardee DUNS number3. Amount of subaward4. Subaward obligation or action date5. Date of report submission6. Subaward number7. Subaward project description8. Subawardee names and compensation of highly compensated officersIDOT passed through approximately $506,046,000 to subrecipients of the AIP program during the yearended June 30, 2021.Criteria or Requirement:In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federalawards that equal or exceed the micro-purchase threshold and publish the required information on a publicfacing,OMB-designated, governmentwide website and follow OMB guidance to support Transparency Actimplementation. Consistent with the Federal Acquisition Regulation (FAR) threshold for subcontractreporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000.2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrol designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include complying with FFATA. Cause:In discussing these conditions with IDOT officials, IDOT stated missing FFATA reporting was due tostaffing transition combined with a lack of appropriate staffing resources.Possible Asserted Effect:Failure to identify awards subject to FFATA and to report subawards in accordance with FFATA results innoncompliance with federal requirements.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-036)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDOT establish procedures to identify awards subject to FFATA reporting requirementsand report required subaward information in accordance with FFATA.Views of IDOT Officials:IDOT agrees with this finding.

State Agency: Illinois Department of Transportation (IDOT)Federal Agency: U.S. Department of Transportation (USDOT)Program Name: COVID-19 ? Airport Improvement ProgramALN and Program Expenditures: 20.106 ($508,551,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: NoneCompliance Requirement: ReportingFinding 2021-037: Inaccurate information included in annual SF-425 reporting packageType of Finding: Significant Deficiency and Non-ComplianceCondition Found: IDOT failed to correctly report information required in the annual SF-425, Federal Financial Report, forthe Airport Improvement Program (AIP).The annual report includes information on each individual grant issued. For two awards (3-17-0085-040and 3-17-0065-032), the SF-425 total expenditures agreed to the client?s transaction ledger for amountspaid but did not agree to the interim SF-271, Outlay Report and Request for Reimbursement forConstruction Program Report, which is provided with the SF-425 report. Creation of each SF-271 and SF-425 is a manual process of reconciling amounts between the source and the two reports. For the 3-17-0085-040 award, two payments were correctly included in the SF-425 report but not the supporting interim SF-271 report in the amount of $43,091. For the 3-17-0065-032, the SF-425 amount of $4,897,809 agreed topayments made against the award at the time the report was filed but the amount reported on thecorresponding interim SF-271 was incorrect. The annual SF-425 was correct but the supporting documentsrequired in the SF-425 reporting package were incorrect.Criteria or Requirement:The Federal Aviation Administration's Office of Airports AIP Grant Payment and Sponsor FinancialReporting Policy (Policy), section 9 financial reporting, dated October 2020, requires sponsors to submitcertain financial reports to summarize grant expenditures and the status of project funds in accordance with2 CFR 200.327. The Policy specifies these financial reports must be collected outside of the DelphieInvoicing system, as Delphi eInvoicing is limited to grant payments and does not currently provide thefull capabilities to manage financial reporting requirements. In addition, Appendix H to the SF-425instructions, states the SF-425, filed by sponsors to report outlays and program income on a cash or accrualbasis, must be submitted annually for each open grant and is due 90 days after the end of each federal fiscalyear. Appendix H also states the SF-425 must be submitted as a final financial report during closeout inaccordance with 2 CFR 200.327 and 2 CFR 200.343.2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrol designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include reviewing reports prepared for accuracy. Cause:In discussing these conditions with IDOT officials, IDOT stated the preparation of the reports is a manualprocess and the difference was due to human error.Possible Asserted Effect:Failure to reconcile the SF-425 report to the supporting interim SF-271 can lead to inaccurate reporting ofexpenditures incurred.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-037)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IDOT be more precise in the review control to ensure the SF-425 agrees to the supportingdetail of the interim SF-271 reports.Views of IDOT Officials:IDOT agrees with this finding.

State Agency: Illinois Emergency Management Agency (IEMA)Federal Agency: U.S. Treasury Department (TREAS)Program Name: COVID-19 ? Coronavirus Relief FundALN and Program Expenditures: 21.019 ($2,573,382,000)Award Numbers: Various ? see table of award numbersFederal Award Year: Various ? see table of award numbersQuestioned Costs: Cannot be determinedCompliance Requirement: ReportingFinding 2021-038: Inadequate Review of Quarterly Financial Progress ReportsType of Finding: Material Weakness and Material Non-ComplianceCondition Found: IEMA is responsible for filing the statewide Coronavirus Relief Fund (CRF) reports by utilizing selfreporteddata from each agency. There is no statewide process to validate completeness of each quarterlyreport.The State of Illinois delegated the statewide reporting for CRF to IEMA. IEMA?s process includesinstructing each agency with CRF expenses to complete the Treasury reporting template. IEMA thenconsolidates the templates to create a consolidated report to file with Treasury. There is no process to verifythe agency templates include all the expenditures for the quarter, nor is there a year-end process to reconcilethe four quarters to the Schedule of Expenditures of Federal Awards.Criteria or Requirement:Reporting was outlined by Treasury in their July 2, 2020 memorandum (OIG-CA-20-021), CoronavirusRelief Fund Reporting and Record Retention Requirements. The memorandum?s quarterly reporting sectionstates each prime recipient of Coronavirus Relief Fund payments shall report COVID-19 related costs intothe GrantSolutions portal, and data required to be reported includes, but is not limited to, the following:1. the total amount of payments from the Coronavirus Relief Fund received from Treasury;2. the amount of funds received that were expended or obligated for each project or activity;3. a detailed list of all projects or activities for which funds were expended or obligated, including:a. the name of the project or activity;b. a description of the project or activity; and4. detailed information on any loans issued; contracts and grants awarded; transfers made to othergovernment entities; and direct payments made by the recipient that are greater than $50,000.2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrol designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include processes to validate the completeness of reports. Cause:In discussing these conditions with IEMA officials, they stated that each State agency was responsible forensuring the accuracy and completeness of reports. While IEMA could provide some guidance andfeedback, the State agencies were ultimately responsible for reviewing and submitting their own data toensure compliance with the US Treasury OIG reporting requirements.Possible Asserted Effect:Failure to ascertain the financial progress reports are complete could result in inaccurate reporting toTreasury.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-038)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IEMA work with the Governor?s Office of Management and Budget (GOMB) to reconcilethe financial progress reports to final CRF costs incurred through December 2021. Any adjustments shouldbe included in the final financial progress report.Views of IEMA Officials:IEMA accepts the recommendation. IEMA will work with the Governor?s Office of Management andBudget (GOMB) to establish reporting procedures for CRF expenditures that implement controls to ensurethe completeness and accuracy of the reports.

State Agency: Illinois Emergency Management Agency (IEMA)Federal Agency: U.S. Department of Homeland Security (USHLS)Program Name: COVID-19 ? Disaster Grants ? Public Assistance (Presidentially DeclaredDisasters)ALN and Program Expenditures: 97.036 ($585,680,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: NoneCompliance Requirement: ReportingFinding 2021-039: Failure to Timely Report Accurate Subaward Information Required by FFATAType of Finding: Material Weakness and Material Non-ComplianceCondition Found: IEMA failed to timely report accurate information required by the Federal Funding Accountability andTransparency Act (FFATA) for awards granted to subrecipients of the Public Assistance program.FFATA requires the State to report certain identifying information related to awards made to subrecipientsin amounts greater than or equal to $30,000. Of the information required to be reported, the following keydata elements are required to be audited:1. Subawardee Name2. Subawardee DUNS number3. Amount of subaward4. Subaward obligation or action date5. Date of report submission6. Subaward number7. Subaward project description8. Subawardee names and compensation of highly compensated officersDuring our testwork of 43 subawards, we noted the following exceptions:See Schedule of Findings and Questioned Costs for chart/table.IEMA management reviewed the FFATA reports for completeness and accuracy but evidence of the reviewwas not available. IEMA subrecipient expenditures under the federal programs for the year ended June 30,2021 were approximately $191,843,000.Criteria or Requirement:In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federalawards that equal or exceed the micro-purchase threshold and publish the required information on a publicfacing,OMB-designated, governmentwide website and follow OMB guidance to support Transparency Actimplementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontractreporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000.2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrol designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include appropriate documentation to support the control.Cause:In discussing these conditions with IEMA officials, they stated the reports were filed late due to thetransition of the responsibility from the Chief Accountability Office to the program area in March 2021.For controls, IEMA stated program personnel were not aware of the need to document their reviews bysomeone other than the preparer.Possible Asserted Effect:Failure to report subawards in accordance with FFATA could result in noncompliance with federalrequirements.Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-039)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IEMA report required subaward information in accordance with the FFATA timeline.Further, IEMA should maintain adequate documentation to evidence review of the FFATA reports inaccordance with policy.Views of IEMA Officials:IEMA accepts the recommendations. IEMA has been reporting FFATA information timely since March2021 when the reporting function was moved from the Chief Accountability Officer to the program area.IEMA is in the process of formalizing policies and procedures that will require documentation of reviewprior to submitting the reports.

State Agency: Illinois Emergency Management Agency (IEMA)Federal Agency: U.S. Department of Homeland Security (USHLS)Program Name: COVID-19 ? Disaster Grants ? Public Assistance (Presidentially DeclaredDisasters)ALN and Program Expenditures: 97.036 ($585,680,000)Award Numbers: Various ? See schedule of award numbersFederal Award Year: Various ? See schedule of award numbersQuestioned Costs: NoneCompliance Requirement: ReportingFinding 2021-040: Inadequate Review of Public Assistance Quarterly Progress ReportsType of Finding: Material WeaknessCondition Found: IEMA failed to adequately document the review process to validate completeness and accuracy of quarterlyreporting. IEMA is responsible for filing the quarterly progress reports (QPR) that are due from recipientson all open large projects 30 days after the end of each calendar quarter.Federal Emergency Management Agency (FEMA) sends a QPR template for IEMA to complete eachquarter with the corresponding deadline noted. Once received, IEMA compiles the QPR data based oninformation submitted against each large project. IEMA management reviews the compiled QPR forcompleteness and accuracy but evidence of the review was not available.Criteria or Requirement:44 CFR 206.204 requires the recipient to submit progress reports to the FEMA regional administratorquarterly. The FEMA regional administrator and recipient shall negotiate the date for submission of thefirst report. Such reports will describe the status of those projects on which a final payment of the Federalshare has not been made to the recipient and outline any problems or circumstances expected to result innoncompliance with the approved grant conditions.2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internalcontrol designed to reasonably ensure compliance with Federal laws, regulations, and program compliancerequirements. Effective internal controls should include appropriate documentation to support the control.Cause:In discussing these conditions with IEMA officials, they stated program personnel were not aware of theneed to document their reviews by someone other than the preparer.Possible Asserted Effect:Failure to establish adequate reporting controls may result in inaccurate reports, preventing FEMA fromeffectively monitoring the program. Repeat Finding:A similar finding was not reported in the prior year audit. (Finding Code 2021-040)Statistical Sampling:The sample was not intended to be, and was not, a statistically valid sample.Recommendation:We recommend IEMA review its procedures for preparing QPR required by FEMA and maintain adequatedocumentation to evidence review of the QPR in accordance with policy.Views of IEMA Officials:IEMA accepts the recommendation. IEMA will ensure that evidence of supervisory review is obtained priorto submission of the reports.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION